HAZMAT II

Platform: Metactf | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: label_based_osint, transport_classification_lookup, regulatory_marking_interpretation

Summary

Task: identify the storage container type from a truck photo showing radioactive UF6 transport markings. Solution: interpret the visible regulatory labels and choose the broader package classification, TYPE B(U), rather than the model name or inner cylinder type.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_hazmat_ii
• Tags: hazmat, radioactive_material, uf6, transport_markings, package_certification, image_label_osint
• Indicators: UN 2977 visible on the container, TYPE B(U) printed on the package, UX-30 marking appears alongside certificate code, task asks for the type of storage container rather than a serial model
• Source: 20260410_metactf_hazmat_ii.md

Foothold

Vulnerability / Misconfiguration

1. Label_based_osint
2. Transport_classification_lookup
3. Regulatory_marking_interpretation

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• label_based_osint
• transport_classification_lookup
• regulatory_marking_interpretation
• Tags: hazmat, radioactive_material, uf6, transport_markings, package_certification, image_label_osint

Original Writeup

<details><summary>Click to expand original content</summary>

Description

I saw another crazy looking truck! This one looks even scarier... can you identify the type of storage container being used here?

English summary: the image shows a radioactive uranium hexafluoride transport package with several regulatory markings. The goal is to determine which container type the challenge expects from the visible labels.

Analysis

The key evidence in the image is the combination of transport and certificate markings:

• RADIOACTIVE MATERIAL / URANIUM HEXAFLUORIDE / FISSILE / UN 2977
• USA/9196/B(U)F-96
• TYPE B(U)
• UX-30
• gross weight about 8270 lbs / 3751 kg

Research shows that UX-30 is the specific model designation for the overpack/package used to transport UF6 cylinders. That makes it a real and relevant identifier, but it is more specific than the challenge's accepted answer.

The important distinction is between:

• 30B cylinder: the inner uranium hexafluoride cylinder, not the exterior transport package visible on the truck
• UX-30 / UX-30 overpack: the exact model name of the package
• TYPE B(U): the regulatory package class printed directly on the container itself

REDACTED is correct because the challenge asked for the type of storage container, and the visible accepted classification on the outer package is TYPE B(U). The flag normalizes that broader package class to REDACTED. Alternatives like UX_30 or UX_30_OVERPACK are too model-specific, while 30B_CYLINDER refers to the inner cylinder rather than the container seen in the image.

Solution

1. Inspect the image and record all visible hazmat and certificate markings.
2. Notice that the package is for radioactive UF6 transport because of UN 2977 and the URANIUM HEXAFLUORIDE text.
3. Search the certificate and model strings USA/9196/B(U)F-96 and UX-30 to identify what kind of package is being used.
4. Confirm that UX-30 refers to a UF6 transport overpack/package and that 30B is the inner cylinder class often carried inside it.
5. Compare those findings with the wording of the challenge: it asks for the type of storage container.
6. Use the broader regulatory class printed on the exterior, TYPE B(U), rather than the model name.
7. Normalize the answer to the expected flag format as REDACTED.

#!/usr/bin/env python3

def main() -> None:
    package_type = "REDACTED"
    print(f"DawgCTF{{{package_type}}}")


if __name__ == "__main__":
    main()

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR