HAZMAT III

Platform: Metactf | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: label_based_osint, sds_research, transport_classification_lookup

Summary

Task: identify a strange green industrial liquid from a photo and determine the correct transport placard number. Solution: use the visible product label to find the SDS, then read Section 14 to recover UN 3082 and build the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_hazmat_iii
• Tags: product_identification, sds, hazmat, transport_regulations, ethylene_glycol, un_number
• Indicators: label shows UCARTHERM, container says SEE MSDS, liquid is bright fluorescent yellow-green, the task asks for a placard number for transport
• Source: 20260410_metactf_hazmat_iii.md

Foothold

Vulnerability / Misconfiguration

1. Label_based_osint
2. Sds_research
3. Transport_classification_lookup

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• label_based_osint
• sds_research
• transport_classification_lookup
• Tags: product_identification, sds, hazmat, transport_regulations, ethylene_glycol, un_number

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Apparently corporate says I have to deliver this really weird looking green vat somewhere, can you help me figure out what number I should put on my placard when I transport this?

English summary: the challenge provides an image of a bucket filled with bright yellow-green liquid. The goal is to identify the product and recover the correct DOT/UN transport number that belongs on the placard.

Analysis

The fastest clue is the label on the container. It clearly shows UCARTHERM and also says SEE MSDS, which strongly suggests that the intended path is product identification followed by safety data sheet lookup.

Searching for UCARTHERM identifies it as a Dow / ChemPoint heat-transfer-fluid product line based on ethylene glycol. The liquid color also matters: the photographed fluid is fluorescent yellow-green, which matches descriptions of the dyed UCARTHERM Heat Transfer Fluid PM-6141 variant used for leak detection.

Once the exact product family is known, the SDS provides the transport answer directly. In Section 14, the DOT transport information lists:

Proper shipping name: Environmentally hazardous substance, liquid, n.o.s. (Ethylene glycol)
UN number: 3082
Class: 9
Packing group: III

So the placard number requested by the challenge is 3082.

Solution

1. Open the provided image and inspect the visible text on the bucket.
2. Note the two critical clues: UCARTHERM and SEE MSDS.
3. Search for UCARTHERM product information and identify it as an ethylene glycol-based heat transfer fluid.
4. Use the fluorescent yellow-green color to narrow the product to the dyed UCARTHERM PM-6141 / oil-and-gas variant.
5. Retrieve the SDS for UCARTHERM Heat Transfer Fluid PM-6141 Dyed.
6. Read Section 14, which contains the transport classification.
7. Extract the listed UN number: 3082.
8. Wrap it in the required format to get the flag: DawgCTF{REDACTED}.

#!/usr/bin/env python3

def main() -> None:
    # Manual OSINT result after identifying the product and reading Section 14
    # of the UCARTHERM Heat Transfer Fluid PM-6141 Dyed SDS.
    un_number = "3082"
    print(f"DawgCTF{{{un_number}}}")


if __name__ == "__main__":
    main()

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR