Historical Breadcrumbs

A Windows profile extract for user plandau, suspected of leaking data. The flag is a base64 tag in a suspicious upload URL recorded in Chrome history.

Solve

1. The extract contains Chrome user data, PowerShell history, and other artifacts. Open the Chrome history database:

sqlite3 "Users/plandau/AppData/Local/Google/Chrome/User Data/Default/History"

2. Query the urls table for the outbound upload:

SELECT url FROM urls WHERE url LIKE '%paste-mirror%';

https://paste-mirror-q4.example.invalid/upload?tag=U1ZJVVNDR3tvc3ByZXlfY2hyb21lX2hpc3RvcnlfbGVha191cmx9&src=oc

3. Decode the tag parameter:

echo U1ZJVVNDR3tvc3ByZXlfY2hyb21lX2hpc3RvcnlfbGVha191cmx9 | base64 -d

Flag: SVIUSCG{osprey_chrome_history_leak_url}