# Catching The Bus

## Problem

<figure><img src="/files/cLl2NMqpf4YdWDMvi9yf" alt=""><figcaption></figcaption></figure>

**By Zwique (Team BlitzHack) — First Blood**

### **Challenge Overview**

We are provided with a screenshot depicting a conversation between two individuals. The challenge likely involves analyzing this chat to extract meaningful information, uncover hidden clues, or derive a flag.

### Initial Analysis

**Image Inspection**

The screenshot appears to contain a text-based conversation. Potentially important information includes:

1. **NiKe Factory Store**
2. **Address of the bus station:**

`Wombwell`\
`Lane/Bleachcroft Way,`\
`Barnsley S70 3NR, UK`

3. The bus license plate has the **initials** of their college.
4. Their college is located along the Provo River.

<figure><img src="/files/9AxDfEGhxHUfboI5kIyq" alt="" width="240"><figcaption><p>Chat</p></figcaption></figure>

### Finding the bus station :busstop:

The first thing we need to find is the exact bus station from the given address. So, I used Google Maps to track it down.

{% embed url="<https://maps.app.goo.gl/HBvR3T9awfwNVj8N6>" %}
Bus station
{% endembed %}

### Line of Bus :bus:

As the flag asks us to find details about the bus, I looked for lines that pass this station. ![](/files/RYxobN2HEQDU9KBavOZo) Three lines seem to stop here, and guessing would not be the right approach. Therefore, I used the hint that the messenger is coming from **NiKe Factory Store**.

The closest factory store is ***Nike Factory Store Rotherham***, and line `22x` stops there. :tada:

<figure><img src="/files/u1l0bLX40H2VsKToEDOC" alt=""><figcaption><p>Nike Factory - Station Map</p></figcaption></figure>

### The operator of line 22x?

If you take a look at this bus, you will see that it is operated by **StageCoach Group**. More detailed information is below. :arrow\_down:

{% embed url="<https://www.stagecoachbus.com/routes/yorkshire/22X/rotherham-barnsley/XUBO022X.O>" %}

Great. The only two things left are the registration number and fleet number.

The most difficult part of this challenge was identifying the **registration number** and **fleet number**. These two elements required deeper analysis.

### Content of registration number :registered:

We know that the college initials are included in the license plate, and the college is near the Provo River. I searched for it and got the result below.

<figure><img src="/files/hEieyfSIqkWk2g1kwBzP" alt=""><figcaption><p>College</p></figcaption></figure>

The license plate may contain either **BYU** or **UVU**.

### Tricky Part :bricks:

I searched for different images of line 22x and compared their plate numbers one by one. ![](/files/niNrfTLhqahHG66w4N0U)![](/files/npTx5s8MkMnKn3cYjmB0)

I initially thought the plate had to start with the letter `Y`, so I searched for combinations that ended with either `BYU` or `UVU`. I found nothing. However, I found this PDF that seemed to list all buses operated by StageCoach. ![](/files/bmO6wBwcLR7ZAfkeoyzl)

{% embed url="<https://www.ukbuses.co.uk/fleet/stagecoachyorkshire.pdf>" %}

`UVU` did not come up, but I found one entry containing `BYU`. It did not work out. :boom:

The issue with this PDF was that it did not include a complete list of all bus divisions.

<figure><img src="/files/bmO6wBwcLR7ZAfkeoyzl" alt=""><figcaption></figcaption></figure>

### Correct platform :spider\_web:

I then began searching through various websites that listed the plate numbers of all buses operated by **StageCoach**.

{% embed url="<https://buslists.uk/>" %}

This website provides information about various operators and their fleets. So, I looked for buses operated by StageCoach.

<figure><img src="/files/V864uEEf4Tu4U9NS6F17" alt=""><figcaption><p>Directions of StageCoach</p></figcaption></figure>

I tried them one by one until I found the exact bus fleet number ending with **BYU**. It turned out that [Stagecoach East Midlands](https://buslists.uk/operators/pN7iOr) had the number we were looking for.

<figure><img src="/files/3Qss9NOxNKoQjYumyp1R" alt=""><figcaption></figcaption></figure>

{% embed url="<https://buslists.uk/operators/pN7iOr/vehicles/ezCZaJ>" %}
Bus
{% endembed %}

### Constructing the flag

**`squ1rrel{SF10BYU.StageCoach.24183}`**

**Thank you.** :clap:


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://zwique.gitbook.io/zwique_notes/writeups/random-ctf-writeup/catching-the-bus.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.