# OLD Times ### 424 Points
-----
>There are rumors that a group of people would like to overthrow the communist party. Therefore, an investigation was initiated under the leadership of Vlaicu Petronel. Be part of this ultra secret investigation, help the militia discover all secret locations and you will be rewarded.
Looking at the given text, the main thing that stands out is the name. A quick google gives [twitter.com/PetronelVlaicu](https://twitter.com/PetronelVlaicu)
There's a few tweets that stand out. A photo which is tagged with another user. - [twitter.com/NicolaCeaucescu](https://twitter.com/NicolaCeaucescu)
There's only one person the account follows:- [twitter.com/nicolaeceausesc](https://twitter.com/nicolaeceausesc)
They have a link in their bio:- [cinemagia.ro/actori/nicolae-ceausescu-73098/](http://www.cinemagia.ro/actori/nicolae-ceausescu-73098/)
Another tweet tells us that they "love Temple OS"
But I wasnt seeing much to go forward. Using wayback machine, I can look of snapshots of the account and I find a deleted tweet with the string:
`1XhgPI0jpK8TjSMmSQ0z5Ozcu7EIIWhlXYQECJ7hFa20`
This looks hopefull! Base64 against this doesn't produce anything readable, but this [Link Identifier](https://a2x2.github.io/link/) by a2x2 tells use that this b64 is associated to a [Google Doc](https://docs.google.com/document/d/1XhgPI0jpK8TjSMmSQ0z5Ozcu7EIIWhlXYQECJ7hFa20/edit)
One part of the doc stands out more than others:
>The local activity is under control. People seek their daily routine and have no doubts about the party, except for one man: Iovescu Marian - who goes by the name of E4gl3OfFr3ed0m
Googling this leads to a GitHub user with a single repository
- [https://github.com/E4gl3OfFr3ed0m/resistance](https://github.com/E4gl3OfFr3ed0m/resistance)
Now we can go through old commits and look at the deleted data. In a line edit we find the url [http://138.68.67.161:55555/](http://138.68.67.161:55555/)
Accessing this account gives a forbidden response though. Looking deeper, we find an old .php file:
```php# spread_locations.php= 0){		   echo "[".$reg."]: ";		   echo $locs[$reg];		 }		 else{		   echo "Intruder!";		 }		
?>```
I wrote a quick python script to get all the locations data:
```pyimport requests
locations = []
for x in range(0,129):	page = requests.get('http://138.68.67.161:55555/spread_locations.php?region=' + str(x))	loc = page.text.split(' ')	l = loc[1]	locations.append(l)
for l in locations:	print(l)```
This gives the data
```22.5277957,47.356108922.5497683,47.18465222.5277957,47.027619222.538782,46.885142722.5607546,46.666946922.5827273,46.50839122.7365359,47.005148122.9342898,47.050080823.14303,47.042594723.2968386,47.452773723.3297976,47.266722523.3407839,47.102454523.3737429,46.960177623.3847292,46.802482823.3847292,46.644324423.879114,46.697095424.2636355,47.682566424.8459109,46.764868125.1864871,47.734315625.351282,46.847585824.1317996,47.571502324.0439089,47.415615923.945032,47.244352223.9010867,47.102454523.8571414,46.94517924.3844851,47.571502324.5382937,47.423049624.615198,47.274177124.6921023,47.139832824.8019656,46.982667624.0988406,47.214510524.3075808,47.259266824.4723757,47.289083325.2304324,47.586324525.2633914,47.408181225.318323,47.236893425.3293093,47.087495925.4831179,47.415615925.3952273,47.786013325.6149539,47.822908925.7797488,47.75647825.8236941,47.623361625.7138308,47.504750525.5819949,47.326330225.7358035,47.214510525.9335574,47.07253325.9994753,46.937678226.2192019,47.999642826.1862429,47.889254826.2301882,47.704750926.2521609,47.578913926.2851199,47.423049626.3400515,47.289083326.4609011,47.948157726.625696,47.852406526.8014773,47.682566426.8783816,47.534428426.3949832,47.132359226.9223269,47.393308726.82345,47.274177126.4389285,46.990162226.6696414,47.020129926.8454226,47.192118221.8905886,45.700979122.1213015,45.700979122.3520144,45.708651522.5497683,45.72399322.7914675,45.731662223.4286746,45.800637724.0878542,45.900118224.7909792,45.938332625.4281863,46.045192925.6149539,46.075686525.8017214,46.083307325.988489,46.075686526.1862429,46.09092722.3630007,45.524224222.3849734,45.339190422.406946,45.16129722.4179324,44.982846522.4289187,44.811633323.4616335,45.639562323.4836062,45.454907623.5165652,45.254180523.5495242,45.091534923.5495242,44.920646124.1208132,45.746997524.9008425,45.777655324.0988406,45.578078224.1317996,45.346912224.1647585,45.145801724.1757449,45.021687524.9997195,45.662601525.0107058,45.470318725.0107058,45.292837125.0326785,45.122550824.5712527,45.593455524.7030886,45.808296324.3734988,45.731662225.4281863,45.884825125.4611453,45.677955725.4941042,45.493427425.5380496,45.300565325.5600222,45.169043125.7907351,45.200016926.054407,45.24644626.3070925,45.277377625.6698855,45.662601525.8566531,45.72399327.4826296,46.159457127.3178347,46.220301227.1090945,46.265890126.9333132,46.220301226.7795046,46.144235626.7026003,45.976520726.8783816,45.884825127.0651492,45.861877527.2629031,45.846573927.4496707,45.785317227.526575,45.670279227.5705203,45.608828727.5046023,45.485725527.4167117,45.416361527.2738894,45.400935727.1200808,45.362352826.9223269,45.385505726.7685183,45.531920823.9230593,46.41000525.4941042,46.5386279```
These coordinates are all too close to be interesting on a map, but we can plot them all on a plane using [Desmos](https://www.desmos.com/)
![Plot of flag](https://raw.githubusercontent.com/jack4818/CTF/master/HackTM/plot.png)
Which gives us the flag!
HackTM{HARDTIMES}