OSINT - PatriotCTF 2025

Hey! I was able to compete with some of the wonderful people at ResetSec for this competition, and here’s how I was able to solve 2 OSINT challenges from start to finish, specifically ones that others seemed to have a bit of trouble with.

osint/Kittiez!!!!!

Author: vWing

This challenge gives you a text file with the following:

1
I lost it all in one bad tick—
2
my feline Vault, gone *way* too quick.
3
A virus on my janky ’puter
4
went boom and turned my cats to neuter.
5

6
I had so many cats in store,
7
but one’s the one my heart longs for.
8
If I could see that pic again,
9
my nine lives might come back to ten.
10

11
For “maximum security” flair,
12
I hashed each cat with loving care.
13
Couldn’t back up the pics themselves—
14
the feds would sniff them off my shelves.
15

16
So now I search through bits and trash
17
for just one sacred, purring stash.
18
If you can find that photo, friend,
19
my broken heart might almost mend. <3
20

21
The md5 file hash of my beloved picture is:
22

23
9c5ca692da8d6e489beecd5b448ddb35
24
(  The flag is the text in the image - case insensitive. Replace spaces with underscores, i.e. pctf{I_Love_Kitties!}  )

My first instinct was to throw the hash into VirusTotal, but at the time there were no results. However, that later changed:

https://www.virustotal.com/gui/file/3bb3fbf6c9073c52ab5337ae7f1813495028cf28a24c0005ff51367fd0a7cc0f/community

That file name becomes important later. The posted pastebin referenced in the result contains the following hex-decoded text:

1
I would like to say that this challenge is 10% Misc, 90% GuessINT, and 0% OSINT. Also, 01001110 01100101 01110110 01100101 01110010 00100000 01000111 01101111 01101110 01101110 01100001 00100000 01000111 01101001 01110110 01100101 00100000 01011001 01101111 01110101 00100000 01010101 01110000 00100001

…which is just a rickroll.

The author later posted a hint in Discord, in the cat pictures channel:

That points you toward VX-Underground — specifically, their cat picture collection, which is shockingly large:

After downloading the entire archive, you can compute MD5 sums:

find . -type f -exec md5sum "{}" \; | grep -i 9c5ca692da8d6e489beecd5b448ddb35
./Cats.00003/3bb3fbf6c9073c52ab5337ae7f1813495028cf28a24c0005ff51367fd0a7cc0f.jpg

You may notice that the file name is the same as the hash in VirusTotal, and I suppose that would have been faster, however I did not have that at the time.

Opening the file reveals:

Flag: pctf{shoutout_to_silly_cats}

osint/Waldo’s Night Out

Author: Neil Sharma

The prompt: Identify the cities/towns in Northern Virginia where each image was taken.

Location #1 — Abandoned Sky Zone

Searching “sky socks” leads to Sky Zone (trampoline park). An abandoned Sky Zone existed in Sterling, VA — confirmed by the interior condition and news coverage.

Location #2 — Target + CVS building

This blurry picture shows a Target and CVS in the same structure. After scanning Virginia for Targets, the building layout matched the Reston, VA Target:

Location #3 — ICL Hotel Liquidation

These two images mattered:

ICL handles hotel liquidations. Searching their prior projects reveals multiple Sheraton hotels. Another image shows a carpet pattern:

Which also appears in photos of the Sheraton Tysons:

And this atrium shot seals the match:

Final Flag

pctf{Sterling_Reston_Tysons}

Thanks to the GMU organizers for the fun challenges!

— iiNovaCore