Saarsec

saarsec

Schwenk and pwn

UMDCTF 2025 - Ohio/the-master

ohio/the-master

(challenge by segal, writeup by Nuke)

The challenge

The challenge description is as follows:

image

The provided image is a jpg of a google streetview location:

The solution

While not strictly necessary, I found it very helpful to open the provided OSINT images in a 360° viewer, for example https://renderstuff.com/tools/360-panorama-web-viewer/.

Picture analysis

We get a lot of information from the picture: Road markings, houses, trees, electricity poles, garbage cans, etc. Going by the category name and other challenges, we can assume that we are in Ohio, but even without that assumption we can figure this out pretty quickly.

Zooming into one of the garbage cans, we can clearly make out “KIMBLE” and a phone number.

image

It is slightly blurry, but guessing “1-300-201-6055” (or anything close to this) is good enough. We can search for “kimble 1-300-201-6055” and find the correct phone number “1-800-201-0005” with multiple links to a Waste Services company named Kimble.

We can see very bright yellow roadsigns with the words “TRAIL X-ING AHEAD”. These aren’t exclusive to any specific area, so not of much use.

image

There are also streetsigns down the road. It might be possible to guess what at least the bottom one says, but it was too blurry for me. Even if you were able to make out “King Ave”, there are a lot of them in Ohio and I’m not sure how feasible it would be to track all of them down. (The second screenshot below is taken from a separate streetview location.)

image

image

There is a large green sign on the south end of the picture which, if you would be able to read it, would give you the city of the location. It was also unfortunately too blurry for me though. (The second screenshot below is taken from a separate streetview location.)

image

image

The image on the closest sign to the camera has a very specific shape and clearly has the word “MORGAN” on it in red letters. Right below this is a sign that says “MARKER AHEAD” and an arrow to the left.

image

We can see that the road is very straight, almost perfectly north-south (if the compass is to be believed), bends slightly upwards towards the south and curves towards the west in the north. There are also multiple smaller streets intersecting the road.

image

image

Filtering information

Looking at the Kimble website (through a VPN) we can check their Service Areas and see that they serve lots of places in eastern Ohio. This eliminates about half the state, but that’s not nearly enough to start manually scanning locations.

image

If you did manage to read “King Ave” you could now try finding all of them in the Service Areas, though that’s still a lot of work and it’s not unlikely that you’ll miss some.

I’d also assume nobody was able to read the large green sign. So the solution here must be related to the “MORGAN” sign.

The Morgan Trail

If your eyes (or depixelation tools) are better than mine, you might be able to make out more words on the sign. But even if not, reverse image searching combined with “ohio” and “morgan” will eventually lead you to figuring out that the whole sign says “JOHN HUNT MORGAN HERITAGE TRAIL 1863”.

image

From here you’re one search away from finding this website: https://www.hmdb.org/results.asp?Search=Series&SeriesID=364 (care: ads)

You’ll see that there are 56 markers, presumably all with signs like the one from the picture we were given. Now, nobody has time to go through all of them (though it would lead you to the solution eventually). Luckily, the website also provides a map with markers placed at each site.

image

Knowing what we know about the layout of the location, you can rather quickly scan through the trail markers. We are on a relatively large road, that has multiple smaller roads intersecting with it. We also know that the marker would be to the left of the road. Importantly, note that the sign “MARKER AHEAD” is not placed exactly at the marker location that is given on the map.

After a couple minutes of scanning, you should find that the area around the marker in Lore City fits pretty well. Going into streetview perspective and following the main road, you will find the exact location of the given picture.

image

Since the challenge just asks for the street, the flag is UMDCTF{Main St, Lore City, OH 43755}.