L3akCTF 2024: Searching for mh4cker1337

Introduction

Over the last weekend, I participated in the first iteration of L3akCTF 2024 solo, and I had a blast. I didn’t have much time to play, as I was already playing other CTFs with other teams, so I didn’t solve the entire challenge before the CTF ended.

This is a compilation on the Gameplay challenges, which is a series of OSINT challenges, following breadcrumbs left by mh4cker1337, a CTF player who left a trail of flags in his gameplay sessions. Here’s my writeup on all the challenges.

gameplay-1

When me and my friend aren’t duoing CTFs, we like to play video games together. We left a trail of flags in the wake of our gaming antics, can you find them all? Here’s a clue to start you off: mch4cker1337

We’re given the username “mch4cker1337”, and the fact that they and the challenge author frequenly play games together. A simple google search for "mch4cker1337" reveals a YouTube channel containing videos of Minecraft gameplay of Martini-Craft, and mch4cker1337. In the YouTube channel, there’s 6 videos in total, with 5 of them being shorter than 3 minutes long, but the outlier is a video titled Pro Minecraft Gameplay, which is 2 hours and 25 minutes long.

At 26:14, our host goes to sleep in Minecraft, allowing us to see the first four letters sent in the game chat, being L3AK, which just so happens to be the flag format.

We can get the rest of the flag by watching the entire video, and noting down the letters sent in the chat.

L3AK{M1n3Cr4ft_G4m3Pl4y_w1th_M4rt1n!_Cr4ft_1s_v3Ry_fun}

Edit: (2024-05-26) The intended solution is to sherlock “mch4cker1337”, find a twitter account, where they mention making a Steam account with the same name, but mistyping a single character (being mch4cker1338), then using the Steam account to get to the Youtube channel.

gameplay-2

It’s recommended to solve Gameplay-1 before you can solve this challenge.

In the comments, we can see mh4cker1337 and Martini-Craft speaking to each other.

@mch4cker1337 BROOOOO WHATTTT, THIS IS THE BEST GAMEPLAY IVE EVER SEEN !!! HOW DID YOU FIND DIAMONDS SO FAST ???

@martini-craft Dudeeee thanks for leaving this comment! I’m a professional minecraft gamer god as you saw from the gameplay BTW, what happened there at the end? Did you miss the water or something??!!

@mch4cker1337 @martini-craft we should play some other games maybe ?

@martini-craft (edited) @mch4cker1337 Yeah sure dude! Follow me on my reddit account: https://www.reddit.com/user/Feisty-Schedule1097/

The Reddit account linked in the comments, appears to be fairly normal, with activity in a few gaming-related subreddits. However, by switching to the old Reddit design, which often reveals more details about user activity, I was able to recover a deleted comment:

We can get the flag as the #general channel’s topic.

L3AK{Th3_g4M1nG_TrA1L_LeD_Y0u_heR3}

gameplay-3

You have to solve Gameplay-2 before you can solve this challenge.

Taking a look at the Discord server, we notice two interesting things. The first thing we notice is that mh4cker1337 is talking about what they’re not doing when they’re not playing CTFs. According to the screenshots, they play chess during their free time, and the second part contains an image of an office building, with Martini saying that he lives relatively close to here. We can ignore the second part for now, and focus on the first part.

We’re given a screenshot of these two playing, and we notice that Martini-Craft won the game by checkmate:

Something worth noting here is the usernames of the two players, m4Rt1niCraFT and a guest user.

Let’s take a look at the Discord server again, and we notice a suspicious message in the #general channel:

We can use the Wayback Machine to go back to the chess.com account, where we can get Martini’s email.

Hi! My name is Martini Craft and I like to play video games and CTFs! Some of my favorite games are Minecraft, DOTA 2, and Genshin Impact. Here's my gmail:
 
+ caravaggioluca599@gmail.com

Using Epieos, we can extract the data from his email.

{
  "metadata": {
    "query": "caravaggioluca599@gmail.com",
    "timestamp": "2024-05-26T12:56:34.709Z"
  },
  "data": {
    "visitor": {
      "google": {
        "id": "112298933713479956632",
        "services": {
          "google_maps": "https://www.google.com/maps/contrib/112298933713479956632",
          "google_calendar": "https://calendar.google.com/calendar/u/0/embed?src=caravaggioluca599@gmail.com",
          "google_plus_archive": "https://web.archive.org/web/*/plus.google.com/112298933713479956632*"
        }
      },
      "chess": true
    }
  }
}

The Google Calendar contains an event on the 27th of May 2024:

Secret Memorial Day Gamer Meetup
When: Monday, 27th May, 9:30am – 10:30am
Description: I have a secret Memorial Day event happening at my place, more details on my Instagram account: https://www.instagram.com/tf4rc_1n1tr4m_733132/

On the Instagram Account, we can see three posts, where two of them contain the flag.

L3AK{1NsT4grAM_AcC0uNT_R3Cov3rY}

gameplay-4

For this challenge, submit the name of the apartment complex in the flag wrapper L3AK. All lowercase, no spaces.

The third Instagram post, contains a picture of their favorite pizza place, Atwood’s Pizza.

I absolutely love Atwood's Pizza! I had the Lazy Cat specialty pizza with my CTF team and it was delicious!
 
I took my school's Gold Route bus to get here from campus, although I usually take a different bus route to get from my apartment to campus.
 
Anyways, I would highly recommend this place to other students living in the area!

This reveals two things. The first thing is that he lives near Atwood’s Pizza, and the second thing is that his apartment is not on the Gold Route (which is a major bus route in the area).

Going back to the Discord server, we’re given a crucial hint to narrow down the location of Martini’s apartment:

“here’s a hint, I live relatively close to here”

Because the building is a skyscraper, it’s very easy to use Google Lens to find the location of the building.

The image is of the Coda Building in Atlanta, Georgia. This narrows it down to the city, but not enough to get the flag. Going back to the Discord server, there are two crucial hints:

We know that there is a gas station across from Martini’s apartment, and that there’s a Subway down the street. Based from all this, we can piece together the location of Martini’s apartment.

• Gas station across from apartment
• Subway down the street
• Near the Coda Building
• Atwood’s Pizza

I made a map to visualize possible locations: Yellow points are unique locations like the Coda building and Atwood’s, blue markers are gas stations, and red markers are Subway locations. As the Gold Line courses through the middle of the city, we can eliminate locations close to the line.

We see that in the top left there is a Subway, and two gas stations on the same street, which is is 15 minutes away from Coda, so that is the most probable location.

By cross-referencing the hints and the unique locations, we can find that the only possible location of Martini’s apartment is in the The Local on 14th apartment complex.

L3AK{thelocalon14th}

Closure

This was an extraordinarily fun challenge, and I hope you enjoyed it as much as I did. Thank you to the L3AK team for creating this challenge, and thank you for reading.