Okay, guys, so I’m going to share a write-up from the TOP - 1Player team at the CAT CTF 26 (OSINT) event.
Pool Party
Let’s get right to it. The first challenge was titled “Pool Party” with the following description:
It was a really hot Friday, and we just wanted to go for a swim.
We drove to the sports club, but security stopped us at the gate because our friend wasn’t a member, and guests weren’t allowed.
While we were outside, another friend called and told us to come to his compound next to the club.
We spent the rest of the day by the water.
The pool wasn’t the best, but the red chairs reminded us of the other pool.
The goal is to find the exact name of the pool on Google Maps.
and the attachment:
So I checked it right away. Based on my analysis of the building in the background:
It looks like an unfinished building, maybe? So I used Google Lens just to check the building, and I found it—it’s located near NAL Mall in Zayed Regency
Then, after searching and analyzing, I found the building along with its pool:
I also found the original image from a Google Maps review
After that, I put together the flag. From the question, we know that the flag format is:
CATF {<Exact_Location_Name_On_Google_Maps_Underscore_instead_of_spaces>}
So the flag (based on the name on Google Maps, replacing spaces with underscores) is:
CATF{Swimming_pool_Regency}
Hiking
So, in this second challenge, we’re shown this description:
While on Google Earth, I discovered something very unusual: a strange white structure sitting atop an isolated mountain. It looks man-made.
Curiosity led me there, but I found yet another one along the way. Now I’m stuck inside, and this live image is my only clue. Can you locate me?
Submit the latitude and longitude in decimal degrees,
rounded to three decimal places.
Flag format: CATFILAT.LON
Ex: CATF(30.030,31,460)
and this attachment:
That’s when I realized I’d seen this video before, So I searched again and found a video clip on TikTok (I haven’t found the full video yet, but I recognized it from the thumbnail on the @joshtheintern account; I don’t know if the video has been deleted).
So, from that TikTok account, I found the full video on YouTube: https://youtu.be/ekGCqJ9Cc6Q. From there, I watched the video and traced the location from the beginning. Here’s the documentation:
mapped the mountain and the goal
mapped the route
found the lake
found this structure
found the 2nd mountain and the final mountain near "Rocca la Meja"
still mapped the route
AND THEN......
FOUND THE BUNKER!!!
outside pov
inside pov
So, after I found the main location, I copied the coordinates from Google Earth, converted them to latitude and longitude according to the flag’s format, and submitted the final flag.
flag:
CATF{44.400122, 6.99997}
Well, thanks to those two challenges, I managed to make it to the finals. Unfortunately, I had my own event scheduled during the finals in Egypt, so I couldn’t attend.
Still, a big thank you to the CAT Reloaded team for organizing a CTF where AI was completely prohibited. It really brought back that competitive CTF atmosphere where you had to rely on your own skills and problem-solving.
And yes, I wrote this write-up entirely by hand and only used a translator for the language.