TJCSC
PresentationsCTFWriteups

Table of Contents

PatriotCTF 2025 - Waldo's Night Out (OSINT)

by Andrew Liu on 11/30/2025

PatriotCTF 2025

I participated with my club team tjcsc in PatriotCTF 2025, and we got 54th overall!

Challenge: Waldo’s Night Out

Category: OSINT

Flag: pctf{sterling_reston_tysons}

This challenge had three parts, where we had to find which city/town each place was in. Let’s solve it step by step!

Part 1

Here are the given images:

IMG 0003 IMG 0103 IMG 0252 IMG 1900

Interesting. These seem to be from some abandoned place. In the fourth image, there is visible text that said “Skysocks”. This along with the other images reminded me of a Skyzone location.

So, I searched up “abandoned skyzone NOVA”. I immediately got these results:

1

They all refer to a town called “Sterling”. This must be the town for the first part! Double checking my work, I went to Google Maps:

2

That confirms it! The first city/town must be Sterling. Currently, our flag is pctf{sterling_}. Let’s keep going.

Part 2

Here are the given images:

IMG 0023 IMG 0390 IMG 1473 IMG 1779

I looked through the images briefly, and noticed that it was on some rooftop of a tall building. However, what instantly gave it away was the fourth image. I instantly recognized the company to be Fannie Mae, a large government-sponsored enterprise that gives out mortgages. Doing a quick search on Google Maps gave:

1

There are only two locations in the Washington D.C. area, but only one of them is in Northern Virginia. It is in a town called “Reston”. Sounds like the town for the second part! Let’s double check:

2

This image looks exactly like the building from the given pictures! Now, our flag is pctf{sterling_reston_}. Last part, here we go!

Part 3

Here are the given images:

IMG 7471 IMG 7499 IMG 7501 IMG 7540

Hmm, this one is a bit harder. It’s some abandoned building again. The first image shows a large hallway with multiple columns. The second image shows a piece of paper that says “STOP! This area not open for liquidation”, a phone number “470-277-3666”, and at the bottom text that reads “ICL/International Content Liquidations, INC.” My first instinct was to search up the company, which gave me these results:

1

Cool! I see some results for a Sheraton Tysons Hotel. That seems plausible, since the hallways look like a hotel lobby.

Clicking on the second link, I see a webpage with more details:

2

Maybe the images can confirm my thought. Let’s look at this one:

1

This looks exactly like the first image given! I’m confident that the images are from this building.

Let’s try the flag… It worked! pctf{sterling_reston_tysons} Nice! That was pretty easy as well.

TJCSC FacebookTJCSC CTFTJCSC Discord