A Clean Trail (OSINT) - Writeup
On this page
Challenge Overview
| Event | KPMG CTF 2026 Campus Edition |
|---|---|
| Challenge | A Clean Trail |
| Category | OSINT |
| Points | 20 |
| Files | a PrivateBin link + Challenge.png |
"This carpet care service might be able to clean more than just carpets. Sometimes, the key to unlocking a mystery is just a call away. Follow the trail and see what connects."
Two artifacts: a PrivateBin paste (encrypted, asks for a password) and an image, Challenge.png. The hints are doing a lot of work: "carpet care service", "the key... is just a call away" (a phone number is the password), and "follow the trail... see what connects" (it's a chain, each clue unlocks the next).
Step 1: Geolocate the Image
Challenge.png is a Google Street View capture. Two anchors pin the location:
- The road marking "Morse Rd".
- A "Now Leasing — Albany Glen" sign.
Albany Glen is at 3691 Albany Chase Rd, Columbus, OH 43230, so the shot is on Morse Rd, Columbus / New Albany, Ohio. More importantly, parked in frame is the thing the hint pointed at: a carpet-care van.
Step 2: Read the Phone Number Off the Van
The van is branded MCT Carpet Care, "Carpet Cleaning and Restoration Service" (so it cleans more than just carpets), and critically it has a phone number printed on the side:
614-468-8778
"The key is just a call away" = the phone number is the PrivateBin password. Entering the van's number (try 614-468-8778) decrypts the paste.
This is the whole trick of the stage: don't go hunting for the "nearest carpet business" on Maps, the business is in the photo, and the number is painted right on it. Read the artifact you were given before searching outward.
Step 3: Follow the Decrypted Paste
The PrivateBin decrypts to a LinkedIn profile and a taunt:
https://www.linkedin.com/in/yathwik-shetty21/
Think you've got what it takes? Let the hunt continue!
The profile is Yathwik Shetty, Analyst @ KPMG India, the trail's "person."
Step 4: Find the Planted Clue in Activity
On LinkedIn, the clue is in Activity → Comments. The most recent comment isn't text, it's a block of +, >, <, ., - characters:
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>+++++.++++...
That character set (+-<>.,[] only) is Brainfuck, an esoteric programming language. Checking the target's own posts/comments is standard LinkedIn OSINT, CTF authors love planting the next step where you have to actually read the person's activity feed.
Step 5: Decode the Brainfuck
Paste it into any Brainfuck interpreter (dCode's is easy, with memory-state view):
The program prints the flag:
KPMG_CTF{3th31c4L_H$ck3r}
Summary
| Step | Clue | Yields |
|---|---|---|
| 1 | Street View (Morse Rd + Albany Glen) | Location + a carpet van |
| 2 | Phone number on the van | PrivateBin password 614-468-8778 |
| 3 | Decrypted paste | LinkedIn profile (Yathwik Shetty) |
| 4 | Profile → Activity → Comments | Brainfuck code |
| 5 | Decode Brainfuck | Flag |
Key Takeaways
- Mine the artifact before searching outward. The answer wasn't the nearest carpet cleaner on Google Maps, it was the van in the photo with its number painted on the side. Read what you're given first; geolocation here was just to frame the image, not to find a business.
- Interpret the hints literally. "Clean more than just carpets" → a restoration/carpet van; "the key is just a call away" → a phone number as a password. CTF OSINT prompts are usually describing the exact mechanic.
- Follow the person across platforms. PrivateBin → LinkedIn → a specific comment. Trails like this hop services, and the next clue often hides in someone's activity (comments/posts), not their headline.
- Recognise encodings by their alphabet. A blob of only
+-<>.,[]is Brainfuck every time. Knowing esolangs on sight saves you from treating it as "random symbols."
Flag: KPMG_CTF{3th31c4L_H$ck3r}