Overview

We spent most of the afternoon working on the regular CTF until around 4–5 PM, then shifted our focus to the Treasure Hunt. The plan going in was always to prioritize the Treasure Hunt once enough clues were unlocked so we’d have a meaningful amount of the map to work with.

By the end, we had narrowed things down to just 4 of 1,575 grid squares, used the “leafy area” hint to pick the most likely one, and that’s where the treasure was ultimately found.

Treasure found by: Reps4Thor & Nirtom

Treasure location at PhreakNIC 26

Building the Master Map

Each clue came with a Base Map showing a grid of the hotel grounds. Our strategy was to treat every clue as a way to cross out impossible locations until only a few remained.

  1. For every challenge, we started with its Base Map and blacked out the grid squares indicated by that clue.
  2. Reps4Thor imported each map as a layer into Photoshop, stacking them all into a single composite file.
  3. Once all unlocked clues were layered, we were left with only 4 visible (unblocked) grid squares out of the original 1,575.

To make those stand out visually, we inverted the selection so that only the remaining squares were highlighted. From there, we used the hint that the treasure was buried in a leafy/wooded area. One of the four candidate grid squares clearly had more trees than the others, so that became our first target.

Result: that was the correct square.

Base treasure hunt map
Base Treasure Map of Murfreesboro.

Clue 1 – Sudoku

The first clue was a standard-looking Sudoku puzzle. We were never completely sure we interpreted this one exactly as intended, but our working assumption ended up fitting the overall structure of the hunt.

Our interpretation: any square with a number in it should be blacked out on the grid. It felt almost too simple, which meant we overthought it multiple times during the night, looking for some deeper twist or hidden encoding.

In the end, the “black out numbered cells” approach slotted cleanly into the rest of the puzzle and worked with the following clues.

Clue 1 Sudoku puzzle
Clue 1: The Sudoku puzzle and its resulting grid overlay.
Click the Image for the full resolution image, We did not save a "solved" version of this, just treated the grid squares with a number as being blacked out.

Clue 1 – Sudoku - Update

During the proofreading phase of the writeup we sent a copy over to the Event Organizer (crook3dfingers) and we discovered that the text for this clue was accidentally left out. "It was supposed to say it is buried under a square numbered greater than 5. It was buried under an 8 square, and that would have cut the map nearly in half."

Clue 2 – Dots (Braille)

Clue 2 was a grid of dots. Reps4Thor quickly recognized the pattern as Braille.

Our workflow for this clue:

Dots that form the braille clue
Clue 2: Braille dots mapped onto the grid to remove more candidate squares.
Click the Image for the full resolution image or Click Here to view our Solved version

Clue 3 – Art (Ice Machine Posters)

Clue 3 was labeled “Art”, and I was fairly sure it referred to the images posted near the ice machines on each floor of the hotel.

The hotel had four floors, and the clue ordering seemed to be from top to bottom. The smart route would have been:

Instead, we did it the hard way: up the stairs, down the elevator, repeating for each floor. On every floor, next to the ice machine, there was a picture with a partial image of the grid.

Thanks to the legendary Clarion lighting, getting good photos was harder than it should have been. After snapping all four:

This clue knocked out another sizable chunk of grid squares.

Art posters near the ice machines on each floor
Clue 3: Ice machine art from each floor, assembled into a partial grid overlay.

Clue 4 – Word Search

Clue 4 was a huge word search with 73 words. We briefly considered solving it by hand, then remembered that automation exists.

Our approach:

Cheating? We’re calling it “thinking smarter, not harder.” The logic still mattered; we just let tools handle the tedious part.

Word search clue used in the treasure hunt
Clue 4: The massive word search and the solver output used to mark the grid.
Click the Image for the full resolution image or Click Here to view our Solved version

Clue 5 – No Book (FOTTR Cards)

Clue 5, titled “No Book”, revolved around a set of cards. We started out with the physical cards laid out, working through them in person.

Then we remembered that FOTTR had released an image dump of all the cards. Using that digital version made it much easier to scan, zoom, and double-check details.

We split the work like this:

The result was a large number of squares we could confidently black out, wiping out a big section of the remaining map.

FOTTR cards used in the No Book clue
Clue 5: FOTTR card images mapped to the grid to eliminate even more locations.
Click the Image for the full resolution image or Click Here to view our Solved version

Clue 6 – The Photo

Clue 6 dropped at the same time as Clue 5. It was simply a photo of the flag buried in a wooded/leafy area.

First instinct: check the EXIF metadata to see if any GPS coordinates were left behind by accident.

Nope. GPS was stripped. No free coordinates this time.

Even without metadata, the photo was still valuable: it gave us a visual reference for the kind of environment we should be expecting once we narrowed the map down to just a few squares.

Photo of the buried flag in a leafy wooded area
Clue 6: Reference photo of the buried flag in a leafy, wooded area.
Click the Image for the full resolution image

Clue 7 – The Songs

Clue 7 was released at 11:00 PM and served as the final push (unless nobody managed to find the treasure).

The clue consisted of seven songs. We tackled it like this:

  1. Use Shazam to quickly identify each track.
  2. Drop the list of songs into ChatGPT and have it sort them by release date, giving us a definite ordering.
  3. We took the oldest Song Name, which was a color, which back to specific grid squares on the master map. We blacked out all the other 6 colors.

After applying the Clue 7 mapping, we were left with just four grid squares. We cross-referenced those with the “leafy area” visual from Clue 6 and chose the square that clearly had the densest tree coverage. Click Here to see the map of the Final 4 locations highlighted

We headed there immediately.

At 11:21 PM, we found the treasure.

Final Clue
Clue 7: The treasure is hidden in the color of the earliest song.
Click the Image for the full resolution image or Click Here to view our Solved version
Treasure found at night at PhreakNIC
The moment of the find: payoff for a fully layered map and a leafy patch of ground.

Closing Thoughts

The Treasure Hunt was a great mix of classic puzzles, physical scavenger-hunting, and some well-chosen tools:

We didn’t brute-force anything on-site; we just leaned into automation to handle the repetitive bits and focused our attention on the logic and connections between clues.

In the end, a carefully layered map, a leafy patch of ground, and some solid teamwork were what got us there first.

For future organizers: more trees are good. The Clarion lighting, however, will not be missed.