R3CTF - h1de@ndSe3k 2 Writeup

This is a second stage of the “hidenandseek” R3CTF challenge.

In this case we have that ben, the NPC with the flag:

• Is invisible
• Randomly teleports between (0, -50, 0) (512, 50, 512)
• newtp only works in “ben’s range”

The main issue is that the teleportation range is much wider now, we can’t have many tries. Sitting there and waiting for ben to appear wasted some time, he only spawned a few times and was too far away.

Randomly teleporting between places wasn’t also much better, ben just dispawns (he might have spent there 5 seconds, so you have even less time now).

Also, as ben tends to suffocate in cobblestone, you can’t see the flat (you would have to teleport and mine a block).

What I did was modifying the cheated minecraft client source code to automatically teleport when Ben appears. Also I enabled a few extra helpers such as F5 camera modifications and the most important one, X-ray. Seems that with xray and third person mode you can see the tag even if we are both suffocating in cobblestome.

So I modified the onRender call of the ESP/Tracer functionality of Meteor to send a chat message that teleports. Be careful to only do it once as the server (Paper) would ban you for spamming:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

@EventHandler
private void onRender(Render3DEvent event) {
    if (mc.options.hudHidden || style.get() == TracerStyle.Offscreen) return;
    count = 0;

    for (Entity entity : mc.world.getEntities()) {
	if (shouldBeIgnored(entity)) continue;

	Color color = getEntityColor(entity);

	double x = entity.prevX + (entity.getX() - entity.prevX) * event.tickDelta;
	double y = entity.prevY + (entity.getY() - entity.prevY) * event.tickDelta;
	double z = entity.prevZ + (entity.getZ() - entity.prevZ) * event.tickDelta;

	if (once == 0) {
	    Text a;
	    ChatUtils.sendPlayerMsg("/newtp " + String.valueOf(x) + " " + String.valueOf(y) + " " + String.valueOf(z));
	    once = 1;
	}

	double height = entity.getBoundingBox().maxY - entity.getBoundingBox().minY;
	if (target.get() == Target.Head) y += height;
	else if (target.get() == Target.Body) y += height / 2;

	event.renderer.line(RenderUtils.center.x, RenderUtils.center.y, RenderUtils.center.z, x, y, z, color);
	if (stem.get()) event.renderer.line(x, entity.getY(), z, x, entity.getY() + height, z, color);

	count++;
    }
}

Then I just waited some time in third person view till I got teleported: