diff --git a/README.md b/README.md index 48cbcd3..572f303 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,7 @@ - [aaaa/attitude-adjustment](aaaa/attitude-adjustment) - [aaaa/digital-filters-meh](aaaa/digital-filters-meh) +- [aaaa/like-to-watch](aaaa/like-to-watch) - [aaaa/seeing-stars](aaaa/seeing-stars) - [comms/56k](comms/56k) - [ground-segment/phasors-to-stun](ground-segment/phasors-to-stun) diff --git a/aaaa/like-to-watch/README.md b/aaaa/like-to-watch/README.md new file mode 100644 index 0000000..6441dc1 --- /dev/null +++ b/aaaa/like-to-watch/README.md @@ -0,0 +1,158 @@ +# I Like To Watch + +**Category:** Astronomy, Astrophysics, Astrometry, Astrodynamics, AAAA +**Points (final):** 37 +**Solves:** 126 + +>Fire up your Google Earth Pro and brush up on your KML tutorials, we're going to make it look at +>things! + +## Write-up + +by [haskal](https://awoo.systems) + +A netcat endpoint is provided, and when you connect it provides the following info: + +``` +We've captured data from a satellite that shows a flag located at the base of the Washington +Monument. +The image was taken on March 26th, 2020, at 21:54:33 +The satellite we used was: + +REDACT +1 13337U 98067A 20087.38052801 -.00000452 00000-0 00000+0 0 9995 +2 13337 51.6460 33.2488 0005270 61.9928 83.3154 15.48919755219337 + +Use a Google Earth Pro KML file to 'Link' to http://18.191.77.141:26963/cgi-bin/HSCKML.py +and 'LookAt' that spot from where the satellite when it took the photo and get us that flag! +``` + +Additionally, an example KML file is provided + +```xml + + + + HackASatCompetition + 0 + 0 + HackASatComp1 + + View Centered Placemark + 0 + 0 + This is where the satellite was located when we saw it. + 0 + 0 + + + FILL ME IN + FILL ME IN TOO + FILL ME IN AS WELL + FILL IN THIS VALUE + FILL IN THIS VALUE TOO + FILL IN THIS VALUE ALSO + clampToGround + + + http://FILL ME IN:FILL ME IN/cgi-bin/HSCKML.py + 1 + onStop + 1 + BBOX=[bboxWest],[bboxSouth],[bboxEast],[bboxNorth]; +CAMERA=[lookatLon],[lookatLat],[lookatRange],[lookatTilt],[lookatHeading]; +VIEW=[horizFov],[vertFov],[horizPixels],[vertPixels],[terrainEnabled] + + + + +``` + +We can use [gpredict](http://gpredict.oz9aec.net) to figure out where the satellite was by loading +the TLE (one way is to create an http endpoint with the TLE in a txt file, and then add the URL in +the gpredict settings). However, gpredict will refuse to load this TLE. It turns out the checksums +are incorrect, and if we calculate them according to the TLE spec, we get these lines with fixed +checksums + +``` +REDACT +1 13337U 98067A 20087.38052801 -.00000452 00000-0 00000+0 0 9992 +2 13337 51.6460 33.2488 0005270 61.9928 83.3154 15.48919755219334 +``` + +Now, gpredict loads the data (if not, close gpredict, clear the cache with `rm +~/.config/Gpredict/satdata/*.sat`, start gpredict, and select `Update TLE data from network`). The +next step is to create a location for the washington monument. The monument is located at +-77.0354,38.889100. Finally, use the gpredict time controller to pause real time, then set the time +to March 26th, 2020 at 21:54:33. + +![Gpredict showing the satellite pass at that time](gpredict.png) + +We can see that (in the ground reference frame) the satellite is at azimuth 35.52 degrees and +elevation 58.18 degrees. Additionally, it has a line-of-sight range of 488 km. + +To make our lives easier you can notice in Wireshark that Google Earth Pro simply makes HTTP +requests to the given endpoint with parameters given in the KML file, like this + +``` +http://server/cgi-bin/HSCKML.py?BBOX=...;CAMERA=...;... +``` + +So we can use plain curl to avoid messing with the Google Earth Pro GUI a lot. We need the following +parameters: the bounding box of the view, the camera parameters, and the view parameters. + +For the bounding box, we create a reasonable box around the location of the washington monument + +``` +BBOX=-77.035378,38.889384,-77.035178,38.889584 +``` + +For the camera parameters, we look directly at the base, but we need to provide a heading and tilt. +The Google Earth KML reference has a handy diagram of the reference frame needed + +![KML docs showing the tilt parameter](kml1.png) + +![KML docs showing the heading parameter](kml2.png) + +Since gpredict is in a ground reference frame, we need to add 180 to the azimuth to get the heading, +and subtract 90 - elevation to get the tilt. With these calculations and the monument coordinates we +have (note the range is in meters, not km, so we multiply by 1000) + +``` +CAMERA=-77.035278,38.889484,488000,31.82,215.18 +``` + +Finally, for the view we chose some reasonable parameters that seemed to work. This part doesn't +seem to be very important + +``` +VIEW=60,60,500,500,1 +``` + +Putting it together, the full URL is + +``` +http://theserver/cgi-bin/HSCKML.py?BBOX=-77.035378,38.889384,-77.035178,38.889584; +CAMERA=-77.035278,38.889484,488000,31.82,215.18;VIEW=60,60,500,500,1 +``` + +Requesting the URL reveals the flag + +```xml + + + +CLICK FOR FLAG +flag{juliet71739hotel:GNeeb.....} + +-77.0354,38.889100 + + + +``` + +## Resources and other writeups + + * + * + * diff --git a/aaaa/like-to-watch/gpredict.png b/aaaa/like-to-watch/gpredict.png new file mode 100644 index 0000000..60f4daa Binary files /dev/null and b/aaaa/like-to-watch/gpredict.png differ diff --git a/aaaa/like-to-watch/kml1.png b/aaaa/like-to-watch/kml1.png new file mode 100644 index 0000000..5b1577c Binary files /dev/null and b/aaaa/like-to-watch/kml1.png differ diff --git a/aaaa/like-to-watch/kml2.png b/aaaa/like-to-watch/kml2.png new file mode 100644 index 0000000..fc98cb4 Binary files /dev/null and b/aaaa/like-to-watch/kml2.png differ