# I Like To Watch
**Category:** Astronomy, Astrophysics, Astrometry, Astrodynamics, AAAA
**Points (final):** 37
**Solves:** 126
>Fire up your Google Earth Pro and brush up on your KML tutorials, we're going to make it look at
>things!
## Write-up
by [haskal](https://awoo.systems)
A netcat endpoint is provided, and when you connect it provides the following info:
```
We've captured data from a satellite that shows a flag located at the base of the Washington
Monument.
The image was taken on March 26th, 2020, at 21:54:33
The satellite we used was:
REDACT
1 13337U 98067A 20087.38052801 -.00000452 00000-0 00000+0 0 9995
2 13337 51.6460 33.2488 0005270 61.9928 83.3154 15.48919755219337
Use a Google Earth Pro KML file to 'Link' to http://18.191.77.141:26963/cgi-bin/HSCKML.py
and 'LookAt' that spot from where the satellite when it took the photo and get us that flag!
```
Additionally, an example KML file is provided
```xml
HackASatCompetition00HackASatComp1View Centered Placemark00This is where the satellite was located when we saw it.00FILL ME INFILL ME IN TOOFILL ME IN AS WELLFILL IN THIS VALUEFILL IN THIS VALUE TOOFILL IN THIS VALUE ALSOclampToGroundhttp://FILL ME IN:FILL ME IN/cgi-bin/HSCKML.py1onStop1BBOX=[bboxWest],[bboxSouth],[bboxEast],[bboxNorth];
CAMERA=[lookatLon],[lookatLat],[lookatRange],[lookatTilt],[lookatHeading];
VIEW=[horizFov],[vertFov],[horizPixels],[vertPixels],[terrainEnabled]
```
We can use [gpredict](http://gpredict.oz9aec.net) to figure out where the satellite was by loading
the TLE (one way is to create an http endpoint with the TLE in a txt file, and then add the URL in
the gpredict settings). However, gpredict will refuse to load this TLE. It turns out the checksums
are incorrect, and if we calculate them according to the TLE spec, we get these lines with fixed
checksums
```
REDACT
1 13337U 98067A 20087.38052801 -.00000452 00000-0 00000+0 0 9992
2 13337 51.6460 33.2488 0005270 61.9928 83.3154 15.48919755219334
```
Now, gpredict loads the data (if not, close gpredict, clear the cache with `rm
~/.config/Gpredict/satdata/*.sat`, start gpredict, and select `Update TLE data from network`). The
next step is to create a location for the washington monument. The monument is located at
-77.0354,38.889100. Finally, use the gpredict time controller to pause real time, then set the time
to March 26th, 2020 at 21:54:33.
![Gpredict showing the satellite pass at that time](gpredict.png)
We can see that (in the ground reference frame) the satellite is at azimuth 35.52 degrees and
elevation 58.18 degrees. Additionally, it has a line-of-sight range of 488 km.
To make our lives easier you can notice in Wireshark that Google Earth Pro simply makes HTTP
requests to the given endpoint with parameters given in the KML file, like this
```
http://server/cgi-bin/HSCKML.py?BBOX=...;CAMERA=...;...
```
So we can use plain curl to avoid messing with the Google Earth Pro GUI a lot. We need the following
parameters: the bounding box of the view, the camera parameters, and the view parameters.
For the bounding box, we create a reasonable box around the location of the washington monument
```
BBOX=-77.035378,38.889384,-77.035178,38.889584
```
For the camera parameters, we look directly at the base, but we need to provide a heading and tilt.
The Google Earth KML reference has a handy diagram of the reference frame needed
![KML docs showing the tilt parameter](kml1.png)
![KML docs showing the heading parameter](kml2.png)
Since gpredict is in a ground reference frame, we need to add 180 to the azimuth to get the heading,
and subtract 90 - elevation to get the tilt. With these calculations and the monument coordinates we
have (note the range is in meters, not km, so we multiply by 1000)
```
CAMERA=-77.035278,38.889484,488000,31.82,215.18
```
Finally, for the view we chose some reasonable parameters that seemed to work. This part doesn't
seem to be very important
```
VIEW=60,60,500,500,1
```
Putting it together, the full URL is
```
http://theserver/cgi-bin/HSCKML.py?BBOX=-77.035378,38.889384,-77.035178,38.889584;
CAMERA=-77.035278,38.889484,488000,31.82,215.18;VIEW=60,60,500,500,1
```
Requesting the URL reveals the flag
```xml
CLICK FOR FLAGflag{juliet71739hotel:GNeeb.....}-77.0354,38.889100
```
## Resources and other writeups
*
*
*