### **[Original writeup](https://github.com/bias0/writeups/tree/main/csaw21-constela) with images (https://github.com/bias0/writeups/tree/main/csaw21-constela)**

### **Traffic Analysis**

They provide a *.pcap*, in which we can find a lot of diffrent traffic. After inspectioning a little the conversations, I found a TCP stream with an intersting repeated **hexadecimal string**.

>0x42416837436b6b694657567559574a735a5639755a58647a58325a6c5a5751474f675a465646524a49694268645852766257463061574e68624778350a58324e6f5a574e72583356775a4746305a584d474f77425556456b694848567a5957646c5832316...
>c64484a7059334e6664584e6c636c396b595852680a426a73415646524a49686431634752686447566663484a7665486c665a584a79623349474f7742554d456b69465856775a4746305a563968646d46700a62474669624755474f7742554d413d3d0aC

That resulted in a **base64** message, decoded with the usual pipe of `echo "base64_message" | base64 -d` :

>BAh7CkkiFWVuYWJsZV9uZXdzX2ZlZWQGOgZFVFRJIiBhdXRvbWF0aWNhbGx5X2NoZWNrX3VwZGF0ZXMGOwBUVEkiHHVzYWdlX21ldHJpY3NfdXNlcl9kYXRhBjsAVFRJIhd1cGRhdGVfcHJveHlfZXJyb3IGOwBUMEkiFXVwZGF0ZV9hdmFpbGFibGUGOwBUMA==
>
>I"enable_news_feed:ETTI" automatically_check_updates;TTI"usage_metrics_user_data;TTI"update_proxy_error;T0I"update_available;T0

**Unfortunatly, this led to nowhere :(**.

So I returned to the *.pcap* in order to find something else. In the **DNS messages** I noticed something strange. In a lot of traces with requests to a variety of sites, I ***c***saw (xD) some odd sites that appear one following the other, for example:

> JEdQR0dBLCwzMC4wLE4sMzUuMCxXLDcs.com
MDAsLDEwMDIwLjAsZnQsLCwsKjQ3.com

Then, as before, I decoded it from base64 taking the concatenation of the two strings excpet the *.com*.

>$GPGGA,,42.0,N,27.0,W,7,00,,10015.0,ft,,,,*47

This is a message format used for the **GPS satellite location** (*as hinted by the challenge description*) with fields as follows:

>$GPGGA,123519,4807.038,N,01131.000,E,1,08,0.9,545.4,M,46.9,M,,*47
>
>Where:
>```
> GGA Global Positioning System Fix Data
> 123519 Fix taken at 12:35:19 UTC
> 4807.038,N Latitude 48 deg 07.038' N
> 01131.000,E Longitude 11 deg 31.000' E
> 1 Fix quality: 0 = invalid
> 1 = GPS fix (SPS)
> 2 = DGPS fix
> 3 = PPS fix
> 4 = Real Time Kinematic
> 5 = Float RTK
> 6 = estimated (dead reckoning) (2.3 feature)
> 7 = Manual input mode
> 8 = Simulation mode
> 08 Number of satellites being tracked
> 0.9 Horizontal dilution of position
> 545.4,M Altitude, Meters, above mean sea level
> 46.9,M Height of geoid (mean sea level) above WGS84
> ellipsoid
> (empty field) time in seconds since last DGPS update
> (empty field) DGPS station ID number
> *47 the checksum data, always begins with *```

I tried to put the coordinates in google maps but they are placed in the Atlantic Ocean with nothing to see.

After that I noticed that in the DNS streams all the times the two strings that can be concatenated appear, they have a slightly difference in the characters, meaning that there are more coordinates.

I collected all of them using a wireshark filter:

> `dns && (((ip.src == 127.0.0.1) && (ip.dst == 127.0.0.53))) && ((frame.len==109) || (frame.len==105)) && dns.qry.name `

that takes all the frames that are coupled one after the other, without repeatin them with the dns request forwarding. Wireshark gives the possibility to export the result in a json file, in order to use it in a python exploit ([export](constela/values.json)).

## **Exploit**

In the exploit I took the values (**321 locations**) of longitude, latitude and altitude in order to plot them, and after a lot of different tries (even a 3D plot with all the elements, quite beautiful).Finally I maneged to get the right combiantion: **Latitude and Altitude**, both with a max range of 25 different elements.

## The result is a square, that if shrunk a bit gives a **QR CODE** that returns the flag!

> `flag{tH3_5chw1fTy_C0n3teLat10N}`

Original writeup (https://github.com/bias0/writeups/tree/main/csaw21-constela).