unsolved during CTF, write-up by playtester

# LOST

The challenge file (morethanaghz) contains a list of hex stings, the name and description seems to refer to the 2004 TV show Lost. There's also an airports.csv file included which is a large list of airports - the whole thing has to be aviation related somehow.

The filename "morethanaghz" inspires a google search for "aviation ghz" results in this [file](https://www.iata.org/contentassets/d7e421981aa64169af1a8d6b37438d4d/aviation20usages20of20frequency20spectrum20-2020170726.pdf) describing aviation usages of frequency spectrum - spending some time researching the ones that are above 1000MHz (and spending too much time on [this paper](https://elib.dlr.de/127793/1/Final_DASC_2019.pdf) because it has cybersecurity in the title) and googling for "1090 extended squitter hex" resulted in [this website](https://mode-s.org/decode/content/ads-b/1-basics.html) with a hex string looking suspiciously like the ones provided in the challenge file.

(It was at this point I realized that I could've saved a a bunch of time by searching for "hex data 8D aircraft" or similar)

Using http://jasonplayne.com:8080/ to decode the first string (8df7420c5805809793eb0ebbca1a) confirmed the suspicion that it is indeed Mode-S traffic - "Airborne Position (with Barometric altitude)" to be more specific - a few minutes of reading revealed that you actually need two messages to get the position. Inputting the first two strings returns the coordinates "Lat": 66.88810729980469, "Lon": -157.1620509935462 - some Airfield in Podunk, Nowhere (https://goo.gl/maps/VmkA4DjknaCsQ2UJ9).

Bits 8-31 in the message represent the Aircraft identifier (AA), so let's just check this one aircraft - the last two entries starting with "8df7420c". (51.61408996582031, 8.61632475981841) is an Airport in Germany.

Lets plot the traffic to see if it spells something. [pyModeS](https://github.com/junzis/pyModeS) seems to be the covenient option

import plotly.express as px
import pyModeS as pms

with open("morethanaghz") as file:
lines = file.readlines()
lats = []
lons = []

for i,l in enumerate(lines):
if (i+1)%2 == 0:
a = pms.adsb.airborne_position(lines[i-1].strip(),l.strip(),0,0)

try: # there are some data issues, don't know don't care
lats += a[0],
lons += a[1],
except:
print(i)

fig = px.line_geo(lat=lats,lon=lons,projection="orthographic")
fig.show()

This is kinda slow, maybe something is off, let's just draw the first flight

import plotly.express as px
import pyModeS as pms

with open("morethanaghz") as file:
lines = file.readlines()
lats = []
lons = []

lasticao = ""
for i,l in enumerate(lines):
if i>0 and pms.adsb.icao(l) != lasticao:
break
lasticao = pms.adsb.icao(l)
if (i+1)%2 == 0:
a = pms.adsb.airborne_position(lines[i-1].strip(),l.strip(),0,0)

try: # there are some data issues, don't know don't care
lats += a[0],
lons += a[1],
except:
print(i)

fig = px.line_geo(lat=lats,lon=lons,projection="orthographic")
fig.show()
Alright, seems to work, Alaska to Germany (not exactly a great circle..), so let's run the whole data set again.

Hm, yeah. I'm pretty confident it doesn't spell anything. Back to the beginning...

> The show contains elements of [supernatural](https://en.wikipedia.org/wiki/Supernatural_fiction "Supernatural fiction") and [science fiction](https://en.wikipedia.org/wiki/Science_fiction "Science fiction"), and follows the survivors of a commercial [jet airliner](https://en.wikipedia.org/wiki/Jet_airliner "Jet airliner") flying between [Sydney](https://en.wikipedia.org/wiki/Sydney "Sydney") and [Los Angeles](https://en.wikipedia.org/wiki/Los_Angeles "Los Angeles"), after the plane crashes on a mysterious [island](https://en.wikipedia.org/wiki/Mythology_of_Lost#The_Island "Mythology of Lost") somewhere in the [South Pacific Ocean](https://en.wikipedia.org/wiki/South_Pacific_Ocean "South Pacific Ocean").

Is there a flight from Sydney to LA among the data?

Quite a few flights from/to sydney, none to LA. Resistencia (AR), São Carlos (BR), Tambor (CR), Taipei (TW) - notably all at airports - the flight in the TV show **crashed** in the South Pacific and there is this suspicious airports.csv file included in the challenge. How about instead of checking which aircraft land somewhere in the south pacific, how about we check for Aircraft that *didn't* land at an airport?

import pyModeS as pms

with open("morethanaghz") as file:
lines = file.readlines()
lats = []
lons = []

with open("airports.csv") as f:
airports = f.readlines()
for l in airports:
data = l.split(",")
try:
lat = round(float(data[6]),2)
lon = round(float(data[7]),2)
except:
pass
lats += lat,
lons += lon,

prev2 = ""
prev = ""

for i in lines:
if i[1:7] != prev[1:7]:
if prev2 != "" and prev != "":
a = pms.adsb.airborne_position(prev.strip(),prev2.strip(),0,0)
if round(a[0],2) not in lats:
if round(a[1],2) not in lons:
print(a)
print(pms.adsb.icao(prev))
prev2 = prev
prev = i

resulting in

(-12.11727, -18.81789)
31a535

Looks like a flight from London to the middle of the Atlantic. Goolge Maps confirms there's no Airport around
So I'm afraid I have bad news for your friends.

Flag is: ENO{31a535}