| Category | Communication & RF |
| Points | 500 |
| Solves | 25 |
You wake up with one your alarms going off. Cortex has picked up some interesting signals coming out of Aquilon Mead, but no local sensors you can access remotely. You need to go there to collect the logs. Time for a fishing trip. Good thing you left that backdoor in Aeon’s infra, their recon sat will come in handy for this one.
Flag format: STARPWN.[a-zA-Z0-9_]+.
Attachments: nice_day_for_fishing.zip (aquilon_mead_sigint_node42.sigmf-data, .sigmf-meta, outputs_file_1.tiff, outputs_file_2.tiff)
You need to extract the aquilon_mead_sigint_node42 file. It was compressed because of its large size.
1. Parse the SigMF capture
The capture aquilon_mead_sigint_node42.sigmf-data is an RF recording in SigMF format from a SIGINT node at Aquilon Mead. The metadata file specifies the center frequency, sample rate, and data type.
2. Demodulate AIS
The signal contains AIS (Automatic Identification System) — the maritime vessel tracking protocol broadcast on VHF (161.975 MHz / 162.025 MHz). Demodulate GMSK and decode HDLC-framed NRZI AIS packets with CRC-16/X.25 validation.
Try multiple bit-alignment offsets (0–9) to maximize valid frame count:
offset=8: 419 valid frames ← best
Total CRC-valid AIS frames: 425
3. Parse the satellite TIFF imagery
Two GeoTIFF frames (outputs_file_1.tiff, outputs_file_2.tiff) from Aeon’s recon satellite cover the same area at different times. Detect moving objects by differencing the two frames — identifies 8 moving objects in the imagery.
4. Align RF and imagery timelines
Cross-correlate AIS vessel positions with satellite-detected moving objects to find the best temporal alignment:
Best TIFF/RF alignment: 37.6s → 97.2s
5. Classify MMSIs
Match AIS-tracked vessels against satellite-confirmed moving objects. Vessels whose AIS-reported positions correspond to real satellite detections are legitimate; those that appear in AIS but have no satellite-visible counterpart are phantom (spoofed) transmitters:
| Type | MMSIs |
|---|---|
| Legitimate | 211695738, 248917603, 271834956, 352781649, 419263587, 477328165, 563104892, 668195274 |
| Phantom | 305718642, 574902381, 731405982 |
6. Extract the covert stream from phantom MMSIs
The 3 phantom vessels are not real ships — they are used as a covert data channel. Decode the payload bytes hidden in their AIS transmissions:
python3 solve_nice_day_for_fishing.py \
aquilon_mead_sigint_node42.sigmf-data \
aquilon_mead_sigint_node42.sigmf-meta \
outputs_file_1.tiff \
outputs_file_2.tiff
Expected:
[AIS] offset=0: 367 valid frames
[AIS] offset=1: 271 valid frames
[AIS] offset=2: 363 valid frames
[AIS] offset=3: 383 valid frames
[AIS] offset=4: 396 valid frames
[AIS] offset=5: 388 valid frames
[AIS] offset=6: 409 valid frames
[AIS] offset=7: 414 valid frames
[AIS] offset=8: 419 valid frames
[AIS] offset=9: 415 valid frames
[+] Total CRC-valid AIS frames: 425
[+] TIFF moving objects: 8
[+] Best TIFF/RF alignment: 37.6s -> 97.2s
[+] Legitimate moving MMSIs:
211695738
248917603
271834956
352781649
419263587
477328165
563104892
668195274
[+] Phantom MMSIs:
305718642
574902381
731405982
[+] Covert stream: b'\x00\x00\x00,#%#&)STARPWN.3_SP33DY_MMS1S.","\''
[+] FLAG: STARPWN.3_SP33DY_MMS1S.
Search for the flag regex STARPWN\.[A-Za-z0-9_]+\. in the decoded stream to extract the flag.
# Usage:
# python3 solve_nice_day_for_fishing.py \
# aquilon_mead_sigint_node42.sigmf-data \
# aquilon_mead_sigint_node42.sigmf-meta \
# outputs_file_1.tiff \
# outputs_file_2.tiff
#
# Dependencies: numpy scipy rasterio
#
# Pipeline:
# 1. GMSK demodulation + NRZI decode + HDLC frame extraction (AIS)
# 2. CRC-16/X.25 validation, try offsets 0-9, keep best
# 3. Rasterio: load TIFFs, detect moving objects via image differencing
# 4. Cross-correlate AIS positions with satellite detections -> time alignment
# 5. Hungarian algorithm (linear_sum_assignment) for MMSI-to-object matching
# 6. Phantom MMSIs -> covert stream -> regex search -> flag
STARPWN.3_SP33DY_MMS1S.