Mr-Worldwide picoCTF 2019 Solution

Description

1. Step 1Read the coordinate list

   Observation

   The description mentions coordinates and the setup downloads message.txt. The first move is simply opening the file to see how many coordinate pairs there are and what format they use.

   Open the file. It contains a list of GPS coordinates (latitude, longitude pairs). Each coordinate points to a specific location on Earth.

   bash

   cat message.txt

   Copied!

   What didn't work first

   Tried: Treat the raw coordinate numbers as an encoding directly (e.g. convert decimal degrees to ASCII).

   Latitude and longitude values like 35.6895 and 139.6917 are floating-point degree values, not character codes. Treating them as ASCII or base-10 integers produces garbage output. The coordinates are inputs to a reverse-geocoding lookup, not a numeric cipher.

   Tried: Search for a pattern in the decimal parts of each coordinate, assuming the flag is hidden in the fractional digits.

   The fractional parts of the coordinates are real GPS precision values, not encoded data. There is no hidden pattern in the decimals themselves. The flag encoding operates entirely at the level of city names derived from reverse geocoding.

   Learn more

   GPS coordinates use the WGS84 datum. Latitude ranges from -90 (South Pole) to +90 (North Pole). Longitude ranges from -180 to +180, with 0 at the Prime Meridian through Greenwich, England. Positive longitude is East, negative is West.

2. Step 2Geocode each coordinate to a city name

   Observation

   The title references Mr. Worldwide, and the description says the first letters of the city names spell the flag. So each coordinate needs reverse-geocoding to recover the city it belongs to.

   For each coordinate pair, use Google Maps (paste coordinates into the search bar) or a geocoding API to find the nearest city. Note the first letter of each city name.

   python

   python3 << 'EOF'
   # Using geopy for reverse geocoding
   from geopy.geocoders import Nominatim
   geolocator = Nominatim(user_agent="picoctf")
   
   coords = [
       # (lat, lon),
       # paste coordinates here
   ]
   
   for lat, lon in coords:
       location = geolocator.reverse(f"{lat}, {lon}")
       print(location.address)
   EOF

   Copied!

   What didn't work first

   Tried: Use the street or neighborhood name from the geocoder result instead of the city name.

   Nominatim returns a full address string that may start with a street, suburb, or district, so the first letter of that string is the wrong character. The challenge wants the major city name, so read the city or town field from the parsed address components, not the raw string.

   Tried: Run the geopy script against only the first coordinate to test it, then assume the rest will work the same way.

   Nominatim rate-limits requests and returns slightly different shapes depending on the coordinate. A point in a rural area may resolve to a country or administrative region rather than a city. Check each coordinate and verify the city name individually before taking its first letter.

   Learn more

   Reverse geocoding converts coordinates to a human-readable address. The Nominatim service (powered by OpenStreetMap) is free for low-volume use. Google Maps Geocoding API is more accurate but requires an API key.

   For this challenge, the important part is the city name, not the full address. Focus on the major city closest to each coordinate.

3. Step 3Take first letters to spell the flag

   Observation

   The description states outright that the first letters of the city names spell the flag. That acrostic step is the last thing needed to assemble the picoCTF{...} answer.

   Collect the first letter of each city name in order. These letters form the flag content. Wrap the result in picoCTF{...}.

   Learn more

   This encoding technique is called an acrostic - using the first letter of each word or item to spell a hidden message. It has been used in literature, art, and espionage for centuries.

Flag

Geocode each coordinate to a city and take the first letter of each city name - they spell out the flag.