Devil's Centroid

Platform: Broncoctf2026 | Category: OSINT | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: floor_rounding_flag_formatting, geographic_centroid_computation, landmark_to_city_mapping, red_herring_elimination, song_lyric_identification, thematic_clue_analysis, wikipedia_mediawiki_api_coordinate_lookup

Summary

Task: OSINT puzzle giving three devil-themed clues that each identify a city; goal is the floored centroid of their Wikipedia coordinates. Solution: recognize the Bermuda (Devil's) Triangle — Bermuda, San Juan, Miami — via landmark and song-lyric identification, then average the three Wikipedia lat/lon pairs and floor to bronco{REDACTED}.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_devils_centroid
• Tags: osint, geolocation, miami, flag_formatting, bermuda_triangle, devils_triangle, wikipedia_coordinates, centroid, song_lyrics_identification, san_juan, bermuda, garita_del_diablo
• Indicators: treasure in the center of a specific triangle, possessed by the devil, Devil's Isle, haunted sentry box, Spanish song-lyric quote
• Source: 20260711_broncoctf2026_devils_centroid.md

Foothold

Vulnerability / Misconfiguration

1. Floor_rounding_flag_formatting
2. Geographic_centroid_computation
3. Landmark_to_city_mapping
4. Red_herring_elimination
5. Song_lyric_identification

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• floor_rounding_flag_formatting
• geographic_centroid_computation
• landmark_to_city_mapping
• red_herring_elimination
• song_lyric_identification
• thematic_clue_analysis
• wikipedia_mediawiki_api_coordinate_lookup
• Tags: osint, geolocation, miami, flag_formatting, bermuda_triangle, devils_triangle, wikipedia_coordinates, centroid, song_lyrics_identification, san_juan, bermuda, garita_del_diablo

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Rumors speak of a treasure buried in the center of a specific triangle. Three people have sent me locations where they are, but there's a problem. I think they're all possessed by the devil.

All they gave me 3 different pieces of information:

• I'm at a place called Devil's Isle
• I found myself near a haunted sentry box
• This one just went 'Nunca podrán dominarla La buena música no engaña'

The coordinates of the cities themselves on Wikipedia should give me a decent estimate.

Flag: bronco{XX(N or S),XX(E or W)}, Rounded down to the nearest whole number after all of the calculations. Example: bronco{06N,66E}

English summary: three devil-themed clues each resolve to a city. The three cities are the classic vertices of a famous "triangle". Take each city's Wikipedia coordinates, compute the geographic centroid (arithmetic mean of the three lat/lon pairs), floor both values, and format with N/S and E/W hemispheres.

Analysis

The core insight is thematic: a "specific triangle" whose points are all possessed by the devil is the Bermuda Triangle, popularly known as the Devil's Triangle. Its three classic corners are Miami, San Juan (Puerto Rico), and Bermuda. Each clue names one of these vertices.

Clue-by-clue resolution:

1. "I'm at a place called Devil's Isle" → Bermuda. Bermuda's historical nickname is "The Isle of Devils" / "Devil's Isle".

• Red-herring elimination: Devil's Island (Île du Diable, near Kourou, French Guiana) is a different place and is wrong. The task deliberately writes "Devil's Isle", not "Devil's Island".
• Also note the Wikipedia page for Hamilton, Bermuda has no coordinates field — another reason to use the Bermuda country page, which the prompt itself hints at ("coordinates of the cities themselves on Wikipedia").

1. "I found myself near a haunted sentry box" → San Juan, Puerto Rico. A Google search for "haunted sentry box" leads to La Garita del Diablo ("The Devil's Sentry Box"), a stone sentry box at Castillo San Cristóbal in San Juan. It is tied to the legend of the vanishing soldier Sánchez and the short story "The Haunted Sentry Box of Porto Rico" by Lewis Miller. City = San Juan, Puerto Rico.

2. "Nunca podrán dominarla / La buena música no engaña" → Miami. An exact-phrase Google search of the Spanish lyric (hitting Genius/Spotify/Musixmatch) identifies the song "Miami 666" by the Panamanian alternative rock band Señor Loop. The song title gives the city = Miami.

Solution

Step 1 — Fetch exact Wikipedia coordinates via the MediaWiki API

curl -s "https://en.wikipedia.org/w/api.php?action=query&prop=coordinates&titles=Miami&format=json"
curl -s "https://en.wikipedia.org/w/api.php?action=query&prop=coordinates&titles=San%20Juan,%20Puerto%20Rico&format=json"
curl -s "https://en.wikipedia.org/w/api.php?action=query&prop=coordinates&titles=Bermuda&format=json"

Coordinates returned:

Step 2 — Compute the centroid and floor

#!/usr/bin/env python3
import math

# (lat, lon) from Wikipedia
points = [
    (32.32,        -64.74),        # Bermuda      -> "Devil's Isle"
    (18.40638889,  -66.06388889),  # San Juan     -> "haunted sentry box" / Garita del Diablo
    (25.77416667,  -80.19361111),  # Miami        -> Senor Loop "Miami 666"
]

lat = sum(p[0] for p in points) / 3   # 25.500185...
lon = sum(p[1] for p in points) / 3   # -70.3325

lat_h = 'N' if lat >= 0 else 'S'
lon_h = 'E' if lon >= 0 else 'W'

# "Rounded down to the nearest whole number" -> floor of the magnitude
lat_v = math.floor(abs(lat))          # 25
lon_v = math.floor(abs(lon))          # 70

print(f"bronco{{{lat_v}{lat_h},{lon_v}{lon_h}}}")
# bronco{REDACTED}

Arithmetic:

• lat = (32.32 + 18.40638889 + 25.77416667) / 3 = 25.500185...° → N, floor → 25
• lon = (-64.74 + -66.06388889 + -80.19361111) / 3 = -70.3325° → W (negative = west), floor of magnitude → 70

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR