# Cyberia Grid

| Field | Value |
|-------|-------|
| Category | OT |
| Difficulty | Medium-Hard |
| Points | 500 |
| Author | Eun0us |
| CTF | Espilon 2026 |

---

## Description

Cyberia is not just a nightclub. An industrial PLC controller manages the building power
infrastructure over EtherNet/IP.

The previous owner — rumored to be connected to the Knights of the Eastern Calculus —
added extra tags that do not correspond to any physical equipment.

Read the tags. Find the hidden data. The Psyche Processor awaits activation.

- EtherNet/IP: `tcp/<host>:44818`

Format: **ESPILON{flag}**

---

## TL;DR

Read all EtherNet/IP tags including hidden ones (`KIDS_Subject`, `Knights_Cipher`,
`Psyche_Processor`). Derive the 4-value activation sequence from infrastructure tag values
(BPM, sound level, lighting sum, hacker constant 0x1337). Write to `Psyche_Processor[0-3]`.
After one scan cycle, read `Decoded_Output` for the flag.

---

## Tools

| Tool | Purpose |
|------|---------|
| Python 3 + `cpppo` | EtherNet/IP client (read/write tags) |
| Knowledge of EtherNet/IP | Understanding CIP tag addressing |

---

## Solution

### Step 1 — Connect and enumerate tags

Using the cpppo EtherNet/IP client:

```python
from cpppo.server.enip.get_attribute import proxy_simple as device

with device(host="<HOST>", port=44818) as via:
    # Read infrastructure tags
    zone_main   = via.read("Zone_Main_Power")
    zone_vip    = via.read("Zone_VIP_Power")
    zone_bsmt   = via.read("Zone_Basement_Power")  # = 0 (OFF — suspicious)
    sound_db    = via.read("Sound_System_dB")       # = 95
    bpm         = via.read("BPM")                   # = 140
    lighting    = [via.read(f"Lighting_Main[{i}]") for i in range(8)]
    # = [255, 200, 180, 150, 100, 80, 60, 40]

    # Read hidden tags
    kids        = [via.read(f"KIDS_Subject[{i}]") for i in range(16)]
    cipher      = [via.read(f"Knights_Cipher[{i}]") for i in range(4)]
    # cipher = [0x4B, 0x6E, 0x69, 0]  -- 4th byte missing
    psyche_st   = via.read("Psyche_Status")         # = "DORMANT"
```

> 📸 `[screenshot: cpppo client output listing all tag values including hidden ones]`

**Observation:** `Zone_Basement_Power = 0` — the basement is OFF. This is the first hint
that something is hidden underground.

### Step 2 — Analyze the hidden tags

- `KIDS_Subject[0-15]`: 16 DINT values containing XOR-encoded flag data
- `Knights_Cipher[0-3]`: partial XOR key `[0x4B, 0x6E, 0x69, 0]` = `"Kni?"` — 4th byte missing
- `Psyche_Processor[0-3]`: all zeros — needs activation
- `Psyche_Status = "DORMANT"`

### Step 3 — Derive the activation sequence

Each `Psyche_Processor` value is derived from existing infrastructure tags:

| Index | Formula | Calculation | Value |
|-------|---------|-------------|-------|
| 0 | `Zone_Basement_Power XOR BPM` | `0 ^ 140` | 140 |
| 1 | `Sound_System_dB` | `95` | 95 |
| 2 | `sum(Lighting_Main) % 256` | `1065 % 256` | 17 |
| 3 | `0x1337` (hacker constant) | `4919` | 4919 |

> 📸 `[screenshot: Python calculation showing the four derived activation values]`

### Step 4 — Activate the Psyche Processor

Write the derived values:

```python
with device(host="<HOST>", port=44818) as via:
    for i, val in enumerate([140, 95, 17, 4919]):
        via.write(via.parameter_substitution(f"Psyche_Processor[{i}]"), val)
```

### Step 5 — Wait one scan cycle and read the flag

After ~500ms (one PLC scan cycle):

```python
import time
time.sleep(0.6)

with device(host="<HOST>", port=44818) as via:
    flag = via.read("Decoded_Output")
    print(flag)

    # Also: Knights_Cipher[3] is now populated: 0x67 = 'g' → key = "Knig"
```

> 📸 `[screenshot: Decoded_Output tag returning the flag after Psyche Processor activation]`

### Key concepts

- `Zone_Basement_Power = 0` is the first hint that something is hidden underground
- The `0x1337` constant is a recurring hacker reference across the OT challenges
- The PLC scan cycle polling pattern mirrors real industrial controller behavior
- EtherNet/IP has no built-in authentication — anyone can read/write tags on the network

---

## Flag

`ESPILON{cyb3r14_ps7ch3_pr0c3ss0r}`