109 lines
1.8 KiB
Markdown
Executable File
109 lines
1.8 KiB
Markdown
Executable File
# Let's All Love UART
|
|
|
|
| Field | Value |
|
|
|-------|-------|
|
|
| Category | IoT |
|
|
| Difficulty | Easy |
|
|
| Points | 500 |
|
|
| Author | Eun0us |
|
|
| CTF | Espilon 2026 |
|
|
|
|
---
|
|
|
|
## Description
|
|
|
|
This challenge emulates a UART interface on a Lain router.
|
|
Open both connections, interact as if it was real hardware.
|
|
|
|
- **TX**: Read only
|
|
- **RX**: Write only
|
|
|
|
**Let's All Love Lain!**
|
|
|
|
---
|
|
|
|
## TL;DR
|
|
|
|
Open the TX and RX ports simultaneously. Send `flag` on the RX (write) port.
|
|
The flag is immediately printed on the TX (read) port.
|
|
|
|
---
|
|
|
|
## Tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| `nc` | Split UART connection |
|
|
| Python 3 | Automated solver script |
|
|
|
|
---
|
|
|
|
## Solution
|
|
|
|
### Step 1 — Open both channels
|
|
|
|
```bash
|
|
# Terminal 1 — read device output
|
|
nc <host> 1111
|
|
|
|
# Terminal 2 — send commands
|
|
nc <host> 2222
|
|
```
|
|
|
|
> 📸 `[screenshot: two terminal windows open, TX showing the device banner]`
|
|
|
|
### Step 2 — Request the flag
|
|
|
|
In Terminal 2 (RX):
|
|
|
|
```text
|
|
flag
|
|
```
|
|
|
|
### Step 3 — Read the flag
|
|
|
|
In Terminal 1 (TX):
|
|
|
|
```
|
|
ESPILON{LAIN_TrUsT_U4RT}
|
|
```
|
|
|
|
> 📸 `[screenshot: TX terminal printing the flag immediately after the flag command is sent]`
|
|
|
|
### Automated solver
|
|
|
|
```python
|
|
#!/usr/bin/env python3
|
|
import socket
|
|
import threading
|
|
|
|
HOST = "<host>"
|
|
TX_PORT = 1111
|
|
RX_PORT = 2222
|
|
|
|
def reader():
|
|
with socket.create_connection((HOST, TX_PORT)) as s:
|
|
while True:
|
|
data = s.recv(4096)
|
|
if not data:
|
|
break
|
|
out = data.decode(errors="replace")
|
|
print(out, end="")
|
|
if "ESPILON{" in out:
|
|
break
|
|
|
|
tx_thread = threading.Thread(target=reader, daemon=True)
|
|
tx_thread.start()
|
|
|
|
with socket.create_connection((HOST, RX_PORT)) as s:
|
|
s.sendall(b"flag\n")
|
|
|
|
tx_thread.join()
|
|
```
|
|
|
|
---
|
|
|
|
## Flag
|
|
|
|
`ESPILON{LAIN_TrUsT_U4RT}`
|