Eun0us/ESPILON-CTF-2026-Writeups

Eun0us 6a0877384d [+] Writeups v2 — sync solves, real points, scoreboard stats, cleanup

- Remove undeployed challenges: Phantom_Byte, Cr4cK_w1f1, Lain_Br34kC0r3 V1,
  Lain_VS_Knights, Lets_All_Love_UART, AETHER_NET, Last_Train_451, Web3/
- Sync 24 solve/ files from main CTF-Espilon repo
- Update all READMEs with real CTFd final scores at freeze
- Add git-header.png banner
- Rewrite README: scoreboard top 10, edition stats (1410 users, 264 boards,
  1344 solves), correct freeze date March 26 2026

2026-03-27 21:27:45 +01:00

3.9 KiB

Raw Blame History

Schumann Resonance

Field	Value
Category	OT
Difficulty	Medium
Points	196
Author	Eun0us
CTF	Espilon 2026

Description

The building management system at Tachibana General Laboratories runs BACnet/IP for environmental monitoring. Sub-basement 7 was decommissioned years ago, but its BACnet device is still broadcasting.

The device description mentions "Schumann Monitoring Station." Some objects carry unusual properties.

Enumerate the device. Read every property. The resonance frequency holds the key.

BACnet/IP: udp/<host>:47808

Format: ESPILON{flag}

TL;DR

Discover BACnet device 783 via WhoIs (device ID = Schumann frequency 7.83 Hz × 100). XOR key = 0x0783. Decode 7 fragment descriptions (hex-encoded XOR'd strings) to reconstruct the flag. Alternatively: write 7.83 to AnalogValue:10 to activate the Resonance_Lock and have the flag written automatically to CharStringValue:200.

Tools

Tool	Purpose
Python 3 + `BAC0`	BACnet/IP discovery and read/write
XOR arithmetic	Decode fragment hex strings

Solution

Step 1 — Device discovery

Send a BACnet WhoIs broadcast to port 47808:

import BAC0

bacnet = BAC0.lite(ip="<YOUR_IP>/24")
bacnet.whois()
# → Device:783 "Tachibana-ENV-SB7"

Device instance 783 → 7.83 Hz → Schumann Resonance.

Step 2 — Enumerate objects

Read the object-list from Device:783:

Object	Name	Note
AnalogInput:0-3	Temp, Humidity, Pressure, CO2	Normal sensors
AnalogInput:4	EMF_Resonance = 7.83	Description = "PROTOCOL_SEVEN_CARRIER"
AnalogValue:10	Freq_Multiplier = 0.0	Writable! Hint: "set to Schumann harmonic"
AnalogValue:11-17	Fragment_0 through Fragment_6	Descriptions = hex strings
BinaryValue:100	Resonance_Lock	inactive
CharStringValue:200	Research_Log	"Access Denied"

Step 3 — Identify the XOR key

Device instance = 783 → 7.83 Hz → XOR key = 0x0783 (2-byte big-endian).

Key bytes: [0x07, 0x83] applied cyclically.

Step 4 — Decode fragments (manual path)

Read the description property of each Fragment AnalogValue:

fragments = []
for i in range(7):
    desc = bacnet.read(f"783 analogValue {11+i} description")
    enc = bytes.fromhex(desc)
    key = (0x07, 0x83)
    dec = bytes(b ^ key[j % 2] for j, b in enumerate(enc))
    fragments.append(dec.decode())

flag = "".join(fragments)
print(flag)

Step 5 — Activate (alternative path)

Write the Schumann frequency to AnalogValue:10:

bacnet.write(f"783 analogValue 10 presentValue 7.83")

This sets BinaryValue:100 (Resonance_Lock) to active and writes the flag to CharStringValue:200 (Research_Log).

Read the flag:

flag = bacnet.read(f"783 characterstringValue 200 presentValue")
print(flag)

Key concepts

BACnet device instance 783 = 7.83 × 100 — the Schumann resonance frequency (7.83 Hz)
AnalogInput:4 description "PROTOCOL_SEVEN_CARRIER" is a lore reference and key derivation hint
BACnet has no authentication — ReadProperty/WriteProperty work without credentials
Two solve paths: manual fragment decode OR write the magic value and read the result

Flag

ESPILON{sch0m4nn_r3s0n4nc3_783}

3.9 KiB Raw Blame History Unescape Escape