Eun0us/ESPILON-CTF-2026-Writeups

Eun0us 6a0877384d [+] Writeups v2 — sync solves, real points, scoreboard stats, cleanup

- Remove undeployed challenges: Phantom_Byte, Cr4cK_w1f1, Lain_Br34kC0r3 V1,
  Lain_VS_Knights, Lets_All_Love_UART, AETHER_NET, Last_Train_451, Web3/
- Sync 24 solve/ files from main CTF-Espilon repo
- Update all READMEs with real CTFd final scores at freeze
- Add git-header.png banner
- Rewrite README: scoreboard top 10, edition stats (1410 users, 264 boards,
  1344 solves), correct freeze date March 26 2026

2026-03-27 21:27:45 +01:00

1.9 KiB

Raw Blame History

Anesthesia Gateway -- Solution

Overview

MQTT broker simulating an anesthesia monitoring gateway. A debug topic leaks an encoded firmware blob. Reverse the encoding to extract a maintenance key and publish it to unlock the flag.

Steps

1. Connect and discover topics

mosquitto_sub -h HOST -t "sainte-mika/#" -v

Topics discovered:

sainte-mika/or13/vitals -- patient vital signs (JSON)
sainte-mika/or13/sevoflurane -- anesthetic gas data
sainte-mika/or13/propofol -- infusion pump data
sainte-mika/or13/ventilator -- mechanical ventilator data
sainte-mika/or13/alarms -- alarm status (note: "network": "WIRED-MED")
sainte-mika/or13/debug/firmware -- base64-encoded blob (every 45s)

2. Capture firmware blob

Grab the base64 string from debug/firmware.

3. Decode the blob

The encoding chain is: JSON -> zlib -> XOR("WIRED") -> base64

To reverse:

import base64, zlib

blob = "<base64 string from MQTT>"
raw = base64.b64decode(blob)

# XOR with key "WIRED" (hint: WIRED-MED appears in alarm data)
key = b"WIRED"
xored = bytes(b ^ key[i % len(key)] for i, b in enumerate(raw))

# After XOR, bytes start with 78 9C (zlib magic)
config = zlib.decompress(xored)
print(config.decode())

4. Extract maintenance key

The decoded JSON contains:

{
    "maintenance_key": "N4V1-C4R3-0R13-L41N"
}

5. Publish key and get flag

mosquitto_pub -h HOST -t "sainte-mika/or13/maintenance/unlock" -m "N4V1-C4R3-0R13-L41N"

Subscribe to the flag topic:

mosquitto_sub -h HOST -t "sainte-mika/or13/maintenance/flag"

Key insights

The XOR key "WIRED" is discoverable from the alarm topic which includes "network": "WIRED-MED"
After XOR decryption, the zlib magic bytes 78 9C confirm the correct key
The maintenance key "N4V1-C4R3-0R13-L41N" = "Navi Care OR13 Lain" in leetspeak

Flag

ESPILON{mQtt_g4tw4y_4n3sth3s14}

Author

Eun0us

1.9 KiB Raw Blame History