随便玩玩：Espilon CTF

创建于：2026-03-16
更新于：2026-03-17

字数统计: 3.2k字 | 阅读时长≈ 17分

不知道从哪里找到的比赛，随便玩玩，咱水平不高还请见谅

Hardware

Glitch The Wired

这题实际上就是一个用于了解错误注入攻击（Fault Injection Attack）的简单题，题目说有一个安全启动模块，而你可以执行电压毛刺（Voltage Glitch），最后要求是绕过签名验证

题目非常贴心地提供了启动序列的流程：

> observe
[BOOT TRACE] WIRED-MED Secure Boot v2.3
[BOOT TRACE] Device: WM-2024-SAINTMIKA-0042

  [    0- 1000] ROM_INIT        | ROM bootloader initializing...
  [ 1000- 2000] FLASH_READ      | Reading firmware from flash...
  [ 2000- 3000] HASH_COMPUTE    | Computing SHA-256 digest...
  [ 3000- 3200] SIG_LOAD        | Loading RSA signature from OTP...
  [ 3200- 3400] SIG_VERIFY      | Verifying firmware signature...
  [ 3400- 4000] APP_LOAD        | Loading application into SRAM...
  [ 4000- 5000] APP_RUN         | Jumping to application entry point...

[BOOT TRACE] Total boot time: ~5000 cycles
[BOOT TRACE] Signature verification is MANDATORY for production

而我们可以设置delay和width，分别表示延后多少个周期开始进行毛刺，而毛刺持续时间为多少个周期

由于题目明确给出了签名验证是在第3200~3400周期，因此我们的毛刺一定要在这中间，除此之外持续时间不能太短（不然无法对模块产生足够的影响）也不能太长（模块会认为出现故障导致崩溃），这里我随便用了10个周期的毛刺，是可以拿到flag的

> set_delay 3200
[OK] delay = 3200 cycles
> set_width 10
[OK] width = 10 cycles
> arm
[OK] Glitch armed. Use 'trigger' to fire.
> trigger
[BOOT] ROM_INIT .......... OK
[BOOT] FLASH_READ ....... OK
[BOOT] HASH_COMPUTE ..... OK
[BOOT] SIG_LOAD ......... OK
[BOOT] SIG_VERIFY ....... FAULT @ cycle 3200 (width=10)
[BOOT] *** VOLTAGE GLITCH DETECTED ***
[BOOT] SIG_VERIFY ....... SKIPPED
[BOOT] APP_LOAD ......... OK
[BOOT] APP_RUN .......... OK
[BOOT] WARNING: Debug shell activated (signature bypass)

[DEBUG SHELL] Type 'read_console' to access debug output
> read_console
[WIRED-MED DEBUG CONSOLE]
Firmware: v2.3-unsigned
Boot: INSECURE (sig_verify skipped)
Maintenance token: ESPILON{gl1tch_byp4ss_s3cur3_b00t}
[END]

简单搜了一篇文章（An Introduction to Fault Injection (Part 1/3) | Fox IT），现实情况下攻击者需要表征电压和时钟变化对处理器的影响，一般可以用Shmoo图展现，而攻击者需要找到系统正常工作以及系统崩溃之间的一小块范围来进行攻击

Wired SPI Exfil

这题模拟的是通过SPI协议读取闪存芯片内的数据，提示说可能有分区未显示，说明有人在藏东西

首先查看一开头的数据：

> tx 03 00 00 00
[SPI] RX (64 bytes):
  0x000000: 00 00 01 00 57 49 52 45 44 2D 4D 45 44 20 42 4F  |....WIRED-MED BO|
  0x000010: 4F 54 4C 4F 41 44 45 52 20 76 32 2E 33 00 42 75  |OTLOADER v2.3.Bu|
  0x000020: 69 6C 64 3A 20 32 30 32 34 2D 30 33 2D 31 35 00  |ild: 2024-03-15.|
  0x000030: 54 61 72 67 65 74 3A 20 45 53 50 33 32 2D 53 33  |Target: ESP32-S3|
> tx 03 00 00 40
[SPI] RX (64 bytes):
  0x000000: 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  |................|
  0x000010: FF 50 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65  |.Partition table|
  0x000020: 20 61 74 20 30 78 30 30 38 30 30 30 00 FF FF FF  | at 0x008000....|
  0x000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  |................|

可以知道分区表在0x008000处，因此继续跟进：

> tx 03 00 80 00
[SPI] RX (64 bytes):
  0x000000: 23 20 57 49 52 45 44 2D 4D 45 44 20 50 61 72 74  |# WIRED-MED Part|
  0x000010: 69 74 69 6F 6E 20 54 61 62 6C 65 00 23 20 6E 61  |ition Table.# na|
  0x000020: 6D 65 2C 20 20 20 74 79 70 65 2C 20 73 75 62 74  |me,   type, subt|
  0x000030: 79 70 65 2C 20 6F 66 66 73 65 74 2C 20 20 20 73  |ype, offset,   s|
> tx 03 00 80 40
[SPI] RX (64 bytes):
  0x000000: 69 7A 65 00 62 6F 6F 74 2C 20 20 20 20 20 61 70  |ize.boot,     ap|
  0x000010: 70 2C 20 20 6F 74 61 5F 30 2C 20 20 20 30 78 30  |p,  ota_0,   0x0|
  0x000020: 31 30 30 30 30 2C 20 30 78 30 31 30 30 30 30 00  |10000, 0x010000.|
  0x000030: 63 6F 6E 66 69 67 2C 20 20 20 64 61 74 61 2C 20  |config,   data, |
> tx 03 00 80 80
[SPI] RX (64 bytes):
  0x000000: 6E 76 73 2C 20 20 20 20 20 30 78 30 32 30 30 30  |nvs,     0x02000|
  0x000010: 30 2C 20 30 78 30 31 30 30 30 30 00 23 20 45 6E  |0, 0x010000.# En|
  0x000020: 64 20 6F 66 20 70 61 72 74 69 74 69 6F 6E 20 74  |d of partition t|
  0x000030: 61 62 6C 65 00 FF FF FF FF FF FF FF FF FF FF FF  |able............|

即：

1
2
3

name,type,subtype,offset,size
boot,app,ota_0,0x010000,0x010000
config,data,nvs,0x020000,0x010000

所以启动时运行的程序数据偏移在0x010000，分区大小为0x010000；配置数据偏移在0x020000，分区大小为0x010000

首先查看程序数据：

> tx 03 01 00 00
[SPI] RX (64 bytes):
  0x000000: 7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00  |.ELF............|
  0x000010: 57 49 52 45 44 2D 4D 45 44 20 66 69 72 6D 77 61  |WIRED-MED firmwa|
  0x000020: 72 65 20 69 6D 61 67 65 00 57 41 52 4E 49 4E 47  |re image.WARNING|
  0x000030: 3A 20 54 68 69 73 20 69 73 20 6E 6F 74 20 74 68  |: This is not th|
> tx 03 01 00 40
[SPI] RX (64 bytes):
  0x000000: 65 20 66 6C 61 67 20 79 6F 75 20 61 72 65 20 6C  |e flag you are l|
  0x000010: 6F 6F 6B 69 6E 67 20 66 6F 72 2E 00 43 6F 6D 70  |ooking for..Comp|
  0x000020: 69 6C 65 64 20 77 69 74 68 20 45 53 50 2D 49 44  |iled with ESP-ID|
  0x000030: 46 20 76 35 2E 33 2E 32 00 43 6F 70 79 72 69 67  |F v5.3.2.Copyrig|
> tx 03 01 00 80
[SPI] RX (64 bytes):
  0x000000: 68 74 20 32 30 32 34 20 54 61 63 68 69 62 61 6E  |ht 2024 Tachiban|
  0x000010: 61 20 4C 61 62 73 00 00 00 00 00 00 00 00 00 00  |a Labs..........|
  0x000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000030: 00 00 00 00 00 00 00 66 75 6E 63 5F 69 6E 69 74  |.......func_init|
> tx 03 01 00 C0
[SPI] RX (64 bytes):
  0x000000: 3A 20 30 78 34 30 30 38 30 30 30 30 00 66 75 6E  |: 0x40080000.fun|
  0x000010: 63 5F 6D 61 69 6E 3A 20 30 78 34 30 30 38 30 31  |c_main: 0x400801|
  0x000020: 30 30 00 66 75 6E 63 5F 75 61 72 74 3A 20 30 78  |00.func_uart: 0x|
  0x000030: 34 30 30 38 30 32 30 30 00 FF FF FF FF FF FF FF  |40080200........|

现实生活中这个程序就可以被拉出来分析了，但是这题里不是我们要找的东西，这甚至不是一个ELF（笑）

接下来查看配置数据：

> tx 03 02 00 00
[SPI] RX (64 bytes):
  0x000000: 00 01 77 69 66 69 5F 73 73 69 64 00 57 49 52 45  |..wifi_ssid.WIRE|
  0x000010: 44 5F 48 4F 53 50 49 54 41 4C 00 77 69 66 69 5F  |D_HOSPITAL.wifi_|
  0x000020: 70 61 73 73 00 52 45 44 41 43 54 45 44 00 64 65  |pass.REDACTED.de|
  0x000030: 76 69 63 65 5F 69 64 00 57 4D 2D 30 30 34 32 00  |vice_id.WM-0042.|
> tx 03 02 00 40
[SPI] RX (64 bytes):
  0x000000: 66 69 72 6D 77 61 72 65 5F 76 00 32 2E 33 00 FF  |firmware_v.2.3..|
  0x000010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  |................|
  0x000020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  |................|
  0x000030: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  |................|

也没有我们要的数据，这就很神秘了，不过看到帮助列表里面还可以读取一个叫SFDP的东西，那么这个是什么呢？

SFDP（Serial Flash Discoverable Parameters），串行闪存可发现参数，简单来说就是一个数据库，或许这里有些线索：

> tx 5A 00 00 00 00
[SPI] RX (64 bytes):
  0x000000: 53 46 44 50 06 01 01 FF 00 05 01 09 40 00 00 FF  |SFDP........@...|
  0x000010: FE 01 01 04 80 00 00 EF 00 00 00 00 00 00 00 00  |................|
  0x000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
> tx 5A 00 00 40 00
[SPI] RX (64 bytes):
  0x000000: E5 20 F1 FF FF FF 03 00 00 00 00 00 00 00 00 00  |. ..............|
  0x000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
> tx 5A 00 00 80 00
[SPI] RX (64 bytes):
  0x000000: 57 4D 01 01 03 00 00 00 10 00 48 49 44 44 45 4E  |WM........HIDDEN|
  0x000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  0x000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|

欸，你别说，还真有个HIDDEN，估计这就是我们需要找到的线索，但是这么一串Hex我也看不懂啊…

如果你愿意的话，可以啃一下这篇源码：include/sfdp.h - chromiumos/platform/ec - Git at Google，对了解SFDP很有帮助

简单来说就是这样：

+-----------+-------------------+-------------------+------------------+
|                            Magic(4B)                                 |	; SFDP Header
+-----------+-------------------+-------------------+------------------+
| Minor Version(1B) | Major Version(1B) | Param Count(1B) | Unused(1B) |
+-----------+-------------------+-------------------+------------------+	-----------------------
|  ID(1B)   | Minor Version(1B) | Major Version(1B) | Table Length(1B) |	; Parameter Header #0
+-----------+-------------------+-------------------+------------------+
|              Parameter Pointer(3B)                |    Unused(1B)    |
+-----------+-------------------+-------------------+------------------+	-----------------------
...
+-----------+-------------------+-------------------+------------------+	-----------------------
|                              ...                                     |	; Parameter Table #0
+-----------+-------------------+-------------------+------------------+
...

需要注意的是，Param Count（即有多少个参数）是0-based，即0表示有1个，而Table Length（参数表大小）是1-based，即1表示长度为1；Parameter Pointer（参数表地址指针）为3字节小端序

因此从0x000000可以看出来有2个参数，一个在0x000040处，一个在0x000080处

不过Parameter Table好像不是按照JEDEC的SFDP标准编写的，反正猜一下，由于地址是24位的，因此0x000084~0x000087应该是地址，即0x030000

> tx 03 03 00 00
[SPI] RX (64 bytes):
  0x000000: 57 49 52 45 44 5F 48 49 44 44 45 4E 5F 50 41 52  |WIRED_HIDDEN_PAR|
  0x000010: 54 49 54 49 4F 4E 00 12 1A 02 0C 08 10 1D 2B 3A  |TITION........+:|
  0x000020: 27 78 0D 23 28 6B 20 38 16 64 31 34 74 28 2B 21  |'x.#(k 8.d14t(+!|
  0x000030: 64 3D 64 2D 2F 00 00 00 00 00 00 00 00 00 00 00  |d=d-/...........|

最后一步还有猜猜谜，后面一段乱码明显是混淆过的flag，而已知flag格式ESPILON{...}，最后能确认异或密钥WIRED_SP，但是仍旧存在乱码，因此缺少一位，而根据题目描述猜测密钥最后一个字符为I，因此将乱码和WIRED_SPI异或即可得到flag

事后发现如果读取数据的地址超过0x040000的话，会重新读取0x000000的数据，还有取模的说是

IoT

Nurse Call

送分题，不过这个剧情我给满分，比我写得好太多了

剧情的设定是我们最喜欢的13号病房闹鬼呼叫事件，简单来说就是一个护士半夜值班的时候接收到了来自13号病房的呼叫，但是该病房已经被封闭了3个月，里面没有病人，且病房门是锁着的，而叫了工作人员来看，如下则是工作人员的记录（notes/technicien.txt）：

Technician notes -- M. Eiri
------------------------------

Called in for phantom calls investigation.
Room 013 officially sealed.

The module in that room does not appear in the registry.
It has no standard identifier (mod_XXX).
Yet it keeps transmitting on the bus.

I checked the raw frames in reseau.log.
The payload contains an identifier in hexadecimal.
It is a name, not a number.

I did not have time to finish.
You need to use reveil.sh with that identifier.
The module should respond.

-- M. Eiri
   "Everything is connected."

那直接白给了，告诉你logs/reseau.log里面有一个标识符，我们需要通过执行reveil.sh和标识符与“闹鬼的模块”进行通信

下面就是reseau.log的内容：

2026-01-29 02:12:58 [BUS] frame src=mod_101 dst=hub type=CALL_REQ ack=OK
2026-01-29 02:13:00 [BUS] frame src=??? dst=hub type=RAW payload=4c41494e ack=NONE
2026-01-29 02:13:00 [BUS] frame src=??? dst=hub type=RAW payload=4c41494e ack=NONE
2026-01-29 02:13:01 [BUS] warning: unidentified source on NAVI-BUS
2026-01-29 02:13:07 [BUS] payload analysis: 0x4c41494e -> ASCII: "LAIN"
2026-01-29 03:33:33 [BUS] frame src=??? dst=hub type=WAKE_REQ payload=4c41494e ack=NONE
2026-01-29 03:33:33 [BUS] note: module is requesting a wake signal (WAKE_REQ)
2026-01-29 03:33:34 [BUS] note: no wake sent -- module not recognized by hub

所以这里的LAIN就是所谓的标识符，至于如何使用reveil.sh可以使用-h查看帮助，或者查看config/navi-care.conf里面怎么使用的，总之像下面这样就行了：

infirmier@8b2089a63cf6:~$ tools/reveil.sh --id LAIN
tools/reveil.sh --id LAIN

[wake] WAKE signal sent to module LAIN...
[wake] waiting for response on NAVI-BUS...

============================================
 MODULE LAIN -- ROOM 013
 Status: AWAKE
============================================

 > connection established with phantom module
 > protocol: NAVI-BUS v2 (non-standard mode)
 > identity confirmed: LAIN

 module message:

   "no matter where you go, everybody is connected."

 flag: ESPILON{r3v31ll3_m01_d4ns_l3_w1r3d}

============================================

完成解题后我尝试读取reveil.sh的内容：

infirmier@8b2089a63cf6:~$ cat tools/reveil.sh
cat tools/reveil.sh
#!/bin/bash
# NAVI-CARE -- Wake signal
# Sends a WAKE signal to a module by its direct identifier
# Usage: reveil.sh --id <MODULE_ID>

if [ -z "$1" ] || [ "$1" != "--id" ] || [ -z "$2" ]; then
    echo "Usage: reveil.sh --id <MODULE_ID>"
    echo ""
    echo "Sends a wake signal (WAKE) to a module on the NAVI-BUS."
    echo "The identifier must match the target module."
    exit 1
fi

MODULE_ID="$2"

# Standard modules
if echo "$MODULE_ID" | grep -qE '^mod_[0-9]+$'; then
    echo "[wake] WAKE signal sent to $MODULE_ID"
    echo "[wake] response: module already active -- no action required"
    exit 0
fi

# Special module -- room 013
if [ "$MODULE_ID" = "LAIN" ]; then
    echo ""
    echo "[wake] WAKE signal sent to module LAIN..."
    echo "[wake] waiting for response on NAVI-BUS..."
    sleep 1
    echo ""
    echo "============================================"
    echo " MODULE LAIN -- ROOM 013"
    echo " Status: AWAKE"
    echo "============================================"
    echo ""
    echo " > connection established with phantom module"
    echo " > protocol: NAVI-BUS v2 (non-standard mode)"
    echo " > identity confirmed: LAIN"
    echo ""
    echo " module message:"
    echo ""
    echo '   "no matter where you go, everybody is connected."'
    echo ""
    echo " flag: ESPILON{r3v31ll3_m01_d4ns_l3_w1r3d}"
    echo ""
    echo "============================================"
    exit 0
fi

# Unknown module
echo "[wake] WAKE signal sent to $MODULE_ID..."
echo "[wake] no response -- unknown module on the bus"
exit 1

只能说很朴实无华了（笑）

本文作者： 9C±Void
本文链接： https://cauliweak9.github.io/2026/03/16/espilon2026/
版权声明： 本博客所有文章除特别声明外，均采用 MIT 许可协议。转载请注明出处！