crc_me.md

TryHackMe Industrial Intrusion CTF:

Task 21 CRC me, if you can

Walkthrough by WASP1337 aka CyberWasp

Three months after the Virelia Water Control Facility was “remediated,” flickering sensors and phantom alerts persist. A covert second-stage implant still lurks, waiting for its kill switch. As a hired red-team specialist for Black Echo, your mission is to **forge **a legitimate control frame that **disables **the implant before the real attacker flips it on.

Start the VM attached to this task and use Netcat to interact with the CRC-Oracle and the Control server: Port 1501 – CRC-Oracle: Send any payload (except the kill switch) and get back the exact framed packet: nc 10.10.93.125 1501 Port 1500 – Control: Send a fully framed packet; get FAIL or the flag on success: nc 10.10.93.125 1500

You can download the challenge files, which contains:

• gateway_proto.py – CRC-32 stub
• open_frame.bin – example “OPEN” frame
• kill_switch.bin – raw bytes of the shutdown command

gateway_proto.py

# /opt/ctf/crc_challenge/gateway_proto.py
POLY        = 0x04C11DB7
INIT        = 0xFFFFFFFF
XOR_OUT     = 0xFFFFFFFF
REFLECT_IN  = True
REFLECT_OUT = True
BLOCK_SIZE  = 16

def reflect8(b):
    r = 0
    for i in range(8):
        if b & (1 << i):
            r |= 1 << (7 - i)
    return r

def reflect32(x):
    r = 0
    for i in range(32):
        if x & (1 << i):
            r |= 1 << (31 - i)
    return r

def crc32(data: bytes) -> int:
    crc = INIT
    for b in data:
        if REFLECT_IN:
            b = reflect8(b)
        crc ^= (b << 24)
        for _ in range(8):
            if crc & 0x80000000:
                crc = (crc << 1) ^ POLY
            else:
                crc <<= 1
            crc &= 0xFFFFFFFF
    if REFLECT_OUT:
        crc = reflect32(crc)
    return crc ^ XOR_OUT

send_kill.py:

import socket
from gateway_proto import crc32

# Schritt 1: Load payload
with open('kill_switch.bin', 'rb') as f:
    payload = f.read()  # z.B. b'DENY\n'

# Schritt 2: CRC berechnen
crc_value = crc32(payload)
crc_bytes = crc_value.to_bytes(4, 'big')

# Schritt 3: Header (aus open_frame.bin kopiert)
header = bytes.fromhex('ca fe 01 04')

# Schritt 4: Build full frame
frame = header + payload + crc_bytes

# Schritt 5: An Port 1500 senden
with socket.create_connection(('10.10.93.125', 1500)) as sock:
    sock.sendall(frame)
    response = sock.recv(4096)

print("Antwort:", response.decode(errors='ignore'))

--> python3 send_kill.py --> FLAG