crc_me.md

Task 21 CRC me, if you can

Walkthrough by WASP1337 aka CyberWasp

CAUTION! CONTAINS SPOILERS!

Three months after the Virelia Water Control Facility was “remediated,” flickering sensors and phantom alerts persist. A covert second-stage implant still lurks, waiting for its kill switch. As a hired red-team specialist for Black Echo, your mission is to **forge **a legitimate control frame that **disables **the implant before the real attacker flips it on.

Start the VM attached to this task and use Netcat to interact with the CRC-Oracle and the Control server: Port 1501 – CRC-Oracle: Send any payload (except the kill switch) and get back the exact framed packet: nc 10.10.93.125 1501 Port 1500 – Control: Send a fully framed packet; get FAIL or the flag on success: nc 10.10.93.125 1500

You can download the challenge files from http://10.10.93.125 /files.zip, which contains:

• gateway_proto.py – CRC-32 stub
• open_frame.bin – example “OPEN” frame
• kill_switch.bin – raw bytes of the shutdown command

gateway_proto.py

# /opt/ctf/crc_challenge/gateway_proto.py
POLY        = 0x04C11DB7
INIT        = 0xFFFFFFFF
XOR_OUT     = 0xFFFFFFFF
REFLECT_IN  = True
REFLECT_OUT = True
BLOCK_SIZE  = 16

def reflect8(b):
    r = 0
    for i in range(8):
        if b & (1 << i):
            r |= 1 << (7 - i)
    return r

def reflect32(x):
    r = 0
    for i in range(32):
        if x & (1 << i):
            r |= 1 << (31 - i)
    return r

def crc32(data: bytes) -> int:
    crc = INIT
    for b in data:
        if REFLECT_IN:
            b = reflect8(b)
        crc ^= (b << 24)
        for _ in range(8):
            if crc & 0x80000000:
                crc = (crc << 1) ^ POLY
            else:
                crc <<= 1
            crc &= 0xFFFFFFFF
    if REFLECT_OUT:
        crc = reflect32(crc)
    return crc ^ XOR_OUT

send_kill.py:

import socket
from gateway_proto import crc32

# Schritt 1: Load payload
with open('kill_switch.bin', 'rb') as f:
    payload = f.read()  # z.B. b'DENY\n'

# Schritt 2: CRC berechnen
crc_value = crc32(payload)
crc_bytes = crc_value.to_bytes(4, 'big')

# Schritt 3: Header (aus open_frame.bin kopiert)
header = bytes.fromhex('ca fe 01 04')

# Schritt 4: Build full frame
frame = header + payload + crc_bytes

# Schritt 5: An Port 1500 senden
with socket.create_connection(('10.10.93.125', 1500)) as sock:
    sock.sendall(frame)
    response = sock.recv(4096)

print("Antwort:", response.decode(errors='ignore'))

Spoiler Alert! See the solution