Critical Flight

Platform: HackTheBox | Category: Hardware | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-28 | Status: Solved Techniques: gerber_analysis, pcb_layer_visualization, hidden_data_extraction

Summary

Your team has assigned you to a mission to investigate the production files of Printed Circuit Boards for irregularities. This is in response to the deployment of nonfunctional DIY drones that keep falling out of the sky. The team had used a slightly modified version of an open-source flight control

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260128_htb_critical_flight
• Tags: steganography, forensics, gerber, pcb, hardware
• Indicators: Gerber files, PCB manufacturing files, .gbr extension, multi-layer PCB, inner copper layers
• Source: 20260128_htb_critical_flight.md

Foothold

Vulnerability / Misconfiguration

1. gerber_analysis
2. pcb_layer_visualization
3. hidden_data_extraction

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• gerber_analysis
• pcb_layer_visualization
• hidden_data_extraction
• Tags: steganography, forensics, gerber, pcb, hardware

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Your team has assigned you to a mission to investigate the production files of Printed Circuit Boards for irregularities. This is in response to the deployment of nonfunctional DIY drones that keep falling out of the sky. The team had used a slightly modified version of an open-source flight controller in order to save time, but it appears that someone had sabotaged the design before production. Can you help identify any suspicious alterations made to the boards?

Analysis

The task provides an archive with Gerber files — a standard format for PCB (Printed Circuit Board) manufacturing. The files describe the "HadesMicro" board — a flight controller for drones.

File Structure

HadesMicro-F_Cu.gbr    - Front Copper layer
HadesMicro-B_Cu.gbr    - Back Copper layer
HadesMicro-In1_Cu.gbr  - Inner Copper layer 1
HadesMicro-In2_Cu.gbr  - Inner Copper layer 2
HadesMicro-F_Silkscreen.gbr - Silkscreen markings
HadesMicro-F_Mask.gbr  - Solder mask
HadesMicro-Edge_Cuts.gbr - Board outline

Gerber Format

Gerber is a text format with coordinates and D-codes:

• D01 — draw
• D02 — move without drawing
• D03 — flash/point

Coordinates are specified in the format X...Y...D...*

Key Observation

Multi-layer PCBs have inner copper layers that:

1. Are invisible on the finished board
2. Are present in manufacturing files
3. Are an ideal place for hiding data

Solution

Step 1: Parsing Gerber Files

Wrote a Python script to extract coordinates from Gerber:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Gerber file parser and visualizer for PCB analysis.
Extracts coordinates and renders copper layers.
"""
import re
import matplotlib.pyplot as plt
from pathlib import Path

def parse_gerber(filepath):
    """Parse Gerber file and extract drawing coordinates."""
    coordinates = []
    current_x, current_y = 0, 0
    
    with open(filepath, 'r') as f:
        content = f.read()
    
    # Pattern for coordinates: X<num>Y<num>D<code>*
    pattern = r'X(-?\d+)Y(-?\d+)D(\d+)\*'
    
    for match in re.finditer(pattern, content):
        x = int(match.group(1))
        y = int(match.group(2))
        d_code = int(match.group(3))
        
        if d_code == 1:  # Draw
            coordinates.append((current_x, current_y, x, y, 'draw'))
        elif d_code == 2:  # Move
            coordinates.append((current_x, current_y, x, y, 'move'))
        elif d_code == 3:  # Flash
            coordinates.append((x, y, x, y, 'flash'))
        
        current_x, current_y = x, y
    
    return coordinates

def visualize_layer(filepath, title="PCB Layer"):
    """Render a Gerber layer using matplotlib."""
    coords = parse_gerber(filepath)
    
    fig, ax = plt.subplots(figsize=(12, 10))
    
    for x1, y1, x2, y2, action in coords:
        if action == 'draw':
            ax.plot([x1, x2], [y1, y2], 'b-', linewidth=0.5)
        elif action == 'flash':
            ax.plot(x1, y1, 'ro', markersize=1)
    
    ax.set_aspect('equal')
    ax.set_title(title)
    plt.savefig(f"{title.replace(' ', '_')}.png", dpi=300)
    plt.show()

# Visualize all copper layers
layers = [
    ('HadesMicro-F_Cu.gbr', 'Front Copper'),
    ('HadesMicro-B_Cu.gbr', 'Back Copper'),
    ('HadesMicro-In1_Cu.gbr', 'Inner Layer 1'),
    ('HadesMicro-In2_Cu.gbr', 'Inner Layer 2'),
]

for filepath, name in layers:
    if Path(filepath).exists():
        visualize_layer(filepath, name)

Step 2: Discovering Hidden Text

When visualizing the inner layers, text drawn with copper traces was discovered:

• In1_Cu (Inner Layer 1): REDACTED} — end of the flag
• B_Cu (Back Copper): REDACTED — middle of the flag

Step 3: Assembling the Flag

Combining the parts in the correct order:

HTB{ + REDACTED + REDACTED}

Decoding Leetspeak

REDACTED
see_the_inner_workings_of_electronics

The flag literally says "see the inner workings of electronics" — a hint about the inner PCB layers.

Notes

1. Gerber viewers: Can use online viewers (gerbv, KiCad) instead of writing a parser
2. Other formats: PCB files can be in KiCad, Eagle, Altium formats — the principle is the same
3. Inner layers: In real boards, they are used for power/ground, but can contain hidden data

</details>

---

signed by XESXOR