It's Oops PM

Platform: HackTheBox | Category: Hardware | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-02-16 | Status: Solved Techniques: backdoor_trigger, code_analysis

Summary

Task: Analyze VHDL source code for a TPM chip to find a backdoor. Solution: Identified a pattern comparator that bypasses encryption when input matches 0xFFE9, revealing the hardcoded secret key.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260216_hackthebox_its_oops_pm
• Tags: backdoor, vhdl, tpm
• Indicators: backdoor component, pattern match
• Source: 20260216_hackthebox_its_oops_pm.md

Foothold

Vulnerability / Misconfiguration

1. backdoor_trigger
2. code_analysis

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• backdoor_trigger
• code_analysis
• Tags: backdoor, vhdl, tpm

Original Writeup

<details><summary>Click to expand original content</summary>

Description

This challenge presents VHDL source code for a Trusted Platform Module (TPM) chip. The goal is to analyze the hardware description, find the backdoor, and understand how to extract the secret key.

Analysis

tpm.vhdl

This is the main entity that combines the following components:

• ckey: Component that provides the secret key.
• encryption: Data encryption module.
• backdoor: Module that checks input data for a backdoor trigger.

The tpm.vhdl architecture implements a process that controls the Output signal:

 vhdl read-only • copy allowed Copy
process(Key, Encrypted, B)
begin
    case B is
        when '1' =>
            for i in 0 to 15 loop
                Output(i) <= Key(i);
            end loop;
        when others =>
            for i in 0 to 15 loop
                Output(i) <= Encrypted(i);
            end loop;
    end case;
end process;

If signal B (output of the backdoor module) equals '1', the device outputs the raw secret key Key. Otherwise, it outputs encrypted data.

backdoor.vhdl

This module is responsible for activating signal B. It defines a constant pattern:

 vhdl read-only • copy allowed Copy
constant pattern : STD_LOGIC_VECTOR(15 downto 0) := "1111111111101001";

The activation logic is simple:

 vhdl read-only • copy allowed Copy
if D = pattern then
    B <= '1';
else
    B <= '0';
end if;

The backdoor triggers when input data D exactly matches the pattern 1111111111101001 (in hexadecimal: 0xFFE9).

key.vhdl

This file contains the hardcoded secret key that the TPM is supposed to protect:

 vhdl read-only • copy allowed Copy
constant key : STD_LOGIC_VECTOR(15 downto 0) := "0110001111100001";

Key value in HEX: 0x63E1.

encryption.vhdl

The encryption module performs XOR between input data and the key, but contains intentional errors:

• Bits 0, 6, and 13 are forcibly set to NOT K(i), ignoring input data D. This makes encryption irreversible for some bits, but doesn't interfere with the backdoor operation.

Backdoor Trigger Logic

The trigger is implemented as a comparator of the input data bus with a predefined 16-bit value. When matched, the control signal switches the multiplexer, routing the internal key register directly to the device's output port, bypassing the encryption block.

Solution

1. Structure analysis: Examine tpm.vhdl and notice the suspicious backdoor component whose output controls the multiplexer at the device output.
2. Pattern search: Navigate to backdoor.vhdl and find the trigger value: 1111111111101001.
3. Secret extraction: Understand that when this value is sent to the input, the device will reveal its key.
4. Key retrieval: In key.vhdl, find the key itself: 0110001111100001.

In the CTF context, after discovering this logic, you need to send the magic number to the emulated device or server to obtain the flag.

</details>

---

signed by XESXOR