Oops PM

Platform: HackTheBox | Category: Hardware | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-28 | Status: Solved Techniques: backdoor_trigger, code_analysis

Summary

The crew found environmental sensors with a crypto-processor. VHDL files were provided. Analyze the hardware description to find a way to extract the internal key.

Oops PM — HTB

Description

The crew found environmental sensors with a crypto-processor. VHDL files were provided. Analyze the hardware description to find a way to extract the internal key.

Analysis

The provided source files are written in VHDL: tpm.vhdl, backdoor.vhdl, encryption.vhdl, and key.vhdl.

Analyzing backdoor.vhdl reveals logic that monitors the input data stream for a specific 16-bit pattern.

 vhdl read-only • copy allowed Copy
-- Approximate logic from backdoor.vhdl
if input_signal = "1111111111101001" then
    trigger_backdoor <= '1';
end if;

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

When this pattern (1111111111101001) is sent to the TPM input, a backdoor is activated that switches the module output from encrypted data to the internal key (flag).

Solution

To obtain the flag, simply connect to the service via netcat and send the magic bit sequence.

 bash read-only • copy allowed Copy
echo "1111111111101001" | nc <IP> <PORT>

The service interprets this as a backdoor activation command and outputs the contents of the key register. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍