Project Power Challenge Scenario

Platform: HackTheBox | Category: Hardware | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-21 | Status: Solved Techniques: correlation_power_analysis, first_round_aes_key_recovery, hamming_weight_model

Summary

Task: recover an AES-128 key from a remote embedded device that exposes chosen-plaintext power traces over a socket. Solution: apply first-round AES CPA with a Hamming-weight leakage model, recover the key from 800 traces, then submit it to receive the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260521_hackthebox_project_power
• Tags: side_channel, aes, cpa, power_analysis, embedded, oscilloscope, socket_oracle
• Indicators: service returns one power trace per chosen 16-byte plaintext, second menu option accepts a 32-hex-char AES-128 key, layout shows an oscilloscope observing an embedded AES device, trace corpus is clean float64 waveform data
• Source: 20260521_hackthebox_project_power.md

Foothold

Vulnerability / Misconfiguration

1. correlation_power_analysis
2. first_round_aes_key_recovery
3. hamming_weight_model

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• correlation_power_analysis
• first_round_aes_key_recovery
• hamming_weight_model
• Tags: side_channel, aes, cpa, power_analysis, embedded, oscilloscope, socket_oracle

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Project Power Challenge Scenario

The provided artifacts were a Python socket client and a lab layout image. The goal was to recover the embedded device's AES-128 key and use it against the live instance at 154.57.164.74:31688.

Analysis

At first glance this looked like a remote exploitation challenge, but the supplied interface was not a memory-corruption target. socket_interface.py exposed a much more direct side channel:

• option 1: send a 16-byte plaintext and receive a base64-encoded NumPy power trace
• option 2: send a 32-hex-char AES-128 key and receive the flag if the key is correct

remote_lab_layout.png clarified the architecture: plaintext is sent to the embedded device, an oscilloscope captures the AES power consumption, and Laptop-2 forwards the trace back over the socket. That makes this a standard AES side-channel problem, not a pwn or reverse challenge.

The useful prior-art match was CTFBase writeup 20260123_0xl4ugh_sca1, which used classic Correlation Power Analysis (CPA) against AES. The right first-round leakage model here was:

HW(SBOX[plaintext[i] XOR key[i]])

CPA works because the real power trace contains samples that correlate with the number of switching bits in this intermediate AES state. For each key-byte guess 0..255, we compute the hypothetical Hamming weights across many chosen plaintexts and measure which guess correlates best with the observed traces. The correct key byte stands out with the highest correlation.

Live collection confirmed that traces decoded as float64 arrays of length 1042, and 800 traces were already enough for a clean recovery. Alternate leakage models and dtype overrides were unnecessary.

Solution

1. Read socket_interface.py and identify the two menu options: trace oracle and key submission.
2. Use the layout image to confirm the side-channel path: embedded AES device -> oscilloscope -> socket-delivered NumPy traces.
3. Implement first-round AES CPA in project_power_solver.py using the Hamming-weight model of SBOX[PT ^ K] for each byte position.
4. Collect 800 live traces and plaintexts from the target.
5. Correlate all 256 guesses for each of the 16 key bytes against the trace matrix.
6. Reconstruct the AES-128 key and submit it with socket option 2.

Minimal run command:

 bash read-only • copy allowed Copy
python3 project_power_solver.py \
  --host 154.57.164.74 \
  --port 31688 \
  --count 800 \
  --save /Users/sergeyskorobogatov/Projects/Agents/CTF/tasks/hackthebox/project-power/live_traces_800.npz \
  --submit

This recovered:

• AES-128 key: 35425203F4BF23C7F93444BF772F2E1F
• Flag: HTB{REDACTED}

Non-needed paths:

• pwn/reverse-style service exploitation was unnecessary
• alternate leakage models were unnecessary
• dtype override experimentation was unnecessary once float64 decoding was confirmed

</details>

---

signed by XESXOR