Smart Brick v2

Platform: Umasscybersec | Category: Hardware | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-11 | Status: Solved Techniques: ascii_mapping, gate_level_simulation, kicad_netlist_reconstruction

Summary

Task: a KiCad PCB file described a logic board with seven inputs and nineteen LED outputs. Solution: reconstruct the gate-level netlist from the board text, simulate all 7-bit input values, and map each LED-driving net to one ASCII character to recover the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: umasscybersec | ID: 20260411_umasscybersec_smart_brick_v2
• Tags: ascii, kicad, ttl_logic, combinational_logic, netlist_parsing
• Indicators: .kicad_pcb board file, 7 inputs labeled IN0..IN6, many 74LS-series logic chips, LED outputs driven by 2N7002 MOSFETs
• Source: 20260411_umasscybersec_smart_brick_v2.md

Foothold

Vulnerability / Misconfiguration

1. ascii_mapping
2. gate_level_simulation
3. kicad_netlist_reconstruction

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• ascii_mapping
• gate_level_simulation
• kicad_netlist_reconstruction
• Tags: ascii, kicad, ttl_logic, combinational_logic, netlist_parsing

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Organizer description was not preserved in the local task files.

English summary: the challenge provided a KiCad PCB layout for a custom logic board. The goal was to understand what the circuit displayed and recover the hidden flag without manually tracing every wire in the CAD viewer.

Analysis

The strongest initial clue was the file format itself: smart-brick-v2.kicad_pcb. That matches the hint about a popular open-source EDA tool, so the right starting point was to inspect the board as KiCad data rather than treat it as a binary blob.

Reconnaissance immediately showed a few important structural facts:

• the board exposes seven inputs labeled IN0..IN6
• connector J1 breaks out those seven inputs plus GND
• connector J2 provides power with +5V and GND
• the logic core is built from classic TTL parts, especially many 74LS21 devices plus 74LS02, 74LS20, 74LS00, 74LS32, 74LS86, 74LS04, 74LS27, and 74LS08
• there are nineteen LEDs, each switched through a 2N7002 MOSFET

Seven independent input bits strongly suggest 7-bit ASCII. The many TTL gates and absence of storage elements also suggest pure combinational logic: for any input value, the board computes a fixed set of outputs.

At that point, the challenge becomes a netlist-recovery problem. Instead of manually following traces in the PCB viewer, it is faster and more reproducible to parse the KiCad board file as text, extract each footprint, collect pad-to-net assignments, and translate each chip package into logic operations.

The included solver does exactly that. It:

1. extracts footprint blocks from the .kicad_pcb text
2. reads footprint reference, value, coordinates, and connected nets
3. converts each TTL package into logical gate descriptions
4. models /IN0 through /IN6 as the seven bits of all 128 possible ASCII inputs
5. recursively evaluates each intermediate net as a bitmask over all input values
6. checks which final gate nets drive the nineteen MOSFET gates
7. converts each one-hot output into its corresponding ASCII character

This works because every final LED-driving net is true for exactly one input character. So each LED is effectively a hard-wired character recognizer.

The final step is to recover display order. Since each LED is driven by a 2N7002, sorting those transistor footprints by Y coordinate gives the top-to-bottom board order. Reading the nineteen decoded characters in that order yields the flag.

Solution

1. Identify the challenge file as a KiCad PCB layout.
2. Inspect the board structure and note the seven IN0..IN6 inputs and nineteen LED outputs.
3. Infer that seven inputs likely encode 7-bit ASCII.
4. Parse the board text to recover footprints, pads, and connected nets.
5. Map each TTL chip family to its corresponding Boolean operation.
6. Simulate the combinational network for all 128 possible 7-bit input values.
7. For each final LED-driving net, find the unique ASCII value that activates it.
8. Sort the LED driver transistors from top to bottom and read the resulting characters.

The recovered string is:

 text read-only • copy allowed Copy
UMASS{REDACTED}

A compact excerpt of the provided solver shows the overall approach:

 python read-only • copy allowed Copy
for i in range(7):
    mask = 0
    for x in range(128):
        if (x >> i) & 1:
            mask |= 1 << x
    cache[f"/IN{i}"] = mask

def ev(net: str) -> int:
    if net in cache:
        return cache[net]
    op, ins = ops[net]
    vals = [ev(n) for n in ins]
    ...

for net in final_gate_nets:
    hits = [x for x in range(128) if (ev(net) >> x) & 1]
    gate_to_char[net] = chr(hits[0])

flag = "".join(gate_to_char[gnet] for _y, _ref, gnet in sorted(led_rows))
print(flag)

The full solve_smart_brick_v2.py script prints the flag directly once the netlist model is built.

</details>

---

signed by XESXOR