Ether Tag

Author: 0xIDA
Platform: HTB · Category: misc · Difficulty: Very Easy

Solvers

• solve_cpppo.py
• solve.py

Summary

An ICS/SCADA challenge where we connected to an EtherNet/IP controller and read the value of the "FLAG" tag to retrieve the flag.

Analysis

The server was listening on a non-standard port (30964) and spoke a simplified EtherNet/IP protocol. Initial probing revealed:

1. List Identity (command 0x63) worked — responded with device info identifying a Rockwell ControlLogix PLC (1756-L61/B LOGIX5561)
2. List Services (command 0x64) returned an empty service list
3. Register Session (command 0x65) failed — the server closed the connection
4. Raw SendRRData (command 0x6F) with null session returned "Invalid Session Handle" (status 0x0008)

Despite the session registration not working via raw commands, the cpppo library's high-level connector API handled the session management internally and successfully read the tag.

Exploitation

Used the cpppo Python library to connect and read the FLAG tag array:

from cpppo.server.enip import client

with client.connector(host="154.57.164.73", port=30964) as conn:
    chars = []
    for i in range(100):
        ops = client.parse_operations([f"FLAG[{i}]"])
        for _, _, _, _, sts, val in conn.synchronous(ops, timeout=10):
            if sts != 0 or not val or val[0] == 0:
                break
            chars.append(chr(val[0]))
    flag = ''.join(chars)
    print(flag)

The FLAG tag is an array of DINT elements, each holding the ASCII value of one character:

• FLAG[0] = 72 = 'H'
• FLAG[1] = 84 = 'T'
• FLAG[2] = 66 = 'B'
• FLAG[3] = 123 = '{'
• FLAG[4..20] = remaining flag characters
• Element 21 = 0 (null terminator)

Key Findings

• The EtherNet/IP protocol uses the Common Industrial Protocol (CIP) with a 24-byte encapsulation header
• Tag reading requires the Read Tag service (0x4C) or Read Tag Fragmented (0x52)
• Tags can be arrays — each element is accessed with TAG[index] syntax
• The cpppo library handles all the low-level ENIP/CIP protocol details

Tools Used

• cpppo — Python EtherNet/IP CIP library
• Custom Python script for array element iteration

Flag

HTB{3th3rn3t1p_pwn3d}

Lessons Learned

• EtherNet/IP challenges may use simplified implementations without full session management
• Tag data can be stored as arrays of DINTs with ASCII character codes
• The cpppo library is an excellent tool for CTF EtherNet/IP challenges
• When a protocol seems to reject raw commands, try a higher-level library that handles session state correctly