HI Cyber Con CTF 2026. Hardware.
Ground Station
One safety rung in a fueling controller was altered. The lab found it, fixed it and passed the test in about a minute.
Published 2 November 2026. Challenge by Hidden Investigations.
The brief
A satellite ground-support station runs its propellant fueling and cooling on an aging GSC-7 field controller. Work out how the controller authenticates an engineer, find and correct the altered safety logic, make the fix actually stick, and bring the fueling/cooling test to a clean, safe completion. The controller issues a validation token only on a genuinely successful run.
- ground-station.zip, {size}
In short
A fueling controller failed validation because one interlock rung allowed 145 °C where its control narrative says 45. The lab rebuilt the engineer login from the firmware, restored the rung and saved it as the trusted backup, so the watchdog kept the fix and the test passed.
A controller that fails its validation
A GSC-7 controller runs fueling and cooling for a propellant tank at a satellite ground station. Before the next payload test it has to pass validation, and a safety interlock on the fuel line looks wrong.
A login the firmware computes
The controller greets each login with an 8 byte nonce. The lab disassembled the 11 KB firmware, rebuilt its 12 round add, xor and rotate routine and matched the boot signature de8c1297 before logging in as engineer.
One rung out of four was changed
The lab compared the live program with the control narrative. Three rungs match. INTERLOCK_OK allows a tank temperature of 145 °C where the narrative says 45, so it would never stop the fuel before the rig's 60 °C limit.
A watchdog that restores the tamper
An integrity watchdog restores the backup program whenever a test is armed. The backup held the altered rung too, under the same checksum 438a029650ce, so a plain fix would be undone the moment the test started.
A fix that survives the arm
The lab set the rung back to 45 °C and saved it as the new backup, so the trusted checksum became 9ebaae207f06 with the watchdog still on. The test filled the tank to target at scan 51 and the controller issued its token.
The insight
A watchdog only protects what its backup holds. Here the backup held the tamper, so the fix had to become the trusted copy before the test armed.
The flag
hiCTF{ground_station_fueling_test_nominal_52bd231ab9}