Prison Escape

Technical Walkthrough

Prison Escape Writeup

Summary

The challenge provides an Omega RF protocol document, a prison blueprint, and a live RF transmitter web UI. The solve path was to decode the downloaded .complex IQ captures, reconstruct the packet format, generate valid CRC-protected command packets, and transmit the correct alarm/laser sequence.

Raw flag material is stored only in loot/flag.txt.

Artifact Inventory

• files/a12c73aa-a2bd-4a12-95ba-246a5f41af9c.zip: original challenge archive.
• analysis/extracted/Omega.pdf: Omega protocol document.
• analysis/extracted/blueprint.png: prison layout and device placement.
• analysis/remote/capture.bin: RF capture downloaded from /capture.
• solve/prison_escape.py: reproducible decoder and transmitter.

Analysis

• The web service exposes /transmit, /updates, and /capture.
• /capture returns complex64 IQ samples.
• The signal contains a 10,400-sample burst: 104 bits at 100 samples per bit.
• The burst uses two-frequency FSK.
• CRC is CRC-16/CCITT-style with init 0x1d0f, calculated over the packet header and payload.

Packet Format

Alarm packet:

AAAAAAAA 69781621 [source] [destination] [type] [crc16]

Laser packet:

BBBBBBBB 69781622 [source] [destination] [type] [crc16]

Examples decoded from captures:

A4 FF 03  # alarm A4 broadcasts
E3 FF 53  # laser E3 broadcasts move-right state

The official forum hint about source/destination fields and FF as broadcast matched the decoded captures. It was used only as an advisory lead and validated locally.

Solve

Use source 00, destination device IDs, and the documented packet type bytes.

00 A1 F1
00 A2 F1
00 A3 F1
00 A4 F1
00 E1 91
00 E2 91
00 E3 53

The solver auto-selects the alarm or laser header and appends the CRC.

Reproduce

cd <local workspace>
python3 Hardware/Prison-Escape/solve/prison_escape.py sequence --mod FSK --bits 1 --header auto --payloads 00A1F1 00A2F1 00A3F1 00A4F1 00E191 00E291 00E353
python3 scripts/challenge_harness.py capture-flag Hardware/Prison-Escape --from loot/flag-candidate.txt

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Decode multiple captures; each one can represent a separate device packet.
• Treat public or forum hints as advisory only and validate them against live captures.
• Packet families can use different headers even when they share the same CRC routine.

Challenge

• Name: Prison-Escape
• Category: Hardware
• Difficulty: Medium
• Mode: hybrid

Summary

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

Analysis

Solve

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Prison-Escape
• Category: Hardware
• Difficulty: Medium
• Mode: hybrid
• Remote instance: none
• Start time: 2026-06-13T13:58:26Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Remote service is an HTTP RF transmitter at <TARGET>:31332.
• /updates requires a valid session from /; /capture provides a .complex IQ capture.
• The capture is complex64 IQ with 100 samples per bit and two-frequency FSK symbols.
• Decoded alarm packet example: <secret redacted>.

- Alarm header: <secret redacted>.

- Payload: A4 FF 03 = source A4, destination FF, broadcast packet type.

- CRC-16/CCITT with init 0x1d0f validates over header + payload.

• Decoded laser packet example: <secret redacted>.

- Laser header: <secret redacted>.

- Payload: E3 FF 53 = source E3, destination FF, move-right packet type.

• Targeted commands must use source 00, destination device ID, and packet type.
• Final successful sequence:

- alarm suppress: 00A1F1, 00A2F1, 00A3F1, 00A4F1

- laser movement: 00E191, 00E291, 00E353

• Repro command:

cd <local workspace>
python3 Hardware/Prison-Escape/solve/prison_escape.py sequence --mod FSK --bits 1 --header auto --payloads 00A1F1 00A2F1 00A3F1 00A4F1 00E191 00E291 00E353

• Raw flag is stored only in loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Hardware
• Challenge: Prison-Escape
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches