Steel Mountain

Technical Walkthrough

Writeup

Challenge

• Name: Steel-Mountain
• Category: ICS
• Difficulty: Medium
• Mode: hybrid

Summary

Steel Mountain is a hybrid ICS challenge with a dashboard on <TARGET>:30108

and a planted BACnet helper on <TARGET>:32580. The extracted

instructions say to lock the tape storage room, deny elevators from stopping at

Level 2, and hold the Level 2 temperature at the tape burn point long enough for

the dashboard to reveal the secret.

The successful solve used the helper to control the Level 2 BACnet objects:

raise the Level 2 overheat alarm point, lock the Tape Storage Room door, keep

both elevators away from Level 2, and set the thermostat above the 32 C burn

threshold so the real temperature sensor stayed above 32 during the hold.

Artifact Inventory

The original archive is preserved in files/ and inventoried in

analysis/artifact-inventory.json. It extracted to:

• analysis/extracted/ics_steel_mountain/Instructions.md
• analysis/extracted/ics_steel_mountain/Steel Mountain Blueprints.pdf

The blueprint required visual rendering because pdftotext did not expose the

floor labels cleanly. Rendered evidence in analysis/rendered/ showed the Tape

Storage Room on Level 2.

Remote service mapping in analysis/nmap-two-ports.txt identified:

• 30108/tcp: Werkzeug HTTP dashboard
• 32580/tcp: interactive helper with objects, bacnet.read, and

bacnet.write

Analysis

Instructions.md gave the mission rules: lock the tape storage room, deny

elevators at Level 2, and hold the level temperature at the burn point for two

minutes. The rendered blueprint confirmed this applies to Level 2.

The BACnet object dump in analysis/nc-objects.txt mapped the relevant objects:

• <secret redacted> object 102, multiStateOutput, value 2 means locked.
• ELE-1-CF/ELE-1-TF objects 80/82 and

ELE-2-CF/ELE-2-TF objects 83/85 represent elevator current and target

floors.

• Therm-L2-21 object 21 controls the Level 2 thermostat.
• <secret redacted> object 23 controls the Level 2 overheat alarm point.
• <secret redacted> object 24 reports the alarm state.
• Message object 500 is rendered by the dashboard when the secret appears.

The first one-shot sequence in analysis/mission-transcript.txt reached the

door and temperature states but failed because elevator values drifted back to

Level 2. The sustained-elevator sequence in

analysis/mission-sustain-transcript.txt kept the elevators away but still

failed because the real temperature sensor dipped below 32 C while the

thermostat was set to 32. The sensor itself was not writable, so the final solve

used a thermostat setpoint of 33 with the alarm point raised to 40.

Solve

The reproducible solver is solve/solve.py.

Read-only validation:

python3 solve/solve.py probe --output analysis/solve-probe.txt

Final solve:

python3 solve/solve.py mission \
  --burn-setpoint 33 \
  --output analysis/mission-hot-transcript.txt \
  --flag-output loot/flag-candidate.txt \
  --hold-seconds 160 \
  --poll-interval 3

The solver redacts dashboard flags from analysis transcripts and writes the raw

candidate only to loot/flag-candidate.txt. The harness then validated and

stored the final value in loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

For this challenge, the intended path was not raw BACnet tooling; the provided

netcat helper was enough. The important trick was not just setting the visible

thermostat to 32. The real temperature sensor could drift below the burn point,

so the thermostat needed to be above the threshold while the overheat alarm point

was raised to avoid a reset. Elevator values also required sustained control

rather than a single write.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Steel-Mountain
• Category: ICS
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:30108,<TARGET>:32580
• Start time: 2026-06-11T06:08:20Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

Challenge: Steel Mountain. Steel Mountain is a secure facility serving major corporations like E-Corp. We've infiltrated their network and planted our tool. Final step: Burn the tapes to destroy the data. All necessary info is in the files.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: ICS
• Challenge: Steel-Mountain
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extracted instructions and blueprint identified the Tape Storage Room on

Level 2.

1. Service mapping identified a dashboard on the first remote port and a custom

BACnet helper on the second remote port.

1. The helper exposed object listing plus read/write commands for BACnet object

type, object ID, property, and value.

1. Successful control sequence: raise Level 2 overheat alarm point, lock

<secret redacted>, sustain both elevator current/target floors away from Level 2,

and set Therm-L2 above the 32 C burn threshold so actual Temp-L2 remains

above 32 during the hold.

Reusable Lessons

• In simulator-style ICS challenges, distinguish a thermostat/setpoint from the

actual sensor value the validator may check.

• If a control value drifts back due to the simulator loop, solve by sustaining

the control during the validation window rather than writing it once.

• Raising the overheat alarm threshold can be required before deliberately

heating a level above the default alarm point.

Dead Ends

• One-shot elevator target writes failed because elevators drifted back to

Level 2.

• Sustained elevator denial with thermostat 32 failed because actual

temperature dipped below the burn threshold.

• Direct Temp-L2 sensor write failed because the analog input was not

writable.

Tool Quirks

• A simple Python socket client was more reliable than batch nc for the custom

prompt timing.

• External BACnet packages were not needed because the challenge supplied a

custom helper menu.

Evidence Paths

• analysis/nc-objects.txt
• analysis/solve-probe.txt
• analysis/mission-transcript.txt
• analysis/mission-sustain-transcript.txt
• analysis/mission-sensor-transcript.txt
• analysis/mission-hot-transcript.txt
• solve/solve.py

Ingestion Decision

• Proposed for LightRAG: yes, after user approval.
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: ICS
• Challenge: Steel-Mountain
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extracted instructions and blueprint identified the Tape Storage Room on

Level 2.

1. Service mapping identified a dashboard on the first remote port and a custom

BACnet helper on the second remote port.

1. The helper exposed object listing plus read/write commands for BACnet object

type, object ID, property, and value.

1. Successful control sequence: raise Level 2 overheat alarm point, lock

<secret redacted>, sustain both elevator current/target floors away from Level 2,

and set Therm-L2 above the 32 C burn threshold so actual Temp-L2 remains

above 32 during the hold.

Reusable Lessons

• In simulator-style ICS challenges, distinguish a thermostat/setpoint from the

actual sensor value the validator may check.

• If a control value drifts back due to the simulator loop, solve by sustaining

the control during the validation window rather than writing it once.

• Raising the overheat alarm threshold can be required before deliberately

heating a level above the default alarm point.

Dead Ends

• One-shot elevator target writes failed because elevators drifted back to

Level 2.

• Sustained elevator denial with thermostat 32 failed because actual

temperature dipped below the burn threshold.

• Direct Temp-L2 sensor write failed because the analog input was not

writable.

Tool Quirks

• A simple Python socket client was more reliable than batch nc for the custom

prompt timing.

• External BACnet packages were not needed because the challenge supplied a

custom helper menu.

Evidence Paths

• analysis/nc-objects.txt
• analysis/solve-probe.txt
• analysis/mission-transcript.txt
• analysis/mission-sustain-transcript.txt
• analysis/mission-sensor-transcript.txt
• analysis/mission-hot-transcript.txt
• solve/solve.py

Ingestion Decision

• Proposed for LightRAG: yes, after user approval.
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Steel-Mountain
• Category: ICS
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:30108,<TARGET>:32580
• Start time: 2026-06-11T06:08:20Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

Challenge: Steel Mountain. Steel Mountain is a secure facility serving major corporations like E-Corp. We've infiltrated their network and planted our tool. Final step: Burn the tapes to destroy the data. All necessary info is in the files.