Writeup: Nurse Call - EspilonCTF (IOT)

Description

You gain access to the maintenance terminal of the patient call system at Clinique Sainte-Mika. The system reports phantom calls coming from a sealed room. The previous technician did not finish his investigation. His session was left open.

Objective: Explore the logs, understand the anomaly, and find what hides in Room 013.

Solution

Step 1 - Initial Reconnaissance

Upon connecting to the terminal via nc espilon.net 38138, we are greeted with a banner indicating a previous session was left open. The home directory contains:

README.txt
config/    - Room and system configuration
logs/      - Call and maintenance logs
notes/     - Staff and technician notes
tools/     - Diagnostic and command tools
work/      - Workspace

Step 2 - Analyzing the Logs

logs/appels.log reveals phantom calls from Room 013 with unknown patient and type. A key entry shows a raw payload:

2026-01-29 03:33:33 [NOTE] payload room 013: 0x4c41494e (non-compliant with standard protocol)

logs/reseau.log confirms the payload and decodes it:

[BUS] payload analysis: 0x4c41494e -> ASCII: "LAIN"

The module is also sending a WAKE_REQ (wake request) that the hub refuses because the module is unrecognized.

logs/maintenance.log shows the previous technician (EIRI_M) traced the anomaly and left notes:

tech_id=EIRI_M note: "room 013 physically decommissioned 3 months ago"
tech_id=EIRI_M note: "but the module is still transmitting on the bus"
tech_id=EIRI_M note: "need to use reveil.sh with the correct id"
tech_id=EIRI_M note: "the id is in the call log payload"

His session was interrupted before he could finish.

Step 3 - Waking the Phantom Module

Following the technician's trail, we use the wake tool with the identifier LAIN (decoded from 0x4c41494e):

tools/reveil.sh --id LAIN

Output:

============================================
 MODULE LAIN -- ROOM 013
 Status: AWAKE
============================================

 > connection established with phantom module
 > protocol: NAVI-BUS v2 (non-standard mode)
 > identity confirmed: LAIN

 module message:

   "no matter where you go, everybody is connected."

 flag: ESPILON{r3v31ll3_m01_d4ns_l3_w1r3d}

============================================

Key Steps Summary

1. Read logs/appels.log - found hex payload 0x4c41494e from Room 013
2. Read logs/reseau.log - confirmed payload decodes to ASCII LAIN
3. Read logs/maintenance.log - learned to use reveil.sh --id with the payload identifier
4. Ran tools/reveil.sh --id LAIN - woke the phantom module and retrieved the flag

Notes

• The challenge is themed around Serial Experiments Lain (1998 anime). The technician's ID EIRI_M references Masami Eiri, and the quote "no matter where you go, everybody is connected" is iconic from the series.
• The flag r3v31ll3_m01_d4ns_l3_w1r3d is leet-speak French for "reveille moi dans le wired" ("wake me in the Wired").