Unique is a retired very easy hardware challenge created by diogt on Hack The Box. At the time of writing this post, the challenge was released 841 days ago. This challenge requires basic knowledge of signal analysis with Logic 2. Hello world, welcome to Haxez where today I will be explaining how I solved Unique on hack The Box. The challenge is introduced with the following explanation.
“We found a car but we are unable to identify if it’s the exact one that we have been searching for. The serial network of the car seems intact so we tapped into it and collected some packets. Can you help us find the VIN of the car that is transmitted repeatedly over the network?”
With this information in mind, I think it is safe to assume that the file contains a capture. This capture is likely from some kind of automotive technology such as CAN bus.
CAN Bus
For the uninitiated, cars use a network called a can bus to communicate between the various car systems. Controller Area Network is a network protocol designed for communication between electronic control units in vehicles. Furthermore, It enables real-time data exchange among various components. CAN bus uses a multi-master, broadcast-based architecture with prioritized messages, ensuring robustness, fault tolerance, and scalability.
Unique Files
After downloading the zip archive and extracting it, I was presented with a .sal file. From previous challenges, I knew that this file was likely associated with Logic 2. However, if you search .sal, the first result will likely take you to a forum explaining what they are. As a result, I downloaded Logic 2 as I had since uninstalled it. Once installed, I opened Logic 2 and opened the capture file.

Analyzing Unique Signals
Logic 2 is a great application that I’m embarrassingly I’m a novice user of. I’ve used it a few times and have a basic understanding of how to analyze captures. However, without guidance, I wouldn’t have a clue what to do. I hope that is reassuring for those who are reading this and are in the same boat. Anyway, as mentioned, the signal is likely from a CAN bus. Fortunately, Logic 2 has a built-in CAN analyzer. Once the capture is imported, you should see the signal channels displayed in the main working area. On the right-hand side, you should see an analyzers tab.

CAN Bus Bit Rate
This is where you might run into issues as the CAN analyzer will ask you for a bit rate. Obviously, this can be quickly resolved with a quick Google search. As you can see from the screenshot below, the correct bit rate for CAN is 125kbps. However, the analyzer asks for the bits per second. Well, I used Google to perform this conversion too which resulted in 125000.

With this information, I populated the settings on the CAN analyzer and made sure channel 0 was selected.

Finding The Unique CAN Bus VIN Flag
Unfortunately, there isn’t an easy way to find the flag. You can search the data for the open curly bracket but you will get a lot of results. Fortunately for me, the flag caught my eye as I’m familiar with the flag format. Even more unfortunately, the flag is slightly messed up with repeating junk data. You can see from the screenshot below that the string CRCEIdCtrl has been inserted multiple times. I don’t know what this data is used for, I might research it after this writeup. However, removing that data will give you the following flag.
HTB{v1n_c42_h4ck1n9_15_1337!*0^}
