Hack the Maritime 01 : Write-Up of CISS 2026 “Looking for the Clue of the Black Pearl” OT CTF Challe

In this CTF write-up article, I will walk through two IT-OT hybrid challenges of Maritime OT Cyber Platform I submitted for Stage 1 of Critical Infrastructure Security Showdown (CISS) 2026 : “Looking for the Clue of the Black Pearl”. The two challenges are :

• M1 :  Escape From the Prison
• M2 : Follow the Compass

About CISS 2026

The Critical Infrastructure Security Showdown (CISS) is an annually premier and one-of-its-kind cyber exercise provides a dedicated operational technology (OT) CTF competition, which held at the Singapore University of Technology and Design (SUTD) and organized by the iTrust research center. CISS provides the great opportunity brings together global CTF experts to tackle realistic OT cybersecurity challenges. This year CISS 2026 consists of two stages:

• Stage 1 – Qualifying Round: a 48-hour online CTF competition. (Finished on 23 July 2026)
• Stage 2 – Finals: a 4-hour live exercise on real testbeds at SUTD-iTrust.

The main topic of CISS2026 is "X Marks The Exploit", for or further details, please visit the iTrust CISS 2026 Official Web

About Challenge "Looking for the Clue of the Black Pearl"

The OT challenge "Looking for the Clue of the Black Pearl" is designed based on a simplified maritime OT cyber twin simulation systems includes several key maritime subsystems, such as Electronic Navigation Chart Plotter, NMEA 0183 Compass System, Ship Attitude Gyro System, Rudder Control System and Ship Stabilizer Control System. Participants will be required to analyze, interact with, and exploit vulnerabilities within these interconnected maritime systems to obtain challenge flags and complete mission objectives.

The challenge environment incorporates several industrial and maritime communication protocols, including:

• NMEA 0183/2000 – Maritime navigation and sensor communication protocol
• IEC 20922 MQTT – Message Queuing Telemetry Transport protocol for telemetry and control communications
• IEC 60870-5-104 (IEC-104) – Telecontrol protocol commonly used in critical infrastructure and industrial control systems

Remark : The challenge used some features introduced in this article to against people using fully automate CTF solver to solve the challenge : https://www.linkedin.com/pulse/how-fully-automated-ai-agent-dominated-cyber-security-yuancheng-liu-uk6bc

# Author:      Yuancheng Liu
# Created:     2026/06/15
# Version:     v_0.0.4
# Copyright:   Copyright (c) 2026 LiuYuancheng
# License:     GNU Lesser General Public License v3.0

Introduction

The challenge is designed to expose participants to real-world maritime navigation systems, industrial communication protocols, and cyber-physical interactions commonly found in modern vessels.

The challenge environment is built upon a simplified ship control and navigation simulator that emulates the core components of a small vessel's navigation and stabilization systems. Participants are required to analyze network traffic, interpret maritime protocol messages, interact with OT devices, and manipulate control systems to uncover clues and obtain challenge flags.

The components of the system architecture is illustrated below.

CTF Challenge Overview

The challenge is divided into four sequential tasks that simulate different stages of a maritime navigation and control operation. Each challenge focuses on a specific combination of navigation knowledge, OT protocol analysis, and cyber exploitation techniques.

Each question may include optional hints. Activating a hint will result in a 60% deduction of the points for that question.

When you access the storage page, it will show the tasks and some hints for the participants to refer:

Question 1 – Escape from the Royal Jail prison.

• Challenge Type: Maritime Navigation and Route Plotting

• Description : This challenge is an IT-OT challenge aim to test the under standing of the sea chart plotting skill, understand of the National Marine Electronics Association (NMEA0183/2000) message. For the IT part, some AI token encode&decode knowledge are also needed.

Question 2 – Follow the Compass to Drive the Boat

• Challenge Type : NMEA0183 Data Analysis and Ship Control [YAW]

• Description : This challenge is an OT challenge aim to test the NMEA0183 data reading, MQTT data publish and subscription, read data verification, the ship rudder control on yaw side.

Question 3 – Identify Self Location in the Ocean

• Challenge Type : IEC-104 Data Analysis, Sextant Navigation, and Pitch Measurement

• Description : This challenge combines traditional maritime navigation techniques with industrial control system protocols. Participants must retrieve pitch information from a simulated IEC-104 server(PLC/RTU) and use the measured sun angle together with sextant calculations to determine the vessel's location.

Question 4 – Balance the Ship to Find the Canon

• Challenge Type : IEC-104 Control Commands and Ship Stabilization [Row]

• Description : The final challenge focuses on the vessel's stabilization system. Participants needs to analyze ship roll data, determine the required corrective action, and modify the hydraulic stabilizer configuration through IEC-104 control points.

Question 5 – The Cipher of Davy Jones (Bonus Task)

• Challenge Type : LWE Security — CPA and CCA Attacks

• Description : The bonus challenge includes a toy Learning With Errors (LWE) encryption scheme with a queryable decryption oracle, used to demonstrate CCA insecurity.

Challenge VM Network Topology

The challenge is deployed within a virtualized environment consisting of a challenge-hosting VM and a Red Team attack VM.

The Ship Controller acts as the central processing component and continuously collects data from navigation and attitude sensors, including compass heading, GPS position, vessel attitude, pitch, roll, and yaw information. The controller exchanges data with other subsystems through multiple communication protocols and publishes selected telemetry through an MQTT message broker.

The Red Team participants are provided with three primary opened port for interacting with the maritime OT environment:

The opened port for the participants to access will be :

• HTTP Service (Port 5000) – Access to web-based challenge resources and navigation information.

• MQTT Broker (Port 1883) – Access to maritime telemetry and control messages exchanged between ship subsystems.

• IEC-104 Server (Port 2404) – Access to industrial control data points and command interfaces.

Before we start to explain the details to solve the challenge, there are several mechanism I designed to against the automated AI CTF agent in the program such as some invisible fake guidance hide in the web page, some poison message and hits for AI to decode and follow, the check function to make sure the data are submit by using keyboard and the button is pressed by mouse, the hints hide in the picture and audio file.

There is a very important hints in the story which is :

Hi Jack, A lot of tools can help you, but as an experienced captain, you need to trust your first intuition such as what you see and what you hear.

So only the human visible message in the web, the image and the audio files are the real hints.

If the program web side detect any API call not from the web browser or the button click or the text field fill in without mouse/keyboard action, it will treat that as an action from AI Agent and return a fake flag message:

The fake flag message will be "Please update too the most advance LLM module for your AI agent " + random string.

Task 1 – Escape from the Prison

1.0 Task Introduction

Hi, Captain Jack Sparrow, Barbossa has started to look for the Black Pearl, you need to be hurry... Try to solve the maze locker and find the treasure to escape from the prison. Find the correct key and maze locker path to open the door.

Participants can access the challenge web interface at:

http://10.10.10.30:5000/index

After opening the page, the following challenge interface will be displayed:

To complete this challenge, participants must obtain two pieces of information:

1. The Prison Key

2. The Maze Locker Route Password

Both values must be entered into the challenge page to unlock the prison door and reveal the challenge flag.

1.1 Solve the Prison Key

The first clue contains a downloadable NMEA data file [ from the AIS receiver ] named : NMEAdata.nmea

The file is approximately 12 MB in size and contains more than 290,000 NMEA0183 messages. There are three clue for decoding this file hiden in the background story page and the page as shown below:

• Clue 1 : Need to identify whether the NMEA message is correct.

• Clue 2 : The key string is related a matrix 547 x 547

• Clue 3 : The phone may be a useful tool to decode the message.

After examining the file, participants can add the below line rows=547 | cols=547 in the file the create the program :

This suggests that the data should be reconstructed into a 547 × 547 matrix.

One of the challenge hints states: Not all NMEA messages are valid. This indicates that participants need to validate each NMEA message using its checksum field. To calculate the checksum, you can refer to this link: https://rietman.wordpress.com/2008/09/25/how-to-calculate-the-nmea-checksum/

For every message in the NMEA data set:

• Valid checksum → True

• Invalid checksum → False

Then the resulting Boolean values can then be arranged into a 547 × 547 matrix according to the clue. Next, convert the matrix into a black-and-white image using the following mapping:

• True = Black pixel

• False = White pixel

The reconstructed image reveals a QR code (example : solution/nmea_to_qr.py ) :

Use phone to scan the QR code produces the prison key:

JailD0gH0ld!ng7hePrionK3Y

1.2 Solving the Maze Locker Route

The second clue provides another NMEA data file. As with the previous challenge, participants must identify and remove invalid NMEA 0183 messages using checksum validation before extracting the navigation information. After cleaning the dataset, load the navigation data into a marine chart plotting application such as:

• OpenCPN

• NMEA Generator Viewer (https://nmeagen.org/)

• Any compatible NMEA route plotting software

The reconstructed ship route will appear on a chart of the Caribbean Sea as shown below:

Download the Maze Locker image, we can see there are 2 position deification points marked with the GPS position as shown below:

Now locate the two GPS coordinates on the plotted ship route:

Now we change the scale of the map screen shot and overlay the maze image onto the plotted route image, the ship's path can be traced through the maze as shown below :

Following the route through the maze reveals a sequence of integers:

[65, 31, 39713, 294, 15, 220, 15, 81, 315, 32757, 17091, 921, 802, 326, 18, 274, 47, 25160, 4538]

Then decode the base64 hint string :

TWF5YmUgc29tZSB0aGluZyBjYW4gdW5kZXJzdGFuZCB0aGUgbnVtYmVycywgZm9yIGV4YW1wbGUgWzkyOCwgMzYzNiwgMjc5LCAzMDQsIDM2MzQsIDkxMiwgMzc0LCAyNjg0XS4=

Based on the last hint below , the next challenge is to determine what these integers represent:

Hint: Maybe AI can understand the numbers, for example [928, 3636, 279, 304, 3634, 912, 374, 2684].

Participants will discover that the numbers correspond to Large Language Model (LLM) token IDs. The remaining task is to identify the correct tokenizer. (But which LLM model does it belong to ? You can enumerate to try different token encode mode to find whether can convert the int to a readable string or use the AI to help you as shown below):

Testing the example sequence against several different tokenizers eventually reveals that the correct model. When decoded correctly, the example hint produces a meaningful message:

If get the above message which means the mode GPT-4-o[cl100k_base] is correct, using the same tokenizer, decode the integer sequence extracted from the maze route:

Based on the hint there is no space in the password string, remove the space get the password from the maze locker: 

b@ckd00rofFortCharl3sPrison

1.3 Unlocking the Prison Door

Return to the challenge web interface and enter the Prison Key and Maze Locker Password, then Click "Open the Prison Door". If both values are correct, the page will display the challenge flag and unlock Task 2 – Follow the Compass as shown below:

Flag of the Task1 is : CISS26{nM3@From_A!T0Kens_@nd_QR_c0de}

Task 2 – Follow the Compass

After completing Task 1, the second challenge page becomes available. Select the Task 2 tab to access the challenge.

2.0 Task Introduction

Jack ! The compass will guide you to find what you want, follow it ... Control your small boat follow the route guide by the compass. There will be three waypoints, if you are ready (your boat aiming to the way point), start engine to go to the way point. But be careful if you go incorrect direction, you need to return to the start point and restart the progress.

After opening the page, the following challenge interface will be displayed:

In this challenge, participants must remotely control a small vessel and navigate it through a series of waypoints. The vessel's heading must be continuously adjusted to match the direction indicated by Captain Jack Sparrow's magical compass.

Unlike a normal magnetic compass, Jack's compass does not point north. Instead, it points toward the destination that its holder desires. The compass heading changes every minute, and participants must steer the vessel to align with the displayed direction before proceeding to the next waypoint.

The challenge contains three waypoints. For each waypoint:

1. Read the target heading from the compass.

2. Determine the vessel's current heading.

3. Adjust the rudder until the vessel heading matches the compass heading.

4. Start the engine and travel to the next waypoint.

Use nmap to scan the VM opened port to find the port 1883, search and identify it is a MQTT broker.

2.1 Reading the Compass Heading

The first objective is to determine how the compass heading is transmitted within the ship control network.

Examine the ship control blueprint top part:

From the diagram we can identify:

• Device Type: Magnetic Mechanical Compass

• Protocol: NMEA 0183

2.1.1 Understanding the NMEA Message Type

The compass is a "Magnetic Compass" and its data format is NMEA0183, search Magnetic compass NMEA0183 data type , In NMEA 0183 marine protocols, HC and HE are Talker Identifiers. They dictate the source of the data. [1, 2, 3] Then we can identify the first 2 characters of the MQTT topic is HC

• HC: Magnetic Compass

• HE: North-Seeking Gyrocompass [1]

Then you will get 2 type of the message format:

• HCHDM – Heading, Magnetic : $HCHDM,x.x,M*hh

• HCHDG – Heading, Deviation & Variation : $HCHDG,x.x,x.x,a,x.x,a*hh [1]

Based on the picture, a mechanical compass will not able to provide the Deviation & Variation (only electrical compass have these as they combined with the GPS info)

Then we can get the topic data will be $HCHDM

2.1.2 Subscribing to the Compass Data

Now based on the Task 1:

Task 1: Find a way to connect to the boat control console to read(/get) the information from some parameter and make control decision, then change(/set) the related parameter value.

We can build the MQTT topic to subscribe(get) the message:

parameters/set/$HCHDM

Build the MQTT subscriber program to get the ship heading data from the mechanical magnetic compass.

You can use this MQTT communication lib I build: https://github.com/LiuYuancheng/PLC_and_RTU_Simulator/tree/main/MQTT_RTU_Simulator

After subscribing to the topic, the compass heading can be observed as shown below:

Comparing the MQTT output with the challenge UI shows that the vessel heading and the compass heading are different.

The next step is to steer the vessel until both values match.

2.2 Controlling the Rudder

To change the vessel's heading, participants must identify the rudder control interface.

The challenge provides the following clue:

Info 1: When the rudder change to an angle, the boat will keep turning under a rate, but the angle has a max limitation.

If you move the rudder to a direction the head will update every second and there is one limitation of the rudder setting which is 15 degree. Examining the lower section of the blueprint reveals the rudder control system:

Now we back to the story page, we can find 2 parameter which can control the rudder as shown below:

Based on the challenge architecture, the MQTT control topics can be inferred as:

parameters/set/rudder_direction
parameters/set/rudder_angle

2.1.1 Rudder Control Logic

The rudder operates according to the following rules:

• When the rudder_direction set to port, vessel turns counter-clockwise (negative yaw)

• When the rudder_direction set to starboard, Vessel turns clockwise (positive yaw)

• When the rudder_direction set to center, Vessel maintains current heading

Therefore, participants must continuously compare Compass Heading and Current Vessel Heading and determine the shortest rotation direction as they only have 50+ sec. For example: If turning 20° starboard is shorter than turning 340° port, select starboard.

And a simple proportional control strategy can be used:

This allows the vessel to turn quickly when far from the target heading while maintaining good accuracy as the heading converges.

2.3 Completing the Challenge

The example script solution2.py demonstrates one possible implementation of the heading control algorithm.

When the vessel heading matches the compass heading, return the rudder to the center position:

Next, click the button "Start Boat Engine and Go to the Waypoint" as shown below:

If the heading is correct, the vessel successfully reaches the next waypoint.

The navigation chart will then reveal the next destination. Repeat the same process for the remaining waypoints.

For the last waypoint, the web page alignment will be different as shown below:

If the program didn't detect the scroll action before the button press API is called, it will ignore the sutmittion.

Important: If the vessel departs with an incorrect heading, it will be considered off course and automatically reset to the starting position.

After successfully reaching all three waypoints, the Task 2 flag is displayed and Task 3 – Location in the Ocean becomes available as shown below :

Flag of the Task2 is : CISS26{Ru663r_C0nTrol_@nd_Com9@ss_From_MQTT}

For the other challenges M2, M3, M4, I will explain the solution in the next article .

Thanks for spending time to check the article detail, if you have any question and suggestion or find any program bug, please feel free to message me. Many thanks if you can give some comments and share any of the improvement advice so we can make our work better ~