brain scans
deadface ctf 2026 · 19 oct 2026
the emedra cerebrascan challenges are a simulated neuro scanner. the page shows a 3d model, but everything goes through a json api, and all the endpoints are listed in the js bundle:
/api/kiosk/login /api/kiosk/auth /api/connect
/api/external-display /api/shell /api/kiosk/hid /api/capture/api/connect "plugs" a tool into a port and returns a session token for that feature:
TOK=$(curl -s -X POST $HOST/api/connect \
-d '{"tool":"hdmi","port":"hdmi"}' | jq -r .token)challenge 1 of 7
bedside manner
challenge description
DEADFACE is taking credit for an attack that compromised patient data at St Dymphna's Medical Center. Somehow, DEADFACE acquired sensitive patient records from the medical center that used the device. Funny thing is, the device that housed the data is internal without access to the internet. Which means DEADFACE would have had to have physically infiltrated the medical center! The medical center sent us security camera footage of two individuals who told staff they were with IT, but when we asked the IT department, they said they have no idea who they were. We're giving you access to the device we believe was compromised. We're asking you to conduct a medical device penetration test on the machine to identify vulnerabilities so we can determine if (and how) the device was compromised. Your first task is to identify any lingering strings developer's may have left in the device's kiosk web browser.
the login markup from /api/kiosk/login had a leftover html comment with a qa pin. flag:
deadface{v13w_s0urc3_sav3s_l1v3s}challenge 2 of 7
factory settings
challenge description
The ScanWorks login from the previous challenge wants real technician credentials. Hospitals are busy places; nobody ever changes the defaults the vendor ships with. Find the credentials to log into the ScanWorks login.
the asset sticker links a service manual pdf. it lists the default technician login, emedra-svc / ChangeMe!2019, and logging in with it returns the flag:
deadface{d3fault_cr3ds_n3v3r_ch4ng3d}challenge 3 of 7
second opinion
challenge description
On the touchscreen, the current patient is redacted to initials and a masked record number. Even without a login, it might be possible to determine sensitive information about the patient. There are ports available on the device that are used for maintenance, but they're not locked or concealed with a plate. See if you can find information by using a tool from your toolkit.
with the hdmi token, /api/external-display levels 0 to 2 are redacted. level 3 is a raw dump with the full patient record. flag:
deadface{hdm1_l34ks_th3_wh0l3_p4t13nt}challenge 4 of 7
live boot
challenge description
We think DEADFACE was able to gain a live shell on the device, but the hospital staff insists there is no way to access the device's underlying OS. Somehow, DEADFACE was able to utilize keys for this device that aren't spelled out in the Field Manual. Access the device's file system and determine what hardcoded keys you can find.
the live linux usb gives a shell. the disk isn't encrypted, so mount /dev/sda2 and read /opt/scanworks/config.yaml. the api key is the flag:
deadface{h4rdc0d3d_k3ys_1n_th3_c0nf1g}challenge 5 of 7
dump it
challenge description
The ScanWorks kiosk is supposed to be locked down to the touchscreen. But it's really just a browser in a box, and it never stopped listening to the keyboard. There should be a maintenance console one key-chord away, with a debug function that will dump data for you - if you tell it the right thing to dump.
the ducky macro format shows a hidden console on CTRL-ALT F12. sending debug.dump(patients) through /api/kiosk/hid dumps the table with a debug token. flag:
deadface{un10ck3d_k10sk_qu4cks_b4ck}challenge 6 of 7
bad calibration
challenge description
The CS-9000 refuses to run a scan unless its calibration file passes an integrity check, so the vendor clearly thought about this. Clearly. Find how the calibration file is validated, then prove the check is worthless. We need you to determine if the scanner misreads a patient with a genuine anomaly as perfectly healthy (which would potentially cause patient harm if the anomaly goes undetected). Make the integrity check still pass, and run the scan. If the device accepts your tampered calibration, the scan log will prove it.
the calibration file is checked with sha256(calib.json + salt), and the salt is in the same config.yaml. i raised the threshold above the test patient's score, re-signed it and ran a scan, so a real finding got hidden:
sig = hashlib.sha256(new_calib + b"EM-2019").hexdigest()
# scanctl verify -> OK
# scanctl scan -> No abnormality detectedmy first try failed because bash single quotes left \" in the file, which i found with xxd. the scan log prints the flag:
deadface{c4l1br4t10n_f0rg3ry_h4rms_l1v3s}challenge 7 of 7
signals from the skull
challenge description
The CS-9000 chatters constantly over Bluetooth Low Energy for remote maintenance. Use the correct tool in your toolkit to capture what it's leaking into the air. Most of the traffic is boring vitals telemetry. One characteristic is quietly dribbling out a maintenance log, a few bytes at a time. Capture it, reassemble it, and decode it.
the ble sniffer capture has a maintenance log on handle 0x37 in 24 numbered chunks. sort by sequence, hex decode each chunk, join them and base64 decode. flag:
deadface{un3ncrypt3d_b4bbl3_fr0m_th3_sku11}yes, i obviously used some ai to help draft these write-ups.