A vulnerable-by-design CubeSat laboratory, built on the real FlatSat ↗
One complete aerospace penetration test — 56 findings, 56 runnable proofs, one full engagement report — that you can re-run right here, in this tab. Every PoC executes unmodified, in CPython compiled to WebAssembly, and every run is hash-checked against the committed simulator transcript (and the same PoC code also passed on the real board).
The target is the satellite testbed FlatSat —
PwnSat × Electronic Cats' open-hardware
platform, the first vulnerable-by-design CubeSat in the world — running its
upstream firmware (v1.0.3) plus the lab modules this project adds. It compiles to a
.uf2 and flashes the very same board: the 112 / 112
bench parity beside this text is not a claim — it is committed, hashed evidence,
and the panel below shows exactly what this repository adds on top of the upstream
platform.
- FINDINGS18 upstream + 38 lab56
- PROOFSsimulator + real board112 / 112
- HARDWAREsame board as upstreamRP2040
- LICENSEno accounts · no backendGPL-2.0
- SEVERITY MIXas rated across the 56 writeups
python3 poc/…THE PROJECT YOU ARE STANDING ON — FLATSAT v1.0
FlatSat
is a physical, open-hardware “satellite on a desk”, created by
PwnSat and Electronic Cats (with the first version made possible by
Alex Lynd) to learn space hacking on real hardware in a legal, license-free
ISM-band radio environment. It simulates real satellite subsystems — on-board computer,
dual RF links, sensors, telemetry — over authentic aerospace protocols (CCSDS Space
Packet Protocol), and ships deliberately breakable: an .uf2 firmware that
wants to be exploited, and eight documented attacks (00–07) to
practise on it. Hardware is open under CERN-OHL v1.2, firmware under GPL-2.0-or-later;
PwnSat and Electronic Cats are their authors' registered trademarks.
UPSTREAM FLATSAT ↔ THIS LAB — EXACTLY WHAT CARRIES OVER
| FlatSat v1.0 (upstream) | This FlatSat electr0sm0g Lab | Where to verify |
|---|---|---|
| RP2040 on-board computer, 2× Semtech SX1262 LoRa (uplink/downlink), BME280, LIS2DH12, ISM band | the same board — the lab bench is a real FlatSat (“FlatSat 1”), the simulator models the same chip set and buses | docs/REALISM.md, docs/HARDWARE-USB-TEST.md |
vulnerable-by-design firmware v1.0.3 + platformio.ini |
that exact firmware plus lab modules (19 more lab APIDs 0x15–0x27, mission model, anomaly engine) — one PlatformIO build | firmware/, docs/BUILD.md |
8 attacks, scripts 00–07 (RF + USB variants) |
the 18 findings present upstream (V0-01…V0-18) plus 38 new ones this lab introduced (V-01…V-38) — 56 PoCs in all | docs/SPARTA_MAPPING.md, FINDINGS.json |
| CCSDS Space Packet Protocol framing, APID registry | unchanged framing; every byte this page streams is that protocol, decoded field by field in OPS | docs/DESIGN-RATIONALE.md, REPO view sources |
IT IS NOT A MODEL OF A FIRMWARE — IT FLASHES THE DEVICE
pio runPlatformIO, env pico_tinyusb — the upstream flow, unchanged.uf2 → BOOTSELdrag-and-drop onto the Pico exactly like the upstream wiki quick-start (final bench image H; kept hardware transcripts span images E–H as annotated in hw_pass.txt)python3 poc/… --usbevery PoC runs against the flashed board over USB, or over the simulator with no hardware at allImage H actually flashed on the bench: md5 …
(335,872-byte UF2, digest anchored in docs/BUILD.md and re-checked by CI).
The honest boundary: the flight FlatSat firmware upstream keeps its own course;
this lab's build trades operational hardening for 56 teaching targets — that trade
is the point, and it is documented finding by finding.
WHAT IS REAL HERE — AND WHAT IS SIMULATED, HONESTLY
REAL
- The simulator, harness and all 56 PoCs are the byte-identical files from the git repo, executed as real CPython (compiled to WebAssembly — Pyodide, version-pinned) in a Web Worker. Nothing is canned or replayed.
- A POC OK verdict means the transcript made on your machine, right now hashes to the committed simulator transcript digest — the same one CI re-checks on every push to main.
- Every PoC was additionally executed against the real flashed FlatSat 1 board; both worlds' transcripts are committed —
evidence/(simulator) andevidence-hw/(board).
SIMULATED (BY DESIGN)
- The RP2040 binary itself does not run in your browser. The Python simulator is a bit-faithful twin of the firmware's link and behaviour logic — same frames, APIDs, state machines, fault points (docs/REALISM.md maps them side by side).
- Orbit, eclipse, battery, attitude and the ground station are mission models, not physics: the bench has no ADCS or EPS — the lab says so out loud.
- Radio here is a wire tap, not RF: same bytes, no anechoic chamber claims.
THE 56 FINDINGS
across … of the 9 tactic families of SPARTA v3.2 (Space Attack Research and Tactic Analysis, The Aerospace Corporation), (reconnaissance → execution → initial access → defense evasion → persistence → lateral movement → exfiltration), touching … APIDs as the committed transcripts actually exercised them. In INDEX every finding is one card: full writeup (root cause → mechanism → walkthrough → impact → mitigations), one-click RUN LIVE, its raw bench transcript, its source. Every number on this page is read from the baked catalog at load — nothing is retyped.
THE FLAGSHIP CHAIN — V-36, FIVE STAGES, ONE UPLINK
Run V-36 from the start-here strip and watch the killchain pipeline below light its five stages exactly as the committed evidence anchors appear in the transcript.
THE FIVE VIEWS
VERIFY IT OUTSIDE THE BROWSER
Clone the repository, then: make check (catalog, digests, self-tests) ·
python3 poc/v136_gps_spoof_chain.py (same transcript this page hashes
against) · the CI job web-demo re-runs this very page headless on
every push and fails if any verdict, hash, or frame count drifts. Ten verification
rows, each with its command: docs/VERIFICATION.md.
Want it on real hardware: the GitHub release v1.0.0 ↗ publishes a flashable
firmware.uf2 with its md5sum.txt, built by CI from this exact
tag (BOOTSEL the Pico, drop the file in, done). Note the honesty line: the CI rebuild
can differ bit-wise from the image swept on the bench — that final image H,
md5 bfc145c9…, is pinned in evidence-hw/, and the library
dependencies float within their semver ranges in platformio.ini.
WHAT IT IS NOT — AND WHO DESERVES THE CREDIT
Not a product, not marketing, not flight-proven software: the working notebook of one research engagement, published whole — no accounts, no analytics, one static artifact you could archive on a USB stick (the only external calls: the pinned Pyodide CDN and Google Fonts, with system-font fallbacks). It stands on the shoulders of FlatSat by PwnSat × Electronic Cats (hardware CERN-OHL v1.2, firmware GPL-2.0-or-later — licenses respected, trademarks theirs). The threat taxonomy used across this site is SPARTA — Space Attack Research and Tactic Analysis, © The Aerospace Corporation (sparta.aerospace.org), reproduced per its terms of use; this lab's own code is GPL-2.0-or-later · Étienne Lacoche — Cybersecurity Researcher.
OPS — LIVE MISSION CONTROLPoC stream with every wire frame decoded field by field, spacecraft state read live from the model, verdict bar hashing this run against the committed evidence
INDEX — 56 VULNERABILITIES, STEP BY STEP
FlatSat V1.0 is vulnerable by design (Electronic Cats × PwnSat pentest lab). Every card below is a real weakness that was found, exploited, and verified twice — once against this simulator, once against the board (images E–H, per-run annotations in hw_pass.txt) — 112/112 PoC OK.
Each writeup follows the same path: Summary → Root cause → Attack mechanism → Exploitation walkthrough (step by step) → Impact → Mitigations → References, mapped to SPARTA v3.2 — Space Attack Research and Tactic Analysis, The Aerospace Corporation. Click a card to read it; press RUN LIVE to execute the unmodified PoC here, in the pane on the right, under CPython/WASM — the fresh transcript must hash to the committed evidence for the verdict to pass.