Five HMIs, One Real: The First Labshock OT CTF

We planned one match. People asked for a second.

The first live beta of the Labshock OT CTF ran on Eastwater Facility, with ten players, every seat taken, and more than thirty people watching.

The Scenario

Five HMI screens sit on the plant network. Only one of them is real.

The operator login is leaked on a public page. The password is hidden in a file share. The decoys are everywhere, and picking the wrong one means a Modbus write that goes nowhere at all.

Players connected to the same plant, each on their own seat, and worked it in parallel:

• found the credentials
• found the real HMI among the decoys
• took control
• changed real plant registers
• scored points live

A referee scored the actual registers rather than a submitted flag, so the points followed what happened to the process.

The Part We Wanted to See

People started talking.

They shared progress, watched the scoreboard, and checked what others had found. Then the first match finished and the question came back: can we do one more?

So we did.

That is the thing a solo lab cannot produce. You can learn a protocol alone. You cannot learn how differently somebody else approaches the same plant unless they are on it at the same time.

What This Was Actually Testing

Ten seats, one scenario, a small beta.

It was the first real test of the CTF engine, the scoring, the seat system, the referee and the scenario flow — with real players rather than with us.

The system held. More importantly, people learned by doing, and wanted to play again.

OT security must be testable.

Not documented.

Try It Yourself

• Join the community to get a seat in the next one: discord.gg/bpmaQFfW76
• Eastwater Facility, where this ran: labshocksecurity.com/news/eastwater-facility-water-treatment-simulation
• Start free and work the plant on your own first: github.com/zakharb/labshock
• The first Battlegrounds season starts soon.