Member-only story
Phantom Fob Walkthrough Tryhackme
14.09.2026
Author: timiphil9, Target: 10.114.167.212
Modern cars have an internal network called the CAN Bus. Every part of the car: doors, dashboard, engine, talks to every other part by broadcasting little messages onto this shared wire. In this room you’re plugged into the CAN bus of a demo vehicle. You’ve been given a key fob that can Lock the car and sound the Horn, but has no Unlock button. The manufacturer claims the unlock command “can’t be copied.” Your job is to watch the car’s messages, work out how the door commands are built, and craft the Unlock message yourself.
Step 1: Reconnaissance
nmap -Pn -p- --min-rate 4000 -T4 10.114.167.212PORT STATE SERVICE
22/tcp open ssh
8080/tcp open http-proxy
29536/tcp open unknown
Accessing on browserhttp://10.114.197.212:8080/ reveals a live dashboard displaying a key fob with four available buttons: Lock, Horn, Immobiliser Arm, and Immobiliser Disarm. Notably, there is no Unlock button.
