diff --git a/.devcontainer/virtual/docker-compose.yml b/.devcontainer/virtual/docker-compose.yml
index ef7c412e..323e438d 100644
--- a/.devcontainer/virtual/docker-compose.yml
+++ b/.devcontainer/virtual/docker-compose.yml
@@ -17,6 +17,7 @@ services:
     volumes:
       - ../../:/CybICS
       - ../../software/attack-machine/workspace:/root/Desktop/workspace
+      - ../../training/buffer_overflow:/opt/challenges/buffer_overflow
     networks:
       virt-cybics:
         ipv4_address: 172.18.0.100
diff --git a/.gitignore b/.gitignore
index 64eadeac..6c73de5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -154,3 +154,7 @@ software/landing/data/*.json
 !software/landing/data/.gitkeep
 software/landing/app.py.backup
 software/landing/app.py.old
+
+# buffer overflow challenge
+training/buffer_overflow/plc_diagnostics
+training/buffer_overflow/.gdb_history
\ No newline at end of file
diff --git a/software/attack-machine/Dockerfile b/software/attack-machine/Dockerfile
index bc087a55..94b8e30e 100644
--- a/software/attack-machine/Dockerfile
+++ b/software/attack-machine/Dockerfile
@@ -285,6 +285,14 @@ RUN echo 'welcome' >> /root/.bashrc
 # Initialize Metasploit database
 RUN msfdb init || true
 
+# Bufferoverflow tools
+RUN pip3 install --no-cache-dir --break-system-packages pwntools
+
+RUN apt-get update && apt-get install -y gdb checksec
+
+RUN curl --proto '=https' --tlsv1.2 -LsSf 'https://install.pwndbg.re' | sh -s -- -t pwndbg-gdb
+
+
 # Expose VNC and noVNC ports
 EXPOSE 5902 6081
 
diff --git a/software/landing/Dockerfile b/software/landing/Dockerfile
index 91e6a876..1ea7d22d 100644
--- a/software/landing/Dockerfile
+++ b/software/landing/Dockerfile
@@ -36,6 +36,9 @@ COPY software/landing/modules/ modules/
 # Copy training content from root
 COPY training/ training/
 
+# Decompress pre-built flash dump challenge files
+RUN gunzip -k /CybICS/training/flash_dump/flash_dump.bin.gz
+
 # Copy attack scripts to /usr/local/bin for easy access
 COPY training/flood_overwrite/flooding_hpt.py /usr/local/bin/flooding_hpt.py
 RUN chmod +x /usr/local/bin/flooding_hpt.py
diff --git a/software/landing/app.py b/software/landing/app.py
index fc0a96bd..adb60f75 100644
--- a/software/landing/app.py
+++ b/software/landing/app.py
@@ -219,6 +219,30 @@ def challenge_detail(challenge_id):
                          solved=challenge_id in session['solved_challenges'],
                          challenge_type=challenge.get('type', 'offensive'))
 
+@app.route('/ctf/download/<challenge_id>')
+def challenge_download(challenge_id):
+    """Serve a downloadable file for a challenge"""
+    import os as _os
+    from flask import send_file as _send_file
+    print("DOWNLOAD-HEADERS:", dict(request.headers))
+    challenge, _ = ctf_manager.get_challenge(challenge_id)
+    if not challenge or 'download' not in challenge:
+        return "File not found", 404
+    filename = challenge['download']
+    file_path = _os.path.abspath(_os.path.join(
+        _os.path.dirname(__file__), 'training', challenge_id, filename
+    ))
+    if not _os.path.isfile(file_path):
+        return f"File '{filename}' not found on server {file_path}", 404
+    return _send_file(
+        file_path,
+        as_attachment=True,
+        download_name=filename,
+        conditional=False
+    )
+    response = _send_file(file_path, as_attachment=True, download_name=filename)
+    return response
+
 @app.route('/ctf/verify/<challenge_id>', methods=['POST'])
 def verify_defense(challenge_id):
     """Verify a defense challenge and auto-submit flag on success"""
diff --git a/software/landing/ctf_config.json b/software/landing/ctf_config.json
index c5fb48d8..8d7f35b3 100644
--- a/software/landing/ctf_config.json
+++ b/software/landing/ctf_config.json
@@ -3,7 +3,7 @@
   "description": "Industrial Control Systems Security Training Platform",
   "categories": {
     "basic_understanding": {
-      "name": "🏭 Basic Understanding",
+      "name": "\ud83c\udfed Basic Understanding",
       "description": "Fundamental understanding of industrial processes and control systems",
       "challenges": [
         {
@@ -29,7 +29,7 @@
       ]
     },
     "network_analysis": {
-      "name": "🔍 Network Analysis",
+      "name": "\ud83d\udd0d Network Analysis",
       "description": "Network reconnaissance and traffic analysis techniques",
       "challenges": [
         {
@@ -65,7 +65,7 @@
       ]
     },
     "security_testing": {
-      "name": "⚔️ Security Testing",
+      "name": "\u2694\ufe0f Security Testing",
       "description": "Test system resilience and security mechanisms",
       "challenges": [
         {
@@ -111,7 +111,7 @@
       ]
     },
     "advanced_security": {
-      "name": "🔐 Advanced Security",
+      "name": "\ud83d\udd10 Advanced Security",
       "description": "Advanced attack and detection techniques",
       "challenges": [
         {
@@ -137,11 +137,11 @@
         {
           "id": "detect_basic",
           "title": "Detect Port Scan",
-          "description": "Perform a port scan and verify the IDS detected it — find the flag in the IDS rule stats",
+          "description": "Perform a port scan and verify the IDS detected it \u2014 find the flag in the IDS rule stats",
           "points": 250,
           "tag": "analysis",
           "flag": "CybICS(sc4n_d3tect3d)",
-          "hint": "Run a port scan, then query the IDS at /api/rules/stats — the flag appears when the port_scan rule has fired",
+          "hint": "Run a port scan, then query the IDS at /api/rules/stats \u2014 the flag appears when the port_scan rule has fired",
           "training_content": "training/detect_basic/README.md"
         },
         {
@@ -151,14 +151,35 @@
           "points": 400,
           "tag": "analysis",
           "flag": "CybICS(m0dbus_fl00d_d3tect3d)",
-          "hint": "Run the override script, then query /api/rules/stats — the flag appears when the modbus_flood rule fires",
+          "hint": "Run the override script, then query /api/rules/stats \u2014 the flag appears when the modbus_flood rule fires",
           "training_content": "training/detect_overwrite/README.md"
+        },
+        {
+          "id": "buffer_overflow",
+          "title": "Stack Smashing the PLC Diagnostics Service",
+          "description": "A forgotten maintenance binary on the attack machine contains a classic stack buffer overflow. Reverse-engineer it, find the vulnerable function, and redirect execution to capture the flag.",
+          "points": 350,
+          "tag": "exploit",
+          "flag": "CybICS(buff3r_0v3rfl0w_pwn3d)",
+          "hint": "Compile the binary with make, then use GDB + pwndbg: cyclic to find the offset, nm to find the target function address, and python3 + struct.pack to craft the payload.",
+          "training_content": "training/buffer_overflow/README.md"
+        },
+        {
+          "id": "flash_dump",
+          "title": "Flash Dump Analysis",
+          "description": "A flash memory dump from an industrial controller was obtained via its debug port. The firmware is encrypted — but the device boots without user input. Analyse the dump, reverse-engineer the unlock binary, and decrypt the firmware partition.",
+          "points": 400,
+          "tag": "reverse-engineering",
+          "flag": "CybICS(fl4sh_dump_4nalyz3d)",
+          "hint": "Start with binwalk to find what's in the dump. Then look for an EXT filesystem — it contains a binary that reveals where the key is stored.",
+          "training_content": "training/flash_dump/README.md",
+          "download": "flash_dump.bin"
         }
       ]
     },
     "ids_challenges": {
-      "name": "🔍 IDS Challenges",
-      "description": "Interact with the Intrusion Detection System — trigger alerts, analyze incidents, and evade detection",
+      "name": "\ud83d\udd0d IDS Challenges",
+      "description": "Interact with the Intrusion Detection System \u2014 trigger alerts, analyze incidents, and evade detection",
       "challenges": [
         {
           "id": "ids_challenge",
@@ -193,7 +214,7 @@
       ]
     },
     "defense": {
-      "name": "🛡️ Defense & Hardening",
+      "name": "\ud83d\udee1\ufe0f Defense & Hardening",
       "description": "Harden the ICS environment by applying defensive security measures",
       "challenges": [
         {
@@ -259,4 +280,4 @@
       ]
     }
   }
-}
+}
\ No newline at end of file
diff --git a/software/landing/templates/challenge.html b/software/landing/templates/challenge.html
index 531c35f2..d5ae2ae4 100644
--- a/software/landing/templates/challenge.html
+++ b/software/landing/templates/challenge.html
@@ -559,6 +559,16 @@ <h1>{{ challenge.title }}</h1>
         <!-- Main content -->
         <div class="main-content">
             {% if training_content %}
+            {% if challenge.download %}
+            <div style="margin-bottom:1.5rem;">
+                <a href="/ctf/download/{{ challenge.id }}"
+                    target="_top"
+                    download
+                    style="display:inline-block;padding:0.5rem 1.25rem;background:#ff6b00;color:#1a1a1a;font-weight:700;border-radius:0.375rem;text-decoration:none;">
+                        &#11015; Download {{ challenge.download }}
+                </a>
+            </div>
+            {% endif %}
             <div class="training-content" id="training-content">
                 {{ training_content | safe }}
             </div>
diff --git a/software/landing/templates/index.html b/software/landing/templates/index.html
index 226403b5..0968f681 100644
--- a/software/landing/templates/index.html
+++ b/software/landing/templates/index.html
@@ -1831,7 +1831,7 @@ <h2>Welcome to CybICS</h2>
                     title="CTF Training"
                     allow="fullscreen"
                     allowfullscreen="true"
-                    sandbox="allow-same-origin allow-scripts allow-popups allow-forms"
+                    sandbox="allow-same-origin allow-scripts allow-popups allow-forms allow-downloads"
                 ></iframe>
             </div>
 
diff --git a/training/buffer_overflow/Makefile b/training/buffer_overflow/Makefile
new file mode 100644
index 00000000..2bd4319e
--- /dev/null
+++ b/training/buffer_overflow/Makefile
@@ -0,0 +1,32 @@
+# CybICS Buffer Overflow Challenge – Build System
+#
+# Compiler flags chosen deliberately for the challenge:
+#   -fno-stack-protector   disable stack canaries (no SSP cookie)
+#   -no-pie                produce a non-position-independent executable
+#                          so that function addresses are fixed at link time
+#   -O0                    no optimisation – keeps stack frames predictable
+#   -z execstack           mark the stack executable
+#
+# ASLR must be disabled at runtime (see README).
+
+CC      = gcc
+CFLAGS  = -O0 -fno-stack-protector -no-pie -z execstack -g
+TARGET  = plc_diagnostics
+SRC     = plc_diagnostics.c
+
+.PHONY: all clean run
+
+all: $(TARGET)
+
+$(TARGET): $(SRC)
+	$(CC) $(CFLAGS) -o $(TARGET) $(SRC)
+	@echo ""
+	@echo "[+] Binary compiled: ./$(TARGET)"
+	@echo "[+] Compile flags: $(CFLAGS)"
+	@echo ""
+
+clean:
+	rm -f $(TARGET)
+
+run: $(TARGET)
+	./$(TARGET)
diff --git a/training/buffer_overflow/README.md b/training/buffer_overflow/README.md
new file mode 100644
index 00000000..44c121a0
--- /dev/null
+++ b/training/buffer_overflow/README.md
@@ -0,0 +1,241 @@
+# Stack Smashing the PLC Diagnostics Service
+
+> **MITRE ATT&CK for ICS:** `Execution` | [T0807 - Command-Line Interface](https://attack.mitre.org/techniques/T0807/) | [T0862 - Supply Chain Compromise](https://attack.mitre.org/techniques/T0862/)
+
+## Overview
+
+A forgotten **internal maintenance binary** (`plc_diagnostics`) has been discovered on the attack machine. It was written years ago by a field engineer and never audited for security. The binary contains a classic **stack-based buffer overflow** — user input is copied into a fixed-size stack buffer without any length check, allowing an attacker to overwrite the return address and redirect execution.
+
+This technique is called **ret2win**: you overflow the buffer until you reach the return address on the stack, then replace it with the address of a hidden function that prints the flag.
+
+```
+Stack frame of run_diagnostic():
+
+  [ cmd_buffer (64 bytes) ][ saved RBP (8 bytes) ][ return address (8 bytes) ]
+   ←────── overflow with padding ───────────────────→ ← overwrite with target →
+
+Goal: replace the return address with the address of maintenance_shell()
+```
+
+## Prerequisites
+
+- Access to the attack machine (`http://localhost:6081/vnc.html`) or the webshell
+- The challenge files are located at `/opt/challenges/buffer_overflow/` on the attack machine
+- Tools required: `gcc`, `pwndbg`, `python3`, `nm`, `checksec`
+
+## Task
+
+Analyse the binary, find the vulnerability, determine the exact overflow offset, and redirect execution to the hidden `maintenance_shell()` function to capture the flag.
+
+The flag has the format `CybICS(flag)`.
+
+---
+
+### Phase 1: Setup & Reconnaissance
+
+- Copy the challenge files to your working directory and compile the binary:
+
+```bash
+cp -r /opt/challenges/buffer_overflow ~/Desktop/bof_challenge
+cd ~/Desktop/bof_challenge
+make
+```
+
+- Run the binary normally to understand its behaviour:
+
+```bash
+./plc_diagnostics
+```
+
+   Enter an input when prompted and observe the output.
+
+- Check what security protections are active:
+
+   ```bash
+   checksec --file=./plc_diagnostics
+   ```
+
+   You should see: **No canary**, **No PIE**, **NX disabled** — ideal conditions for a stack overflow.
+
+
+   <details>
+   <summary>Binary Compiler Flags</summary>
+
+   <ul style="padding-left: 40px;">
+    <li><code>-fno-stack-protector</code> → disables stack canaries</li>
+    <li><code>-no-pie</code> → disables PIE, resulting in fixed addresses</li>
+    <li><code>-z execstack</code> → marks the stack as executable</li>
+    <li>
+   <a href="https://caiorss.github.io/C-Cpp-Notes/compiler-flags-options.html">
+      Learn more about C compiler flags
+   </a>
+    </li>
+  </ul>
+
+   </details>
+
+
+- List all function symbols and their addresses:
+
+   ```bash
+   nm ./plc_diagnostics | grep -E "maintenance|run_diag|main"
+   ```
+
+   **Write down the address of `maintenance_shell`** — this is your target jump address.
+
+- Read the source code and find the vulnerability:
+
+   ```bash
+   cat plc_diagnostics.c
+   ```
+
+   What makes this binary exploitable?
+
+   <details>
+   <summary>Hint</summary>
+
+   <ul style="padding-left: 40px;">
+      <li>C has some unsafe functions. Look for one.</li> 
+      <li><a href="https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/dangers-c.html">
+      Learn more about unsafe functions
+   </a></li>
+  </ul>
+
+   </details>
+
+   <details>
+   <summary>Solution</summary>
+
+   <div style="padding: 10px;">
+   Look for the unsafe `strcpy()` call inside `run_diagnostic()`. Unlike `strncpy()`, `strcpy()` copies until it hits a null byte with no regard for the destination buffer size.
+   </div>
+
+   </details>
+
+
+### Phase 2: Find the Overflow Offset
+
+You need to know exactly how many bytes of padding are required before you reach the return address on the stack.
+
+- Open the binary in pwndbg:
+
+   ```bash
+   pwndbg ./plc_diagnostics
+   ```
+
+- Generate a cyclic pattern with pwndbg. Every 8-byte subsequence in this pattern is unique, which lets you pinpoint the exact offset after a crash:
+
+   ```
+   pwndbg> cyclic <charLength>
+   ```
+
+   Try different input lengths.
+
+   <details>
+   <summary>Hint</summary>
+
+   <div style="padding: 10px;">
+   Try it with a length of 100
+   </div>
+
+   </details>
+
+
+
+- Run the program and paste the full character pattern when prompted:
+
+   ```
+   pwndbg> run
+   ```
+
+   If the cyclic pattern is long enough, the program will crash with a **Segmentation Fault**.
+
+- If a **Segmentation Fault** is triggered, find the unique cyclic pattern value that was written as the return address on the stack.
+
+   <details>
+   <summary>Hint</summary>
+
+   <div style="padding: 10px;">
+   Try to find a command in pwndbg that allows you to read the stack value that the stack pointer (RSP) points to.
+   </div>
+
+   </details>
+
+   <details>
+   <summary>Solution</summary>
+
+   <div style="padding: 10px;">
+   Use the following command to extract the pattern that was written to the return address on the stack:
+   </div>
+
+   ```bash
+   x/1gx $rsp
+   ```
+
+   </details>
+
+- If the cyclic pattern is found, try to get the offset for the return address which cyclic
+
+   <details>
+   <summary>Solution</summary>
+
+   <div style="padding: 10px;">
+   Use following command to extract the offset of the return address with the previous found return address pattern.
+   </div>
+
+   ```bash
+      cyclic -l <unique_pattern>
+   ```
+   
+   <div style="padding: 10px;">
+   The result is your offset — it should be **72** (64 bytes for `cmd_buffer` + 8 bytes for saved RBP on x86-64).
+   </div>
+
+   </details>
+
+
+### Phase 3: Craft and Send the Exploit
+
+Use the standalone exploit script `exploit.py` to obtain the flag:
+
+   Update `<MAINTENANCE_ADDR>` with the real address and `<OFFSET>` with the offset, then run:
+
+   ```bash
+   python3 exploit.py
+   ```
+
+
+Submit the flag in the CTF dashboard.
+
+## 🛡️ Security Framework References
+
+<details>
+<summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS — Techniques Applied
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Execution | Command-Line Interface | [T0807](https://attack.mitre.org/techniques/T0807/) | Executing code via a vulnerable process |
+| Initial Access | Supply Chain Compromise | [T0862](https://attack.mitre.org/techniques/T0862/) | Exploiting unaudited legacy software |
+| Execution | Exploitation for Client Execution | [T0853](https://attack.mitre.org/techniques/T0853/) | Exploiting memory corruption to execute arbitrary code |
+
+### MITRE CWE — Weaknesses Exploited
+
+| CWE | Name | Description |
+|-----|------|-------------|
+| [CWE-121](https://cwe.mitre.org/data/definitions/121.html) | Stack-based Buffer Overflow | Writing beyond `cmd_buffer[64]` into adjacent stack memory |
+| [CWE-676](https://cwe.mitre.org/data/definitions/676.html) | Use of Potentially Dangerous Function | Using `strcpy()` instead of `strncpy()` or `strlcpy()` |
+| [CWE-242](https://cwe.mitre.org/data/definitions/242.html) | Use of Inherently Dangerous Function | `strcpy()` is listed as inherently unsafe |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Information Integrity (SI)** | SI-2, SI-16 | Flaw remediation, memory protection |
+| **System and Communications Protection (SC)** | SC-39 | Process isolation |
+| **Risk Assessment (RA)** | RA-5 | Vulnerability scanning of ICS software |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2 highlights that legacy ICS software often lacks modern security controls such as stack canaries, ASLR, and safe string-handling functions. SI-2 (Flaw Remediation) requires organisations to identify and patch vulnerable binaries. RA-5 (Vulnerability Scanning) recommends static analysis tools such as `flawfinder` or `cppcheck` to detect unsafe function calls like `strcpy()` before deployment.
+
+</details>
diff --git a/training/buffer_overflow/exploit.py b/training/buffer_overflow/exploit.py
new file mode 100644
index 00000000..3f1ea080
--- /dev/null
+++ b/training/buffer_overflow/exploit.py
@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+import struct
+import subprocess
+
+BINARY           = "./plc_diagnostics"
+MAINTENANCE_ADDR = 0x<TargetFunctionJumpAddress>  
+OFFSET           = <OFFSET>              
+
+payload = b"A" * OFFSET + struct.pack("<Q", MAINTENANCE_ADDR)
+
+print(f"[*] Sending {len(payload)}-byte payload to {BINARY}")
+subprocess.run([BINARY], input=payload)
\ No newline at end of file
diff --git a/training/buffer_overflow/plc_diagnostics.c b/training/buffer_overflow/plc_diagnostics.c
new file mode 100644
index 00000000..9cd03e33
--- /dev/null
+++ b/training/buffer_overflow/plc_diagnostics.c
@@ -0,0 +1,93 @@
+/*
+ * CybICS - PLC Diagnostics Service
+ * Version: 1.3.37
+ *
+ * Internal ICS diagnostic tool for querying PLC status.
+ * WARNING: This binary is only intended for internal maintenance use.
+ *
+ * Usage: ./plc_diagnostics
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/* --------------------------------------------------------------------------
+ * Internal maintenance backdoor - DO NOT EXPOSE TO NETWORK
+ * -------------------------------------------------------------------------- */
+void maintenance_shell(void) {
+    unsigned char encoded[] = {
+        0x19, 0x23, 0x38, 0x13, 0x19, 0x09, 0x72, 0x38,
+        0x2f, 0x3c, 0x3c, 0x69, 0x28, 0x05, 0x6a, 0x2c,
+        0x69, 0x28, 0x3c, 0x36, 0x6a, 0x2d, 0x05, 0x2a,
+        0x2d, 0x34, 0x69, 0x3e, 0x73,
+    };
+    unsigned char key = 0x5A;
+
+    char flag[sizeof(encoded) + 1];
+    for (size_t i = 0; i < sizeof(encoded); i++)
+        flag[i] = encoded[i] ^ key;
+    flag[sizeof(encoded)] = '\0';
+
+    printf("\n");
+    printf("  *** MAINTENANCE MODE ACTIVATED ***\n");
+    printf("  PLC Diagnostic System - Internal Access\n");
+    printf("  ----------------------------------------\n");
+    printf("  FLAG: %s\n", flag);
+    printf("\n");
+    fflush(stdout);
+    exit(0);
+}
+
+
+
+
+/* --------------------------------------------------------------------------
+ * Process a diagnostic command string from the operator console
+ * -------------------------------------------------------------------------- */
+void run_diagnostic(char *input) {
+    char cmd_buffer[64];   /* Fixed-size command buffer */
+
+    printf("[*] Running diagnostic: %s\n", input);
+
+    strcpy(cmd_buffer, input);
+
+    printf("[*] Diagnostic command stored at: %p\n", (void *)cmd_buffer);
+    printf("[+] Diagnostic completed successfully.\n");
+}
+
+/* --------------------------------------------------------------------------
+ * Banner
+ * -------------------------------------------------------------------------- */
+void print_banner(void) {
+    printf("╔══════════════════════════════════════════╗\n");
+    printf("║   CybICS PLC Diagnostics Service v1.3   ║\n");
+    printf("║   Internal Maintenance Tool              ║\n");
+    printf("╚══════════════════════════════════════════╝\n");
+    printf("\n");
+}
+
+/* --------------------------------------------------------------------------
+ * Main – reads a single diagnostic command from stdin
+ * -------------------------------------------------------------------------- */
+int main(void) {
+    char input[256];
+
+    print_banner();
+
+    printf("Enter diagnostic command (max 64 chars): ");
+    fflush(stdout);
+
+    if (fgets(input, sizeof(input), stdin) == NULL) {
+        fprintf(stderr, "[-] Read error.\n");
+        return 1;
+    }
+
+    /* Strip trailing newline */
+    input[strcspn(input, "\n")] = '\0';
+
+    run_diagnostic(input);
+
+    return 0;
+}
diff --git a/training/flash_dump/.gitignore b/training/flash_dump/.gitignore
new file mode 100644
index 00000000..77738287
--- /dev/null
+++ b/training/flash_dump/.gitignore
@@ -0,0 +1 @@
+dist/
\ No newline at end of file
diff --git a/training/flash_dump/README.md b/training/flash_dump/README.md
new file mode 100644
index 00000000..1061eee8
--- /dev/null
+++ b/training/flash_dump/README.md
@@ -0,0 +1,177 @@
+# Flash Dump Analysis
+
+> **MITRE ATT&CK for ICS:** `Collection` | [T0893 - Data from Local System](https://attack.mitre.org/techniques/T0893/) | [T0811 - Data from Information Repositories](https://attack.mitre.org/techniques/T0811/)
+
+## Overview
+
+During a physical security assessment of an industrial controller, you gained access to the device's **debug port (JTAG/SWD)**. Using this access you dumped the entire flash memory of the device.
+
+The manufacturer claims the firmware is protected by full-disk encryption. Your goal: **prove this protection is useless**, because the device must boot without user input — meaning the decryption key has to be stored unencrypted on the device itself.
+
+You are given:
+- `flash_dump.bin` — raw flash memory dump (download below)
+
+The flag is hidden inside the encrypted firmware partition.
+
+---
+
+## Task
+
+Analyse the flash dump, find and reverse-engineer the unlock binary embedded in it, extract the encryption key, and decrypt the firmware partition to read the flag.
+
+---
+
+### Phase 1: Reconnaissance
+
+Download `flash_dump.bin` and run `binwalk` to get an overview of what is inside:
+
+
+```bash
+binwalk flash_dump.bin
+```
+
+You should see two interesting structures at specific offsets. Note them down — you will need them in the next phases.
+
+<details>
+<summary>Hint</summary>
+
+Look for a **Linux EXT filesystem** and a **LUKS encrypted container**. Ignore false-positive hits from binwalk.
+
+</details>
+
+---
+
+### Phase 2: Extract and Mount the Filesystem
+
+Create a loop device for the EXT2 filesystem region and mount it read-only:
+
+```bash
+sudo losetup -f --show -o $((0x10000)) flash_dump.bin
+# note the loop device, e.g. /dev/loop0
+
+sudo mkdir -p /mnt/flash_ext2
+sudo mount -o ro /dev/loop0 /mnt/flash_ext2
+```
+
+Browse the filesystem and find the unlock binary:
+
+```bash
+sudo tree -a /mnt/flash_ext2
+cp /mnt/flash_ext2/usr/sbin/unlock_firmware ./unlock_firmware
+```
+
+Cleanup when done:
+
+```bash
+sudo umount /mnt/flash_ext2
+sudo losetup -d /dev/loop0
+```
+
+---
+
+### Phase 3: Reverse Engineer the Binary
+
+Analyse `unlock_firmware` to find where it reads the decryption key from.
+
+Start with a quick inspection:
+
+```bash
+strings unlock_firmware
+```
+
+What device path does it reference? What does it call to unlock the partition?
+
+Now open it in **Ghidra** (or `objdump -d unlock_firmware`) and find the `main()` function. Look for the `lseek()` call — its second argument is the byte offset where the key is stored in the flash.
+
+<details>
+<summary>Hint</summary>
+
+The binary seeks to a constant called `BASE_INIT` before reading 32 bytes. Find the numeric value of this constant in the disassembly — it is the second argument passed to `lseek()`.
+
+</details>
+
+<details>
+<summary>Solution</summary>
+
+The `lseek()` call uses the immediate value `0x80` (decimal 128) as the seek offset. This means the 32-byte LUKS key is stored at byte offset `0x80` in the flash dump.
+
+</details>
+
+---
+
+### Phase 4: Extract the Key
+
+Use `dd` to extract the 32-byte key from the dump at the offset you found:
+
+```bash
+dd if=flash_dump.bin bs=1 skip=$((0x80)) count=32 of=key.bin
+xxd key.bin    # verify it looks like 32 bytes of random data
+```
+
+---
+
+### Phase 5: Open the LUKS Container
+
+Create a loop device for the LUKS region and open it with the extracted key:
+
+```bash
+sudo losetup -f --show -o $((0x200000)) flash_dump.bin
+# note the loop device, e.g. /dev/loop1
+
+sudo cryptsetup open --type luks2 --key-file key.bin /dev/loop1 flash_challenge_luks
+```
+
+Mount the decrypted container and read the flag:
+
+```bash
+sudo mkdir -p /mnt/flash_luks
+sudo mount /dev/mapper/flash_challenge_luks /mnt/flash_luks
+
+cat /mnt/flash_luks/firmware/flag.txt
+```
+
+---
+
+### Cleanup
+
+```bash
+sudo umount /mnt/flash_luks
+sudo cryptsetup close flash_challenge_luks
+sudo losetup -d /dev/loop1
+rm key.bin
+```
+
+---
+
+## 🛡️ Security Framework References
+
+<details>
+<summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS — Techniques Applied
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Collection | Data from Local System | [T0893](https://attack.mitre.org/techniques/T0893/) | Reading key material directly from device storage |
+| Collection | Data from Information Repositories | [T0811](https://attack.mitre.org/techniques/T0811/) | Extracting firmware from encrypted partition |
+| Initial Access | Exploit Public-Facing Application | [T0819](https://attack.mitre.org/techniques/T0819/) | Debug port access to dump flash memory |
+
+### MITRE CWE — Weaknesses Exploited
+
+| CWE | Name | Description |
+|-----|------|-------------|
+| [CWE-321](https://cwe.mitre.org/data/definitions/321.html) | Use of Hard-coded Cryptographic Key | Decryption key stored in plaintext at a fixed offset |
+| [CWE-312](https://cwe.mitre.org/data/definitions/312.html) | Cleartext Storage of Sensitive Information | Key is readable by anyone with physical flash access |
+| [CWE-693](https://cwe.mitre.org/data/definitions/693.html) | Protection Mechanism Failure | Encryption provides no real security when key is co-located |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------| 
+| **System and Communications Protection (SC)** | SC-12, SC-28 | Cryptographic key management, protection of data at rest |
+| **Physical and Environmental Protection (PE)** | PE-3 | Physical access controls to prevent debug port access |
+| **Configuration Management (CM)** | CM-6 | Secure configuration — debug interfaces should be disabled in production |
+
+**Why this matters in ICS:** NIST 800-82r3 Section 6.2 highlights that embedded ICS devices frequently store credentials and keys in unprotected flash memory. SC-12 requires proper key management — keys must never be stored adjacent to the data they protect without additional protection mechanisms such as a TPM or secure enclave.
+
+</details>
\ No newline at end of file
diff --git a/training/flash_dump/build.sh b/training/flash_dump/build.sh
new file mode 100755
index 00000000..b54785a0
--- /dev/null
+++ b/training/flash_dump/build.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# =============================================================================
+# training/flash_dump/build.sh
+#
+# Run from within training/flash_dump/:
+#   sudo ./build.sh
+#
+# Outputs:
+#   flash_dump.bin.gz     <- commit this into the repo
+#   dist/flash_dump.bin   <- local uncompressed copy (gitignored)
+#   dist/unlock_firmware  <- local compiled binary (gitignored)
+#
+# Flash layout:
+#   0x000000  boot header + partition table
+#   0x000080  32-byte LUKS key
+#   0x010000  ext2 filesystem (contains unlock_firmware)
+#   0x200000  LUKS2 container (contains flag.txt)
+#
+# Requirements: gcc, cryptsetup, python3, mke2fs (e2fsprogs), gzip
+# Must be run as root (cryptsetup + mount needs it)
+# =============================================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DIST_DIR="$SCRIPT_DIR/dist"
+
+# --- constants ----------------------------------------------------------------
+KEY_OFFSET=128          # 0x80
+KEY_LEN=32
+EXT2_OFFSET=65536       # 0x10000
+EXT2_SIZE_MB=1
+LUKS_OFFSET=2097152     # 0x200000
+LUKS_SIZE_MB=32
+FLASH_SIZE_MB=64
+FLAG="CybICS(fl4sh_dump_4nalyz3d)"
+
+OUT_DUMP="$DIST_DIR/flash_dump.bin"
+OUT_BINARY="$DIST_DIR/unlock_firmware"
+OUT_LUKS="$DIST_DIR/luks.img"
+OUT_EXT2="$DIST_DIR/rootfs.img"
+OUT_GZ="$SCRIPT_DIR/flash_dump.bin.gz"
+
+MAPPER="flash_challenge_luks"
+MNT_LUKS="/tmp/flash_challenge_luks"
+MNT_EXT2="/tmp/flash_challenge_ext2"
+
+# --- helpers ------------------------------------------------------------------
+info() { echo "[*] $*"; }
+ok()   { echo "[+] $*"; }
+err()  { echo "[-] $*" >&2; exit 1; }
+
+# --- checks -------------------------------------------------------------------
+[[ $EUID -eq 0 ]] || err "Run as root (needed for cryptsetup + mount)"
+command -v gcc        &>/dev/null || err "gcc not found"
+command -v cryptsetup &>/dev/null || err "cryptsetup not found"
+command -v python3    &>/dev/null || err "python3 not found"
+command -v mke2fs     &>/dev/null || err "mke2fs not found (install e2fsprogs)"
+command -v gzip       &>/dev/null || err "gzip not found"
+
+# --- setup dist dir -----------------------------------------------------------
+mkdir -p "$DIST_DIR"
+
+# --- compile binary -----------------------------------------------------------
+info "Compiling unlock_firmware..."
+gcc -O0 -g -o "$OUT_BINARY" "$SCRIPT_DIR/unlock_firmware.c"
+ok "dist/unlock_firmware compiled"
+
+# --- generate key -------------------------------------------------------------
+info "Generating 32-byte LUKS key..."
+python3 -c "
+import secrets, sys
+key = secrets.token_bytes(32)
+open('$DIST_DIR/key.bin','wb').write(key)
+sys.stderr.write('[+] Key: ' + key.hex() + '\n')
+"
+
+# --- create ext2 with unlock_firmware -----------------------------------------
+info "Creating ext2 rootfs (${EXT2_SIZE_MB}MB)..."
+dd if=/dev/zero of="$OUT_EXT2" bs=1M count=$EXT2_SIZE_MB status=none
+mke2fs -t ext2 -L "rootfs" "$OUT_EXT2" 2>/dev/null
+mkdir -p "$MNT_EXT2"
+mount -o loop "$OUT_EXT2" "$MNT_EXT2"
+mkdir -p "$MNT_EXT2/usr/sbin"
+cp "$OUT_BINARY" "$MNT_EXT2/usr/sbin/unlock_firmware"
+umount "$MNT_EXT2"
+rmdir "$MNT_EXT2"
+ok "ext2 rootfs ready"
+
+# --- create LUKS container ----------------------------------------------------
+info "Creating LUKS2 container (${LUKS_SIZE_MB}MB)..."
+dd if=/dev/zero of="$OUT_LUKS" bs=1M count=$LUKS_SIZE_MB status=none
+cryptsetup luksFormat --type luks2 --batch-mode --key-file "$DIST_DIR/key.bin" "$OUT_LUKS"
+cryptsetup open --type luks2 --key-file "$DIST_DIR/key.bin" "$OUT_LUKS" "$MAPPER"
+mkfs.ext4 -q -L "firmware" /dev/mapper/$MAPPER
+mkdir -p "$MNT_LUKS"
+mount /dev/mapper/$MAPPER "$MNT_LUKS"
+mkdir -p "$MNT_LUKS/firmware"
+echo "$FLAG" > "$MNT_LUKS/firmware/flag.txt"
+cat > "$MNT_LUKS/firmware/version.txt" << 'EOF'
+CybICS Industrial Controller Firmware
+Version: 1.4.2
+This firmware is proprietary and confidential.
+EOF
+umount "$MNT_LUKS"
+cryptsetup close "$MAPPER"
+rmdir "$MNT_LUKS"
+ok "LUKS container ready"
+
+# --- assemble flash dump ------------------------------------------------------
+info "Assembling flash_dump.bin (${FLASH_SIZE_MB}MB)..."
+dd if=/dev/zero of="$OUT_DUMP" bs=1M count=$FLASH_SIZE_MB status=none
+
+python3 << PYEOF
+import struct
+
+data = bytearray(open("$OUT_DUMP", "rb").read())
+data[0:10] = b'\xEB\x58\x90CYBFLSH1\x00'
+data[0x10:0x20] = struct.pack("<IIII", 0x80,     0x80,      0xCAFE, 0x01)
+data[0x20:0x30] = struct.pack("<IIII", 0x10000,  0x100000,  0xDEAD, 0x02)
+data[0x30:0x40] = struct.pack("<IIII", 0x200000, 0x2000000, 0xBEEF, 0x03)
+key = open("$DIST_DIR/key.bin", "rb").read()
+data[$KEY_OFFSET : $KEY_OFFSET + $KEY_LEN] = key
+open("$OUT_DUMP", "wb").write(data)
+PYEOF
+
+dd if="$OUT_EXT2" of="$OUT_DUMP" bs=512 seek=$(( EXT2_OFFSET / 512 )) conv=notrunc status=none
+dd if="$OUT_LUKS" of="$OUT_DUMP" bs=512 seek=$(( LUKS_OFFSET / 512 )) conv=notrunc status=none
+ok "Flash dump assembled"
+
+# --- cleanup intermediate files -----------------------------------------------
+rm -f "$DIST_DIR/key.bin" "$OUT_LUKS" "$OUT_EXT2"
+
+# --- compress for repo --------------------------------------------------------
+info "Compressing -> flash_dump.bin.gz..."
+gzip -9 -c "$OUT_DUMP" > "$OUT_GZ"
+ok "$(du -h "$OUT_GZ" | cut -f1) -> flash_dump.bin.gz"
+
+# --- done ---------------------------------------------------------------------
+echo ""
+ok "====================================="
+ok " dist/flash_dump.bin   $(du -h "$OUT_DUMP"   | cut -f1)  (local only)"
+ok " dist/unlock_firmware  $(du -h "$OUT_BINARY" | cut -f1)  (local only)"
+ok " flash_dump.bin.gz     $(du -h "$OUT_GZ"     | cut -f1)  (commit this)"
+ok "====================================="
\ No newline at end of file
diff --git a/training/flash_dump/flash_dump.bin.gz b/training/flash_dump/flash_dump.bin.gz
new file mode 100644
index 00000000..be7237f1
Binary files /dev/null and b/training/flash_dump/flash_dump.bin.gz differ
diff --git a/training/flash_dump/unlock_firmware.c b/training/flash_dump/unlock_firmware.c
new file mode 100644
index 00000000..9ab93cb8
--- /dev/null
+++ b/training/flash_dump/unlock_firmware.c
@@ -0,0 +1,34 @@
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define FLASH_DEV   "/dev/mmcblk0"
+#define LUKS_DEV    "/dev/mmcblk0p2"
+#define MAPPER_NAME "firmware"
+#define BASE_INIT   0x80
+#define KEY_LENGTH  32
+
+int main(void) {
+    unsigned char key[KEY_LENGTH];
+    char key_path[] = "/tmp/.fwkey_XXXXXX";
+    char cmd[256];
+    int fd, kfd;
+
+    fd = open(FLASH_DEV, O_RDONLY);
+    lseek(fd, BASE_INIT, SEEK_SET);
+    read(fd, key, KEY_LENGTH);
+    close(fd);
+
+    kfd = mkstemp(key_path);
+    write(kfd, key, KEY_LENGTH);
+    close(kfd);
+
+    snprintf(cmd, sizeof(cmd),
+        "cryptsetup open --type luks2 --key-file %s %s %s",
+        key_path, LUKS_DEV, MAPPER_NAME);
+    system(cmd);
+
+    unlink(key_path);
+    return 0;
+}
\ No newline at end of file