spoof-host

intercepting-communication/module.yml

@@ -33,6 +33,10 @@ challenges:
   name: UDP
 - id: udp-2
   name: UDP 2
+- id: udp-spoof-host
+  name: UDP 2
+  visibility:
+    start: "2029-11-04T13:00:00-07:00"
 - id: level-12
   name: ARP
 - id: level-13

intercepting-communication/udp-spoof-host/.init

@@ -0,0 +1 @@
+../.init

intercepting-communication/udp-spoof-host/DESCRIPTION.md

@@ -0,0 +1,9 @@
+Though we didn't explore this for TCP, in addition to selecting the destination port, both TCP and UDP can set their _source_ port.
+We'll practice that here --- you can set the source port with `s.bind` on the socket, exactly how a server does it to set their listening port.
+Read the source code of `/challenge/run` to see what source port you'll need!
+
+----
+
+**NOTE:**
+You must set the source port _before_ sending data!
+Otherwise, Linux will pick a random source port (the default behavior, when `bind` is not called).

intercepting-communication/udp-spoof-host/run

@@ -0,0 +1,43 @@
+#!/usr/bin/exec-suid --real -- /usr/bin/python -I
+
+import psutil
+import socket
+import os
+
+from dojjail import Host, Network
+
+flag = open("/flag").read()
+parent_process = psutil.Process(os.getppid())
+
+class ServerHost(Host):
+    def entrypoint(self):
+        server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        server_socket.bind(("0.0.0.0", 31337))
+        while True:
+            try:
+                client_message, (client_host, client_port) = server_socket.recvfrom(1024)
+                if client_message.strip() == b"ACTION?":
+                    server_socket.sendto(b"NONE", (client_host, client_port))
+            except ConnectionError:
+                continue
+
+class ClientHost(Host):
+    def entrypoint(self):
+        client_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        client_socket.bind(("0.0.0.0", 31338))
+        while True:
+            try:
+                server_socket.sendto(b"ACTION?", ("10.0.0.3", 31337))
+                message, (peer_host, peer_port) = server_socket.recvfrom(1024)
+                if peer_port == 31337 and message.strip() == b"FLAG":
+                    print(f"YOUR FLAG: {flag}")
+            except ConnectionError:
+                continue
+
+user_host = Host("ip-10-0-0-1", privileged_uid=parent_process.uids().effective)
+client_host = ClientHost("ip-10-0-0-2")
+server_host = ServerHost("ip-10-0-0-3")
+network = Network(hosts={user_host: "10.0.0.1", client_host: "10.0.0.2", server_host: "10.0.0.3"}, subnet="10.0.0.0/24")
+network.run()
+
+user_host.interactive(environ=parent_process.environ())