sniff

intercepting-communication/module.yml

@@ -17,6 +17,10 @@ challenges:
   name: Monitor 1
 - id: level-6
   name: Monitor 2
+- id: sniff-cookie
+  name: Sniffing Cookies
+  visibility:
+    start: "2029-11-04T13:00:00-07:00"
 - id: level-7
   name: Network Configuration
 - id: level-8

intercepting-communication/sniff-cookie/.init

@@ -0,0 +1 @@
+../.init

intercepting-communication/sniff-cookie/DESCRIPTION.md

@@ -0,0 +1,3 @@
+You have learned to sniff traffic, but knowledge is only the beginning of action.
+Now it's time to apply this to an actual security scenario.
+Steal the admin's cookie, and GET the flag!

intercepting-communication/sniff-cookie/run

@@ -0,0 +1,57 @@
+#!/usr/bin/exec-suid --real -- /usr/bin/python -I
+
+import requests
+import random
+import psutil
+import socket
+import string
+import flask
+import time
+import os
+
+from dojjail import Host, Network
+
+flag = open("/flag").read()
+parent_process = psutil.Process(os.getppid())
+admin_pw = "".join(random.sample(string.ascii_letters*10, 8))
+
+class ClientHost(Host):
+    def entrypoint(self):
+        time.sleep(2)
+        s = requests.Session()
+        assert s.post("http://10.0.0.2/login", data={"username":"admin", "password":admin_pw}).status_code == 200
+        while True:
+            try:
+                s.get("http://10.0.0.2/ping")
+            except (OSError, ConnectionError, TimeoutError, RequestException):
+                continue
+
+class ServerHost(Host):
+    def entrypoint(self):
+        app = flask.Flask("server")
+
+        @app.route("/login", methods=["POST"])
+        def login():
+            username = flask.request.form.get("username")
+            password = flask.request.form.get("password")
+            if username == "admin" and password == admin_pw:
+                flask.session["user"] = "admin"
+
+        @app.route("/ping", methods=["GET"])
+        def ping():
+            return "pong"
+
+        @app.route("/flag", methods=["GET"])
+        def flag():
+            if flask.session["user"] != "admin":
+                flask.abort(403, "NOPE")
+            return flag
+
+        app.secret_key = os.urandom(8)
+        app.run("0.0.0.0", 80)
+
+client_host = ClientHost("ip-10-0-0-1", privileged_uid=parent_process.uids().effective)
+server_host = ServerHost("ip-10-0-0-2")
+network = Network(hosts={ client_host: "10.0.0.1", server_host: "10.0.0.2" }, subnet="10.0.0.0/24") network.run()
+
+client_host.interactive(environ=parent_process.environ())