spoof 4

intercepting-communication/module.yml

@@ -39,6 +39,10 @@ challenges:
   name: UDP Spoofing 2
 - id: udp-spoof-host-3
   name: UDP Spoofing 3
+- id: udp-spoof-host-4
+  name: UDP Spoofing 4
+  visibility:
+    start: "2029-11-04T13:00:00-07:00"
 - id: level-12
   name: ARP
 - id: level-13

intercepting-communication/udp-spoof-host-4/.init

@@ -0,0 +1 @@
+../.init

intercepting-communication/udp-spoof-host-4/DESCRIPTION.md

@@ -0,0 +1,6 @@
+Let's up the game a bit: this challenge checks that the response came from the right server!
+Luckily, UDP is a lot easier to forge than TCP.
+In TCP, forging a server response requires you to know sequence numbers and a whole bunch of other inconvenient-to-guess information.
+Not so with UDP!
+
+Go ahead and craft the server response with scapy, as you've done with TCP, and let's see that flag fly!

intercepting-communication/udp-spoof-host-4/run

@@ -0,0 +1,46 @@
+#!/usr/bin/exec-suid --real -- /usr/bin/python -I
+
+import psutil
+import socket
+import time
+import os
+
+from dojjail import Host, Network
+
+flag = open("/flag").read()
+parent_process = psutil.Process(os.getppid())
+
+class ServerHost(Host):
+    def entrypoint(self):
+        server_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        server_socket.bind(("0.0.0.0", 31337))
+        while True:
+            try:
+                client_message, (client_host, client_port) = server_socket.recvfrom(1024)
+                if client_message.strip() == b"ACTION?":
+                    server_socket.sendto(b"NONE", (client_host, client_port))
+            except ConnectionError:
+                continue
+
+class ClientHost(Host):
+    def entrypoint(self):
+        client_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        while True:
+            try:
+                client_socket.sendto(b"ACTION?", ("10.0.0.3", 31337))
+                message, (peer_host, peer_port) = client_socket.recvfrom(1024)
+                if peer_host == "10.0.0.3" and peer_port == 31337 and message.startswith(b"FLAG"):
+                    _, flag_host, flag_port = message.strip().split(b":")
+                    client_socket.sendto(flag.encode(), (flag_host, int(flag_port)))
+
+                time.sleep(1)
+            except (ConnectionError, ValueError):
+                continue
+
+user_host = Host("ip-10-0-0-1", privileged_uid=parent_process.uids().effective)
+client_host = ClientHost("ip-10-0-0-2")
+server_host = ServerHost("ip-10-0-0-3")
+network = Network(hosts={user_host: "10.0.0.1", client_host: "10.0.0.2", server_host: "10.0.0.3"}, subnet="10.0.0.0/24")
+network.run()
+
+user_host.interactive(environ=parent_process.environ())