Hacking Behind the Firewall

Linky was an RF math problem, introducing the link-budget algorithm and getting contestants to calculate missing parameters for the operation of the radio link. Years have passed since our satellite was designed, and the Systems Engineers didn't do a great job with the documentation. Partial information was left behind in the user documentation and we don't know what power level we should configure the Telemetry transmitter to ensure we have 10 dB of Eb/No margin over the minimum required for BER (4.4 dB) . Upon connecting to the target port and presenting token, you're presented with a TUI of sorts: _ _ _ | | (_)_ __ | | ___ _ | | | | '_ \| |/ / | | | | |___| | | | | <| |_| | |_____|_|_| |_|_|\_\\__, | |___/ .-. (;;;) \_| \ _.--l--._ . \ | `. .` `.\ | .` `. .` `\ | .` `. / __ \.|.` __ \/ | ''--._ \V _.--'' | | _ (") _ | ...

Welcome back to another year of HaS writeups. Grade F Prime Beef "Exploit the system, get the passcode, retrieve the flag." Connecting to the target system and providing the token gave us a web gui for fprime (and a shell, but it wasn't required), a NASA open source framework for flight software. This looks like an interesting framework to explore! But we're doing a CTF and we need the flag. Helpfully, we have RCE built in as a feature: github So we can send it a command, dump the output to a file, and downlink it (timestamps are messed up as I'm recovering this from burp logs and cbb finding the exact flow): PUT /commands/fileManager.ShellCommand?_no_cache=...&session=... HTTP/1.1 Host: 18.222.149.133:11782 Content-Length: 68 Content-Type: application/json Accept: */* Origin: http://18.222.149.133:11782 Referer: http://18.222.149.133:11782/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close {"key":42769...