Back to writeups
HTBmiscsolved

Baby Frame

1 Jan 2025 · by 0xIDA

Solvers

Baby Frame

Author: 0xIDA
Platform: HTB · Category: misc · Difficulty: N/A

Solvers

Category: Misc
Difficulty: Very Easy
Flag: HTB{cdf1af4c747c9eb8573ee0b5d963c2cd}

Challenge Description

A recently recovered experimental spacecraft broadcasting under spacecraft ID 12 has entered visibility range. Ground telemetry suggests that one onboard diagnostic application remains active on APID 42 over virtual channel 3. Mission operators believe the service is waiting for a single correctly formatted CCSDS space packet containing the user payload HEALTHCHECK.

Target: 154.57.164.76:32499

Solution

This challenge requires constructing a valid CCSDS (Consultative Committee for Space Data Systems) space packet wrapped in a TC (Telecommand) Transfer Frame.

CCSDS Protocol Structure

1. Space Packet (17 bytes)

The CCSDS Space Packet Primary Header is 6 bytes:

Bits  | Field
------|------------------------
3     | Version Number (0)
1     | Packet Type (1 = TC)
1     | Secondary Header Flag (0)
11    | APID (42)
2     | Sequence Flags (3 = unsegmented)
14    | Sequence Count (0)
16    | Data Length (payload_length - 1)

Space Packet Structure:

  • Header: 102ac000000a (6 bytes)
    • 0x102a = Version(0) + Type(1) + SecHdr(0) + APID(42)
    • 0xc000 = SeqFlags(3) + SeqCount(0)
    • 0x000a = Data Length (10 = 11 bytes - 1)
  • Payload: HEALTHCHECK (11 bytes)

Total Space Packet: 102ac000000a4845414c5448434845434b

2. TC Transfer Frame (22 bytes)

The TC Transfer Frame Primary Header is 5 bytes:

Bits  | Field
------|------------------------
2     | Version (0)
1     | Bypass Flag (0)
1     | Control Command Flag (0)
2     | Reserved (0)
10    | Spacecraft ID (12)
6     | Virtual Channel ID (3)
10    | Frame Length (total_length - 1)
8     | Frame Sequence Number (0)

TC Frame Structure:

  • Header: 000c0c1500 (5 bytes)
    • 0x000c = Version(0) + Bypass(0) + CCF(0) + Reserved(0) + Spacecraft ID(12)
    • 0x0c15 = Virtual Channel(3) + Frame Length(21 = 22 total - 1)
    • 0x00 = Frame Sequence Number (0)
  • Payload: Space Packet (17 bytes)

Total TC Frame: 000c0c1500102ac000000a4845414c5448434845434b

Exploitation

Send the complete TC frame to the server:

import socket
import struct

space_packet = generate_space_packet(apid=42, packet_count=0, payload=b"HEALTHCHECK")
frame = generate_tc_frame(spacecraft_id=12, virtual_channel_id=3, tc_packet_count=0, payload=space_packet)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("154.57.164.76", 32499))
s.sendall(frame)
response = s.recv(4096)
print(response.decode())

Response:

SPACECRAFT: HTB{cdf1af4c747c9eb8573ee0b5d963c2cd}

Key Insights

  1. Frame Length Calculation: The frame length field contains the total frame length minus 1 (including the 5-byte header), not just the payload length.

  2. Packet Wrapping: Only the TC frame needs to be sent - the space packet is embedded as the frame's payload.

  3. CCSDS Standards: The challenge follows the official CCSDS Space Packet Protocol (133.0-B-2) and TC Space Data Link Protocol (232.0-B-4) specifications.

Flag

HTB{cdf1af4c747c9eb8573ee0b5d963c2cd}