I overengineered a pwn.college MITM challenge and ended up managing TCP by hand
Source Reddit Cybersecurity
Discussion
This content is a write-up by a security researcher describing their approach to solving a pwn.college MITM challenge. The author overengineered the solution by manually managing TCP connections and sequence numbers instead of using the intended ARP spoofing and transparent forwarding method. The write-up includes technical details about the challenges faced, including an ACK sequence-space bug that disrupted the connection.
r/cybersecurity (opens in a new tab)u/yyamak0 points0 comments
I overengineered a pwn.college MITM challenge and ended up managing TCP by hand
The intended solution was basically ARP spoofing + transparent forwarding + replacing echo with flag.
Instead, I terminated the client-facing TCP connection myself with Scapy, manually generated SYN-ACKs and tracked SEQ/ACK values, while using a separate kernel-managed connection to the real server.
I wrote up what went wrong, including an ACK sequence-space bug that completely broke the connection.
Full write-up: https://yusufyamak.medium.com/a-textbook-case-of-overengineering-solving-pwn-colleges-mitm-challenge-the-hard-way-c84b0d8d61ea