Exploit for satellitectf

Name: Exploit for satellitectf
Rating: 5 (194 reviews)
2026-01-15 | CVSS 6.9
## https://sploitus.com/exploit?id=AE8BA343-F7B4-54F6-A491-407BC942766C
# CONSTELLATION PIVOT CTF

**A Satellite Cyber-Physical CTF Challenge*

[![NASA cFS](https://img.shields.io/badge/NASA-cFS%20v7-blue)](https://github.com/nasa/cFS)
[![RTEMS 6](https://img.shields.io/badge/RTEMS-6-orange)](https://www.rtems.org/)
[![QEMU](https://img.shields.io/badge/QEMU-7.2+-green)](https://www.qemu.org/)
[![License](https://img.shields.io/badge/License-Apache%202.0-red.svg)](LICENSE)

> **King of the Hill (KotH)** satellite exploitation challenge featuring multi-architecture pivot, orbital mechanics, and cyber-physical win conditions.

---

## Challenge Overview

**Constellation Pivot** is a realistic satellite CTF challenge that requires players to:

1. **Exploit** a LEON3 SPARC Relay Satellite
2. **Pivot** across a bandwidth-constrained Inter-Satellite Link (ISL)
3. **Compromise** a RISC-V Target Satellite
4. **Manipulate** physical parameters (reaction wheels, battery voltage)
5. **Maintain** persistence for 30 consecutive seconds to capture the flag

### Key Features

- **Multi-Architecture**: SPARC (Big-Endian) → RISC-V (Little-Endian) pivot
- **Realistic Orbital Mechanics**: Dynamic ISL throttling (9600 baud at >2000km)
- **Cyber-Physical**: Win condition requires memory corruption + actuator control
- **Self-Healing**: Automated watchdog and recovery systems
- **Spectator-Friendly**: Real-time 3D orbital visualization dashboard

---

## Architecture

```
┌─────────────────────────────────────────────────────────────────────────┐
│                          GROUND SEGMENT                                 │
│  ┌──────────────────┐           ┌──────────────────┐                   │
│  │  COSMOS/OpenC3   │◄─────────►│   Streamlit      │                   │
│  │  (Command & Ctrl)│   HTTP    │   (Dashboard)    │                   │
│  └────────┬─────────┘           └────────▲─────────┘                   │
│           │ UDP 4000                     │ WebSocket                   │
└───────────┼──────────────────────────────┼─────────────────────────────┘
            │                              │
            ▼                              │
┌─────────────────────────────────────────┼─────────────────────────────┐
│                    SIMULATION LAYER     │                             │
│  ┌─────────────┐   ┌──────────────┐   ┌┴──────────────┐              │
│  │ Link Proxy  │──►│   Physics    │──►│    Scoring    │              │
│  │ (9600 baud) │   │  Hypervisor  │   │    Oracle     │              │
│  └──────┬──────┘   └──────┬───────┘   └───────────────┘              │
│         │                 │ UART1                                     │
└─────────┼─────────────────┼───────────────────────────────────────────┘
          │ UART0           │
          ▼                 ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                          SPACE SEGMENT                                  │
│  ┌──────────────────────────────────┐  ┌──────────────────────────────┐│
│  │     RELAY-SAT (CPU 1)            │  │    TARGET-SAT (CPU 2)        ││
│  │  ┌────────────────────────────┐  │  │  ┌────────────────────────┐ ││
│  │  │ LEON3 SPARC (Big-Endian)   │  │  │  │ RISC-V 64 (Little-End) │ ││
│  │  │ RTEMS 6 + NASA cFS         │◄─┼──┼─►│ RTEMS 6 + NASA cFS     │ ││
│  │  │                            │  │  │  │                        │ ││
│  │  │ ┌────────────────────────┐ │  │  │  │ ┌────────────────────┐ │ ││
│  │  │ │  PAYLOAD_APP           │ │  │  │  │ │  RV_VAULT          │ │ ││
│  │  │ │  (Vuln: Stack Overflow)│ │  │  │  │ │  (Vuln: ROP Chain) │ │ ││
│  │  │ └────────────────────────┘ │  │  │  │ └────────────────────┘ │ ││
│  │  │ ┌────────────────────────┐ │  │  │  │ ┌────────────────────┐ │ ││
│  │  │ │  SBN (Software Bus Net)│◄┼──┼──┼─►│ │  SBN               │ │ ││
│  │  │ └────────────────────────┘ │  │  │  │ └────────────────────┘ │ ││
│  │  └────────────────────────────┘  │  │  └────────────────────────┘ ││
│  │        QEMU (Port 4444)          │  │       QEMU (Port 4445)       ││
│  └──────────────────────────────────┘  └──────────────────────────────┘│
│              ISL: UDP Socket 10001 (Throttled by Distance)             │
└─────────────────────────────────────────────────────────────────────────┘
```

---

## Quick Start

### Prerequisites

- **OS**: Ubuntu 22.04 LTS (or similar Debian-based Linux)
- **Docker**: 20.10+
- **Python**: 3.10+
- **QEMU**: 7.2+ (qemu-system-sparc, qemu-system-riscv64)
- **WireGuard**: Latest kernel module
- **Disk Space**: ~10GB for toolchains and builds

### Installation

```bash
# Clone the repository
git clone https://github.com/ridpath/satellitectf.git
cd satellitectf

# Run the automated setup wizard
sudo ./setup.sh
```

The `setup.sh` script will:
1. Check all prerequisites (Docker, Python, QEMU, etc.)
2. Install system dependencies (QEMU, WireGuard, NFTables)
3. Build RTEMS SPARC and RISC-V toolchains (15-30 min)
4. Compile NASA cFS binaries for both satellites
5. Create gold master state snapshots
6. Generate WireGuard team configurations
7. Run pre-flight verification checks

### Starting the Challenge

```bash
# Start the mission
cd satellitectf
sudo ./infra/scripts/start_mission.sh
```

This launches:
- **Physics Hypervisor** (orbital mechanics simulation)
- **Link Proxy** (9600 baud throttling engine)
- **Scoring Oracle** (QMP memory inspection)
- **Streamlit Dashboard** (http://localhost:8501)
- **QEMU Instances** (Relay-Sat + Target-Sat)

### Accessing the Dashboard

Open your browser to:
```
http://localhost:8501
```

You'll see:
- **3D Orbital Globe** (Mapbox satellite view)
- **Inter-Satellite Link Status** (distance, bandwidth)
- **King of the Hill** (current commander, hijack alerts)
- **Physical Telemetry** (RPM, voltage, memory marker)

---

## For CTF Organizers

### Team Network Setup

1. **Start WireGuard VPN**:
   ```bash
   sudo wg-quick up wg0
   ```

2. **Distribute Team Configs**:
   ```bash
   ls infra/security/wireguard/team_configs/
   # Share team1.conf, team2.conf, etc. with participants
   ```

3. **Monitor Teams**:
   ```bash
   ./infra/scripts/admin_tool.sh status
   ./infra/scripts/admin_tool.sh teams
   ```

### Admin Tools

```bash
# View all active sessions
./infra/scripts/admin_tool.sh status

# Hard reset (restore gold master)
./infra/scripts/admin_tool.sh hard-reset

# Tail aggregated logs
./infra/scripts/admin_tool.sh logs

# Kick a misbehaving team
./infra/scripts/admin_tool.sh kick-team 10.8.0.5
```

### Chaos Testing

Before going live, test the self-healing capabilities:
```bash
./infra/scripts/chaos_test.sh
```

This will:
- Kill random QEMU processes
- Flood the link proxy
- Corrupt active_run state
- Verify automatic recovery

---

## For Players

### Connection Info

Once you receive your WireGuard config:

```bash
# Connect to the VPN
sudo wg-quick up team1.conf

# Target IP
VPN_GATEWAY=10.8.0.1

# Command Port (UDP)
TARGET_PORT=4000

# Telemetry (multicast on same port)
# Listen on UDP 4000 for responses
```

### Endianness Reminder

- **Relay-Sat (CPU 1)**: **BIG-ENDIAN** (SPARC)
- **Target-Sat (CPU 2)**: **LITTLE-ENDIAN** (RISC-V)

**You must byte-swap your payloads when pivoting!**

### Win Condition

To capture the flag, you must:
1. Write `0xACE5PACE` to Target-Sat memory (specific address in handout)
2. Spin reaction wheel > 5000 RPM
3. Set battery voltage == 12.4V (exact)
4. Hold this state for **30 consecutive seconds**

The flag will be broadcast in telemetry on UDP 4000.

### Tactical Handout

Download the player kit from the dashboard or:
```bash
wget http://10.8.0.1:8000/ctf_satellite_kit_v1.zip
sha256sum ctf_satellite_kit_v1.zip  # Verify checksum
```

Contains:
- ELF binaries (for Ghidra/IDA analysis)
- COSMOS YAML snippets
- Message ID reference
- Memory map hints
- Sample exploit skeleton

---

## Development Guide

### Directory Structure

```
satellitectf/
├── firmware/           # NASA cFS source and custom apps
│   ├── cFS/           # NASA cFS v7 (submodule)
│   └── apps/          # Custom cFS applications
│       ├── payload_app/   # SPARC vulnerability
│       ├── rv_vault/      # RISC-V vulnerability
│       └── sim_int/       # Simulation interface
├── sim/               # Python simulation layer
│   ├── physics_hypervisor.py
│   ├── link_proxy.py
│   ├── scoring_oracle.py
│   └── signal_bridge.py
├── ground/            # Ground segment
│   ├── cosmos/        # OpenC3/COSMOS
│   └── dashboard/     # Streamlit dashboard
├── infra/             # Infrastructure
│   ├── docker/        # Dockerfiles for toolchains
│   ├── scripts/       # Orchestration scripts
│   └── security/      # WireGuard, NFTables
├── dist/              # Compiled binaries and handout kit
├── gold_master/       # Clean state snapshots
├── logs/              # Aggregated logs
├── verification/      # Pre-flight checks and gold run
└── Makefile           # Build automation
```

### Building from Source

```bash
# Build RTEMS toolchains (cached in Docker)
make toolchains

# Compile cFS binaries
make firmware

# Create team handout package
make dist

# Create gold master snapshot
make gold-master

# Clean all builds
make clean
```

### Running Verification Tests

```bash
# Pre-flight checklist
cd satellitectf
./verification/preflight.sh

# Gold run (automated solve)
./verification/gold_run.py

# Integration tests
python3 tests/integration_test.py
```

---

## Interface Control Document (ICD)

### Network Ports

| Port  | Protocol | Purpose                     | Access       |
|-------|----------|-----------------------------|--------------|
| 4000  | UDP      | Team uplink/downlink        | VPN Teams    |
| 4001  | TCP      | Flag broadcast (Oracle)     | Internal     |
| 4444  | TCP      | Relay QEMU QMP Monitor      | Internal     |
| 4445  | TCP      | Target QEMU QMP Monitor     | Internal     |
| 5000  | TCP      | Relay UART0 (Ground Link)   | Internal     |
| 5001  | TCP      | Relay UART1 (Physics Feed)  | Internal     |
| 8501  | HTTP     | Streamlit Dashboard         | Public       |
| 10001 | UDP      | ISL Physical Layer          | Internal     |
| 51820 | UDP      | WireGuard VPN               | External     |

### Message IDs (CCSDS/cFS Software Bus)

| MID (Hex) | Type | Application    | Purpose              |
|-----------|------|----------------|----------------------|
| 0x1880    | CMD  | PAYLOAD_APP    | Relay command input  |
| 0x0880    | TLM  | PAYLOAD_APP    | Relay housekeeping   |
| 0x1920    | CMD  | RV_VAULT       | Target command input |
| 0x0920    | TLM  | RV_VAULT       | Target telemetry     |
| 0x0901    | TLM  | SIM_INT        | GPS truth data       |
| 0x0902    | TLM  | SIM_INT        | IMU truth data       |

### Memory Addresses

Refer to `docs/ICD.md` for detailed memory maps and exploitation hints.

---

## Troubleshooting

### QEMU Won't Start

```bash
# Check if ports are already in use
netstat -tuln | grep -E "4444|4445|5000|5001"

# Kill stale QEMU processes
pkill -9 qemu-system
```

### Dashboard Shows Fallback Map

```bash
# Add Mapbox token
echo "YOUR_MAPBOX_TOKEN" > /ground/.mapbox_token

# Restart dashboard (it will auto-reload)
```

### WireGuard Interface Down

```bash
# Check interface status
sudo wg show wg0

# Restart WireGuard
sudo wg-quick down wg0
sudo wg-quick up wg0
```

### Toolchain Build Failed

```bash
# Check Docker daemon
sudo systemctl status docker

# Re-run with verbose logging
cd infra/docker
docker build --progress=plain -t rtems-sparc -f Dockerfile.rtems-sparc .
```

### Teams Can't Connect

```bash
# Debug network connectivity
./infra/scripts/team_network_debug.sh

# Check firewall rules
sudo nft list ruleset | grep "rate limit"
```

---

## Technical References

- [NASA cFS Documentation](https://github.com/nasa/cFS/tree/main/docs)
- [RTEMS User Manual](https://docs.rtems.org/branches/master/user/index.html)
- [QEMU System Emulation](https://www.qemu.org/docs/master/system/index.html)
- [OpenC3/COSMOS Guide](https://openc3.com/docs)
- [Skyfield Astronomy Library](https://rhodesmill.org/skyfield/)

---

## Credits
**Frameworks**: NASA cFS, RTEMS, OpenC3/COSMOS  

---

## License

This project uses components with different licenses:
- NASA cFS: Apache 2.0
- RTEMS: Modified GPL / BSD
- Custom code: Apache 2.0

See individual component directories for specific license information.

---

## Security Notice

This challenge contains intentional vulnerabilities for educational purposes. **Do not deploy the vulnerable satellite binaries in production environments.**

The WireGuard and NFTables configurations provide isolation for CTF events but should be reviewed by a security professional before use in other contexts.

---