Skip to content

It's a trap

Category: Miscellaneous    |    Points: TODO    |    Difficulty: TODO

🧠 Challenge Text

Hi Senior Researcher,

we've received a report about an unregistered web service operating somewhere in the 10.100.26.0/24 network. There is one problem: the subnet has become unusually noisy. Every address and every port seems eager to talk, driving our AI-driven automated scanner completely mad.

Your task is to find the web service.

Stay curious!

A hint links an archived documentation for CIDR 10.100.26.0/24: the PDF its_a_trap.pdf — Pavel Vachek's CESNET paper "CESNET Intrusion Detection System", describing LaBrea.

🎨 Solution

The noise is a LaBrea tarpit

The hint is the whole trick. LaBrea claims every unused address in the subnet, completes the TCP handshake (SYN → SYN+ACK → ACK), then advertises a tiny receive window and never sends data. The connection stays open forever on almost no bandwidth — a tarpit built to drown scanners.

Confirm it:

$ sudo hping3 -S -p 8000 -c 3 10.100.26.0
len=40 ip=10.100.26.0 ... flags=SA ... win=3
len=40 ip=10.100.26.0 ... flags=SA ... win=3
len=40 ip=10.100.26.0 ... flags=SA ... win=3

win=3 — tiny and constant. curl http://10.100.26.X/ connects, sends the request, then hangs with 0 bytes received: the classic LaBrea trap.

Why normal scanning fails

  • Every IP answers ICMP and SYN on (nearly) every port, so "open" is meaningless — a full nmap -p- on 15 tarpit hosts returned 917,480 open ports (~65535 each).
  • The responses are random / throttled per run: a junk-port (47123) scan of the /24 returned 23 IPs, while a web-port scan returned ~230 IPs — same subnet, same instant. So IP/port sets shift between scans and set-intersection cannot cancel the noise.
  • masscan does not work over the OpenVPN tun0 interface (layer-3, no Ethernet/MAC) — it reports zero. nmap -sS works fine on tun0.

The one stable signal: TCP receive window

LaBrea's tell is its tiny window (win=3). A real host's stack advertises a large window (~65k). That value is in the SYN+ACK and stays constant — unlike everything else here. And it can be read without root: do a normal connect(), then getsockopt(TCP_INFO) and read tcpi_snd_wnd (the peer's advertised window, at byte offset 228 of struct tcp_info on Linux ≥ 5.4).

That's winchk.py. Feed it an open-port list and it prints only ports whose peer window is large = real stacks.

# 1. open ports across the /24 (nmap works on tun0; masscan does not)
sudo nmap -sS -Pn -n --top-ports 3000 --open --min-rate 3000 10.100.26.0/24 -oG p1.gnmap
awk '/Ports:/{ip=$2; for(i=1;i<=NF;i++) if($i ~ /\/open\//){split($i,p,"/"); print ip":"p[1]}}' \
    p1.gnmap | sort -u > p1.txt

# 2. keep only ports with a big TCP window (real hosts, not win=3)
python3 -I winchk.py p1.txt

Out of ~750k tarpit ports, only three real hosts surface:

10.100.26.1:22     snd_wnd=65280
10.100.26.1:5666   snd_wnd=65236
10.100.26.10:22    snd_wnd=65160
10.100.26.10:5666  snd_wnd=65160
10.100.26.66:22    snd_wnd=65160
10.100.26.66:5666  snd_wnd=65160
10.100.26.66:2025  snd_wnd=65160   <-- odd port

.1 and .10 are infrastructure (SSH + NRPE/Nagios on 5666). 10.100.26.66 has the same, plus an odd port 2025 — the unregistered web service.

$ curl http://10.100.26.66:2025/
...
<p class="nod">This tarpit for scanners runs on <strong>LaBrea</strong> — one of the
first security tools, which Pavel lectured about and, in effect, brought to CESNET.
He remains in our memory, and we carry on his work.</p>
<div class="flag">FLAG{O2pS-yj4k-Qd8U-v9ft}</div>

A fitting tribute: the service hides behind the very LaBrea tarpit Pavel Vachek — author of the hint PDF — brought to CESNET.

Flag: FLAG{O2pS-yj4k-Qd8U-v9ft}