Nether Portal Desync (HUUP)

"I travel not on established roads but leap freely across the void. Package me wrong, and I'll deliver a secret to the wrong doorstep."

Description

The challenge features an HTTP/3 (QUIC) application layered over UDP. Because UDP is stateless and the proxy doesn't enforce strict HTTP request boundaries similar to TCP, it is possible to desynchronize the proxy and the backend server. An attacker can smuggle a hidden HTTP request within another request.

Notes - max message length is 1024 bytes, only GET requests will really work, and messages are discarded after 10 seconds

Target: byuctf.xyz:40011

Vulnerability Analysis

• Vulnerability: HTTP Request Smuggling (over UDP/QUIC)
• Root Cause: Inconsistent parsing of HTTP payload boundaries between the frontend proxy and backend application under unreliable protocols.

In this specific implementation, a Python middleware (udp_server.py) listens on port 40000 for incoming text. This server forwards requests once a \r\n\r\n is found to the actual web server. Because this is UDP, there is a high chance of partial packet delivery, leading to desynchronization if multiple requests are sent rapidly or if the packet boundaries are manipulated.

Writeup

To solve this challenge, you must account for the unreliable nature of UDP and the specific way the middleware handles request boundaries.

1. Reconnaissance: Accessing the root / endpoint reveals a hint about the Nether connection instability.
2. Endpoint Discovery: Navigate to /endpoints.txt to find a list of 200 possible hidden endpoints.
3. Brute Force: One of these endpoints contains the flag, while three others return false positives.
4. Protocol Mastery: Due to the UDP middleware, a standard browser request may fail to receive the full response body (only headers might return before the connection is closed or timed out).
5. Automation: Write a script (see solve.py) to send raw HTTP requests over UDP to the target. The script must iterate through the endpoints and repeatedly request each one until a full response (containing a body) is received.

Mitigation

• Ensure both frontend and backend use the exact same logic for parsing request boundaries.
• Reject any requests with ambiguous length headers or illegal characters in the header stream.
• Use established HTTP/3 libraries rather than custom UDP-to-TCP forwarding logic.

Hints

• Have you mapped out how the front proxy talks to the back proxy?
• Check the protocol in use—UDP doesn't guarantee delivery!

Flag

CH4KR4X2{P0D5_bl0ckch41n_br34ch}

Hosting

This challenge runs a Flask server on port 1337 and udp_server.py on port 40000.

Build:

sudo docker build -t huup .
sudo docker network create -d bridge huup

Run:

sudo docker run -p 40011:40000/udp --detach --name huup --network huup huup:latest