Blog of a security enthusiast
In the last two blog posts, I described a challenge and exploits to get code execution from arbitrary Go code only allowing the fmt package, at fixed Go version 1.13.3 and without PIE . These factors made the challenge easier for a CTF: the fmt package gives a nice leak with %p, no pie and fixed Go version 1.13.3 allows to hardcode addresses and behave deterministically with code layout, heap,…
In my last blog post , I described The Gomium Browser, a pwn challenge of the Google CTF 2019 finals that 4 teams (pasten, 5BC, p4, A*0*E) solved. The challenge was framed as a command-line browser, but basically boiled down to answering this question: if you control Go source code but can only import the fmt package, can you get enough code execution to execute xcalc? In this blog post let's look…
Last weekend were the Google CTF 2019 finals in London with 10 invited teams, part of a larger event named ESCAL8 with VRP researchers (BugSWAT), students (init.g), etc. I wrote a CTF challenge for the event: The Gomium Browser. Out of 10 teams 4 teams solved it (pasten, 5BC, p4, A*0*E) and a 5th team (Balsn) was really close, unfortunately their exploit was unreliable. In this blog post I won't…
If you like exploitation surely you've had your own reverse or connect-back shells. Set up a listening netcat, run the payload and boom: you get a shell back! Then you explore the box, start a program, want to stop it, and do Ctrl-C... no!!! You just lost your shell, because that interrupted netcat, not the remote process. In this post we'll look at shells and terminals, from the most simple like…
Surely you've heard of the Burp Suite , quite useful software to perform security testing of web applications and in general to play with anything that talks HTTP(S) . There's even a free edition which is often more than enough since I mostly use just Proxy and Repeater. You can even write extensions to automate things or support some weird things you might see on top of HTTP. Burp being written…
Go is becoming more and more popular as a programming language and getting more scrutiny from a security point of view. You might remember my heap corruption during garbage collection post. A few days ago Scott Piper wrote Looking for security trouble spots in Go code , an interesting read. I'd like to expand on a topic I've researched a few months ago after discussing with Dmitry Vyukov ( ASAN ,…
I have a server with a single IPv4 and I want to run two DNS servers: one to serve zones like stalkr.net - if you recall , I like PowerDNS ; another one for tunneling - I like dns2tcp (TCP level), another good one is iodine (IP level). Problem: I looked a bit but none of the DNS server software I've seen support forwarding queries that aren't for them to another server. Basically what I need is a…
Sometimes I need to create a tiny ELF with some assembly code, because I'm restricted in size or just don't like the bloated binary produced by gcc and the linker. The classic reference about this is A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux . I often use their nasm listing as a template. I was working with 64bit code the other day and realized there's no 64bit…
Are you the lucky owner of an IDA Pro linux license? Since I had errors last time I set it up, here is a quick brain dump on setting up IDA Pro 6.5 on Debian sid with IDA python 2.7. It may even work for Ubuntu. Install IDA Pro, choose to use OS-provided python environment (and not bundled). Then try to run it and it fails: $ /opt/ida/idaq libstdc++.so.6: cannot open shared object file: No such…
It was DEFCON 21 quals last week-end, with new organizers . It went well, good organization and good challenges. If you're curious about the results, here is a fancy top15 graph . Apparently it was too easy for PPP who finished all of the challenges... insane! :) There were 5 categories: 3dub: web-based challenges 0x41414141: exploitation \xff\xe4\xcc: shellcode OMGACM: guerilla programming…
I've been playing with Go recently, it's an interesting programming language (I recommend the tour ). It is compiled, garbage-collected and memory safe.. as long as you don't find a bug in the runtime. Alex Reece ( @awreece ) from PPP recently blogged about a nice vulnerability , I found it interesting and started following more of the changes . This one looked fun: runtime: fix heap corruption…
I assume you already know about TOR , The Onion Router for anonymity to protect your privacy. TOR is a network so it can only work if there are nodes (relays). If you have a server, you can run one so consider it. Afraid of legal issues? You do not need to run an exit node, a relay is just fine: everything is encrypted. This post will show you how easy it is to set up a TOR relay on Debian , how…
I think it's always good to carry a rescue operating system, like Ultimate Boot CD for Linux or UBCD for Windows . Personally I like Grml , debian-based, 32/64 bits and it can be installed on USB. Booting from CD/USB is as simple as embedding syslinux , a kernel , an initrd and give it a filesystem. The filesystem can be stored on the CD/USB (usually as a squashfs file), but you can also point to…
As I said in the last post , I obtained YubiKey USB tokens and started to play with it. One of the programs I made is YubiText , it allows to input text when a YubiKey is plugged. For instance, one can use it as a way to type a password. This post will describe how it works and how I use it to have something I call 3-factor password authentication. A quick note on static password mode YubiKey…
I recently obtained YubiKeys from Yubico . It's a USB hardware token able to act as a keyboard device to input characters (a HID ) and also has a little button. It supports different modes: Yubico OTP Mode: Yubico implementation + server OATH-HOTP Mode: standard HOTP as per RFC 4226 Static Password Mode: output the same static string Challenge Response Mode: no HID, software challenges the token…
The first part of this post describes how to use PPTP VPN on Linux, in command-line and not GUI. The second part, actually independent of VPN, describes how to set up policy routing for a user, in order to have all traffic from that user to go through a specific interface (e.g. the VPN interface). VPN service: VPNoD I'm using VPNoD ( @vpnod ) with a free beta account. It is PPTP, encrypted and…
stalkr.net is now signed with DNSSEC ! In this post I will quickly describe what is DNSSEC and why I chose to deploy it, then my choice of Unbound as a resolver and PowerDNS as a server and finally give a few resources about this topic. Very quickly, what is DNSSEC? A hierarchical system to authenticate (+integrity) DNS to avoid forgery using public key cryptography. You create a set of…
Sebastian Krahmer ( @steaIth , c-skills ) made and released a nice SSH/HTTP(S) multiplexer: sshttp . Such a program is needed when you want to share your HTTP (or HTTPS) port with SSH to be able to use SSH when behind a network that only allows outbound connections to HTTP (or HTTPS) and does not bother to do protocol inspection. Learn more by reading the readme . I was previously using sslh but…
Again this year was ShmooCon 's Ghost in the Shellcode warm-up round or Teaser ( @ShellGhostCode ). Congrats to Eindbazen for winning! There was three challenges: crypto ( Tel Aviv ), crackme ( AL's revenge ) and exploitation ( Hackquest ). You will notice strong references to Hackers (1995) movie. Write-ups can be found on FixMe wiki , Leet More blog or Eindbazen blog . Hackquest Summary: given…
I recently discovered Chrome's net-internals . Among other interesting things, there is a tab about HTTP Strict Transport Security (HSTS) . Also, introduced with version 12/13, Chrome now has HSTS preloading and public key pinning . These two features helps improve online security: HSTS preloading: browser already knows if a site has to be contacted via HTTPS only. For instance, it ensures users…
Twitter is great to get and share information, quickly. But it is all web 2.0 and you cannot use a simple cat or grep to view or search your tweets. I would like to have tweets saved in simple text format: date, user, text. Also, I would like a simple program to give me the list of followers/following of a user. Fortunately, Twitter provides a web API and people started to implement it in…
May 19th-20th was Hack in the Box Amsterdam 2011 security conference in the Netherlands, also holding a CTF . To participate, you had to qualify to one of the two qualification rounds that involved web security and reverse engineering. We passed qualifications with team CoP so I went there with teammate sh4ka to play, and we were lucky enough to end in the first place . Congrats to all teams, it…
One of my workstations was an Ubuntu 10.10 on an encrypted LVM . I decided to upgrade to 11.04 and was unable to boot, falling back to initramfs busybox shell. If you are not familiar with this kind of setup, it basically works with: a non-encrypted /boot with kernel and initramfs initramfs contains required modules (aes, lvm, etc.) and a few scripts to mount the filesystem: in this case, a script…
Challenge #18 "A small bug" was a common TOCCTOU bug very interesting to exploit reliably. @hellman already did a write-up on this challenge. His exploit reads the file name on stderr and hopes to win the race on symlink creation. But actually there is a way to win the race every time! Let's see that. Context 18 - A small bug - 250 pts Description Category: pwnables Get access to the key using…
Challenge #19 "Another small bug" was a stack-based buffer overflow. Djo ( @shell_storm ) has already published a write-up ( english ) on Nibbles' blog , as well as @hellman on Leet More's blog , and Agix ( @Agixid ) on shell-storm . Just like hashcalc1 or hashcalc2 , there was no NX . However, ASLR was enabled. Djo and hellman both used a big nopsled + brute-force to circumvent ASLR, Agix used a…