Honeynet Project Public Conference

Last week was held the first-ever Honeynet project public conference in Paris at ESIEA. Great speakers, interesting conferences (slides online, CV+O notes) and nice people to meet at the social event.

During the conferences was also a small capture-the-flag (CTF) competition, which I played. It was composed of 8 challenges by Mark Schloesser and Felix Leder, including a forensic one by Guillaume Arcas. This is how the challenge board looked:

Insomni'hack GPGPU reversing

One of the reversing challenges was exotic: we were given a ciphertext (ohv'c~f3ehnw4byzzky), a GPGPU file (kernel.bin) of the encryption routine, and the Instruction Set Architecture (ISA) of this GPU.

Since I have never played with GPGPUs (code/assembly/whatever), it seemed hard at first glance. But actually not! Open kernel.bin and see that there's some kind of disassembly. Good! And pretty small, roughly 80 lines of code.

I will explain how I reversed it and reimplemented it in Python to have the same encryption routine, discovered that it was also the decryption routine, and just run it against the ciphertext to obtain the plaintext.

Insomni'hack, Codegate and others

Last week-end was great. I was at Insomni'Hack 2011 security event organized by SCRT. Conferences during the day (read Bruno Kerouanton or Emilien Girault), security challenges during the evening (6pm-1am). Short time and adapted challenges, staff did great! We missed the internet but we had beers :)

I played the challenges with some friends and we ended up in the first place winning a nice trophee, a Fortinet Firewall, some tshirts and other goodies. Thanks SCRT! If you are interested in the challenges, shell-storm has mirrored some of them (offline ones at least) while Djo, Emilien Girault and Pascal Junod have already published some write-ups. Also, staff said they will publish all challenges and solutions soon.

Last week-end were also Codegate 2011 qualifications, which I unfortunately did not play this year. Different kind of challenges, strong competition. Many write-ups have been shared by @codegate_yut.

Also, some cool stuff ahead: Honeynet public conference, HITB Amsterdam CTF prequals, HES 2011, and maybe a Plaid Parliament of Pwning (PPP) CTF.

And if you don't know what to do, there's a new wargame at Smash The Stack: amateria. Worth playing :)

ShmooCon CTF Warmup Contest - JavaScrimpd

Last week-end was ShmooCon CTF Warmup Contest (aka Ghost in the Shellcode 2011). Three challenges, the last one being an ELF binary + hostname of a server.

Congrats to awesie/zoaedk & tylerni7 of team PPP for solving it pretty quickly. And since they explained the level pretty well, I really invite you to read their solution.

Some news...

Recently I've been playing with gdb 7.2 and python. It extends what we can have with a great .gdbinit such as gdbinit73. As examples, read the following articles presenting some of the features, or just browse the Python API offered by gdb. A good introduction to gdb and python is also this article by sha on Nibbles blog (english here).

Last week-end were given nice challenges to win a ticket for ShmooCon security conference later this month. Congrats to awesie/zoaedk & tylerni7 of team PPP for solving #3 (see their writeup), a cool network binary involving JS code, a stack-based buffer overflow and some memory leak. I wasn't fast nor good enough but learned a lot!

Speaking of which, get ready for Paradox Conference this week-end in Korea: they provide an online CTF contest, should be challenge-based like defcon quals.
Update: this week-end there is also Wargame SbD I organized by our spanish friends at Security by Default (SbD). Unlike Padocon, there is a nice prize (amazon gift card which is worth an iPad). Thanks @aramosf for reminding me.

Realized again Ubuntu security features. Ptrace scope for instance, protects against same-user ptraces to peek into another process memory.

Made a very small idadif.py to patch a binary from a DIF file produced by IDA. Did not find any better method to do that :/

Also, 27c3 was great. And I love Berlin :)

Last but not least, hacky new year!

Login notifications, pam_exec scripting

If you like monitoring, you might want to receive notifications at every (or only root) login, in addition to logs.

/etc/profile, bashrc, etc.

One can first think of a script in /etc/profile - I saw that solution on many websites - but it is wrong because the user can connect with ssh /bin/sh and it will not run any login script. Also, this kind of login does not appear in last/wtmp but only in auth.log by sshd (because it's not considered as an "interactive login").

Exec race condition exploitations

I recently learned a cool technique for exploiting exec race conditions. It was mentioned in a comment by Julien Tinnes about the 2009 pulseaudio vulnerability in Linux, and more recently by Tavis Ormandy (@taviso) about the GNU C library dynamic linker expanding $ORIGIN in setuid library search path vulnerability. I am sure that many people know this for ages, but still it was new to me and I thought it was worth a small post on it.

Hack.lu CTF - Challenge 19 "magicwall" writeup, double strcpy

I did not solve challenge 19 "magicwall" during the CTF - my friend Ivanlef0u (@Ivanlef0u) did - but since Fluxfingers (@fluxfingers) kept the CTF online, I had the chance to pwn it too! Just like challenge 20 "sscat", it was binary exploitation.

Hellman (@hellman1908) already made a very good writeup, I just wanted to share my different method.

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.

Hack.lu CTF - sscat writeup

Last week was hack.lu 2010 security conference as well a high quality CTF organized by fluxfingers CTF team. Again I played with Nibbles and we ended 2nd as you can see on the final scoreboard and my usual graphs (made possible thanks to fluxfingers).

Challenge 20 was a very nice exploitation level. We were given an SSH with a setuid binary called sscat (standing for Serious Substition Cipher Analysis Tool) - with source. We had to exploit the program in order to read the flag file.