Codegate, HES2010, citctf

As you may know, I played Codegate CTF quals with Nibbles and we managed to be #11. As you can see, there was many good write-ups on the challenges. Despite being 11th, my friend SiD & I had the chance to go in Korea to play CTF finals and it was great: discovering Korea, playing CTF (managed to arrive 4th!), meeting other teams, conference speakers and other nice people. Also, networking session was awesome! I didn't have the time to see the conferences, but it reported to be very good as well.

Challenges by LM**2 were again interesting, excellent write-up from HFS (winners) for the encrypted shellcode (only team to solve it!). I should write-up on some challenges too if I have time. In the meantime I would love to see the challenges available on the net, maybe on intruded?

To conclude Codegate 2010 was amazing, well-organized by Softforum, great people and a lot of fun. You can find nice pictures of the whole event from yoggy0 and team PPP our CTF friends. I will definitely do my best to return next year if there is a Codegate 2011 :)

At the same time, Hackito Ergo Sum (HES) security conference was happening in France: impressive program and speakers (slides are available), they also organized a wargame with OverTheWire guys (reputed for their good online challenges), and recently even made it available among their other wargames (thank you, starting to play hehe!).

Among the next events are CIT CTF on May 15-16 (registration) from our Russian friends of Codegate, and obviously Defcon CTF quals on May 21-24 (registration). Good luck and have fun if you're a player too!

Write-up Codegate 2010 #17 - Crypto, Linear Congruential Generators and Vernam Cipher, the power of XOR

Challenge #17 was crypto, based on Linear Congruential Generators (LCG), a well known pseudorandom number generator (PRNG), and the Vernam Cipher which is basically a XOR cipher relying on exclusive OR . Sadly, we did not succeed this challenge in time. However my friend Ivan found it afterwards thanks to Julianor (a staff member).

Basically, there is a TCP server listening to incoming connections. We simply use netcat (or telnet) to connect to it:

$ nc ctf3.codegate.org 10909
a?

c?

m?

Bad values

Write-up Codegate 2010 #19 - Forensic, introduction to the Sleuth Kit and Autopsy

Challenge #19 was also interesting, at least for the story:

Found a dead guy on the street, assumed that a guy committed suicide.
How can you assume that? Find the clue.

And they gave us a simple binary file: 56DACF1C6CF363F27501FFCA50CC0415 (9.6MB).

Write-up Codegate 2010 #7 - Decrypting HTTPS SSL/TLSv1 using RSA 768bits with Wireshark

Last week-end, I was a challenger at Codegate 2010 Capture the Flag with team Nibbles. Well organized by Koreans guys (who didn't sleep a lot either ;), the CTF proposed quality challenges and I thought it would be a great subject for a few posts.

Challenge #7 was a network capture file (ssl.pcap) containing an encrypted https session. The hint was: does the modulus look familiar?. The goal is obviously to decrypt the https to find the flag. Let's see how we can do that!

Steps:

1. Extract public certificate
2. Identify encryption
3. Create private certificate
4. Decrypt https

Nanosecond time measurement with clock_gettime, CPU idling

Recently, I had to do latency testing of message passing between kernel-land and user-land, so I first looked after time structures and functions available in both the kernel and the libc, and then I looked after possible tuning of the kernel.

Obviously gettimeofday is not precise enough because it returns a timeval structure (defined in time.h), which only has a microsecond resolution:

struct timeval {
  time_t      tv_sec;       /* seconds */
  suseconds_t tv_usec; /* microseconds */
};

Proxmox KVM - Reach VNC in IPv6

These days, I am playing with Proxmox, a free and open-source Linux distribution which provides an easy solution for virtualization. In fact, they include:

• a linux kernel with KVM (full virtualization) and OpenVZ (containers)
• an interface to manage kvm, openvz, storage, backups and also monitoring

You can create, start, stop your virtual machines or containers via the web interface. For a KVM, they even provide a VNC java applet to see the screen of your virtual machine. This is amazing!

POSIX File Capabilities

Sometimes you need a particular program to do a specific task that requires administrative (root) privileges. You can run your program with sudo or chown your program to root and use the setuid bit (that allows to run a program with its owner uid). However, the setuid bit has serious security issues: if you are able to change the flow of execution of the program (and if the program does not drop his root privileges once no longer necessary), you can get a root shell.

More specifically, I needed a program to be able to create raw sockets without requiring full root privileges. It's possible! Using POSIX File Capabilities that relies on capabilities architecture.

Enabling Wake-on-LAN

The first thing you do when you configure Wake-on-LAN is to enable it in your motherboard BIOS (on my ASRock it's "wake on PCI device -> enabled").

However, this is not enough because when you leave Linux (or Windows), your network card may not be set to wake up from LAN. Thanks to tjansson, I'm now using the following root crontab to enable Wake-on-LAN everytime Linux starts (I prefer that to an init/rc6 script).

@reboot /usr/sbin/ethtool -s eth0 wol g

I invite you to read tjansson's blog entry for more information.

Wake on Lan in Python

I love Wake on Lan because it allows me to shutdown my little server at home, and still be able to remotely wake him up if necessary.

The well-known Depicus WoL pages provide Windows binaries (GUI and CLI) to send WoL packets, as well as an online form.

If you are on Linux or prefer sending it on your own (I mean, not using a closed binary), you can use a few lines of Python as explained by myf00 with Python3 code.

SheevaPlug

Earlier this year, I was looking for some small boxes where I can embed a little server and I've stumbled upon the following story of Martin Michlmayr. PlugComputer.org promotes the SheevaPlug, an impressive box in terms of low price (~100 USD), high performances (see the specs) and with low power consumption. Finally, the community behind has a great wiki it shouldn't be hard to start playing with it.

All that to say if you're looking for embedded systems, have a look at it, it is worth it.
I bought one and I'm starting to play with it... :)