Some basic hacking techniques via example: NoNameCon badge by Oleksii Sobolevskyi

Oleksii Sobolevskyi showed, how he solved all the 6 tasks, that were encoded into a hardware badge of the NoNameCon 2019 conference in Kyiv. It included exploring simple XSS vulnerabilities as well as reverse engineering a binary.

Transcript

1. Basic hacking techniques via example: NoNameCon badge Oleksii Sobolevskyi Software Engineer
4. https://www.nonamecon.org/badge
6. Capture the Flag (CTF) — это игра, в которой участники пытаются захватить флаг противников и защитить свой.
7. 1. Mr Bean Walker – reverse engineering 2. BruteSearcher – web application security 3. NoNameCon SpyNet – web application security 4. Ployka PWNer – cryptography 5. Binary Hero – reverse engineering 6. Side Blennel – steganography https://www.nonamecon.org/badge
16. https://youtu.be/chfoAWevHMs
17. https://youtu.be/chfoAWevHMs
27. http://dirb.sourceforge.net/
41. XSS
42. XSS (англ. Cross-Site Scripting — «межсайтовый скриптинг») — тип атаки на веб-системы, заключающийся во внедрении в выдаваемую веб-системой страницу вредоносного кода (который будет выполнен на компьютере пользователя при открытии им этой страницы) и взаимодействии этого кода с веб-сервером злоумышленника.
54. https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
67. https://github.com/tintinweb/ecdsa-private-key-recovery
83. https://docs.espressif.com/projects/esp-idf/en/release-v3.2/get-started/macos-setup.html#toolchain-setup
88. https://github.com/radareorg/cutter
90. https://0x04.net/~mwk/doc/xtensa.pdf
94. sprintf a10, a11, a12, a13, a14, a15
95. a10 = flag{%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x}
96. a11 = flag{%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x}
97. a11 = flag{%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x} 14 x %02x ( 2 hex digit of integer )
98. sprintf a10, a11, a12, a13, a14, a15 , a1+0, a1+4, … a1+36
99. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36
100. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36
101. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36
102. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 ???
103. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 81 = 0x51
104. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36
105. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 a1+0 = a13
106. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 a1+0 = 0xd2
107. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 a1+4 = a8
108. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 a8 = 0x53
109. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 a1+4 = 0x53
110. a12, a13, a14, a15 , a1+0, a1+4, a1+8, a1+12, a1+16, a1+20, a1+24, a1+28, a1+32, a1+36 0xbf, 0xd2, 0x51, 0xb9, 0xd2, 0x53, 0xab, 0xa, 0xea, 0x83, 0x55, 0x4e, 0xfb, 0x8d
113. https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp https://play.google.com/store/apps/details?id=com.macdom.ble.blescanner
118. • https://www.nonamecon.org/badge • screen • strings • dirb (http://dirb.sourceforge.net/) • https://xsshunter.com/ • https://github.com/tintinweb/ecdsa-private-key-recovery • https://docs.espressif.com/projects/esp-idf/en/release-v3.2/get- started/macos-setup.html#toolchain-setup • https://github.com/radareorg/cutter • https://0x04.net/~mwk/doc/xtensa.pdf • https://play.google.com/store/apps/details? id=no.nordicsemi.android.mcp • https://play.google.com/store/apps/details? id=com.macdom.ble.blescanner • https://play.google.com/store/apps/details? id=com.macdom.ble.blescanner • base64
119. https://github.com/search?q=ctf+writeup https://cryptopals.com/ https://ctftime.org/
120. Q&A