From 7fd70061b4639fbe83b63d4d097d4675083b173a Mon Sep 17 00:00:00 2001 From: TheEquus Date: Fri, 10 Jan 2025 00:36:46 +0000 Subject: [PATCH] deploy: 3ade4ddedd4d085f3dd7d51078a6e4ed89b8202b --- about/index.html | 4 +- categories/ctf/index.xml | 52 ++++++++++++++++--- categories/projects/index.xml | 9 +++- categories/random/index.xml | 31 ++++++++++-- categories/windows/index.xml | 25 ++++++++- index.html | 2 +- index.xml | 95 ++++++++++++++++++++++++++++++----- posts/index.xml | 88 ++++++++++++++++++++++++++++---- 8 files changed, 267 insertions(+), 39 deletions(-) diff --git a/about/index.html b/about/index.html index cb24360..d6e0f75 100644 --- a/about/index.html +++ b/about/index.html @@ -1,5 +1,5 @@ About
\ No newline at end of file +or chuck an email contact[at]anniequus.com

\ No newline at end of file diff --git a/categories/ctf/index.xml b/categories/ctf/index.xml index 82d97a2..e71bdd7 100644 --- a/categories/ctf/index.xml +++ b/categories/ctf/index.xml @@ -1,8 +1,44 @@ -CTF on Equus 🐴 (Annie)https://anniequus.com/categories/ctf/Recent content in CTF on Equus 🐴 (Annie)Hugoen-auSun, 26 Sep 2021 00:00:00 +0000Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/Who knew I&rsquo;d be writing a crypto writeup. -The Beginning The challenge provides a SageMath bit of code, as well as a cipher text. -def encrypt(msg, f): return &#39;&#39;.join(chr(f.substitute(c)) for c in msg) P.&lt;x&gt; = PolynomialRing(ZZ) f = 13*x^2 + 3*x + 7 FLAG = open(&#39;./flag.txt&#39;, &#39;rb&#39;).read().strip() enc = encrypt(FLAG, f) print(enc) That&rsquo;s some messy looking cipher text&hellip; -Understanding the sage Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function f."Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything. -TL;DR: Use Saleae to extract information, be reminded that Motorola exists and created S-records, break the information down, use Ghidra to disassemble and decompile the machine code, and make sense of everything to eventually obtain the flag.Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep. -TL;DR - Realise this was all just one big digital logic circuit, recognise the different logic gates and connections, build it all in Verilog, solve with some ModelSim bruteforcing, and get enough sleep. -Introduction The challenge provides us with a zip file containing a python script that takes in some data (level1 / level2) to build the challenge.How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned. -The Basics The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins. \ No newline at end of file +CTF on Equus 🐴 (Annie)https://anniequus.com/categories/ctf/Recent content in CTF on Equus 🐴 (Annie)Hugoen-auSun, 26 Sep 2021 00:00:00 +0000Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/<p> + + + + +<img src="media/chall.png" alt="Challenge info" loading="lazy"/> + +Who knew I&rsquo;d be writing a crypto writeup.</p> +<h2 id="the-beginning">The Beginning</h2> +<p>The challenge provides a SageMath bit of code, as well as a cipher text.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-py" data-lang="py"><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">encrypt</span>(msg, f): +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> <span style="color:#e6db74">&#39;&#39;</span><span style="color:#f92672">.</span>join(chr(f<span style="color:#f92672">.</span>substitute(c)) <span style="color:#66d9ef">for</span> c <span style="color:#f92672">in</span> msg) +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>P<span style="color:#f92672">.&lt;</span>x<span style="color:#f92672">&gt;</span> <span style="color:#f92672">=</span> PolynomialRing(ZZ) +</span></span><span style="display:flex;"><span>f <span style="color:#f92672">=</span> <span style="color:#ae81ff">13</span><span style="color:#f92672">*</span>x<span style="color:#f92672">^</span><span style="color:#ae81ff">2</span> <span style="color:#f92672">+</span> <span style="color:#ae81ff">3</span><span style="color:#f92672">*</span>x <span style="color:#f92672">+</span> <span style="color:#ae81ff">7</span> +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>FLAG <span style="color:#f92672">=</span> open(<span style="color:#e6db74">&#39;./flag.txt&#39;</span>, <span style="color:#e6db74">&#39;rb&#39;</span>)<span style="color:#f92672">.</span>read()<span style="color:#f92672">.</span>strip() +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>enc <span style="color:#f92672">=</span> encrypt(FLAG, f) +</span></span><span style="display:flex;"><span>print(enc) +</span></span></code></pre></div><p> + + + + +<img src="media/CipherText.png" alt="Hex output of cipher text" loading="lazy"/> + +That&rsquo;s some messy looking cipher text&hellip;</p> +<h3 id="understanding-the-sage">Understanding the sage</h3> +<p>Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function <code>f</code>. So to reverse it, we just do the opposite.<br> +Since the values were obtained by substituting each character into <code>13*x^2 + 3*x + 7</code>, to get x back, we solve <code>13*x^2 + 3*x + 7 = &lt;encrypted num&gt;</code>.</p>"Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/<img src="media/ChallInfo.png" alt="Challenge info" loading="lazy"/> + +<p>A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything.</p> +<p>TL;DR: Use Saleae to <a href="#extraction">extract information</a>, <a href="#research">be reminded that Motorola exists</a> and created S-records, <a href="#apply">break the information down</a>, <a href="#loading-up-ghidra">use Ghidra</a> to disassemble and decompile the machine code, and <a href="#trust-the-python">make sense of everything</a> to eventually obtain the flag.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge gives us two .sal files, and based solely on the challenge description, capture.sal gives us a function block, and key.sal gives us a key of some kind. This seems pretty straight forward, so time to get on extracting.</p>Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/<img src="media/challenge.png" alt="Challenge info" loading="lazy"/> + +<p>I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep.</p> +<p>TL;DR - Realise this was all just <a href="#diving-deeper">one big digital logic circuit</a>, recognise the different <a href="#junction-types">logic gates and connections</a>, <a href="#building-with-verilog">build it all</a> in Verilog, solve with some <a href="#writing-the-testbench">ModelSim bruteforcing</a>, and get enough sleep.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge provides us with a <a href="https://github.com/google/google-ctf/tree/master/2021/quals/hw-parking/attachments" target="_blank" rel="noreferrer">zip file</a> + containing a python script that takes in some data (level1 / level2) to build the challenge. run.sh just serves as an easy way to progress from level1 to level2.</p>How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/<p>This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned.</p> +<h2 id="the-basics">The Basics</h2> +<p>The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins.</p> \ No newline at end of file diff --git a/categories/projects/index.xml b/categories/projects/index.xml index ec4a81d..ef01aff 100644 --- a/categories/projects/index.xml +++ b/categories/projects/index.xml @@ -1 +1,8 @@ -Projects on Equus 🐴 (Annie)https://anniequus.com/categories/projects/Recent content in Projects on Equus 🐴 (Annie)Hugoen-auMon, 25 Oct 2021 00:00:00 +0000The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/If you see this (without inspecting source), video tags don't seem to work on your browser mate. Introduction I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully). \ No newline at end of file +Projects on Equus 🐴 (Annie)https://anniequus.com/categories/projects/Recent content in Projects on Equus 🐴 (Annie)Hugoen-auMon, 25 Oct 2021 00:00:00 +0000The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/<video controls> + <source src="media/FinalPresVideo.mp4" type="audio/mp4"> + If you see this (without inspecting source), video tags don't seem to work on your browser mate. +</video> + +<h2 id="introduction">Introduction</h2> +<p>I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully). +This page will talk about the technical side of the password manager system itself in more detail than the video, as well as a bit about editing (with a tiny bit of animating) a video.</p> \ No newline at end of file diff --git a/categories/random/index.xml b/categories/random/index.xml index fd515bc..21a245e 100644 --- a/categories/random/index.xml +++ b/categories/random/index.xml @@ -1,3 +1,28 @@ -Random on Equus 🐴 (Annie)https://anniequus.com/categories/random/Recent content in Random on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/Introduction Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following: -#include &lt;iostream&gt; using namespace std; void admin() { cout &lt;&lt; &#34;There is no DEMO - signs of an admin!&#34;; } void user() { cout &lt;&lt; &#34;I see a DEMO variable - signs of a regular user&#34;; } int main() { char* check; check = getenv(&#34;DEMO&#34;); if (check != NULL) { user(); } else admin(); } What is it even doing, and is it possible to get to admin without being an admin?The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one. -The final mix (on bandcamp) The Writhing South by Sex Baby The full line up can be seen on the bandcamp page of the track itself. \ No newline at end of file +Random on Equus 🐴 (Annie)https://anniequus.com/categories/random/Recent content in Random on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/<h2 id="introduction">Introduction</h2> +<p>Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-C++" data-lang="C++"><span style="display:flex;"><span><span style="color:#75715e">#include</span> <span style="color:#75715e">&lt;iostream&gt;</span><span style="color:#75715e"> +</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">using</span> <span style="color:#66d9ef">namespace</span> std; +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">admin</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;There is no DEMO - signs of an admin!&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">user</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;I see a DEMO variable - signs of a regular user&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">int</span> <span style="color:#a6e22e">main</span>() { +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">char</span><span style="color:#f92672">*</span> check; +</span></span><span style="display:flex;"><span> check <span style="color:#f92672">=</span> getenv(<span style="color:#e6db74">&#34;DEMO&#34;</span>); +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (check <span style="color:#f92672">!=</span> NULL) { +</span></span><span style="display:flex;"><span> user(); +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> +</span></span><span style="display:flex;"><span> admin(); +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>What is it even doing, and is it possible to get to admin without being an admin? This post will look into some interesting Windows environment variable behaviours, and how they can be used to bypass application logic.</p>The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/<p>A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! +A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one.</p> +<p>The final mix (on bandcamp) +<iframe sandbox="allow-scripts allow-same-origin allow-forms" title="The Writhing South Cover on Bandcamp" style="border: 0; width: 100%;" src="https://bandcamp.com/EmbeddedPlayer/track=4231765701/size=large/bgcol=ffffff/linkcol=06783c/tracklist=false/artwork=small/transparent=true/" seamless><a href="https://sexbaby.bandcamp.com/track/the-writhing-south">The Writhing South by Sex Baby</a></iframe> + +The full line up can be seen on the bandcamp page of the track itself.</p> \ No newline at end of file diff --git a/categories/windows/index.xml b/categories/windows/index.xml index 58c46c5..bd952cf 100644 --- a/categories/windows/index.xml +++ b/categories/windows/index.xml @@ -1,2 +1,23 @@ -Windows on Equus 🐴 (Annie)https://anniequus.com/categories/windows/Recent content in Windows on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/Introduction Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following: -#include &lt;iostream&gt; using namespace std; void admin() { cout &lt;&lt; &#34;There is no DEMO - signs of an admin!&#34;; } void user() { cout &lt;&lt; &#34;I see a DEMO variable - signs of a regular user&#34;; } int main() { char* check; check = getenv(&#34;DEMO&#34;); if (check != NULL) { user(); } else admin(); } What is it even doing, and is it possible to get to admin without being an admin? \ No newline at end of file +Windows on Equus 🐴 (Annie)https://anniequus.com/categories/windows/Recent content in Windows on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/<h2 id="introduction">Introduction</h2> +<p>Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-C++" data-lang="C++"><span style="display:flex;"><span><span style="color:#75715e">#include</span> <span style="color:#75715e">&lt;iostream&gt;</span><span style="color:#75715e"> +</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">using</span> <span style="color:#66d9ef">namespace</span> std; +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">admin</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;There is no DEMO - signs of an admin!&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">user</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;I see a DEMO variable - signs of a regular user&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">int</span> <span style="color:#a6e22e">main</span>() { +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">char</span><span style="color:#f92672">*</span> check; +</span></span><span style="display:flex;"><span> check <span style="color:#f92672">=</span> getenv(<span style="color:#e6db74">&#34;DEMO&#34;</span>); +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (check <span style="color:#f92672">!=</span> NULL) { +</span></span><span style="display:flex;"><span> user(); +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> +</span></span><span style="display:flex;"><span> admin(); +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>What is it even doing, and is it possible to get to admin without being an admin? This post will look into some interesting Windows environment variable behaviours, and how they can be used to bypass application logic.</p> \ No newline at end of file diff --git a/index.html b/index.html index 4d6ad07..edc9434 100644 --- a/index.html +++ b/index.html @@ -1,2 +1,2 @@ -Equus 🐴 +Equus 🐴

Random things happen I guess

This site features whatever random project I’ve decided to do and write about.

Latest Posts

\ No newline at end of file diff --git a/index.xml b/index.xml index 56b9883..3f47cdf 100644 --- a/index.xml +++ b/index.xml @@ -1,12 +1,83 @@ -Equus 🐴 on Equus 🐴 (Annie)https://anniequus.com/Recent content in Equus 🐴 on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/Introduction Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following: -#include &lt;iostream&gt; using namespace std; void admin() { cout &lt;&lt; &#34;There is no DEMO - signs of an admin!&#34;; } void user() { cout &lt;&lt; &#34;I see a DEMO variable - signs of a regular user&#34;; } int main() { char* check; check = getenv(&#34;DEMO&#34;); if (check != NULL) { user(); } else admin(); } What is it even doing, and is it possible to get to admin without being an admin?The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/If you see this (without inspecting source), video tags don't seem to work on your browser mate. Introduction I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully).Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/Who knew I&rsquo;d be writing a crypto writeup. -The Beginning The challenge provides a SageMath bit of code, as well as a cipher text. -def encrypt(msg, f): return &#39;&#39;.join(chr(f.substitute(c)) for c in msg) P.&lt;x&gt; = PolynomialRing(ZZ) f = 13*x^2 + 3*x + 7 FLAG = open(&#39;./flag.txt&#39;, &#39;rb&#39;).read().strip() enc = encrypt(FLAG, f) print(enc) That&rsquo;s some messy looking cipher text&hellip; -Understanding the sage Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function f."Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything. -TL;DR: Use Saleae to extract information, be reminded that Motorola exists and created S-records, break the information down, use Ghidra to disassemble and decompile the machine code, and make sense of everything to eventually obtain the flag.Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep. -TL;DR - Realise this was all just one big digital logic circuit, recognise the different logic gates and connections, build it all in Verilog, solve with some ModelSim bruteforcing, and get enough sleep. -Introduction The challenge provides us with a zip file containing a python script that takes in some data (level1 / level2) to build the challenge.How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned. -The Basics The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins.The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one. -The final mix (on bandcamp) The Writhing South by Sex Baby The full line up can be seen on the bandcamp page of the track itself.Abouthttps://anniequus.com/about/Mon, 01 Jan 0001 00:00:00 +0000https://anniequus.com/about/Hi I&rsquo;m Annie Nie, and I do random things. -CTF-ing with skateboarding dog 🛹🐶. -Contact me on LinkedIn , X or chuck an email contact@anniequus.com \ No newline at end of file +Equus 🐴 on Equus 🐴 (Annie)https://anniequus.com/Recent content in Equus 🐴 on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/<h2 id="introduction">Introduction</h2> +<p>Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-C++" data-lang="C++"><span style="display:flex;"><span><span style="color:#75715e">#include</span> <span style="color:#75715e">&lt;iostream&gt;</span><span style="color:#75715e"> +</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">using</span> <span style="color:#66d9ef">namespace</span> std; +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">admin</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;There is no DEMO - signs of an admin!&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">user</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;I see a DEMO variable - signs of a regular user&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">int</span> <span style="color:#a6e22e">main</span>() { +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">char</span><span style="color:#f92672">*</span> check; +</span></span><span style="display:flex;"><span> check <span style="color:#f92672">=</span> getenv(<span style="color:#e6db74">&#34;DEMO&#34;</span>); +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (check <span style="color:#f92672">!=</span> NULL) { +</span></span><span style="display:flex;"><span> user(); +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> +</span></span><span style="display:flex;"><span> admin(); +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>What is it even doing, and is it possible to get to admin without being an admin? This post will look into some interesting Windows environment variable behaviours, and how they can be used to bypass application logic.</p>The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/<video controls> + <source src="media/FinalPresVideo.mp4" type="audio/mp4"> + If you see this (without inspecting source), video tags don't seem to work on your browser mate. +</video> + +<h2 id="introduction">Introduction</h2> +<p>I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully). +This page will talk about the technical side of the password manager system itself in more detail than the video, as well as a bit about editing (with a tiny bit of animating) a video.</p>Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/<p> + + + + +<img src="media/chall.png" alt="Challenge info" loading="lazy"/> + +Who knew I&rsquo;d be writing a crypto writeup.</p> +<h2 id="the-beginning">The Beginning</h2> +<p>The challenge provides a SageMath bit of code, as well as a cipher text.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-py" data-lang="py"><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">encrypt</span>(msg, f): +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> <span style="color:#e6db74">&#39;&#39;</span><span style="color:#f92672">.</span>join(chr(f<span style="color:#f92672">.</span>substitute(c)) <span style="color:#66d9ef">for</span> c <span style="color:#f92672">in</span> msg) +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>P<span style="color:#f92672">.&lt;</span>x<span style="color:#f92672">&gt;</span> <span style="color:#f92672">=</span> PolynomialRing(ZZ) +</span></span><span style="display:flex;"><span>f <span style="color:#f92672">=</span> <span style="color:#ae81ff">13</span><span style="color:#f92672">*</span>x<span style="color:#f92672">^</span><span style="color:#ae81ff">2</span> <span style="color:#f92672">+</span> <span style="color:#ae81ff">3</span><span style="color:#f92672">*</span>x <span style="color:#f92672">+</span> <span style="color:#ae81ff">7</span> +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>FLAG <span style="color:#f92672">=</span> open(<span style="color:#e6db74">&#39;./flag.txt&#39;</span>, <span style="color:#e6db74">&#39;rb&#39;</span>)<span style="color:#f92672">.</span>read()<span style="color:#f92672">.</span>strip() +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>enc <span style="color:#f92672">=</span> encrypt(FLAG, f) +</span></span><span style="display:flex;"><span>print(enc) +</span></span></code></pre></div><p> + + + + +<img src="media/CipherText.png" alt="Hex output of cipher text" loading="lazy"/> + +That&rsquo;s some messy looking cipher text&hellip;</p> +<h3 id="understanding-the-sage">Understanding the sage</h3> +<p>Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function <code>f</code>. So to reverse it, we just do the opposite.<br> +Since the values were obtained by substituting each character into <code>13*x^2 + 3*x + 7</code>, to get x back, we solve <code>13*x^2 + 3*x + 7 = &lt;encrypted num&gt;</code>.</p>"Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/<img src="media/ChallInfo.png" alt="Challenge info" loading="lazy"/> + +<p>A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything.</p> +<p>TL;DR: Use Saleae to <a href="#extraction">extract information</a>, <a href="#research">be reminded that Motorola exists</a> and created S-records, <a href="#apply">break the information down</a>, <a href="#loading-up-ghidra">use Ghidra</a> to disassemble and decompile the machine code, and <a href="#trust-the-python">make sense of everything</a> to eventually obtain the flag.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge gives us two .sal files, and based solely on the challenge description, capture.sal gives us a function block, and key.sal gives us a key of some kind. This seems pretty straight forward, so time to get on extracting.</p>Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/<img src="media/challenge.png" alt="Challenge info" loading="lazy"/> + +<p>I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep.</p> +<p>TL;DR - Realise this was all just <a href="#diving-deeper">one big digital logic circuit</a>, recognise the different <a href="#junction-types">logic gates and connections</a>, <a href="#building-with-verilog">build it all</a> in Verilog, solve with some <a href="#writing-the-testbench">ModelSim bruteforcing</a>, and get enough sleep.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge provides us with a <a href="https://github.com/google/google-ctf/tree/master/2021/quals/hw-parking/attachments" target="_blank" rel="noreferrer">zip file</a> + containing a python script that takes in some data (level1 / level2) to build the challenge. run.sh just serves as an easy way to progress from level1 to level2.</p>How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/<p>This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned.</p> +<h2 id="the-basics">The Basics</h2> +<p>The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins.</p>The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/<p>A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! +A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one.</p> +<p>The final mix (on bandcamp) +<iframe sandbox="allow-scripts allow-same-origin allow-forms" title="The Writhing South Cover on Bandcamp" style="border: 0; width: 100%;" src="https://bandcamp.com/EmbeddedPlayer/track=4231765701/size=large/bgcol=ffffff/linkcol=06783c/tracklist=false/artwork=small/transparent=true/" seamless><a href="https://sexbaby.bandcamp.com/track/the-writhing-south">The Writhing South by Sex Baby</a></iframe> + +The full line up can be seen on the bandcamp page of the track itself.</p>Abouthttps://anniequus.com/about/Mon, 01 Jan 0001 00:00:00 +0000https://anniequus.com/about/<p>Hi I&rsquo;m Annie Nie, and I do random things.</p> +<p>CTF-ing with <a href="https://ctftime.org/team/140575" target="_blank" rel="noreferrer">skateboarding dog</a> +🛹🐶.</p> +<p>Contact me on <a href="https://www.linkedin.com/in/aaannie/" target="_blank" rel="noreferrer">LinkedIn</a> +, <a href="https://twitter.com/ThatEquus" target="_blank" rel="noreferrer">X</a> + or chuck an email contact[at]anniequus.com</p> \ No newline at end of file diff --git a/posts/index.xml b/posts/index.xml index 29c6d80..be34b03 100644 --- a/posts/index.xml +++ b/posts/index.xml @@ -1,10 +1,78 @@ -Posts on Equus 🐴 (Annie)https://anniequus.com/posts/Recent content in Posts on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/Introduction Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following: -#include &lt;iostream&gt; using namespace std; void admin() { cout &lt;&lt; &#34;There is no DEMO - signs of an admin!&#34;; } void user() { cout &lt;&lt; &#34;I see a DEMO variable - signs of a regular user&#34;; } int main() { char* check; check = getenv(&#34;DEMO&#34;); if (check != NULL) { user(); } else admin(); } What is it even doing, and is it possible to get to admin without being an admin?The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/If you see this (without inspecting source), video tags don't seem to work on your browser mate. Introduction I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully).Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/Who knew I&rsquo;d be writing a crypto writeup. -The Beginning The challenge provides a SageMath bit of code, as well as a cipher text. -def encrypt(msg, f): return &#39;&#39;.join(chr(f.substitute(c)) for c in msg) P.&lt;x&gt; = PolynomialRing(ZZ) f = 13*x^2 + 3*x + 7 FLAG = open(&#39;./flag.txt&#39;, &#39;rb&#39;).read().strip() enc = encrypt(FLAG, f) print(enc) That&rsquo;s some messy looking cipher text&hellip; -Understanding the sage Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function f."Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything. -TL;DR: Use Saleae to extract information, be reminded that Motorola exists and created S-records, break the information down, use Ghidra to disassemble and decompile the machine code, and make sense of everything to eventually obtain the flag.Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep. -TL;DR - Realise this was all just one big digital logic circuit, recognise the different logic gates and connections, build it all in Verilog, solve with some ModelSim bruteforcing, and get enough sleep. -Introduction The challenge provides us with a zip file containing a python script that takes in some data (level1 / level2) to build the challenge.How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned. -The Basics The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins.The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one. -The final mix (on bandcamp) The Writhing South by Sex Baby The full line up can be seen on the bandcamp page of the track itself. \ No newline at end of file +Posts on Equus 🐴 (Annie)https://anniequus.com/posts/Recent content in Posts on Equus 🐴 (Annie)Hugoen-auSun, 05 Nov 2023 00:00:00 +0000Wacky Windows Environment Variableshttps://anniequus.com/posts/wacky-windows-env-variables/Sun, 05 Nov 2023 00:00:00 +0000https://anniequus.com/posts/wacky-windows-env-variables/<h2 id="introduction">Introduction</h2> +<p>Picture this - you&rsquo;ve been blessed with the task of dissecting a binary written in C++ that looks like the following:</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-C++" data-lang="C++"><span style="display:flex;"><span><span style="color:#75715e">#include</span> <span style="color:#75715e">&lt;iostream&gt;</span><span style="color:#75715e"> +</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">using</span> <span style="color:#66d9ef">namespace</span> std; +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">admin</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;There is no DEMO - signs of an admin!&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">void</span> <span style="color:#a6e22e">user</span>() { +</span></span><span style="display:flex;"><span> cout <span style="color:#f92672">&lt;&lt;</span> <span style="color:#e6db74">&#34;I see a DEMO variable - signs of a regular user&#34;</span>; +</span></span><span style="display:flex;"><span>} +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span><span style="color:#66d9ef">int</span> <span style="color:#a6e22e">main</span>() { +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">char</span><span style="color:#f92672">*</span> check; +</span></span><span style="display:flex;"><span> check <span style="color:#f92672">=</span> getenv(<span style="color:#e6db74">&#34;DEMO&#34;</span>); +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (check <span style="color:#f92672">!=</span> NULL) { +</span></span><span style="display:flex;"><span> user(); +</span></span><span style="display:flex;"><span> } +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">else</span> +</span></span><span style="display:flex;"><span> admin(); +</span></span><span style="display:flex;"><span>} +</span></span></code></pre></div><p>What is it even doing, and is it possible to get to admin without being an admin? This post will look into some interesting Windows environment variable behaviours, and how they can be used to bypass application logic.</p>The password manager to cure lockdown woeshttps://anniequus.com/posts/arduino-password-manager/Mon, 25 Oct 2021 00:00:00 +0000https://anniequus.com/posts/arduino-password-manager/<video controls> + <source src="media/FinalPresVideo.mp4" type="audio/mp4"> + If you see this (without inspecting source), video tags don't seem to work on your browser mate. +</video> + +<h2 id="introduction">Introduction</h2> +<p>I&rsquo;ll be introducing a roughly two week project that I worked on with two other group mates for a uni subject. The theme we were given was to build something that makes our home smarter or more fun. As a team, we started off with the idea of a password manager and decided to add some small fun elements, that would make this password manager the most fun password manager out there (hopefully). +This page will talk about the technical side of the password manager system itself in more detail than the video, as well as a bit about editing (with a tiny bit of animating) a video.</p>Path to a crypto master, the engineer wayhttps://anniequus.com/posts/sub1-ductf2021/Sun, 26 Sep 2021 00:00:00 +0000https://anniequus.com/posts/sub1-ductf2021/<p> + + + + +<img src="media/chall.png" alt="Challenge info" loading="lazy"/> + +Who knew I&rsquo;d be writing a crypto writeup.</p> +<h2 id="the-beginning">The Beginning</h2> +<p>The challenge provides a SageMath bit of code, as well as a cipher text.</p> +<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-py" data-lang="py"><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">encrypt</span>(msg, f): +</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> <span style="color:#e6db74">&#39;&#39;</span><span style="color:#f92672">.</span>join(chr(f<span style="color:#f92672">.</span>substitute(c)) <span style="color:#66d9ef">for</span> c <span style="color:#f92672">in</span> msg) +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>P<span style="color:#f92672">.&lt;</span>x<span style="color:#f92672">&gt;</span> <span style="color:#f92672">=</span> PolynomialRing(ZZ) +</span></span><span style="display:flex;"><span>f <span style="color:#f92672">=</span> <span style="color:#ae81ff">13</span><span style="color:#f92672">*</span>x<span style="color:#f92672">^</span><span style="color:#ae81ff">2</span> <span style="color:#f92672">+</span> <span style="color:#ae81ff">3</span><span style="color:#f92672">*</span>x <span style="color:#f92672">+</span> <span style="color:#ae81ff">7</span> +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>FLAG <span style="color:#f92672">=</span> open(<span style="color:#e6db74">&#39;./flag.txt&#39;</span>, <span style="color:#e6db74">&#39;rb&#39;</span>)<span style="color:#f92672">.</span>read()<span style="color:#f92672">.</span>strip() +</span></span><span style="display:flex;"><span> +</span></span><span style="display:flex;"><span>enc <span style="color:#f92672">=</span> encrypt(FLAG, f) +</span></span><span style="display:flex;"><span>print(enc) +</span></span></code></pre></div><p> + + + + +<img src="media/CipherText.png" alt="Hex output of cipher text" loading="lazy"/> + +That&rsquo;s some messy looking cipher text&hellip;</p> +<h3 id="understanding-the-sage">Understanding the sage</h3> +<p>Thankfully the SageMath here is nice and short. All that we need to know, is that each character of the flag is thrown into the encryption function <code>f</code>. So to reverse it, we just do the opposite.<br> +Since the values were obtained by substituting each character into <code>13*x^2 + 3*x + 7</code>, to get x back, we solve <code>13*x^2 + 3*x + 7 = &lt;encrypted num&gt;</code>.</p>"Oh yeah Motorola exists" - Revelations made in CSAW CTF 2021https://anniequus.com/posts/csaw2021-serial/Tue, 21 Sep 2021 00:00:00 +0000https://anniequus.com/posts/csaw2021-serial/<img src="media/ChallInfo.png" alt="Challenge info" loading="lazy"/> + +<p>A mildly interesting challenge that touches (very briefly) on serial communication. But given that the files are .sal files, we can use the trusty old Saleae&rsquo;s logic analyser to help decode everything.</p> +<p>TL;DR: Use Saleae to <a href="#extraction">extract information</a>, <a href="#research">be reminded that Motorola exists</a> and created S-records, <a href="#apply">break the information down</a>, <a href="#loading-up-ghidra">use Ghidra</a> to disassemble and decompile the machine code, and <a href="#trust-the-python">make sense of everything</a> to eventually obtain the flag.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge gives us two .sal files, and based solely on the challenge description, capture.sal gives us a function block, and key.sal gives us a key of some kind. This seems pretty straight forward, so time to get on extracting.</p>Inefficiently solving GoogleCTF 2021 with Verilog (ModelSim)https://anniequus.com/posts/googlectf-parking/Sat, 31 Jul 2021 00:00:00 +0000https://anniequus.com/posts/googlectf-parking/<img src="media/challenge.png" alt="Challenge info" loading="lazy"/> + +<p>I unfortunately did not solve this during the competition period, but mildly obsessed over this for about a week after the competition. Here&rsquo;s how I lost way too many hours of sleep.</p> +<p>TL;DR - Realise this was all just <a href="#diving-deeper">one big digital logic circuit</a>, recognise the different <a href="#junction-types">logic gates and connections</a>, <a href="#building-with-verilog">build it all</a> in Verilog, solve with some <a href="#writing-the-testbench">ModelSim bruteforcing</a>, and get enough sleep.</p> +<h2 id="introduction">Introduction</h2> +<p>The challenge provides us with a <a href="https://github.com/google/google-ctf/tree/master/2021/quals/hw-parking/attachments" target="_blank" rel="noreferrer">zip file</a> + containing a python script that takes in some data (level1 / level2) to build the challenge. run.sh just serves as an easy way to progress from level1 to level2.</p>How HackTheBoxCTF Exposed The Marriage of Saleae And Hardwarehttps://anniequus.com/posts/htb-hardware-writeups/Mon, 26 Apr 2021 00:00:00 +0000https://anniequus.com/posts/htb-hardware-writeups/<p>This will be a writeup of all the hardware challenges in HackTheBoxCTF 2021. Although half the challenges in the category was just figuring out the protocol used, there were some interesting lessons learned.</p> +<h2 id="the-basics">The Basics</h2> +<p>The first three challenges (which I&rsquo;ll just call the basics) were best for getting used to using Saleae, its analysers, and getting a basic understanding of the protocols. This is where the heavy reliance on Saleae (logic analyser alpha) begins.</p>The Writhing South Bass Coverhttps://anniequus.com/posts/tws-bass/Fri, 16 Apr 2021 00:00:00 +0000https://anniequus.com/posts/tws-bass/<p>A fun song for a fun band. Sex Baby&rsquo;s cover of &ldquo;The Writhing South&rdquo; by Say Anything is out for the public to feast on! +A band consisting of a rotation between some mates and I, it was my turn to rock out on the bass for this one.</p> +<p>The final mix (on bandcamp) +<iframe sandbox="allow-scripts allow-same-origin allow-forms" title="The Writhing South Cover on Bandcamp" style="border: 0; width: 100%;" src="https://bandcamp.com/EmbeddedPlayer/track=4231765701/size=large/bgcol=ffffff/linkcol=06783c/tracklist=false/artwork=small/transparent=true/" seamless><a href="https://sexbaby.bandcamp.com/track/the-writhing-south">The Writhing South by Sex Baby</a></iframe> + +The full line up can be seen on the bandcamp page of the track itself.</p> \ No newline at end of file