YobiWiki - User contributions [en]

Exim

2026-03-18T21:51:07Z

PhilippeTeuwen: /* Nouveau compte */

==Installation et configuration d'Exim sur Etch avec smarthost==
apt-get install exim4-daemon-heavy
dpkg-reconfigure exim4-config
* Yes, split => conf files are in /etc/exim4/conf.d
* Or if you prefer, No, don't split => conf file is /etc/exim4/exim4.conf.template
* Mail sent by smarthost; received via SMTP or fetchmail
* Mail name: teuwen.org
* List of IP-addresses to listen on: ''empty''
* List of domains as final destination: ''empty''
* Machines to relay mail for: 10.0.0.0/8:192.168.2.4 Note that if only the localhost must be able to use this smtp without authentication, it has still to be mentioned explicitely: '<ip>/32'
* smarthost: courriel.latribu.com
* Hide: no
* Dial-on-Demand: no

Éditer /etc/exim4/passwd.client
courriel.latribu.com:philippe.teuwen@latribu.com:xxxxxx

update-exim4.conf => regenerate /var/lib/exim4/config.autogenerated
Attention!!! à partir d'une certaine version de exim4, le système refuse d'utiliser l'authentification s'il ny a pas d'encryption.
 cf /usr/share/doc/exim4/README.Debian.gz:
''AUTH PLAIN and AUTH LOGIN are disabled for connections which are not protected by SSL/TLS per default. These authentication methods use cleartext passwords (like telnet). If you need to enable them for unencrypted connections because your service provider does support neither TLS encryption nor the CRAM MD5 authentication method, you can do so by setting the appropriate macro as mentioned in the comments in the configuration file.''
 Le problème est résolu en créant un fichier /etc/exim4/exim4.conf.localmacros avec: AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS = true pour une configuration monolithique et en créant un fichier /etc/exim4/conf.d/main/000_localmacros avec le même contenu pour une configuration "split".

Incidemment une autre modification à apporter est le nom du SMTP server dans /etc/exim4/passwd.client
 ''Symptome'': l'envoi de mails hors du domaine de l'ISP (donc envoi qui requiert une authentification) échoue et on en trouve trace dans /var/log/exim4/mainlog
2005-XX-XX XX:XX:XX XXXXXX-XXXXXX-XX ** XX@XX.XX R=smarthost T=remote_smtp_smarthost:
SMTP error from remote mailer after RCPT TO:<XX@XX.XX>: host __courriel.talessa.com [85.234.192.2]__: 550 relay not permitted
''Raison'': le smarthost déclaré dans /etc/exim4/update-exim4.conf.conf est dc_smarthost='__courriel.latribu.com__' mais exim cherche la correspondance dans /etc/exim4/passwd.client avec '''courriel.talessa.com''' comme indiqué plus haut.
 Pourquoi? la réponse est dans la résolution DNS du smarthost:
host '''courriel.latribu.com'''
'''courriel.latribu.com''' CNAME '''courriel.talessa.com'''
'''courriel.talessa.com''' A 85.234.192.2
''Solution'': un bugreport existe: [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=244724 #244724] et [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314327 #314327]
 En attendant, il faut faire référence à courriel.talessa.com dans /etc/exim4/passwd.client
''UPDATE'' Bizarrement bien que le bugreport ne soit pas fermé on dirait que le problème est réglé et il faut, avec les dernières versions d'Exim, indiquer le même smarthost dans passwd.client que dans update-exim4.conf.

==Installation et configuration d'Exim sur Etch==
Pour écouter sur un port additionnel autre que le 25, ajouter à la configuration d'exim:
daemon_smtp_ports = 25 : 2525
Autre solution lue sur le Net, ça dépend sans doute de la version éditer /etc/default/exim4:
# options for daemon listening on port 25 and port 2525
SMTPLISTENEROPTIONS='-oX 2525:25'

==SMTP server avec TLS et auth==
apt-get install openssl
Générer les certificats avec par exemple:
/usr/share/doc/exim4-base/examples/exim-gencert
Activer le TLS en créant/ajoutant à /etc/exim4/exim4.conf.localmacros:
 MAIN_TLS_ENABLE = true pour une configuration monolithique et en créant un fichier /etc/exim4/conf.d/main/000_localmacros avec le même contenu pour une configuration "split".
Activer l'auth en se basant sur le daemon de courier-imap: décommenter dans la section AUTHENTIFICATION CONFIGURATION du fichier /etc/exim4/exim4.conf.template les sections
 plain_courier_authdaemon et login_courier_authdaemon pour une configuration monolithique et en faisant de même dans le fichier /etc/exim4/conf.d/auth/30_exim4-config_examples avec le même contenu pour une configuration "split".
Autoriser exim4 à accéder au socket de courier-imap (/var/run/courier/authdaemon/socket):
adduser Debian-exim daemon
Note qu'à partir d'un certain moment, le serveur SMTP denamdait à voir le certificate du client lorsque c'était possible et comme j'ai un certificat CACert dans Thunderbird, celui-ci me promptait à chaque fois que j'envoyais un mail, pour pas grand chose puisque certif ou pas la communication se faisait.
 Explication: cf /etc/exim4/conf.d/main/03_exim4-config_tlsoptions
 Pour éliminer cela j'ai donc ajouté à mon /etc/exim4/conf.d/main/000_localmacros
MAIN_TLS_TRY_VERIFY_HOSTS =

==Support d'adresses email secondaires==
Je crée souvent des adresses sur mesure pour tous ces sites qui veulent un email: phil-parci, phil-parla...
 Modifier dans /etc/exim4/exim4.conf.template (ou dans /etc/exim4/conf.d/router/900_exim4-config_local_user et 700_exim4-config_procmail selon, pour une configuration "split"), les routeur local_user (et routeur procmail, selon) en ajoutant avant check_local_user:
local_part_suffix = +* : -* : _*
local_part_suffix_optional
Si votre "user" favori n'est pas celui de votre account mais un alias défini dans /etc/aliases les adresses secondaires ne fonctionneront pas avec ce "user" favori.
 Pour que cela fonctionne il faut aussi modifier le routeur system_aliases dans /etc/exim4/exim4.conf.template (ou dans /etc/exim4/conf.d/router/400_exim4-config_system_aliases pour une configuration "split") avant le data = ...lookup:
local_part_suffix = +* : -* : _*
local_part_suffix_optional
On peut aussi utiliser des adresses du type phil.xxx en ajoutant .* à la liste local_part_suffix:
local_part_suffix = +* : -* : _* : .*

==Domaines virtuels==
cf http://www.debian-administration.org/articles/140
 Combiné à la règle précédente, cela signifie qu'il faut ajouter les lignes local_part_suffix... au routeur vdom_aliases, local_user et procmail ne nécessitent alors plus cette modification.
==Nouveau compte==
En résumé pour ajouter un compte:
* adduser --disabled-password --shell /usr/sbin/nologin toto
* userdb toto set uid=1234 gid=1234 home=/home/toto
* userdbpw -hmac-md5 | userdb toto set hmac-md5pw # for courier-imap -> choose encrypted pwd in client config
* userdbpw -md5 | userdb toto set systempw
* makeuserdb
* service courier-authdaemon reload
* (echo "toto : toto@localhost" >> /etc/exim4/virtual/mydomain.com)
* su -s /bin/bash - toto
** maildirmake Maildir

Pour le récupérer via fetchmail:
~/.fetchmailrc :
poll imap.yobi.be with proto IMAP and with interval 5
user 'toto' there with password 'xxx' is 'totolocal' here fetchall

$ fetchmail -v
=> cela donne une erreur de vérification de certificat et le fingerprint, qu'on peut rajouter ainsi:
~/.fetchmailrc :
poll imap.yobi.be with proto IMAP and with interval 5
user 'toto' there with password 'xxx' is 'totolocal' here fetchall sslfingerprint "62:7B:89:58:7B:33:ED:FF:2B:CF:D9:43:CA:E1:32:0E"

==Qqs commandes utiles==
* Pour lister la queue de messages:
exim4 -bp
ou
mailq
* Pour forcer le process de la queue de messages (par ex. car + de 10 messages ont été rapatriés en une fois):
exim4 -q
ou
runq
* Pour forcer le process de la queue de messages, même pour les messages reschedulés pour plus tard (ex: greylisted):
exim4 -qf
* Pour "dégeler" (thaw) tous les messages gelés (frozen):
mailq|gawk '/frozen/{print $3}'|xargs exim4 -Mt;runq
* Pour effacer un message de la queue:
exim4 -Mrm <ID du message>
* Pour débugger un envoi:
echo test|./exim -d+all XX@XX.XX >/tmp/exim-log.txt 2>&1
* Pour avoir les stats du jour:
eximstats /var/log/exim4/mainlog
* Pour les recevoir par mail, cela est prévu dans /etc/cron.daily/exim4-base, il suffit de décommenter le code et ajouter son adresse email.

Exim

2026-03-18T21:36:37Z

PhilippeTeuwen: /* Nouveau compte */

==Installation et configuration d'Exim sur Etch avec smarthost==
apt-get install exim4-daemon-heavy
dpkg-reconfigure exim4-config
* Yes, split => conf files are in /etc/exim4/conf.d
* Or if you prefer, No, don't split => conf file is /etc/exim4/exim4.conf.template
* Mail sent by smarthost; received via SMTP or fetchmail
* Mail name: teuwen.org
* List of IP-addresses to listen on: ''empty''
* List of domains as final destination: ''empty''
* Machines to relay mail for: 10.0.0.0/8:192.168.2.4 Note that if only the localhost must be able to use this smtp without authentication, it has still to be mentioned explicitely: '<ip>/32'
* smarthost: courriel.latribu.com
* Hide: no
* Dial-on-Demand: no

Éditer /etc/exim4/passwd.client
courriel.latribu.com:philippe.teuwen@latribu.com:xxxxxx

update-exim4.conf => regenerate /var/lib/exim4/config.autogenerated
Attention!!! à partir d'une certaine version de exim4, le système refuse d'utiliser l'authentification s'il ny a pas d'encryption.
 cf /usr/share/doc/exim4/README.Debian.gz:
''AUTH PLAIN and AUTH LOGIN are disabled for connections which are not protected by SSL/TLS per default. These authentication methods use cleartext passwords (like telnet). If you need to enable them for unencrypted connections because your service provider does support neither TLS encryption nor the CRAM MD5 authentication method, you can do so by setting the appropriate macro as mentioned in the comments in the configuration file.''
 Le problème est résolu en créant un fichier /etc/exim4/exim4.conf.localmacros avec: AUTH_CLIENT_ALLOW_NOTLS_PASSWORDS = true pour une configuration monolithique et en créant un fichier /etc/exim4/conf.d/main/000_localmacros avec le même contenu pour une configuration "split".

Incidemment une autre modification à apporter est le nom du SMTP server dans /etc/exim4/passwd.client
 ''Symptome'': l'envoi de mails hors du domaine de l'ISP (donc envoi qui requiert une authentification) échoue et on en trouve trace dans /var/log/exim4/mainlog
2005-XX-XX XX:XX:XX XXXXXX-XXXXXX-XX ** XX@XX.XX R=smarthost T=remote_smtp_smarthost:
SMTP error from remote mailer after RCPT TO:<XX@XX.XX>: host __courriel.talessa.com [85.234.192.2]__: 550 relay not permitted
''Raison'': le smarthost déclaré dans /etc/exim4/update-exim4.conf.conf est dc_smarthost='__courriel.latribu.com__' mais exim cherche la correspondance dans /etc/exim4/passwd.client avec '''courriel.talessa.com''' comme indiqué plus haut.
 Pourquoi? la réponse est dans la résolution DNS du smarthost:
host '''courriel.latribu.com'''
'''courriel.latribu.com''' CNAME '''courriel.talessa.com'''
'''courriel.talessa.com''' A 85.234.192.2
''Solution'': un bugreport existe: [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=244724 #244724] et [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314327 #314327]
 En attendant, il faut faire référence à courriel.talessa.com dans /etc/exim4/passwd.client
''UPDATE'' Bizarrement bien que le bugreport ne soit pas fermé on dirait que le problème est réglé et il faut, avec les dernières versions d'Exim, indiquer le même smarthost dans passwd.client que dans update-exim4.conf.

==Installation et configuration d'Exim sur Etch==
Pour écouter sur un port additionnel autre que le 25, ajouter à la configuration d'exim:
daemon_smtp_ports = 25 : 2525
Autre solution lue sur le Net, ça dépend sans doute de la version éditer /etc/default/exim4:
# options for daemon listening on port 25 and port 2525
SMTPLISTENEROPTIONS='-oX 2525:25'

==SMTP server avec TLS et auth==
apt-get install openssl
Générer les certificats avec par exemple:
/usr/share/doc/exim4-base/examples/exim-gencert
Activer le TLS en créant/ajoutant à /etc/exim4/exim4.conf.localmacros:
 MAIN_TLS_ENABLE = true pour une configuration monolithique et en créant un fichier /etc/exim4/conf.d/main/000_localmacros avec le même contenu pour une configuration "split".
Activer l'auth en se basant sur le daemon de courier-imap: décommenter dans la section AUTHENTIFICATION CONFIGURATION du fichier /etc/exim4/exim4.conf.template les sections
 plain_courier_authdaemon et login_courier_authdaemon pour une configuration monolithique et en faisant de même dans le fichier /etc/exim4/conf.d/auth/30_exim4-config_examples avec le même contenu pour une configuration "split".
Autoriser exim4 à accéder au socket de courier-imap (/var/run/courier/authdaemon/socket):
adduser Debian-exim daemon
Note qu'à partir d'un certain moment, le serveur SMTP denamdait à voir le certificate du client lorsque c'était possible et comme j'ai un certificat CACert dans Thunderbird, celui-ci me promptait à chaque fois que j'envoyais un mail, pour pas grand chose puisque certif ou pas la communication se faisait.
 Explication: cf /etc/exim4/conf.d/main/03_exim4-config_tlsoptions
 Pour éliminer cela j'ai donc ajouté à mon /etc/exim4/conf.d/main/000_localmacros
MAIN_TLS_TRY_VERIFY_HOSTS =

==Support d'adresses email secondaires==
Je crée souvent des adresses sur mesure pour tous ces sites qui veulent un email: phil-parci, phil-parla...
 Modifier dans /etc/exim4/exim4.conf.template (ou dans /etc/exim4/conf.d/router/900_exim4-config_local_user et 700_exim4-config_procmail selon, pour une configuration "split"), les routeur local_user (et routeur procmail, selon) en ajoutant avant check_local_user:
local_part_suffix = +* : -* : _*
local_part_suffix_optional
Si votre "user" favori n'est pas celui de votre account mais un alias défini dans /etc/aliases les adresses secondaires ne fonctionneront pas avec ce "user" favori.
 Pour que cela fonctionne il faut aussi modifier le routeur system_aliases dans /etc/exim4/exim4.conf.template (ou dans /etc/exim4/conf.d/router/400_exim4-config_system_aliases pour une configuration "split") avant le data = ...lookup:
local_part_suffix = +* : -* : _*
local_part_suffix_optional
On peut aussi utiliser des adresses du type phil.xxx en ajoutant .* à la liste local_part_suffix:
local_part_suffix = +* : -* : _* : .*

==Domaines virtuels==
cf http://www.debian-administration.org/articles/140
 Combiné à la règle précédente, cela signifie qu'il faut ajouter les lignes local_part_suffix... au routeur vdom_aliases, local_user et procmail ne nécessitent alors plus cette modification.
==Nouveau compte==
En résumé pour ajouter un compte:
* adduser --disabled-password --shell /usr/sbin/nologin toto
* userdb toto set uid=1234 gid=1234 home=/home/toto
* userdbpw -hmac-md5 | userdb toto set hmac-md5pw # for courier-imap -> choose encrypted pwd in client config
* userdbpw -md5 | userdb toto set systempw
* makeuserdb
* service courier-authdaemon reload
* echo "toto : toto@localhost" >> /etc/exim4/virtual/mydomain.com
* su - toto
** maildirmake Maildir

Pour le récupérer via fetchmail:
~/.fetchmailrc :
poll imap.yobi.be with proto IMAP and with interval 5
user 'toto' there with password 'xxx' is 'totolocal' here fetchall

$ fetchmail -v
=> cela donne une erreur de vérification de certificat et le fingerprint, qu'on peut rajouter ainsi:
~/.fetchmailrc :
poll imap.yobi.be with proto IMAP and with interval 5
user 'toto' there with password 'xxx' is 'totolocal' here fetchall sslfingerprint "62:7B:89:58:7B:33:ED:FF:2B:CF:D9:43:CA:E1:32:0E"

==Qqs commandes utiles==
* Pour lister la queue de messages:
exim4 -bp
ou
mailq
* Pour forcer le process de la queue de messages (par ex. car + de 10 messages ont été rapatriés en une fois):
exim4 -q
ou
runq
* Pour forcer le process de la queue de messages, même pour les messages reschedulés pour plus tard (ex: greylisted):
exim4 -qf
* Pour "dégeler" (thaw) tous les messages gelés (frozen):
mailq|gawk '/frozen/{print $3}'|xargs exim4 -Mt;runq
* Pour effacer un message de la queue:
exim4 -Mrm <ID du message>
* Pour débugger un envoi:
echo test|./exim -d+all XX@XX.XX >/tmp/exim-log.txt 2>&1
* Pour avoir les stats du jour:
eximstats /var/log/exim4/mainlog
* Pour les recevoir par mail, cela est prévu dans /etc/cron.daily/exim4-base, il suffit de décommenter le code et ajouter son adresse email.

Bind

2026-01-27T21:47:28Z

PhilippeTeuwen: /* Setup on server */

==Intro==
Some notes how to setup a dynamic DNS...
 Setup is based on Askarel's [https://github.com/askarel/dynaname dynaname]
 Thank you Fred for the help!

==Requirements==
===Your DNS server===
apt-get install bind9
This will be the nameserver '''ns0.foo.org''' for our dynamic subdomain '''dyn.bar.org''' so this has to be announced in the primary DNS of your bar.org domain:
dyn NS ns0.foo.org.
To test it:
dig @your.primary.dns.for.bar.org dyn.bar.org
;; AUTHORITY SECTION:
dyn.bar.org. 10800 IN NS ns0.foo.org.

===Your dynamic IP client===
Old notes:
apt-get install dnsutils bind9utils
git clone https://github.com/askarel/dynaname.git

On Debian Trixie:

If not yet merged, use my branch with tsig-keygen: [https://github.com/doegox/dynaname/tree/phil doegox/dynaname:phil]
apt-get install bind9-dnsutils bind9
git clone https://github.com/doegox/dynaname
cd dynaname
git checkout phil

After key generation (cf below), one can remove bind9 and its dependencies
apt remove bind9 bind9-utils dns-root-data

And we keep bind9-dnsutils for nsupdate

==Setup on client==
To create e.g. home.dyn.bar.org:
cd dynaname
./dynaname -G -H home.dyn.bar.org -S ns0.foo.org
==Setup on server==
Copy client ns0.foo.org/etc/bind/dynaname.conf to ns0.foo.org:/etc/bind/
 and add a hook into ns0.foo.org:/etc/bind/named.conf:
include "/etc/bind/dynaname.conf"

For info dynaname.conf should now look like:
<pre>
key home.dyn.bar.org {
algorithm HMAC-SHA512;
secret "some secret...";
};

zone "dyn.bar.org" in {
type master;
file "dyn/dyn.bar.org";
update-policy {
grant home.dyn.bar.org name home.dyn.bar.org A AAAA TXT;
};
};
</pre>

Create ns0.foo.org:/var/cache/bind/dyn/dyn.bar.org with the following content:
<pre>
$ORIGIN .
$TTL 3600 ; 1 hour
dyn.bar.org. IN SOA ns0.foo.org. me.bar.org. (
2014060301 ; serial, increment it every time you edit file
600 ; refresh (10 minutes)
300 ; retry (5 minutes)
86400 ; expire (1 day)
300 ; minimum (5 minutes)
)
dyn.bar.org. IN NS ns0.foo.org.
$ORIGIN dyn.bar.org.
</pre>

Make sure bind has RW access:
root@ns0:/var/cache/bind/dyn# ls -al
total 16
drwxrwxr-x 2 root bind 4096 Jun 3 23:44 .
drwxrwxr-x 3 root bind 4096 Jun 3 23:15 ..
-rw-r--r-- 1 bind bind 389 Jun 3 23:44 dyn.bar.org

Reload bind
service bind9 reload

Check messages
tail /var/log/syslog

==Setup on server with multiple clients==
For several clients under the same zone dyn.bar.org, e.g. adding work.dyn.bar.org, add to dynaname.conf:
<source lang=diff>
+ key work.dyn.bar.org {
+ algorithm HMAC-SHA512;
+ secret "some other secret...";
+ };

zone "dyn.bar.org" in {
type master;
file "dyn/dyn.bar.org";
update-policy {
grant home.dyn.bar.org name home.dyn.bar.org A AAAA TXT;
+ grant work.dyn.bar.org name work.dyn.bar.org A AAAA TXT;
};
};
</source>
And reload bind
/etc/init.d/bind9 reload

==Update from client==
./dynaname -H home.dyn.bar.org -S ns0.foo.org -A 1.2.3.4

To test it:
dig @ns0.foo.org home.dyn.bar.org
;; QUESTION SECTION:
;home.dyn.bar.org. IN A
;; ANSWER SECTION:
home.dyn.bar.org. 300 IN A 1.2.3.4
;; AUTHORITY SECTION:
dyn.bar.org. 3600 IN NS ns0.foo.org.
==Update from client automatically==
Using [https://github.com/twalrant/yadynip yadynip]:
git clone https://github.com/twalrant/yadynip
cd yadynip
patch -p0 << 'EOF'
--- bin/yadynip 2024-11-11 17:20:40.005543486 +0100
+++ bin/yadynip 2024-11-11 17:20:59.274511702 +0100
@@ -148,6 +148,7 @@

## Perform actions with detected IP address
for part in $(runparts $etcdir/actions.d); do
+ [ -d "$part" ] && continue
# Get and check last known IP address for this action
lastip=$(lastip $(basename $part))
EOF
./install.sh
rm /usr/local/etc/yadynip/checkip.d/00dir600*
rm /usr/local/etc/yadynip/checkip.d/10all-nettools
rm /usr/local/etc/yadynip/checkip.d/12showmyip
rm /usr/local/etc/yadynip/checkip.d/13whatismyip
rm /usr/local/etc/yadynip/checkip.d/20voo-netgear*
rm /usr/local/etc/yadynip/actions.d/00ipUpdate*
rm /usr/local/etc/yadynip/actions.d/00zeupdate*
rm /usr/local/etc/yadynip/actions.d/10sendmail*
mkdir -p /var/cache/yadynip/ipcaches/
ln -s /root/dynaname /usr/local/etc/yadynip/actions.d
/usr/local/etc/yadynip.conf:
verbose=none
logfile=/var/log/yadynip.log
sharedir=/var/cache/yadynip
/usr/local/etc/yadynip/actions.d/conf/d00ynaname.conf:
host=home.dyn.bar.org
ns=ns0.foo.org

/usr/local/etc/yadynip/actions.d/dynaname/: the original dynaname with key files
dynaname
home.dyn.bar.org.private
Now we can call yadynip from cron
crontab -e
*/10 * * * * /usr/local/bin/yadynip

CTF

2024-11-18T14:21:03Z

PhilippeTeuwen:

=GreHack CTF 2024=

== #2 with @everyone ==

 [[Image:GreHack2024.png|300px]]
 [[Image:GreHack2024b.png|300px]]

=GreHack CTF 2019=
* [https://ctftime.org/event/922 ctftime]
== #1 with GreHax0r ==

 [[Image:GreHack2019.jpg|300px]]
==[https://github.com/SideChannelMarvels/Deadpool/blob/master/wbs_aes_grehack2019 GreHack 2019 AES WB Writeup]==

=GreHack CTF 2018=
* [https://ctftime.org/event/679 ctftime]
== #2 with donjon-qsec ==

 [[Image:GreHack2018.jpg|300px]]
==[[GreHack 2018 Writeups|Writeups]]==

=Hack.lu 2018 CTF by Fluxfingers=
* [https://ctftime.org/event/699 ctftime]
== #34 (#3 local) with pollypocket ==

 [[Image:Hacklu2018ctf.png|300px]]

=GreHack CTF 2017=
* [https://ctftime.org/event/426 ctftime]
== #1 with qsec ==

 [[Image:GreHack2017.jpg|300px]]

=Hack.lu 2017 CTF by Fluxfingers=
* [https://ctftime.org/event/525 ctftime]
== #17 (#3 local) with pollypocket ==
==[[Hack.lu 2017 Writeups|Writeups]]==

=GreHack CTF 2016=
* [https://ctftime.org/event/301 ctftime]
== #1 with qsec ==

 [[Image:GreHack2016.jpg|300px]]

=Hack.lu 2016 CTF by Fluxfingers=
* [https://ctftime.org/event/380 ctftime]
== #13 (#4 local) with pollypocket ==

=Y-not-CTF at CybSec15=
== #2 with team1 ==


=Hack.lu 2015 CTF by Fluxfingers=
* [https://ctftime.org/event/244 ctftime]
== #10 (#3 local) with pollypocket ==
 [[Image:Hacklu2015ctf2.png|300px]]
==[[Hack.lu 2015 Writeups|Writeups]]==

=Brucon 2015 MWR challenges=
There were three challenges proposed by MWR during Brucon 2015.
 pollypocket won two of them, cf tweets [https://twitter.com/mwrlabs/status/652120505877680128 here] and [https://twitter.com/mwrlabs/status/652474013743251456 there]
 [[Image:Brucon2015MRW1.jpg|300px]] [[Image:Brucon2015MRW3.png|390px]] [[Image:Brucon2015MRW2.jpg|220px]]

=CHES2015 CTF=
Philippe Teuwen
== #2 under pseudo yobibe ==
 [[Image:Ches2015timefinal.png|300px]]
 [[Image:Ches2015rump1.png|300px]]
 And BTW [https://twitter.com/doegox/status/615463104214863872 first to solve them all after 5.5 days]
 [[Image:Ches2015time.png|300px]]

==[[CHES2015 Writeup|Writeups]]==
[[Image:Ches2015rump2.png|300px]]

=Nuit du Hack CTF Finals 2015 by Hackerzvoice=
== #3 with pollypocket ==
Team: Vincent Hutsebaut, Marc Masure, Charles Hubain, Jeremie Boutoille, Philippe Teuwen
 (#3 of the 10 CTF finalists, #4 including the public wargame participants)
 [[Image:Ndh2015final.png|300px]]

=[http://communaute.sstic.org/ChallengeSSTIC2015 SSTIC Challenge 2015]=
Philippe Teuwen [http://static.sstic.org/challenge2015/solutions/philippe_teuwen.pdf write-up (pdf)] (FR)
== #2 classement qualité ==
[[Image:Sstic2015topqual.png|300px]]
== #9 classement vitesse ==
[[Image:Sstic2015topspeed.png|300px]]

=Nuit du Hack CTF Quals 2015 by Hackerzvoice=
* [https://ctftime.org/event/196 ctftime]
== #1 with pollypocket ==
Team: Vincent Hutsebaut, Philippe Teuwen, Charles Hubain, Marc Masure, Jeremie Boutoille, Matthieu Kaczmarek
 [[Image:Ndh2015quals.png|300px]][[Image:NdhTop10.png|300px]]

==[[NDH Writeups#2015 Nuit du Hack CTF Quals by Hackerzvoice|Writeups]]==
=Codegate CTF preliminary 2015=
* [https://ctftime.org/event/201 ctftime]
== #22 with pollypocket ==

[[Image:Codegate2015ctf.png|300px]]
=Hack.lu 2014 CTF by Fluxfingers=
* [https://ctftime.org/event/154 ctftime]
== #6 (#1 local) with pollypocket ==
 [[Image:Hacklu2014ctf.png|300px]]

=Brucon 2014 CTF by Facebook=
== #2 (local) with pollypocket ==
Team: Vincent Hutsebaut, Marc Masure, Charles Hubain, Philippe Teuwen
 [[Image:Brucon2014ctf0.png|300px]][[Image:Brucon2014ctf1.png|300px]][[Image:Brucon2014ctf2.png|300px]]
 #1 in Base points and in Bonus points ;-)
 [[Image:Brucon2014ctf3.png|300px]]

=Nuit du Hack CTF Finals 2014 by Hackerzvoice=
* [https://ctftime.org/event/149 ctftime]
== #6 with pollypocket ==
Team: Vincent Hutsebaut, Matthieu Kaczmarek, Hugo Caron, Philippe Teuwen, Charles Hubain
==[[NDH Writeups#2014 Nuit du Hack CTF by Hackerzvoice|Writeups]]==
=Hacknowledge-Contest 2014-2015 selections for Belgium=
In the news: [http://www.zataz.com/news/23372/zataz.html Zataz], [http://www.tvlux.be/video/des-hackers-au-wex-_16188.html TV Lux]


== #1 with pollypocket ==
Team: Vincent Hutsebaut, Marc Masure, Hugo Caron, Philippe Teuwen, Charles Hubain, Jeremie Boutoille
 [[Image:Hacknowledge_quals_2.png|300px]]
[[Image:Hacknowledge_quals_1.png|300px]]
[[Image:Hacknowledge_quals_winner.png|300px]]

=Nuit du Hack CTF Quals 2014 by Hackerzvoice=
* [https://ctftime.org/event/142 ctftime]
== #2 with pollypocket ==
Team: Vincent Hutsebaut, Matthieu Kaczmarek, Hugo Caron, Philippe Teuwen, Charles Hubain, Jeremie Boutoille
 [[Image:Ndh2014quals.png|300px]]
[[Image:Stega-expert.png|300px]]
[[Image:Forensics expert.png|300px]]
[[Image:Web expert.png|300px]]

==[[NDH Writeups#2014 Nuit du Hack CTF Quals by Hackerzvoice|Writeups]]==

=Brucon 2013 CTF by Facebook=
== #1 (local) with pollypocket ==
Team: Vincent Hutsebaut, Bert Veldeman, Guy Brismée, Philippe Teuwen
 [[Image:Brucon2013ctf1.png|300px]]
 [[Image:Brucon2013ctf2.png|300px]]


=Hack.lu 2013 CTF by Fluxfingers=
* [https://ctftime.org/event/97 ctftime]
== #5 (#2 local) with pollypocket ==
Team: Vincent Hutsebaut, Matthieu Kaczmarek, Hugo Caron, Charles Hubain, Philippe Teuwen
 [[Image:Hacklu2013ctf.png|300px]]

=Troopers 2013 CTF by PacketWars=
== #1 (local) with Living Dead anti-Defamation League ==
 [[Image:Troopers2013pw.png|300px]]

=Hack.lu 2012 CTF by Fluxfingers=
* [https://ctftime.org/event/38 ctftime]
== #15 (#2 local) with woyouyizhixiaomaol ==
Team: Cédric Bonhomme, William Robinet, Guy Brismée, Raphaël Vinot, Philippe Teuwen, Christophe Kyvrakidis
 [[Image:Hacklu2012ctf.png|300px]]
==T-Shirt challenge==
I designed the Hack.lu 2012 T-Shirt backside, and a more visual version for online teams, see [[Hack.lu Writeups#2012 T-Shirt contest|writeup]]
 [[Image:Hacklu2012_IMG_4924.png|300px]]
 [[Image:Hacklu2012_Noclue.png|300px]]
==[[Hack.lu 2012 Writeups#2012 T-Shirt contest|Writeups]]==

=Brucon 2012 CTF by The Hex Factor=
== #3(?) (local) with xflame_doegox(?) ==
Team: Guy Brismée, Philippe Teuwen
 I don't remember exactly but we got a prize ;-)

=BeNeLux OWASP Day 2012 CTF by Martin Knobloch, OWASP CTF Project=
== #2 (local) individual ==
 [[Image:Owaspbnl2012ctf.jpg|300px]]


=Hack.lu 2011 CTF by Fluxfingers=
* [https://ctftime.org/event/13 ctftime]
* [http://2011.hack.lu/index.php?title=CaptureTheFlag Hack.lu CTF]
== #2 at pre-con crypto challenge ==

== #21 (#5 local) with letmein ==
[[Image:Hacklu2011ctf.png]]

=Brucon 2011 CTF by The Hex Factor=
==Member of The Hex Factor==
That year I was part of The Hex Factor team to design "physical" challenges:
 RFID, visual crypto & QR, Knock knock box
 [[Image:Brucon2011ctfbox.png|300px]]
[[Image:Brucon2011ctfrfid.png|300px]]
 [[Image:Brucon2011ctfqr.png|300px]]
[[Image:Brucon2011ctfqr.gif]]

=Hack.lu 2010 CTF by Fluxfingers=
== #2 at pre-con crypto challenge ==
== #12 (#3 local) with xflame_doegox ==
Team: Guy Brismée, Philippe Teuwen
 [[Image:Hacklu2010ctf.png]]

=Brucon 2010 CTF by The Hex Factor=
== #1 at pre-con stegano challenge ==

== #2 (local) with xflame_doegox ==
Team: Guy Brismée, Philippe Teuwen, ...

File:GreHack2024b.png

2024-11-18T14:15:37Z

PhilippeTeuwen: PhilippeTeuwen uploaded a new version of File:GreHack2024b.png

File:GreHack2024.png

2024-11-18T14:15:03Z

PhilippeTeuwen: PhilippeTeuwen uploaded a new version of File:GreHack2024.png

File:GreHack2024b.png

2024-11-18T14:13:04Z

PhilippeTeuwen:

PhilippeTeuwen:

==Upgrading ELECHOUSE Proxmark3 Easy V3 to 512k==
===(de)soldering===
The popular [https://www.aliexpress.com/popular/proxmark3-kit.html Proxmark3 Easy] has an at91sam7s256 with only 256k and e.g. it's already about 83% full with the current iceman firmware.
 So I decided to attempt an upgrade.

at91sam7s512 is about [http://fr.farnell.com/atmel/at91sam7s512b-au/micro-32-bits-arm7-512k-flash/dp/1972051 15€ on Farnell].

The steps I followed to desolder and solder the new chip are basically the same as seen on [http://www.youtube.com/watch?v=_dS6JukK7IA&t=1m39s this youtube video]:

* heating the chip with my [http://www.aoyue.com/en/pro/?id=16 desoldering station]
* removing the chip with a small [https://www.aliexpress.com/wholesale?SearchText=vacuum+suction+pen+chip suction pen]
* putting flux on the pads
* cleaning the pads with desoldering wick
* putting the new chip and soldering some pins to lock it in place (look for aligning the small dot on the correct corner)
* putting flux on the pins
* putting solder on the pins, don't be afraid of bridges...
* removing extra solder with desoldering wick
* checking carefully for residual solder bridges

And voila.

Note that it's maybe easier to solder the new chip not by using flux+solder+iron but [https://www.aliexpress.com/wholesale?SearchText=mechanic+solder+flux solder flux paste] and heating with air gun, as shown [https://www.youtube.com/watch?v=2Z7nCAxS2Rg&t=9m30s in this video]...

===JTAG programming on Proxmark3 Easy V3===
Then wire your JTAG programmer to the board. Mine is a Segger J-Link.
 To make it easier, solder a [https://www.aliexpress.com/wholesale?SearchText=breakable+single+row+male+curved+header+2.54 breakable single-row male curved header].
 Choose a curved one so you can leave it in place later and still stack the PM3 daughterboard.

Then using [https://www.aliexpress.com/wholesale?SearchText=wire+dupont+male+female Dupont wires male-female], wire it to the JTAG programmer.

For the J-Link, the [https://www.segger.com/interface-description.html pinout] is:
--------- ---------
|1917151311 9 7 5 3 1|
|201816141210 8 6 4 2|
--------------------

PM3 JLink
--- -----
TMS 7
TDI 5
TDO 13
TCK 9
GND 6
3.3 2

If you prefer you can leave 3.3 not connected and power the PM3 over USB while reprogramming it. But *don't* provide both 3.3 + USB!

To use the J-Link on Debian:

$ apt-get install openocd
There is some doc installed locally: file:///usr/share/doc/openocd/openocd.html/index.html

Create /etc/udev/rules.d/60-jlink.rules with
ATTRS{idVendor}=="1366", ATTRS{idProduct}=="0101", MODE="664", GROUP="plugdev"

I created a config file by reusing most of [https://github.com/Proxmark/proxmark3/blob/master/tools/at91sam7s512-buspirate.cfg tools/at91sam7s512-buspirate.cfg] from Adam Laurie, but specific to J-Link instead of buspirate:
<pre>
telnet_port 4444
gdb_port 3333
interface jlink
transport select jtag
adapter_khz 1000
reset_config srst_only srst_pulls_trst
jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3f0f0f0f
target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu
sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100
}
gdb_memory_map enable
sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432
</pre>

Launching OpenOCD:

<pre>
$ openocd -f at91sam7s512-jlink.cfg
Open On-Chip Debugger 0.9.0 (2017-03-07-13:28)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
adapter speed: 1000 kHz
srst_only srst_pulls_trst srst_gates_jtag srst_open_drain connect_deassert_srst
Info : J-Link ARM V8 compiled Dec 1 2009 11:42:48
Info : J-Link caps 0xb9ff7bbf
Info : J-Link hw version 80000
Info : J-Link hw type J-Link
Info : J-Link max mem block 9576
Info : J-Link configuration
Info : USB-Address: 0x0
Info : Kickstart power on JTAG-pin 19: 0xffffffff
Info : Vref = 3.332 TCK = 1 TDI = 0 TDO = 0 TMS = 0 SRST = 1 TRST = 1
Info : J-Link JTAG Interface ready
Info : clock speed 1000 kHz
Info : JTAG tap: sam7x.cpu tap/device found: 0x3f0f0f0f (mfg: 0x787, part: 0xf0f0, ver: 0x3)
Info : Embedded ICE version 1
Info : sam7x.cpu: hardware has 2 breakpoint/watchpoint units
</pre>

Launching a telnet:
<pre>
$ telnet localhost 4444
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0xf00000d3 pc: 0x001c9c60
> flash erase_sector 0 0 15
erased sectors 0 through 15 on flash bank 0 in 0.033260s
> flash erase_sector 1 0 15
erased sectors 0 through 15 on flash bank 1 in 0.033311s
</pre>
Apparently some chips have a bank 1, some don't...

===Backuping firmware===
The chip was new but in case you need to backup the chip content first, this is possible from the telnet session with size = 0x40000 for a 256kb chip and 0x80000 for a 512kb chip. E.g. for 256kb:
<pre>
> dump_image backup.bin 0x100000 0x40000
dumped 262144 bytes in 9.232331s (27.729 KiB/s)
</pre>

===Flashing full image, take 1===
Probably the easiest way, from the telnet session:
<pre>
> flash write_image ./recovery/proxmark3_recovery.bin 0x100000
wrote 217204 bytes from file ./recovery/proxmark3_recovery.bin in 18.417032s (11.517 KiB/s)
</pre>
This works also for restoring a <code>backup.bin</code> image dumped earlier.
===Flashing full image, take 2===
Using the elf images, from the telnet session:
<pre>
> flash write_image ./bootrom/obj/bootrom.elf
> flash write_image ./armsrc/obj/fullimage.elf
</pre>
Note the absence of base address in the command.
===Flashing full image, take 3===
Using the s19 images, from the telnet session:
<pre>
> flash write_image ./bootrom/obj/bootrom.s19 0x100000
> flash write_image ./armsrc/obj/fullimage.s19 0x100000
</pre>
This failed when I tried because the data section seemed to be at a wrong address in <code>fullimage.s19</code>.

Indeed <code>fullimmage.s19</code> loads code and data with offset 0x100000 (<code>flash write_image ./armsrc/obj/fullimage.s19 0x100000</code>):
* code from 0x100000+0x200 to 0x100000+0x33580
* data from 0x100000+0x133580 to 0x100000+0x135200
But data should be at 0x133580 so 0x100000+0x35200
 Here is a patch that solved the issue:
<source lang=diff>
diff --git a/common/Makefile.common b/common/Makefile.common
index 95820e66..e697ae14 100644
--- a/common/Makefile.common
+++ b/common/Makefile.common
@@ -99,7 +99,7 @@ $(VERSIONOBJ): $(OBJDIR)/%.o: %.c $(INCLUDES)
# See ldscript.common. -- Henryk Plötz <henryk@ploetzli.ch> 2009-08-27
OBJCOPY_TRANSLATIONS = --no-change-warnings \
--change-addresses -0x100000 --change-start 0 \
- --change-section-address .bss+0 --change-section-address .data+0 \
+ --change-section-address .bss+0 --change-section-address .data-0x100000 \
--change-section-address .commonarea+0
$(OBJDIR)/%.s19: $(OBJDIR)/%.elf
$(OBJCOPY) -Osrec --srec-forceS3 --strip-debug $(OBJCOPY_TRANSLATIONS) $^ $@
</source>

Update: patch applied in https://github.com/iceman1001/proxmark3/commit/d59026518e02c37ab0673a670b9ea14e17ae399c

===Flashing full image, take 4===
In case flashing the full image from JTAG seems to fail, you can flash only the bootloader:
<pre>
> flash write_image /tmp/bootrom.s19 0x100000
wrote 3624 bytes from file /tmp/bootrom.s19 in 0.392169s (9.024 KiB/s)
</pre>
Then follow the usual recovery procedure:
* Press button and keep it pressed during the whole procedure
* Plug PM3 to USB
* ./flasher /dev/ttyACM0 fullimage.elf
* Release button and re-plug the PM3

===Done===
<pre>
$ ./proxmark3 /dev/ttyACM0
Proxmark3 RFID instrument
bootrom: iceman/iceman/v2.1.0-1547-gb0df293d 2017-05-03 20:44:34
os: iceman/iceman/v2.1.0-1547-gb0df293d 2017-05-03 20:44:39
LF FPGA image built for 2s30vq100 on 2015/03/06 at 07:38:04
HF FPGA image built for 2s30vq100 on 2015/11/ 2 at 9: 8: 8

uC: AT91SAM7S512 Rev B
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 512K bytes. Used: 217204 bytes (41%).
Free: 307084 bytes (59%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memory
</pre>
==JTAG connectors==
===Proxmark3 with headers===
[[File:Pm3.jpg|400px]]
===Proxmark3 without headers===
[[File:Pm3naked1.jpg|400px]] [[File:Pm3naked2.jpg|400px]]
 Apply some pressure to ensure a proper connection during the whole flashing operation

===Proxmark3 Easy with headers===
[[File:Pm3easy.jpg|400px]] [[File:Pm3easy2.jpg|400px]] [[File:Pm3easy3.jpg|400px]]
 See above for the proper pinout.
 If you want to solder a header, beware that there is very little space between both PCBs. It's possible to solder curved pins but without their plastic support, see pics.
 I used a breakout but you can directly connect to the JLink if you prefer. You can fint the board by searching for "jlink adapter card" on aliexpress. You'll need to add a jumper to connect jlink pin2 and 3.3v.
===Proxmark3 Easy without headers===
See [[Proxmark#JTAG_programming_on_Proxmark3_Easy_V3|above]] for pinouts

[[File:Pm3easy4.jpg|400px]]
 Using Dupont individual wires

[[File:Pm3easy6.jpg|400px]] [[File:Pm3easy5.jpg|400px]]
 Using the same cable as shown above

==Resources==
* https://github.com/Proxmark/proxmark3/wiki/Debricking-Proxmark3 using a Bus Pirate
* "Lock Error Bit Detected, Operation Abort" ?
<pre>
flash protect 0 0 15 off
flash protect 1 0 15 off
</pre>