#moduleactivity

I tried these in week 07 but struggled, this past week was hectic, especially since I presented on tuesday with the forensics group and on wednesday for my something awesome. 

Okay... running ./blind I get “This is almost exactly the same as jump...”

The hint from my tutor was to use objdump, specifically objdump -h (headers) 

Okay I get 25 different headers, how do I know which one is the function we want?

I googled gdb show all functions, and found the command info functions

This showed me that there was main function, win function and vuln function 

I’m gonna assume that the vuln function gets called when I run ./blind, and I need it to run the win function 

disass vuln shows me that its setting up a buffer, and calling gets

From info functions I can see that the win function starts at 0x08048506

But how big is the buffer? 

python -c “print(’A’ * 64 + ‘\x06\x85\x04\x08′) | ./blind doesn’t seem to work

python -c “print(’A’ * 72 + ‘\x06\x85\x04\x08′) | ./blind seg faults but also prints out the same message a second time, so something must be happening 

Been trying things like ltrace, strace, gdb but no luck so far 

Googled some reverse engineering posts 

Okay... by stepping through with gdb I can see that once it gets to the part of the program when I input something, afterwards it jumps back from vuln to main 

ooo okay... using gdb, I got up to the part when I’m entering something into the buffer, I spammed a billion “A”s and it finally seg faulted, and I could see the memory address was 0x41414141

So 64 “A”s isnt enough, lets find out how many we need ... 

70 not enough 

Okay wait, 64+12 ‘A’s and it kind loops and asks for more input??

64+14 ‘A’s and we get a seg fault, it’s trying to go to 0x08004141

OK!, we’ve overwritten with 2 “A”’s

So how about 76 “A”s and the address?

Yes!

This level took forever but I got it 

python -c “print(’A’ * 76 + ‘\x06\x85\x04\x08′)” | ./blind

This is almost exactly the same as jump...

COMP6841{Ooh_Youre_Good}Segmentation fault 

Ooh You’re Good!

Downloaded a 1gb zip file, uncompressed to 2.23gbs. That’s what google is allowing me to see about my own data

Well first off

BrowserHistory.json is 1.45million lines long, that’s a lotta browser history 

Reddit and youtube has 19999+ matches in this

Facebook has 12163 matches

My Youtube watch-history.html is 16kb big wow

Location History.json has 4.75million lines (its a 100mb json file), they know everything...

“Confidence”

“IN_ROAD_VEHICLE”, “IN_RAIL_VEHICLE”, “ON_BICYCLE”, “ON_FOOT”

Timestamps, latitude, longitude, activity, 

Oh man

Purchases_Reservations

What... it’s saved every online purchase I’ve made into json files

The Shed at Dulwich Hill

haha I ended up watching the entire video... it was actually really good

To detect against this kind trickery, I guess the best thing would be for trip advisor to hire staff who’s sole job is to go to business’s, have a chat with the owner, verify that the business exists in the first place 

Also... 7 months just declining people and hyping up a restaurant... that’s insane commitment 

Also... idk if I’d be comfortable being blindfolded and lead down an alleyway, I guess the host is quite charismatic 

Tbh I wouldn’t mind trying “The Shed”

Banksy Fake Currency

idk, seems like fraud to me

Deep Fakes

Ohh deep fakes are so cool, corridor crew has done a few videos on this with Tom Cruise/Keanu Reeves 

Activity

I may as well just do The Shed at Dulwich Hill

So the guy spent over 7 months slowly hyping up this fake restaurant on trip advisor 

Fake reviews, rejecting bookings

Dear Donald,

Would you like to know how to win your 2020 re-election?

Would you like to know some dirt on your opponent Biden?

Would you like to know how to retain an orange golden tan for ever?

Click here now !!! --> {LINK} <-- Click here now !!!

Hurry!!!, the link will only last for 24 hours

-----------------------------------------------------------------------------------------------------------

Ooo an interactive social enginerering CTF?!

So we need to obtain the facebook login details for the Puppy Love facebook page and organise payment of $1200 to be made to my fake account from the Puppy Love accounts team. 

I’m a bit confused on how this is gonna work though... 

Oops, let’s try again.

Maybe this is better?

I know it’s a bot but still, lets have some fun!

Okay, it sent me the same email back, I think I need to include the word “urgent” in the email?

Cool!, got the payment:

** Week 06 Module Activity **

Dear CEO’s of Telstra, Vodafone and Optus, 

I am writing this letter to inform you of our decision to disallow companies such as Huawei and ZTE to supply the infrastructure for the 5G network being built in Australia. This is according to the telecommuncations sector security reforms and is due to growing concerns amongst my peers, and other national leaders that these infrastructures provide security risks to our nations. Top men analysts have shown me risk matrices,and have highlighted the low probability high impact risks that come if the infrastructure is built by these companies. We cannot risk allowing these dangerous nations to build backdoors into this infrastructure. Not only do we risk being spied on, having our information recorded and catalogued, we risk our communications network being tampered with or even taken down in times of war. Even though now we are not at war now, these infrastructure deals would lay the groundwork for devastating attacks in future years. 

Therefore, I hereby ban your companies from accepting infrastructure deals provided by Huawei, ZTE or any other chinese telecommunications companies. I look forward to working with you in the future, to mitigate the increased costs of this decision. 

Regards, 

** From Week 06 Module Activities ** 

Oh man, this is a long one, I did this manually. Also I’m kind of just copying and pasting my working out: 

“Lpa” looks like "The" The = 20 8 5 + something = 18 8 22 = R H V Lpa = 12 16 1

Applying this to message 2 OG  EVE 5  22 5 +   RHV 18 8  22 =   WDA 23 4  1

every___ Wdafvnbc

Assuming it's every___ At this point we have the option of Everyday Everyway Everyone

EVERYONE RHV_____ WDAFVNBC

E  V E  R Y  O  N  E 5 22 5 18 25 15 14 5

R  H  V N  W  Y  N  X 18 8 22 14 23 25 14 24

W  D A  F V  N  B  C 23 4 1  6 22 14 2  3

Assuming our starting portion of the OTP is RHVNWYNX Testing it out on message 5 (because we get half of the second word to work on the next portion of the OTP)

T  H  E P  R  I C   E 20 8  5 16 18 9  3  5

R  H  V N  W  Y  N  X 18 8 22 14 23 25 14 24

L  P  A D  O  H  Q  C 12 16 1 4  15 8  17 3

So now our OTP is RHVNWYNX We've decoded The Price in message 5

Decoding all messages up to RHVNWYNX

  RHVNWYNX    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportant <-- guessed Im_____ is Important

Now I'm up to:

      RHVNWYNXZTTSMIPSVG    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinning

      RHVNWYNXZTTSMIPSVG    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAh

      RHVNWYNXZTTSMIPSVG    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOl

      RHVNWYNXZTTSMIPSVG    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPe

      RHVNWYNXZTTSMIPSVG    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinI  

   At this point I'm assuming that in message 4 it's    TheMostImportantPerson    and in message 5 it would be ThePriceOfBitcoinIs    From there we can move forwards to decode some more

   Using "Person"    My OTP becomes: RHVNWYNXZTTSMIPSVGKZYZ

    Status check, I’m up to here:

       RHVNWYNXZTTSMIPSVGKZYZ    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEuro

      RHVNWYNXZTTSMIPSVGKZYZ    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAHippo  

      RHVNWYNXZTTSMIPSVGKZYZ    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOliver

      RHVNWYNXZTTSMIPSVGKZYZ    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPerson

      RHVNWYNXZTTSMIPSVGKZYZ    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinIsToo

   Message 5 could be "Too High" ?    Message 2 could be "Hippo potamus" ?    I'll try message 2 hippopotamus and check message 5 too high

   Aha, I was right about hippopotamus    But it was actually too damn high for message 5

   Status update:

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNO    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEurovisionIs

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNO    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAHippopotamusW

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNO    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOliverFindTheF

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNO    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPersonInTheWor

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNO    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinIsTooDamnHigh

    Message 2 could be "with" ?     Message 4 looks like world, i'll go with message 4

    Status update:

          RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZW    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEurovisionIsEx

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZW    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAHippopotamusWhe

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZW    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOliverFindTheFlu

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZW    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPersonInTheWorld

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZW    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinIsTooDamnHighGi

      kind of stuck here       deservesahippotamuswhe_  in message 2       whe_ has to be when right?       and what the hell is flu_ in message 3

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWX    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEurovisionIsExc

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWX    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAHippopotamusWhen

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWX    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOliverFindTheFlux

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWX    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPersonInTheWorldI

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWX    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinIsTooDamnHighGiv

      intheworldI_ is?

       Gonna guess this is excellent        RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXA    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEurovisionIsExcellent

     One last time:

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO    1. LpaGbbfctNiPvwdbjnPuqolhhtygWhEuafjlirfPxxl       TheSecretToWinningEurovisionIsExcellent

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO    2. WdafvnbcDymxeeulWOtpoofnilwngLhblUfecvqAxs       EveryoneDeservesAHippopotamusWhenTheyre

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO    3. UijMltDjeumxUnbiKstvdrVhcoDasUlrvDypegublg       CanYouPleaseHelpOliverFindTheFluxCapacitor

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO    4. LpaAlrhGmjikgjdmLlcsnnYmIsoPcglaGtKeQcemiu       TheMostImportantPersonInTheWorldIsMeMys

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO    5. LpaDohqcOzVbglebjPdTnoTzbyRbuwGftflTliPiqp       ThePriceOfBitcoinIsTooDamnHighGivenTheD

     Capacity?

     blg      ty_        no!      capacitor!

      The OTP is: 

      RHVNWYNXZTTSMIPSVGKZYZPYOKJSNOZWXAXZDDLHWO