Hacking Behind the Firewall

Welcome back to another year of HaS writeups. Grade F Prime Beef "Exploit the system, get the passcode, retrieve the flag." Connecting to the target system and providing the token gave us a web gui for fprime (and a shell, but it wasn't required), a NASA open source framework for flight software. This looks like an interesting framework to explore! But we're doing a CTF and we need the flag. Helpfully, we have RCE built in as a feature: github So we can send it a command, dump the output to a file, and downlink it (timestamps are messed up as I'm recovering this from burp logs and cbb finding the exact flow): PUT /commands/fileManager.ShellCommand?_no_cache=...&session=... HTTP/1.1 Host: 18.222.149.133:11782 Content-Length: 68 Content-Type: application/json Accept: */* Origin: http://18.222.149.133:11782 Referer: http://18.222.149.133:11782/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close {"key":42769...

SpaceDB This was my favorite challenge of the contest, as it mixed a real-world cubesat framework and technology you're likely to come across as a security engineer, in a convincing manner. The Problem The last over-the-space update seems to have broken the housekeeping on our satellite. Our satellite's battery is low and is running out of battery fast. We have a short flyover window to transmit a patch or it'll be lost forever. The battery level is critical enough that even the task scheduling server has shutdown. Thankfully can be fixed without without any exploit knowledge by using the built in APIs provied by kubOS. Hopefully we can save this one! Note: When you're done planning, go to low power mode to wait for the next transmission window Connecting to the challenge service spawns a kubOS instance, and a GraphQL service we can connect to: ### Welcome to kubOS ### Initializing System ... ** Welcome to spaceDB ** -----------------------...

The Magic Bus Challenge This challenge involved analyzing a fairly simple bus protocol emerging from a modem looking thing upon connecting to the target port provided. From the challenge description: There's a very busy bus we've tapped a port onto, surely there is some juicy information hidden in the device memory... somewhere… Upon connecting netcat to the provided hostname and port, we're provided with a slowly scrolling stream of ASCII text. If you don't send anything, you end up with an output looking similar to this: Scrolling in this sort of fashion: A few observations: On each connection, we consistently see it starting with a "^3a", and ending in a "+." Other than +, ^ and ., we've purely got hex characters other than... ... the NO CARRIER message at the end +++ and NO CARRIER are session commands from the Hayes command set , usually used for modem control (commonly referred to as AT commands) Some experimen...

Preface This year the US Air Force teamed up with DoD's Digital Service and DEFCON's Aerospace village to build a CTF - the first of it's kind - to hack satellites. I joined with some colleagues and their CTF team to get our numbers around half a dozen. We missed the top ten by ~50 points, which was disappointing, but shows the quality of the teams we were up against and that the tournament attracted. Since joining a Bay Area tech company, I haven't found much time or mental space for CTFs or bug bounties. But aerospace has a special place in my heart, and with numerous commercial launch companies massively driving down the costs to get satellites up, understanding the frameworks, communication protocols, physics, tools, history etc. is going to be super important. Before I get to the goods, a hat tip to the USAF & DoD for getting behind this. Satellites are going to become increasingly important in our day-to-day lives, and investing in bringing the security commun...

Thanks to Freelancer.com & the sponsors behind the inaugural StartCon Capture the Flag competition. The Farming Simulator 2016 (CTF chapter of the Platypus community) teams took out 1st, 2nd, 3rd & (5th?) places. Or as we'd rather term it, we performed a successful DoS of prizes to other teams. A large percentage of the winnings will be used responsibly on shit like a giant inflatable platypus. Also a big thank you to Michael Foley , who I believe ran his first CTF this weekend. From running Platypus Con's CTF, I know how hard this shit is, so good work man. I had a lot of fun. Keep 'em coming. Credit for the "thought leadership" in the writeup goes to @infosec_au . If you'd like to say thank you, maybe shoot his charity, Hackers Helping Hackers , a few dollars, or dump any spare conference tickets on them to forward to students or fellow hackers in need. The two flags I grabbed for my team (to come second by a comfortable margin ;)) were: ...