Asis CTF 2017 - 2nd Secured Portal Write Up

Published on Sunday, 09 April 2017 in Security ; tagged with asis, ctf, write-up, web, challenge, php, object, injection, unserialize ; text version

The Asis CTF was taking place this weekend and, although I only looked at two challenges, I really found them interesting and well crafted, especially the second level. The challenges I am talking about are the web Secured Portal and 2nd Secured Portal.

2nd Secured Portal

In this write-up, I am covering the second level: 2nd Secured Portal.

Continue reading


Asis CTF 2017 - Secured Portal Write Up

Published on Saturday, 08 April 2017 in Security ; tagged with asis, ctf, write-up, web, challenge, php, type, juggling ; text version

The Asis CTF was taking place this weekend and, although I only looked at two challenges, I really found them interesting and well crafted, especially the second level. The challenges I am talking about are the web Secured Portal and 2nd Secured Portal.

Secured Portal

In this write-up, I am covering the first level: Secured Portal.

Continue reading


Understanding ipTIME Configuration Backup File Format

Published on Sunday, 12 February 2017 in Reverse Engineering ; tagged with iptime, n704, v3, router, cfg, configuration, backup, reverse, ida, binwalk ; text version

Continuing to play with my ipTIME n704-v3, I wanted to understand how their configuration backup feature was working and in a word: it is very simple. I thought that it could be a good example of how one could proceed in order to reverse similar file formats on other devices.

$ python ipTIME_config.py -e config_n704v3_20000101_010901.cfg
PoC for extracting/repacking ipTIME backup configuration file
Extracting ipTIME configuration...
    [+] Extracting outer gzip
    [+] Dumping extracted header
        Magic: raw_nv
        Size of gz (compressed): 3183
        Sum of gz bytes: 0x677A4
        Max size: 32720
        FS id: 0x10000
    [+] Extracting inner tar.gz tarball
Extraction successful. You can now edit configuration files in ./etc/
Use -c to pack the new configuration

TL;DR: ipTIME .cfg backup file is a mix between a tar.gz of /etc/ and a custom binary header, the whole gzip once more. See this simple script I cooked up to unpack and re-pack ipTIME .cfg configuration files.

Continue reading


ipTIME UART Magic (and Not So Useful?) Key

Published on Sunday, 05 February 2017 in Reverse Engineering ; tagged with iptime, n704, v3, router, uart, magic, key, reverse, ida, binwalk ; text version

I recently bought a new toy to play with: an ipTIME n704-v3. ipTIME is the most (or one of the most) common brand in Korea for devices like routers and I was curious to check one out.

ipTIME n704-v3 router

When connecting to the n704 UART pins, I could not interact with the device. First because I realized my BusPirate TX was dead (sigh); second, after switching the BusPirate, because n704 would not react to my input. There was no boot menu (e.g. U-Boot) and there was no configuration menu. There was one thing that picked my curiosity when reading the boot log messages though:

=================================================================
press magic key to change default setting ...

That sounds interesting! But what could be the magic key? Since Google couldn't answer my question, I decided to look for the answer myself. Be prepared to learn something not so useful today!

TL;DR: x d i a g

Continue reading


Juniors CTF 2016 - Joy500 Oldschool NES Rom Write Up

Published on Sunday, 27 November 2016 in CTF, Security ; tagged with juniors, ctf, write-up, misc, 500, challenge, nes, rom ; text version

I played the Juniors CTF 2016 this weekend with some friends of mine and it was quite fun! Since we missed the registration deadline, I sneakily joined the Securimag team and played with them.

Oldschool challenge

One of the challenges was a modified NES ROM of Castlevania II - Simon's Quest. The challenge was not really hard after all but @xarkes and I thought that it was refreshing to play with a NES ROM for once :)

Continue reading



contactdepier.re About me License WTFPL2