ORA ELLADOS

Δευτέρα 13 Απριλίου 2020

Sslmerge - Tool To Help You Build A Valid SSL Certificate Chain From The Root Certificate To The End-User Certificate

Is an open source tool to help you build a valid SSL certificate chain from the root certificate to the end-user certificate. Also can help you fix the incomplete certificate chain and download all missing CA certificates.

How To Use
It's simple:

# Clone this repository
git clone https://github.com/trimstray/sslmerge

# Go into the repository
cd sslmerge

# Install
./setup.sh install

# Run the app
sslmerge -i /data/certs -o /data/certs/chain.crt

symlink to bin/sslmerge is placed in /usr/local/bin
man page is placed in /usr/local/man/man8

Parameters
Provides the following options:

  Usage:
    sslmerge <option|long-option>

  Examples:
    sslmerge --in Root.crt --in Intermediate1.crt --in Server.crt --out bundle_chain_certs.crt
    sslmerge --in /tmp/certs --out bundle_chain_certs.crt --with-root
    sslmerge -i Server.crt -o bundle_chain_certs.crt

  Options:
        --help        show this message
        --debug       displays information on the screen (debug mode)
    -i, --in          add certificates to merge (certificate file, multiple files or directory with ssl certificates)
    -o, --out         saves the result (chain) to file
        --with-root   add root certificate to the certificate chain

How it works
Let's start with ssllabs certificate chain. They are delivered together with the sslmerge and can be found in the example/ssllabs.com directory which additionally contains the all directory (containing all the certificates needed to assemble the chain) and the server_certificate directory (containing only the server certificate).
The correct chain for the ssllabs.com domain (the result of the openssl command):

Certificate chain
 0 s:/C=US/ST=California/L=Redwood City/O=Qualys, Inc./CN=ssllabs.com
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
 1 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
 2 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
   i:/C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority

The above code presents a full chain consisting of:

Identity Certificate (Server Certificate)
issued for ssllabs.com by Entrust Certification Authority - L1K
Intermediate Certificate
issued for Entrust Certification Authority - L1K by Entrust Root Certification Authority - G2
Intermediate Certificate
issued for Entrust Root Certification Authority - G2 by Entrust Root Certification Authority
Root Certificate (Self-Signed Certificate)
issued for Entrust Root Certification Authority by Entrust Root Certification Authority

Scenario 1
In this scenario, we will chain all delivered certificates. Example of running the tool:

Scenario 2
In this scenario, we only use the server certificate and use it to retrieve the remaining required certificates. Then, as above, we will combine all the provided certificates. Example of running the tool:

Certificate chain
In order to create a valid chain, you must provide the tool with all the necessary certificates. It will be:

Server Certificate
Intermediate CAs and Root CAs

This is very important because without it you will not be able to determine the beginning and end of the chain.
However, if you look inside the generated chain after generating with sslmerge, you will not find the root certificate there. Why?
Because self-signed root certificates need not/should not be included in web server configuration. They serve no purpose (clients will always ignore them) and they incur a slight performance (latency) penalty because they increase the size of the SSL handshake.
If you want to add a root certificate to the certificate chain, call the utility with the --with-root parameter.

Certification Paths
Sslmerge allows use of two certification paths:

Output comments
When generating the chain of certificates, sslmerge displays comments with information about certificates, including any errors.
Here is a list of all possibilities:

not found identity (end-user, server) certificate
The message is displayed in the absence of a server certificate that is the beginning of the chain. This is a unique case because in this situation the sslmerge ends its operation displaying only this information. The server certificate is the only certificate required to correctly create a chain. Without this certificate, the correct chain will not be created.

found correct identity (end-user, server) certificate
The reverse situation here - message displayed when a valid server certificate is found.

not found first intermediate certificate
This message appears when the first of the two intermediate certificates is not found. This information does not explicitly specify the absence of a second intermediate certificate and on the other hand it allows to determine whether the intermediate certificate to which the server certificate was signed exists. Additionally, it can be displayed if the second intermediate certificate has been delivered.

not found second intermediate certificate
Similar to the above, however, it concerns the second intermediate certificate. However, it is possible to create the chain correctly using the second certification path, e.g. using the first intermediate certificate and replacing the second with the main certificate.

one or more intermediate certificate not found
This message means that one or all of the required intermediate certificates are missing and displayed in the absence of the root certificate.

found 'n' correct intermediate certificate(s)
This message indicates the number of valid intermediate certificates.

not found correct root certificate
The lack of the root certificate is treated as a warning. Of course, when configuring certificates on the server side, it is not recommended to attach a root certificate, but if you create it with the sslmerge, it treats the chain as incomplete displaying information about the incorrect creation of the chain.

an empty CN field was found in one of the certificates
This message does not inform about the error and about the lack of the CN field what can happen with some certificates (look at example/google.com). Common Name field identifies the host name associated with the certificate. There is no requirement in RFC3280 for an Issuer DN to have a CN. Most CAs do include a CN in the Issuer DN, but some don't, such as this Equifax CA.

Requirements
Sslmerge uses external utilities to be installed before running:

openssl

Other

Contributing
See this.

Project architecture
See this.

Download Sslmerge

More information

Reversing Some C++ Io Operations

In general decompilers are not friendly with c++ let's analyse a simple program to get familiar with it.
Let's implement a simple code that loads a file into a vector and then save the vector with following functions:

err
load
save
main

Lets identify the typical way in C++ to print to stdout with the operator "<<"

The basic_ostream is initialized writing the word "error" to the cout, and then the operator<< again to add the endl.

The Main function simply calls "vec = load(filename)" but the compiler modified it and passed the vector pointer as a parámeter. Then it bulds and prints "loaded " << size << " users".
And finally saves the vector to /tmp/pwd and print "saved".
Most of the mess is basically the operator "<<" to concat and print values.
Also note that the vectors and strings are automatically deallocated when exit the function.

And here is the code:

Let's take a look to the load function, which iterates the ifs.getline() and push to the vector.
First of all there is a mess on the function definition, __return_storage_ptr is the vector.
the ifstream object ifs is initialized as a basic_ifstream and then operator! checks if it wasn't possible to open the file and in that case calls err()
We see the memset and a loop, getline read a cstr like line from the file, and then is converted to a string before pushing it to the vector. lVar1 is the stack canary value.

In this situations dont obfuscate with the vector pointer vec initialization at the begining, in this case the logic is quite clear.

The function save is a bit more tricky, but it's no more than a vector iteration and ofs writing.
Looping a simple "for (auto s : *vec)" in the decompiler is quite dense, but we can see clearly two write, the second write DAT_0010400b is a "\n"

As we see, save implememtation is quite straightforward.

Related word

Tentacle - A POC Vulnerability Verification And Exploit Framework

Tentacle is a POC vulnerability verification and exploit framework. It supports free extension of exploits and uses POC scripts. It supports calls to zoomeye, fofa, shodan and other APIs to perform bulk vulnerability verification for multiple targets. (Still in DEV...)

Install

pip3 install -r requestment.txt

Usage
When you run it for the first time, the configuration file conf/tentacle.conf will be generated automatically.

# Show help for tentacle.
python3 tentacle.py --help

# Show all modual, and you can see it in `script` path.
python3 tentacle.py --show

# Show all function of module by -f show or -f help
python3 tentacle.py -m script/web/web_status -f show
python3 tentacle.py -m script/web/web_status -f help

# Load target by iS/iN/iF/iT/iX/iE/gg/sd/ze/ff.
# Scan port and then it will try to send the poc.
python3 tentacle.py -m script/web/web_status -iS www.examples.com             # Load target by url or host 
python3 tentacle.py -m script/web/web_status -iN 192.168.111.0/24             # Load target by network
python3 tentacle.py -m script/web/web_status -iF target.txt                   # Load target by file
python3 tentacle.py -m script/web/web_status -iT dcc54c3e1cc2c2e1             # Load target by recode's target
python3 tentacle.py -m script/web/web_status -iX nmap_xml.xml                 # Load target by nmap.xml
python3 tentacle.py -m script/web/web_status -iE "powered by discuz"          # Load target by baidu/bing/360so
python3 tentacle.py -m script/web/web_status -gg 'intext:powered by discuz'   # Load target by google api
python3 tentacle.py -m script/web/web_status -sd 'apache'                     # Load target by shodan api
python3 tentacle.py -m script/web/web_status -ze 'app:weblogic'               # Load target by zoomeye api
python3 tentacle.py -m script/web/web_status -ff 'domain="example.com"'       # Load target by fofa api

# Load modual by -m (e.g. script/info/web_status,@web)
python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status                    # Load web_status module
python3 tentacle.py -iS 127.0.0.1 -m @web                                     # Load all module of web path
python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status,@web                  # Load all module of web path and web_status module
python3 tentacle.py -iS 127.0.0.1 -m "*"                                      # Load all module of script path

# Set port scan scope
python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status                    # Scan top 150 ports and then perform bulk vulnerability verification for multiple targets.
python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status -sP                # Skip port scan and then it will try the default port number server
python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status -lP 80-90,443      # Scan 80-90 ports and 443 port and then perform bulk vulnerability verification for multiple targets.

# Use function of modual by -m and -f  (e.g. -m web_status -f prove), and you should make sure the function of module is exist.
python3 tentacle.py -m script/web/web   _status -f prove

# Show task's result by -tS 
python3 tentacle.py -tS 8d4b37597aaec25e

# Export task's result by -tS to test.xlsx
python3 tentacle.py -tS 8d4b37597aaec25e  -o test

# Update by git
python3 tentacle.py --update

Update

[2018-11-15] Code refactoring and fix bug.
[2019-06-08] Code refactoring and add port scan.
[2020-03-15] Code refactoring and add script.

Thanks

Download Tentacle

via KitPloit

Continue reading

APT Calypso RAT, Flying Dutchman Samples

Reference

2019-10-31 Calypso APT: new group attacking state institutions

Attackers exploit Windows SMB vulnerability CVE-2017-0143 or use stolen credentials to gain access, deploy the custom Calypso RAT and use it to upload other tools such as Mimikatz, EternalBlue and EternalRomance. They move laterally and steal data.

Download

Other malware

Download. Email me if you need the password (see in my profile)

Hashes

MD5	SHA256	SHA1	Filename	File Tyee	Stage
aa1cf5791a60d56f7ae6da9bb1e7f01e	d5afa3bfd423ba060207ad025467feaa56ac53d13616ac8782a7f63c9fc0fdb4	bdd8b9115d1ae536d0ea1e62052485e5ad10761f	MPSSVC.dll	pe dll	Calypso RAT Payload
1e765fed294a7ad082169819c95d2c85	f6a09372156a8aef96576627a1ed9e57f194b008bb77e32ca29ac89505f933f0	60dda7ccd9ae00701046923b619a1b9c33c8e2ac	Wscntfy.exe	pe exe	Calypso RAT Dropper
17e05041730dcd0732e5b296db16d757	b6c21c26aef75ad709f6c9cfa84bfa15b7ee709588382ce4bc3544a04bceb661	f3301405d8ad5b160747241d6b2a8d88bf6292e8		pe exe	Calypso RAT Dropper
1ed72c14c4aab3b66e830e16ef90b37b	eebff21def49af4e85c26523af2ad659125a07a09db50ac06bd3746483c89f9d	dc0d0a34f107d140d9e47582e17a7fec945403ea	coal.exe	pe exe	Calypso RAT Dropper
e24a62d9826869bc4817366800a8805c	c407c3dde18c9b56ed24492ca257d77a570616074356b8c7854a080823f7ee17	53791c9e7c41931a6becb999fee4eb7daf9b1a11	data01.bin	pe dll	Calypso RAT Dropper
c9c39045fa14e94618dd631044053824	ab39301d45045172ad41c9a89210fdc6f0d3f9dccb567fd733b0dbffbfcfbcc3	1cda28bc307c09508dbb1f3495a967bbcc29326e		pe exe	Calypso RAT Dropper
69322703b8ef9d490a20033684c28493	e6a3b43acdaa824f3280095b10798ea341839f7d43f0460df8989f13c98fa6e0	f203680d97705d99f92fe9797691be6177f5fd41	RasCon.dll	pe dll	Calypso RAT Dropper
85ce60b365edf4beebbdd85cc971e84d	5dfdee5dd680948d19ab4d16df534cf10aca5fa0b157c59659d6517fe897c62f	d9c14f7b6de8e26ae33e41a72ae8e35bb1af4434		pe exe	Calypso RAT Dropper
6347e42f49a86aff2dea7c8bf455a52a	281583aca23f8fd8745dd88a600cbfc578d819859a13957ec022b86c3c1c99f4	8b2a81af85590e0e36efc1c05aa4f0600ea21545	HIDMgr.dll	pe dll	Calypso RAT Dropper
cb914fc73c67b325f948dd1bf97f5733	0031c7b63c1e1cd36d55f585d97e2b21a13a19858d5a1aa5455e5cc64b41e6e9	37ce4d0a3168e3b2f80b3fae38082e68a454aee0		pe exe	Calypso RAT Dropper
c84df4b2cd0d3e7729210f15112da7ac	4e8351ddaff18f7df6fcc27a3c75598e0c56d3b406818d45effb4e78616092c2	41a0c5a1aad36f405c8755613c732591e3300f97	mscorsvw.dll	pe dll	Calypso RAT Dropper
5199ef9d086c97732d97eddef56591ec	511683c8ee62478c2b45be1f782ce678bbe03c4349a1778651414803010b3ee9	d19a786adc09dff84642f2c2e0386193fa2a914b	dnscache.dll	pe dll	FlyingDutchman
06c1d7bf234ce99bb14639c194b3b318	a9a82099aa812d0c4025bee2b34f3b34c1d102773e36f1d50648815913dbe03d	464ab9e11d371bf24de46c98c295d4afe7e957c1	fromResource.exe	pedll	FlyingDutchman
617d588eccd942f243ffa8cb13679d9c	0664b09a86ec2df7dfe01a93e184a1fa23df66ea82cab39000944e418ec1f7b2	1b043fdcb582ed13cbf7dabcef6527762b5be93c		pe dll	Hussar
2807236c2d905a0675878e530ed8b1f8	314e438198f8cc2ee393c75f8e9f2ebd2b5133fd6f2b7deb1178f82782fc6330	2f6fe857632a67e87f4f3631bfa93713ccdf168a	AeLookupMgr.dll	pe dll	Calypso RAT Payload
cce8c8ee42feaed68e9623185c3f7fe4	38cc404437b936660066b71cc87a28af1995248d6d4c471706eb1dd347129b4b	9d2235c911b86bb6ad55d953a2f56ea78c5478e5	AppCert.dll.crt		Calypso RAT Payload
e1a578a069b1910a25c95e2d9450c710	413622ded5d344a5a78de4fea22cfdabdeb4cdccf69e9a1f58f668096c324738	36087a5b0809dc3f9dc5a77355a88e99af491a88	RasCfgMan.dll.crt		Calypso RAT Payload
0d532484193b8b098d7eb14319cefcd3	f8043d6bfc3e63d8561f7f74e65cb7ff1731577ecf6c7559795d9de21298f0fc	31f4c6dc6ce78b4e0439b30c830dfd5d9a3fc4fe	RasCfgMan.dll	pe dll	Calypso RAT Payload
974298eb7e2adfa019cae4d1a927ab07	0461710e681fd6dc9f1c83b57f94a88cd6df9e6432174cbfdd70dfd24577a0f8	41bc37679ce3caeecc176d10b4f8259918e25807	VirtualUMP.dll.crt		Calypso RAT Payload
05f472a9d926f4c8a0a372e1a7193998	8017923cd8169bf951106f053408b425f1eb310a9421685638ead55bb3823db3	8d909bd3450ebe0cffd0cb17b91bc28d23ef5083	EFSProvider.dll.crt		Calypso RAT Payload
d1a1166bec950c75b65fdc7361dcdc63	f3f38c097b0cc5337b7d2dbec098bf6d0a3bb4a3e0336e7b1c8af75268a0a49d	5731350f68a74fb4762c4ea878ecff635588a825	RasCon.dll	pe dll 64bits assembly	Calypso RAT Payload
e3e61f30f8a39cd7aa25149d0f8af5ef	c4dc7519bccc24c53794bf9178e4a4d0823875c34479d01cedbb3e9b10f5c730	1b75ea494c3ac171c5177bdcc263b89a3f24f207	MPSSVC.dll	pe dll	Calypso RAT Payload

Continue reading

Blockchain Exploitation Labs - Part 3 Exploiting Integer Overflows And Underflows

In part 1 and 2 we covered re-entrancy and authorization attack scenarios within the Ethereum smart contract environment. In this blog we will cover integer attacks against blockchain decentralized applications (DAPs) coded in Solidity.

Integer Attack Explanation:

An integer overflow and underflow happens when a check on a value is used with an unsigned integer, which either adds or subtracts beyond the limits the variable can hold. If you remember back to your computer science class each variable type can hold up to a certain value length. You will also remember some variable types only hold positive numbers while others hold positive and negative numbers.

If you go outside of the constraints of the number type you are using it may handle things in different ways such as an error condition or perhaps cutting the number off at the maximum or minimum value.

In the Solidity language for Ethereum when we reach values past what our variable can hold it in turn wraps back around to a number it understands. So for example if we have a variable that can only hold a 2 digit number when we hit 99 and go past it, we will end up with 00. Inversely if we had 00 and we subtracted 1 we would end up with 99.

Normally in your math class the following would be true:

99 + 1 = 100
00 - 1 = -1

In solidity with unsigned numbers the following is true:

99 + 1 = 00
00 - 1 = 99

So the issue lies with the assumption that a number will fail or provide a correct value in mathematical calculations when indeed it does not. So comparing a variable with a require statement is not sufficiently accurate after performing a mathematical operation that does not check for safe values.

That comparison may very well be comparing the output of an over/under flowed value and be completely meaningless. The Require statement may return true, but not based on the actual intended mathematical value. This in turn will lead to an action performed which is beneficial to the attacker for example checking a low value required for a funds validation but then receiving a very high value sent to the attacker after the initial check. Lets go through a few examples.

Simple Example:

Lets say we have the following Require check as an example:
require(balance - withdraw_amount > 0) ;

Now the above statement seems reasonable, if the users balance minus the withdrawal amount is less than 0 then obviously they don't have the money for this transaction correct?

This transaction should fail and produce an error because not enough funds are held within the account for the transaction. But what if we have 5 dollars and we withdraw 6 dollars using the scenario above where we can hold 2 digits with an unsigned integer?

Let's do some math.
5 - 6 = 99

Last I checked 99 is greater than 0 which poses an interesting problem. Our check says we are good to go, but our account balance isn't large enough to cover the transaction. The check will pass because the underflow creates the wrong value which is greater than 0 and more funds then the user has will be transferred out of the account.

Because the following math returns true:
require(99 > 0)

Withdraw Function Vulnerable to an UnderFlow:

The below example snippet of code illustrates a withdraw function with an underflow vulnerability:

function withdraw(uint _amount){

    require(balances[msg.sender] - _amount > 0);
    msg.sender.transfer(_amount);
    balances[msg.sender] -= _amount;

}

In this example the require line checks that the balance is greater then 0 after subtracting the _amount but if the _amount is greater than the balance it will underflow to a value above 0 even though it should fail with a negative number as its true value.

require(balances[msg.sender] - _amount > 0);

It will then send the value of the _amount variable to the recipient without any further checks:

msg.sender.transfer(_amount);

Followed by possibly increasing the value of the senders account with an underflow condition even though it should have been reduced:

balances[msg.sender] -= _amount;

Depending how the Require check and transfer functions are coded the attacker may not lose any funds at all but be able to transfer out large sums of money to other accounts under his control simply by underflowing the require statements which checks the account balance before transferring funds each time.

Transfer Function Vulnerable to a Batch Overflow:

Overflow conditions often happen in situations where you are sending a batched amount of values to recipients. If you are doing an airdrop and have 200 users who are each receiving a large sum of tokens but you check the total sum of all users tokens against the total funds it may trigger an overflow. The logic would compare a smaller value to the total tokens and think you have enough to cover the transaction for example if your integer can only hold 5 digits in length or 00,000 what would happen in the below scenario?

You have 10,000 tokens in your account
You are sending 200 users 499 tokens each
Your total sent is 200*499 or 99,800

The above scenario would fail as it should since we have 10,000 tokens and want to send a total of 99,800. But what if we send 500 tokens each? Lets do some more math and see how that changes the outcome.

You have 10,000 tokens in your account
You are sending 200 users 500 tokens each
Your total sent is 200*500 or 100,000
New total is actually 0

This new scenario produces a total that is actually 0 even though each users amount is 500 tokens which may cause issues if a require statement is not handled with safe functions which stop an overflow of a require statement.

Lets take our new numbers and plug them into the below code and see what happens:

1. uint total = _users.length * _tokens;
2. require(balances[msg.sender] >= total);
3. balances[msg.sender] = balances[msg.sender] -total;

4. for(uint i=0; i < users.length; i++){
5. balances[_users[i]] = balances[_users[i]] + _value;

Same statements substituting the variables for our scenarios values:

1. uint total = _200 * 500;
2. require(10,000 >= 0);
3. balances[msg.sender] = 10,000 - 0;

4. for(uint i=0; i < 500; i++){
5. balances[_recievers[i]] = balances[_recievers[i]] + 500;

Batch Overflow Code Explanation:

1: The total variable is 100,000 which becomes 0 due to the 5 digit limit overflow when a 6th digit is hit at 99,999 + 1 = 0. So total now becomes 0.

2: This line checks if the users balance is high enough to cover the total value to be sent which in this case is 0 so 10,000 is more then enough to cover a 0 total and this check passes due to the overflow.

3: This line deducts the total from the senders balance which does nothing since the total of 10,000 - 0 is 10,000. The sender has lost no funds.

4-5: This loop iterates over the 200 users who each get 500 tokens and updates the balances of each user individually using the real value of 500 as this does not trigger an overflow condition. Thus sending out 100,000 tokens without reducing the senders balance or triggering an error due to lack of funds. Essentially creating tokens out of thin air.

In this scenario the user retained all of their tokens but was able to distribute 100k tokens across 200 users regardless if they had the proper funds to do so.

Lab Follow Along Time:

We went through what might have been an overwhelming amount of concepts in this chapter regarding over/underflow scenarios now lets do an example lab in the video below to illustrate this point and get a little hands on experience reviewing, writing and exploiting smart contracts. Also note in the blockchain youtube playlist we cover the same concepts from above if you need to hear them rather then read them.

For this lab we will use the Remix browser environment with the current solidity version as of this writing 0.5.12. You can easily adjust the compiler version on Remix to this version as versions update and change frequently.
https://remix.ethereum.org/

Below is a video going through coding your own vulnerable smart contract, the video following that goes through exploiting the code you create and the videos prior to that cover the concepts we covered above:

Download Video Lab Example Code:

Download Sample Code:

CC Labs GitHub

//Underflow Example Code:

//Can you bypass the restriction?

//--------------------------------------------

pragma solidity ^0.5.12;

contract Underflow{
   mapping (address =>uint) balances;

   function contribute() public payable{
        balances[msg.sender] = msg.value;
   }

   function getBalance() view public returns (uint){
return balances[msg.sender];
   }

   function transfer(address _reciever, uint _value) public payable{
   require(balances[msg.sender] - _value >= 5);
   balances[msg.sender] = balances[msg.sender] - _value;

       balances[_reciever] = balances[_reciever] + _value;
   }

}

This next video walks through exploiting the code above, preferably hand coded by you into the remix environment. As the best way to learn is to code it yourself and understand each piece:

Conclusion:

We covered a lot of information at this point and the video series playlist associated with this blog series has additional information and walk throughs. Also other videos as always will be added to this playlist including fixing integer overflows in the code and attacking an actual live Decentralized Blockchain Application. So check out those videos as they are dropped and the current ones, sit back and watch and re-enforce the concepts you learned in this blog and in the previous lab. This is an example from a full set of labs as part of a more comprehensive exploitation course we have been working on.

Σάββατο 11 Απριλίου 2020

Adding RGB To A 6 Year Old PC In A 16 Year Old Case!

This project was something to get my oldest daughter interested in building PC's. She got a bit interested when she saw me looking at parts to upgrade to a new machine; my current PC was built only a few months after she was born.

She got interested in the cases, specifically the ones where the pictures had glorious RGB set to "Unicorn Barf" mode. She immediately asked if my new machine could look like that and suffice it to say I'll be spending some extra money on RGB parts and a case to help show it off.

When she found out that my current computer would be setup so she and my wife could have a place to play, she asked if we could make it have unicorn barf as well.

Since I still had an old original Antec LANboy windowed case laying around upstairs, I decided to buy some cheap RGB parts and move my current machine into that case with all the new fancy LED's, provided that she would help me do it.

To my joy, she was super excited to do it and so we had our own special Daddy-Daughter PC project.

My parts arrived the next day, on Sunday no less, so we immediately got to work around 11AM. My youngest wanted to hang around as well, so we took a group shot.

First I wanted to see if I could salvage an old power supply out of a very old PC that we had used as a HTPC, which needed to move out of our entertainment center anyway. Sadly it wasn't going to work with my existing build, but my daughter did enjoy taking all the parts out of it to be recycled. Nothing needed to be saved so she got to pull lots of parts out and was excited.

Next was complete disassembly of my existing machine. True to its era, it was built into an Antec One case. Here is my daughter using it to play some Minecraft.

Here is how it looked with both panels off, it wasn't perfect cable management, but it was pretty clean and allowed for good airflow.

2013 Build Specs:

Intel i5-4570
16Gb DDR3 RAM
GTX 760
120GB SATA 6G SSD
1TB HDD
512GB SATA 6G SSD (added this XMas from a friend so my games don't take forever to load anymore).

As we were removing parts I decided to start cleaning up the old Lanboy dust wise and I started mounting the hard drives to the removable drive cage. Yes kids, back in 2003, removable drive cages were an amazing luxury for system building. Compare this with the Antec One from 2013 and it's tool free drive sleds that mount from the opposite side panel and I was starting to appreciate how much cases advanced over time.

And then the Lanboy really started to show its age.

You see my system has two SSD's and one HDD. Not bad for a six year old computer, and while the Lanboy has space to the drives, it doesn't necessarily have space for the drives AND my massive video card.

I spent no less than an hour trying to tetris my way into fitting things properly. Unfortunately the top most drive bays on the tray require the HDD to be further forward, because, um...well...

You see kids, back in the day we used to have 3.5" drive bays that would stick out to the front of the case. For floppy disk drives, ZIP drives, or if we got fancy in early 2003, a SD card reader.

Sadly, the covers for the 3.5" drive bays on the front of the case wouldn't let the HDD mount properly and I couldn't squeeze in my massive GeForce GTX 760 and the drive.

In the end, I installed my SDD drives and then used only two screws (with rubber grommets at least) to secure the HDD at the top of the drive tray. Luckily the drive doesn't really travel and is secure enough.

So I finally got everything mounted in the case, but nothing was cabled up.

And here is where the Lanboy started to show its old age even more.

The other side panel does not come off at all and there is almost no where to easily do any cable management. This is when the nightmares of my old non-LED lit build from 16 years ago came back to haunt me.

Still, I managed then and I managed now; it was just...painful. Even simple things like inserting the power supply was a strain. I did the best I could, there aren't any cable tubes or sleeves that I had lying around, but I did manage to use cable ties and some double sided tape as needed to hide just about everything I could.

In the end I think it looked pretty good.

It was even better once I powered it on and the light show started. Everything booted up and was working fine too.

Front shot, you can also see my other very old Antec case which houses my server.

Conclusion

An old PC into an even older case was an odd build, but my daughter loves it and we had fun building it together.

The LED's aren't really controllable, well the two 80mm (yes, that's right this case only has 80mm fan mounts!) are set to permanent unicorn barf mode, but I technically have a small remote to control the LED strips.

Building the new machine will be a cakewalk in comparison. I'm looking at a Corsair cube case, though I've not 100% settled on it yet. I'm waiting for the Ryzen 3000 series to get released before I pull the trigger, and man waiting for that is hard. My daughter is already excited to help with that too, which makes it even better. The only downside is that all the extra RGB stuff adds a bit to the overall cost, but my daughter is worth it and if I'm honest I like it too.

Τετάρτη 8 Απριλίου 2020

Severed Line (XCOM Files)

PFC Jenkins & SPC Kobayashi, Mar 8, 2015

You want me to tell you about Shinji Kobayashi? The first mission that I ran for XCOM, I was under Kobayashi's command. He had just promoted to Specialist after distinguishing himself on his first mission under XCOM command. These guys don't give a shit about whether or not you're a decorated war hero back home, mind ya. The only thing that matters here is how many aliens you have packed up in bags for the lab rats to study. Until you nailed your first extra, you were as green as it gets around there. Kobayashi had already killed three of the things before I even got to see one up close and personal.

The mission itself was back home in Australia, maybe why I got picked. I don't know. The extras had started abducting people in a commercial area of Canberra. They sent us in to take em out. Aside from Kobayashi, SPC Rojas was second the in command veteran on the team. There was also PFC Cerna, Kovac and Natale with us that night. It was their first mission as well. We all knew each other from training, but none of us were really friends. The other three rookies were all from southern Europe, so they may have been the closest out of the six of us, or I maybe just imagined it. We were all chosen for a reason, though, so I knew I could count on them with my life if I needed to.

SPC Kobayashi didn't speak much. I'd never even heard the guy's voice before touching down that night. Even then, he only ever spoke when necessary, barking out swift orders over the comms in a heavily Japanese-accented English. His stoicism really set the tone for our team. Like his words, his actions were very deliberate and meaningful. He didn't like to waste time, especially in combat. At the time, I didn't know him particularly well, but I did like the guy.

Canberra Drop Zone

We were dropped on the street around 0100 local time on the 8th of March. I remember it distinctly, because it was exactly a week after Kobayashi had distinguished himself on the first XCOM mission against these alien bastards. I was nervous as hell, but Kobayashi and Rojas were calm and collected. Their confidence was reassuring. It was dark, but I thought the other three rookies were just as pale and shaken as I was. I like to tell myself that I wasn't the only hardened combat vet out there scared to death of these scrawny grey men with blaster pistols from outer space. It sounds silly, right?

In front of us there was this big, family Italian-style restaurant. On the left side of that building, there was a laundromat. We weren't sure where the aliens were now. There was enough evidence to assume they had already rounded up all the humans in both areas. The street was deathly silent aside from the soft shuffling of our boots and gear. You know, I'd make a joke about these naked little grey aliens being up all night doing their laundry or something, but honestly remembering the sight of human bodies all wound up in some green ooze turns my stomach at the thought. It's real hard to make jokes when you are seeing these horrible things from some sci-fi horror movie right in front of you.

Kobayashi & Jenkins Push To the Laundromat

SPC Kobayashi split the team into two groups with some waving gestures of his hands. He wanted me with him in the laundromat, while Rojas took the others to secure the restaurant. Kobayashi took the lead on our side, edging forward to the big windows of the laundromat cautiously. Sure enough, he startled three extras that scuttled across the tile floor to take cover. He raised his hand to motion for me to take a shot if I had one, so I fired my rifle. I nailed one of the extras cleanly on his side, he died instantly, spilling out on to the white tile floor. The thrill of that first, minor victory was intoxicating to me. I felt like I had earned my place on the team right then and there. This is why they brought me aboard, I thought. Before I could relish that feeling, the remaining two sectoids began to fire on our position.

I remember Rojas mentioned over the radio coming to reinforce our position, but before Rojas's small team could retreat from their position, several more of these sectoid things burst in through the back door of the restaurant and a fire fight broke out inside. I couldn't tell you, honestly, what was going on next door. Kobayashi and I had our hands full, taking fire from inside the laundromat. If we let them take any more ground, these two groups of aliens would have us surrounded. I advanced up to the window to get a better vantage point inside, while Kobayashi fell back into a flanking position. From his new positon, Kobayashi clipped an extra coming around the corner toward the entrance of the building.

Kobayashi Takes a Shot Through the Front Door

I heard a grenade go off in the restaurant. The chatter over our comms told me Rojas had moved into a forward position to get a good line of sight on the aliens. They had them pinned down at the back door to the restaurant, but it was a stalemate. Sometime after the grenade blast, Rojas was hit. He went down hard, but he was still breathing and more importantly - he was still shooting. In that moment, Kobayashi was beside me. He didn't panic or falter for an instant. He told the other half of our squad to stay calm and protect Rojas. I couldn't believe how cool this guy was under this kind of pressure. I remember the moment so vividly because Shinji put his hand on my shoulder and said to me, "I have to go over there. You take this last one. He is yours." He spoke with such assurance that I felt full of pride and resolve. They were counting on me to secure this building, and Kobayashi seemed to know I could do it.

Jenkins Takes the Laundromat

I didn't have sight on the enemy inside, but I could hear where he was hiding. I tossed in an anti-personnel grenade to flush it out - hoping it would just straight up kill the bloody thing, to be honest. I moved into the building as the grenade exploded in the back. The slippery bastard scrambled out into the open, covered in its own mucus-looking blood from the shrapnel embedded in its skin. It tried to take cover behind a folding table, but I took the shot before it even lifted its weapon in my direction. I sent word over my headset that the building was secure, and Kobayashi responded with one single word, "Good."

As I swept through the rest of the building to make sure there were no more creepers lurking in the shadows, I heard Private Cerna ordered to patch up Rojas who was suffering from a pretty serious shot. The rookies had a hint of anxiety in their voices, but Kobayashi was as firm as ever. He had Kovac and Natale push their way into the restaurant. Apparently a successful endeavor because Kobayashi soon asked me if there was access to the back alley through the laundromat. He had everyone but Rojas ready to breach into the alley expecting to find more resistance waiting for us there, but it wasn't the case. We could tell from some unusual sounds that there was activity inside the building across from us, so again the four rookies took up positions against two doors hoping to get inside and surround any enemies we found there.

Jenkins & Cerna Fire on the Drones

We threw open the doors together and were surprised to find these strange little robots buzzing around - drones by the look of it. Nothing like any drones we'd seen before but unmistakable alien robotics bobbing around the inside of this store like insects in flight. I assumed they were some kind of advanced scout, trying to keep watch while the little greys did their business. The aliens probably weren't pleased about how their last abduction ended in Vancouver so now they had these drones watching out for their troops. Fat lot of good it did for them, though.

Natale and Kovac managed to hit one, but it was Cerna next to me who finished it off. I managed to land a hit on the other drone as it tried to swarm out into the alley, but Kobayashi - that madman - ran intot he store and fired a bullet straight into its little drone face. I guess he was pretty confident that these things weren't swarming all over that store - or maybe he just knew we'd be able to take them down if they were. Whatever he was thinking, it was as crazy as it was impressive.

Kobayashi Finishes Things

This guy is intense, right? It was that mission Kobayashi strapped as many grenades to his body as he could find. Most of us were only carrying one or two of them to get ourselves out of a tricky situation, but not Kobayashi. He had four, maybe five where ever he could strap them on to his uniform. He was later known for his tenacity as a grenadier, but I'm pretty sure that's where it all started. The troops at XCOM would later start calling him "Kaiju" after the popular Japanese film genre. I can only imagine the first time he heard that name being tossed around the base, he just gave some approving nod and said in a low voice, "Good."

from a talk with John Jenkins on the subject of serving under Shinji Kobayashi

XCOM Report - March 8, 2015 - "Severed Line"

SPC Shinji Kobayashi (Japan) - Squad Leader

Confirmed Kills: 2 (1 Sectoid, 1 Drone)
Total CK: 5 (4 Sectoid, 1 Drone)

SPC Roman Rojas (Guatemala)

Confirmed Kills: 0
Total CK: 2 (Sectoid)
Condition: Serious Injury

PFC John Jenkins (Australia)

Confirmed Kills: 2 (Sectoid)
Earned Promotion

PFC Barbara Natale (Italy)

Confirmed Kills: 1 (Sectoid)
Promotion Earned

PFC Jarmila Cerna (Czech Republic)

Confirmed Kills: 2 (1 Sectoid, 1 Drone)
Earned Promotion

PFC Peter Kovac (Slovenia)

Confirmed Kills: 1 (Sectoid)
Promotion Earned