Archive for December, 2010

Lightspark 0.4.5.1, with experimental PowerPC support

Posted by Alessandro Pignotti in Lightspark on December 16, 2010

Lightspark stand­alone exe­cut­ing YouTube on a ppc64 Debian machine

Only a few days have passed since the 0.4.5 and a new Lightspark release is already out! With big news for Pow­erPC users. The main new fea­ture of this release is exper­i­men­tal sup­port for the PPC plat­form!

Cur­rently the per­for­mance of the video play­back is far from ideal as some very inef­fi­cient code is used on a crit­i­cal path, and will be rewrit­ten in an effi­cient man­ner. Nonethe­less tests and bug reports from Pow­erPC users are very welcome.

Beside this fea­ture the release include:

  • A fix to restore YouTube support
  • A new AMF3 parser that will be used to pro­vide Local Shared Object (flash cook­ies) sup­port in a fol­low­ing release.

Pack­ages will be as usu­ally avail­able for Ubuntu Mav­er­ick from the PPA for the i386 and amd64 archi­tec­ture. Pack­ages for PPC are not cur­rently avail­able as launch­pad does not sup­port ppc pack­ages.

Flattr this

, ,

20 Comments

Lightspark 0.4.5.1, with experimental PowerPC support

Posted by Alessandro Pignotti in Lightspark on December 16, 2010

Lightspark stand­alone exe­cut­ing YouTube on a ppc64 Debian machine

Only a few days have passed since the 0.4.5 and a new Lightspark release is already out! With big news for Pow­erPC users. The main new fea­ture of this release is exper­i­men­tal sup­port for the PPC plat­form!

Cur­rently the per­for­mance of the video play­back is far from ideal as some very inef­fi­cient code is used on a crit­i­cal path, and will be rewrit­ten in an effi­cient man­ner. Nonethe­less tests and bug reports from Pow­erPC users are very welcome.

Beside this fea­ture the release include:

  • A fix to restore YouTube support
  • A new AMF3 parser that will be used to pro­vide Local Shared Object (flash cook­ies) sup­port in a fol­low­ing release.

Pack­ages will be as usu­ally avail­able for Ubuntu Mav­er­ick from the PPA for the i386 and amd64 archi­tec­ture. Pack­ages for PPC are not cur­rently avail­able as launch­pad does not sup­port ppc pack­ages.

Flattr this

, ,

20 Comments

Lightspark 0.4.5 Release

Posted by Alessandro Pignotti in Lightspark on December 14, 2010

Lightspark 0.4.5 is out! No big changes from the last Release Can­di­date, beside a –ver­sion switch that will make it eas­ier to assess if the last and best ver­sion is being used.

In the mean time work has not stopped. A brand new parser for the AMF3 is already upstream and will be used to imple­ment ByteArray::readObject and sup­port for Local shared Objects. More­over work is under way to build a sup­ported appli­ca­tion data­base where users will be able to report successes/failures and vote for appli­ca­tions to be sup­ported. This sys­tem is being cus­tomized hav­ing Wine’s AppDB as a base, so thanks the the Wine team for their work!

Flattr this

, ,

8 Comments

Lightspark 0.4.5 Release

Posted by Alessandro Pignotti in Lightspark on December 14, 2010

Lightspark 0.4.5 is out! No big changes from the last Release Can­di­date, beside a –ver­sion switch that will make it eas­ier to assess if the last and best ver­sion is being used.

In the mean time work has not stopped. A brand new parser for the AMF3 is already upstream and will be used to imple­ment ByteArray::readObject and sup­port for Local shared Objects. More­over work is under way to build a sup­ported appli­ca­tion data­base where users will be able to report successes/failures and vote for appli­ca­tions to be sup­ported. This sys­tem is being cus­tomized hav­ing Wine’s AppDB as a base, so thanks the the Wine team for their work!

Flattr this

, ,

8 Comments

iCTF hacking competition 2010: solution of some challenges

Posted by Luca Invernizzi in Uncategorized on December 10, 2010

This year, hav­ing joined the com­puter secu­rity group at UCSB for my phd, I’ve helped in the orga­ni­za­tion of the 2010rh edi­tion of the iCTF, the biggest inter­na­tional online hack­ing com­pe­ti­tion. It has been plenty of fun, with more than 70 teams par­tic­i­pat­ing from all over the world. The CMU team “Plaid par­lia­ment of pwn­ing” won it,  get­ting the  1000$ price (thanks Adobe and IEEE Secu­rity & Pri­vacy mag­a­zine for the sponsorships!).

Since peo­ple have been ask­ing for the solu­tions of the two chal­lenges I wrote, so here they are.

chal­lenge 5:

This chal­lenge is easy, I encour­age you to give it a try, it’s fun!

Ques­tion: “Who’re you’re gonna call?”

File: call
Points: 300
Teams that have com­pleted it: 44 (congrats!)

Solu­tion: in an html com­ment fol­low­ing this line

chal­lenge 4:

This chal­lenge is a lit­tle more dif­fi­cult, but if you know python you have all the skills nec­es­sary to beat it.
Question:

Hello Anony­mous,
it has come to our knowl­edge that the Lity­van Secret Ser­vice (note: this was part of a more com­plex story that ran across all the CTF)
is installing a remote con­trol sys­tem on their sub­marines. This would
allow a hand­ful of man to launch a mas­sive attack from a secure
loca­tion.
This threat is not accept­able: your mis­sion is to break into one
sub­ma­rine remote con­trol sys­tem and launch a mis­sile against Navy Con­trol Center,
so to shut down the sys­tem for good.
The details of this sys­tems are unknown, but we have recov­ered from a
stolen usb device two files that might give some insights to you: they
are attached. We dis­cov­ered what we sus­pect to be one of the entry point
of this sys­tem: it is located at 10.15.42.42, on TCP port 5000.
Should you com­plete this mis­sion, you will be lav­ishly remunerated.
Good luck!
X

To make it run, unpack this file and run server.py (it’s all python, you can check it for back­doors). To start the chal­lenge, you should read only the con­tent of the “pub” direc­tory: that was the mate­r­ial that was given in the ctf.

Points: 500
Teams that have com­pleted it: 0, as most of the dif­fi­cult chal­lenges — because of the struc­ture of the iCTF 2010, it turned out that it was more con­ve­nient to focus only on the easy chal­lenges. We’ll have to fix it next year!

Solu­tion: in an html com­ment fol­low­ing this line. The given file also con­tains a script that can solve the chal­lenge (the test_* files)

For the solu­tion of another dif­fi­cult chal­lenge, head over to Bryce’s blog.

No Comments

iCTF hacking competition 2010: solution of some challenges

Posted by Luca Invernizzi in Uncategorized on December 10, 2010

This year, hav­ing joined the com­puter secu­rity group at UCSB for my phd, I’ve helped in the orga­ni­za­tion of the 2010rh edi­tion of the iCTF, the biggest inter­na­tional online hack­ing com­pe­ti­tion. It has been plenty of fun, with more than 70 teams par­tic­i­pat­ing from all over the world. The CMU team “Plaid par­lia­ment of pwn­ing” won it,  get­ting the  1000$ price (thanks Adobe and IEEE Secu­rity & Pri­vacy mag­a­zine for the sponsorships!).

Since peo­ple have been ask­ing for the solu­tions of the two chal­lenges I wrote, so here they are.

chal­lenge 5:

This chal­lenge is easy, I encour­age you to give it a try, it’s fun!

Ques­tion: “Who’re you’re gonna call?”

File: call
Points: 300
Teams that have com­pleted it: 44 (congrats!)

Solu­tion: in an html com­ment fol­low­ing this line

chal­lenge 4:

This chal­lenge is a lit­tle more dif­fi­cult, but if you know python you have all the skills nec­es­sary to beat it.
Question:

Hello Anony­mous,
it has come to our knowl­edge that the Lity­van Secret Ser­vice (note: this was part of a more com­plex story that ran across all the CTF)
is installing a remote con­trol sys­tem on their sub­marines. This would
allow a hand­ful of man to launch a mas­sive attack from a secure
loca­tion.
This threat is not accept­able: your mis­sion is to break into one
sub­ma­rine remote con­trol sys­tem and launch a mis­sile against Navy Con­trol Center,
so to shut down the sys­tem for good.
The details of this sys­tems are unknown, but we have recov­ered from a
stolen usb device two files that might give some insights to you: they
are attached. We dis­cov­ered what we sus­pect to be one of the entry point
of this sys­tem: it is located at 10.15.42.42, on TCP port 5000.
Should you com­plete this mis­sion, you will be lav­ishly remunerated.
Good luck!
X

To make it run, unpack this file and run server.py (it’s all python, you can check it for back­doors). To start the chal­lenge, you should read only the con­tent of the “pub” direc­tory: that was the mate­r­ial that was given in the ctf.

Points: 500
Teams that have com­pleted it: 0, as most of the dif­fi­cult chal­lenges — because of the struc­ture of the iCTF 2010, it turned out that it was more con­ve­nient to focus only on the easy chal­lenges. We’ll have to fix it next year!

Solu­tion: in an html com­ment fol­low­ing this line. The given file also con­tains a script that can solve the chal­lenge (the test_* files)

For the solu­tion of another dif­fi­cult chal­lenge, head over to Bryce’s blog.

No Comments

Setting IP options in Scapy

Posted by Luca Invernizzi in Networking, Security on December 6, 2010

Dur­ing this year iCTF (the world largest online hack­ing com­pe­ti­tion — very cool) my team faced the prob­lem of set­ting an IP header option in Scapy. That was needed to break a ser­vice that was rely­ing on IP addresses for authentication.

Now, Scapy is an awe­some project, but it lacks a bit on the doc­u­men­ta­tion side, as most of it is com­posed by a bunch of slides. Since IP options are over­looked in the docs and there is noth­ing find­able on the web that shows how to set them, I’ll post it here hop­ing to help some future fel­low googler — that might as well be future me.

Option to set: Loose Route/Record Route (the oth­ers work just the same):

>>> ip=IP(src="1.1.1.1", dst="8.8.8.8", options=IPOption('\x83\x03\x10'))
>>> ip.show2()
###[ IP ]###
version= 4L
ihl= 6L
tos= 0x0
len= 24
id= 1
flags=
frag= 0L
ttl= 64
proto= ip
chksum= 0xd4d0
src= 1.1.1.1
dst= 8.8.8.8
\options\
|###[ IP Option Loose Source and Record Route ]###
|  copy_flag= 1L
|  optclass= control
|  option= loose_source_route
|  length= 3
|  pointer= 16
|  routers= []
|###[ IPOption_EOL ]###
|  copy_flag= 0L
|  optclass= contro
|  option= end_of_list

The ‘\x83\x03\x10’ has been cre­ated fol­low­ing the linked specs (\x83 is the type of the option, \x03 is the length, \x10 is the pointer).

Note that if you for­get the IPOp­tion() bit, your packet will be printed cor­rectly with show()/show2() but will refuse to be sent on the net­work. Instead, it will show this error (here for the sake of search engine indexing):

>>> send(IP(src="1.1.1.1", dst="8.8.8.8", options='\x83\x03\x10'))
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/lib/pymodules/python2.6/scapy/sendrecv.py", line 247, in send
    __gen_send(conf.L3socket(*args, **kargs), x, inter=inter, loop=loop, count=count,verbose=verbose, realtime=realtime)
  File "/usr/lib/pymodules/python2.6/scapy/sendrecv.py", line 230, in __gen_send
    s.send(p)
  File "/usr/lib/pymodules/python2.6/scapy/arch/linux.py", line 384, in send
    sx = str(ll(x))
  File "/usr/lib/pymodules/python2.6/scapy/arch/linux.py", line 382, in <lambda>
    ll = lambda x:conf.l2types[sn[3]]()/x
  File "/usr/lib/pymodules/python2.6/scapy/packet.py", line 260, in __div__
    cloneB = other.copy()
  File "/usr/lib/pymodules/python2.6/scapy/packet.py", line 140, in copy
    clone.fields[k]=self.get_field(k).do_copy(clone.fields[k])
  File "/usr/lib/pymodules/python2.6/scapy/fields.py", line 401, in do_copy
    return map(lambda p:p.copy(), x)
  File "/usr/lib/pymodules/python2.6/scapy/fields.py", line 401, in <lambda>
    return map(lambda p:p.copy(), x)
 
AttributeError: 'str' object has no attribute 'copy'

3 Comments

Setting IP options in Scapy

Posted by Luca Invernizzi in Networking, Security on December 6, 2010

Dur­ing this year iCTF (the world largest online hack­ing com­pe­ti­tion — very cool) my team faced the prob­lem of set­ting an IP header option in Scapy. That was needed to break a ser­vice that was rely­ing on IP addresses for authentication.

Now, Scapy is an awe­some project, but it lacks a bit on the doc­u­men­ta­tion side, as most of it is com­posed by a bunch of slides. Since IP options are over­looked in the docs and there is noth­ing find­able on the web that shows how to set them, I’ll post it here hop­ing to help some future fel­low googler — that might as well be future me.

Option to set: Loose Route/Record Route (the oth­ers work just the same):

>>> ip=IP(src="1.1.1.1", dst="8.8.8.8", options=IPOption('\x83\x03\x10'))
>>> ip.show2()
###[ IP ]###
version= 4L
ihl= 6L
tos= 0x0
len= 24
id= 1
flags=
frag= 0L
ttl= 64
proto= ip
chksum= 0xd4d0
src= 1.1.1.1
dst= 8.8.8.8
\options\
|###[ IP Option Loose Source and Record Route ]###
|  copy_flag= 1L
|  optclass= control
|  option= loose_source_route
|  length= 3
|  pointer= 16
|  routers= []
|###[ IPOption_EOL ]###
|  copy_flag= 0L
|  optclass= contro
|  option= end_of_list

The ‘\x83\x03\x10’ has been cre­ated fol­low­ing the linked specs (\x83 is the type of the option, \x03 is the length, \x10 is the pointer).

Note that if you for­get the IPOp­tion() bit, your packet will be printed cor­rectly with show()/show2() but will refuse to be sent on the net­work. Instead, it will show this error (here for the sake of search engine indexing):

>>> send(IP(src="1.1.1.1", dst="8.8.8.8", options='\x83\x03\x10'))
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/lib/pymodules/python2.6/scapy/sendrecv.py", line 247, in send
    __gen_send(conf.L3socket(*args, **kargs), x, inter=inter, loop=loop, count=count,verbose=verbose, realtime=realtime)
  File "/usr/lib/pymodules/python2.6/scapy/sendrecv.py", line 230, in __gen_send
    s.send(p)
  File "/usr/lib/pymodules/python2.6/scapy/arch/linux.py", line 384, in send
    sx = str(ll(x))
  File "/usr/lib/pymodules/python2.6/scapy/arch/linux.py", line 382, in <lambda>
    ll = lambda x:conf.l2types[sn[3]]()/x
  File "/usr/lib/pymodules/python2.6/scapy/packet.py", line 260, in __div__
    cloneB = other.copy()
  File "/usr/lib/pymodules/python2.6/scapy/packet.py", line 140, in copy
    clone.fields[k]=self.get_field(k).do_copy(clone.fields[k])
  File "/usr/lib/pymodules/python2.6/scapy/fields.py", line 401, in do_copy
    return map(lambda p:p.copy(), x)
  File "/usr/lib/pymodules/python2.6/scapy/fields.py", line 401, in <lambda>
    return map(lambda p:p.copy(), x)
 
AttributeError: 'str' object has no attribute 'copy'

3 Comments