These are the slides from our talk on Project CritHeav3n: pulling firmware for hundreds of consumer routers, auditing it at scale with a mix of our own tooling and AI agents, and checking which findings actually hold up on real hardware.

Open the slides (PDF) on vert3x.io

Navigate with ← / → (or swipe on a phone); press R to jump back to the first slide. More of our work is at vert3x.io.

What it covers#

• Getting the firmware: open vendor FTP portals and storage buckets, plus browser agents that register accounts and download from bot-hardened support pages.
• Post-processing: recovering decryption keys (older images, side channels, JTAG, flash dumps) and cataloging every image by product family and release date.
• Two pipelines, side by side: the top 50 products per vendor were split between Axiom, our own unpack, points-of-interest, deep-scan and reproduce pipeline (91% of its findings were valid vulnerabilities), and a Codex audit with one orchestrator and five parallel auditors running two waves over 23 hours.
• Case studies: a MikroTik SNMP stack overflow (CVE-2026-88464, now patched, with 44,531 MikroTik SNMP hosts publicly reachable per Censys), and a TP-Link mesh "RCE" that scored 8.8 in emulation but never reaches the daemon on a real network, because the kernel reads EtherType 0x0300 as an 802.3 length.
• Results: 40 critical findings across MikroTik, NETGEAR, D-Link, GL.iNet, ipTIME, ASUS, Xiaomi and TP-Link, 19 of them with confirmed code execution. Command injection was the most common weakness by a wide margin.

The takeaway#

Command injection should be dead in 2026, and it still turned up in 19 of our findings. Vendors could cut most of the damage by sanitizing input, running network daemons without root (10 of 16 finding families ended in code execution), and patching a shared component across every product line that ships it, not just the model that was reported. On cost, the whole project ran on about $800 of Codex subscriptions, against roughly $10,000 at API prices.

Unfortunately the recording equipment wasn't working, so there's no video — but here are the slides. This talk breaks down three of the protocols holding low-earth orbit together — AX.25, CCSDS, and DVB-S/S2 — and shows how little stands between an antenna and the data.

▶ Open the slides fullscreen

Navigate with ← / → (or the on-screen arrows); press R to jump back to the first slide.

What it covers#

• AX.25 — the amateur backbone flying on the ISS and hundreds of CubeSats, with zero cryptographic defenses (partly by regulation).
• CCSDS — the professional stack (NASA / ESA / JAXA). A security overlay, SDLS, exists — but adoption is glacial and most missions still ship without it.
• DVB-S / S2 — the commercial workhorse behind satellite TV, VSAT and backhaul. Researchers intercepted live traffic with ~€300 of consumer gear.
• Viasat / KA-SAT — proof this isn't theoretical: tens of thousands of modems knocked offline through a ground-segment compromise on the first morning of the 2022 invasion of Ukraine.

The takeaway#

Passive reception has become cheap for whole classes of satellite traffic, active RF attacks are harder (and often illegal), and ground-segment compromise remains the most realistic high-impact path. The ground is in 2026; orbit is still in 1996.

Open the full-resolution poster (PNG, 4.4 MB) or the PDF.

What happens when you combine Advent of Code with industrial control systems? Ladder logic solutions running on actual PLCs.

This year, I solved Advent of Code 2025 puzzles using ladder logic on an Allen-Bradley Micro870 PLC, with a FactoryTalk Optix HMI for visualization.

Github Repo with Code: https://github.com/ladderlogix/Advent-of-Code-2025

Hardware Setup#

Day 1: Secret Entrance#

The Problem#

You arrive at the secret entrance to the North Pole base, but the password has changed. A safe with a dial (numbers 0-99) holds the answer. Your puzzle input contains rotation instructions like L68 (left 68 clicks) or R48 (right 48 clicks).

The dial starts at 50 and wraps around (left from 0 goes to 99, right from 99 goes to 0).

Part 1: Count how many times the dial ends on position 0 after a rotation.

Part 2: Count how many times the dial passes through or lands on position 0 during ALL rotations (including mid-rotation).

Video Demonstrations#

Day 1 Part 1#

Day 1 Part 2#

Part 1 Solution#

The algorithm processes 4,146 rotation instructions, tracking position on a circular 0-99 dial.

Rung 0 - Reset#

Rung 1 - Start Processing#

Rung 2 - Check If Complete#

Rung 3 - Get Direction From Array#

Rung 4 - Get Distance From Array#

Rung 5 - Subtract (Direction = Left)#

Rung 6 - Modulo Wraparound#

Rung 7 - Handle Negative Values#

Rung 8 - Count Zeros#

Rung 9 - Advance Step#

Part 2 Solution#

Part 2 requires counting every time the dial crosses position 0, not just when it lands there. This adds significant complexity with 6 different cases to handle.

Rung 10 - Zero Crossing Calculation#

This massive branching rung handles all the edge cases for counting zero crossings:

Rung 11 - Part 2 Processing#

Rung 12 - Part 2 Advance#

Stay tuned for more days of Advent of Code solved with ladder logic!

While playing around with a Rockwell Stratix 5400 industrial Ethernet switch, I uncovered a series of vulnerabilities that, when chained together, allow complete device compromise with minimal effort.

Key Findings#

Cisco Stratix 5400 Industrial Ethernet Switch - commonly deployed in critical infrastructure

Background: The Cisco Stratix 5400#

The Cisco Stratix 5400 is an industrial-grade Ethernet switch designed for harsh environments including manufacturing facilities, utilities, oil & gas operations, and transportation systems.

Target Device Specifications:

• Model: 1783-BMS10CGP

Finding #1: GET-Based Remote Code Execution (No CSRF Protection)#

The Vulnerability#

The web interface exposes a GET-based command execution endpoint that accepts arbitrary CLI commands without CSRF token protection:

Endpoint: /%24{variable}%0A?{variable}=<command>
Method: GET
Authentication: Required (HTTP Basic Auth)
CSRF Protection: NONE

Technical Details#

The endpoint uses URL-encoded variable substitution:

• %24 = $ (dollar sign)
• %0A = \n (newline)
• Any variable name works: a, b, c, d, cmd, command, etc.

Proof of Concept#

curl -k -u admin:password \
  "https://192.168.103.143/%24b%0A?b=show%20version%20|%20include%20uptime"

# Returns:
stratix uptime is 11 hours, 42 minutes

Terminal showing successful command execution via the GET-based RCE endpoint

Confirmed Working Commands#

Finding #2: CSRF Leading to Unauthenticated RCE#

Because the RCE endpoint uses GET requests with no CSRF token, any webpage can trigger command execution when visited by an authenticated administrator.

Attack Scenario#

1. Attacker creates malicious webpage
2. Sends link to network administrator
3. Admin clicks link while logged into switch web interface
4. Malicious JavaScript executes commands in admin's browser context
5. Full device configuration exfiltrated to attacker's server

Finding #3: Password Hash Exposure#

The useraccounts.shtml page includes a hidden textarea that contains the output of SSI commands, exposing all user account password hashes in the HTML source code.

<textarea style="display:none; visibility:hidden;" id="USER_SUMMARY">
    <!--#exec cmd='more system:running-config | i user'-->
</textarea>

When rendered:

username admin privilege 15 secret 5 $1$P4Bi$8t74cAAknpCiVCvL7IC6T.
username vulntest privilege 5 secret 9 $9$wLzi8Cmi6aH91k$qOAH1kOzmLhTX1tKqGx/...

Screenshot showing admin password hash visible in page source to read-only user

The Complete Attack Chain#

Phase 1: Initial Access#

Attacker obtains read-only credentials (default/weak passwords)

Phase 2: Information Disclosure#

Access useraccounts.shtml - extract admin password hash from HTML source

Phase 3: Offline Password Cracking#

Run hashcat on MD5-crypt hash - cracked in ~15 minutes with GPU

Phase 4: Admin Access#

Login with cracked admin credentials - full web interface access

Phase 5: Remote Code Execution#

Use GET-based RCE endpoint - extract all configuration, passwords, network topology

Disclaimer: This assessment was performed on authorized equipment for security research purposes. All findings are reported in good faith to improve security.

Industrial Control Systems (ICS) rely heavily on accurate time synchronization for coordinating operations, maintaining event logs, and executing time-dependent control logic. The Distributed Network Protocol (DNP3), widely deployed in electric utilities and critical infrastructure, includes a time synchronization feature that can be exploited by adversaries to cause significant disruption.

I've developed a proof-of-concept tool that demonstrates how DNP3's LAN time-sync procedure can be weaponized to send arbitrary timestamps to outstations, potentially compromising the integrity of time-dependent operations across critical infrastructure.

What is DNP3?#

DNP3 (Distributed Network Protocol 3) is commonly used in SCADA systems for communication between control centers and RTUs or IEDs. It's particularly prevalent in:

• Electric power transmission and distribution
• Water and wastewater systems
• Oil and gas pipelines
• Transportation systems

The protocol operates on standard ports (typically TCP 20000 and 19999).

The Time Synchronization Vulnerability#

DNP3 includes a time synchronization mechanism (function code 0x17) with several concerning characteristics:

1. Lack of Authentication: Time-sync messages typically lack cryptographic authentication
2. Unrestricted Values: The protocol accepts arbitrary timestamp values without validation
3. Wide Impact: A single malicious time-sync message can affect multiple dependent systems
4. Silent Execution: Time modifications may not trigger obvious alarms

Attack Scenarios and Impact#

1. Operational Sequencing Disruption#

• Circuit breaker operations may execute out of sequence
• Load shedding algorithms may make incorrect decisions
• Automated protective relays may fail to coordinate

2. Log File Corruption and Forensic Evasion#

• Historical data appears in wrong temporal order
• Forensic investigations become significantly more difficult
• Sequence of Events (SOE) logs become unreliable

3. Time-Dependent Control Logic Manipulation#

• Scheduled maintenance windows triggered prematurely
• Time-of-use pricing mechanisms circumvented
• Automated switching based on time schedules may malfunction

The Tool: DNP3 Timing Attack#

I developed a Rust-based command-line tool to demonstrate this attack vector.

Features#

• Arbitrary Timestamp Injection: Send any timestamp value to target outstations
• Multiple Target Support: Attack multiple RTUs simultaneously
• Port Flexibility: Support for standard and non-standard DNP3 ports
• Timing Control: Configurable delays and timing patterns
• Rust Safety: Memory-safe implementation with strong type guarantees

Defensive Considerations#

Network Segmentation#

• Isolate DNP3 traffic to dedicated OT networks
• Implement strict firewall rules
• Deploy unidirectional gateways where appropriate

Authentication and Encryption#

• Upgrade to DNP3 Secure Authentication (SAv5/SAv6)
• Implement encrypted tunnels for DNP3 communications

Monitoring and Detection#

• Monitor for unexpected time-sync messages
• Implement anomaly detection for timestamp deviations
• Alert on time jumps exceeding defined thresholds

Responsible Disclosure#

This research is released for educational and authorized security testing purposes only.

Project Links#

• GitHub Repository: DNP3TimmingAttack
• License: AGPL-3.0
• Language: Rust

Download the slides (PowerPoint, 19.5 MB)

Welcome to my homelab - a carefully crafted environment that serves as both my learning playground and professional development space.

The Heart of Operations: Central Server Rack#

Core Infrastructure#

• HPE ProLiant DL350 Gen10: Primary ESXi hypervisor server
• 4TB SSD NAS: Connected via 10Gb link for high-speed external storage
• Cisco 2960L Switch: Main distribution switch
• pfSense Firewall: Primary security gateway

Industrial Control Systems (ICS) Laboratory#

Current ICS Equipment#

• Arduino OPTA: Modern industrial-grade PLC
• Allen-Bradley MicroLogix 1100: Classic PLC
• Cisco ISA Firewall: Specialized security appliance
• Honeywell Cipher 50: Industrial communication device
• Schneider Electric PLC: Additional PLC for diverse testing

Network Security and Monitoring#

Teleseer running on VMware, connected to a span port on the Cisco switch.

This is a mashup of both 2024 and 2025 badge hacking. While the ideas and process are the same, some of the output information might be different, and there are separate sections for each year.

About Us#

Team#

• Stephen Glombicki / Logix (@ladderlogic)
• Cooper Wiegand / shiloh (@cw0)

2024 Team Only

• Victor Yakovlyev / chickn nuggies (@chickinnuggies)
• Jon Sullivan / vort (@vort4282)
• Rob Sullivan (@rsulliva)

Other Authors#

Parts on how to solve some of the flags from 2024 are taken from cw0. His writeup can be found here. I tried to make mine more beginner-friendly and show the setup process.

Setup#

To start attacking the ESP32 chip we should see what is in the firmware. To do this we will use esptool to dump.

Install Esptool#

pip install esptool

Identify ESP32 COM Port#

Finding the COM port can be useful as not all tools can automatically find what you are looking for. The steps depend on your platform; pick your OS or the Arduino IDE below.

Windows#

1. Press Windows Key + X

2. Press Device Manager to launch Device Manager.

   

3. Scroll down to Ports (COM & LPT) and expand the menu

4. Plug your badge into your computer and turn the badge on.

5. The device tree will refresh and you should see a new device under Ports (COM & LPT). This will be the communication port used to talk to the device.

   

Linux#

This command will list out all active serial devices

ls /dev/tty*

You may need to try a couple to see which one works or you can run this following command to see what each one is

for dev in /dev/ttyUSB*; do sudo udevadm info -q all -n "$dev" | grep -E 'DEVNAME|ID_MODEL'; done

Mac#

This command will list out all active serial devices

ls /dev/cu.*

You may need to try a couple to see which one works or you can run this following command to see what each one is

ls /dev/cu.* | grep -i usb | while read dev; do ioreg -p IOUSB -l -w 0 | grep -A 10 "$dev"; done

Arduino IDE#

1. Install the Arduino IDE
2. 

Dumping Flash#

Understanding the Chip#

To dump the flash we will need to know two things: the port and the size of the flash. To find the size of the flash we can run the following command

python -m esptool --port {COMPORT} flash_id

Sample Output:

C:\Users\NSSte>python -m esptool --port COM16 flash_id
esptool.py v4.8.1
Serial port COM16
Connecting...
Detecting chip type... ESP32-S3
Chip is ESP32-S3 (QFN56) (revision v0.2)
Features: WiFi, BLE
Crystal is 40MHz
MAC: 24:58:7c:f4:8e:30
Uploading stub...
Running stub...
Stub running...
Manufacturer: c8
Device: 4017
Detected flash size: 8MB
Flash type set in eFuse: quad (4 data lines)
Flash voltage set by a strapping pin to 3.3V
Hard resetting via RTS pin...

We see we have 8MB of flash, and we also have the MAC address in case we lose the display

More commands can be found in the docs

Reading the Flash with esptool#

Using another command from the docs called read flash we will now dump out the flash contents

python -m esptool -p {COMPORT} -b 460800 read_flash 0 ALL flash_contents.bin

We now should have an 8MB flash file.

Analyzing Flash Dump#

I will be using esp32 image parser to analyze, instead of esp32knife, because I could not get esp32knife to recognize my dump or get it to dump my firmware.

Installing esp32 image parser#

Download the repo#

git clone https://github.com/tenable/esp32_image_parser

Install Requirements#

python -m pip install -r requirements.txt

Showing the dump partitions#

python esp32_image_parser.py show_partitions badge_flash.bin

Annotated Output#

└─$ python esp32_image_parser.py show_partitions badge_flash.bin
reading partition table...
entry 0:
  label      : nvs       -> Non-volatile Storage
  offset     : 0x9000
  length     : 20480
  type       : 1 [DATA]
  sub type   : 2 [WIFI]

entry 1:
  label      : otadata
  offset     : 0xe000
  length     : 8192
  type       : 1 [DATA]
  sub type   : 0 [OTA]

entry 2:
  label      : app0       -> Core 0 Program
  offset     : 0x10000
  length     : 3342336
  type       : 0 [APP]
  sub type   : 16 [ota_0]

entry 3:
  label      : app1       -> Core 1 Program
  offset     : 0x340000
  length     : 3342336
  type       : 0 [APP]
  sub type   : 17 [ota_1]

entry 4:
  label      : spiffs     -> File Systems
  offset     : 0x670000
  length     : 1572864
  type       : 1 [DATA]
  sub type   : 130 [unknown]

entry 5:
  label      : coredump   -> Crash Dumps
  offset     : 0x7f0000
  length     : 65536
  type       : 1 [DATA]
  sub type   : 3 [unknown]

MD5sum:
467eb896e29d1aa938c557f4cdfc4c5b
Done

Pulling Data Out of the Partitions#

Reading Non-Volatile Storage#

ESP32 Image Parser can dump NVS data

python esp32_image_parser.py show_partitions badge_flash.bin

Truncated Output

└─$ python esp32_image_parser.py dump_nvs badge.bin -partition nvs
Dumping partition 'nvs' to nvs_out.bin
Page 0
  page state : FULL
  page seq no. : 0
  page version : 2
  crc 32 : 3115986308
  page entry state bitmap (decoded) : 222222222222222222222222202222222222222222222222222222222222222222222222222222222222222222222222222222222222202222222222222233
  Entry 0
  Bitmap State : Written
    Written Entry 0
      NS Index : 0
      Type : U8
      Span : 1
      ChunkIndex : 255
      Key : badge_config
      Data (U8) : 1

  Entry 1
  Bitmap State : Written
    Written Entry 1
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 3
      ChunkIndex : 255
      Key : ServerPath
      String :
        Size : 38
        Data : https://wwhf2024.s3.amazonaws.com/v2/

  Entry 4
  Bitmap State : Written
    Written Entry 4
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : FirmwareName
      String :
        Size : 13
        Data : wwhf2024.bin

  Entry 6
  Bitmap State : Written
    Written Entry 6
      NS Index : 1
          NS : badge_config
      Type : I32
      Span : 1
      ChunkIndex : 255
      Key : HardwareType
      Data (I32) : 4

  Entry 7
  Bitmap State : Written
    Written Entry 7
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : SSIDName
      String :
        Size : 12
        Data : WWHF Badges

  Entry 9
  Bitmap State : Written
    Written Entry 9
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : SSIDPassword
      String :
        Size : 18
        Data : 77HackTheEsp3too@

  Entry 11
  Bitmap State : Written
    Written Entry 11
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 3
      ChunkIndex : 255
      Key : MQTTBroker
      String :
        Size : 34
        Data : w6e1deed.ala.us-east-1.emqxsl.com

  Entry 14
  Bitmap State : Written
    Written Entry 14
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : MQTTBroadcast
      String :
        Size : 17
        Data : broadcast/action

  Entry 16
  Bitmap State : Written
    Written Entry 16
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : MQTTEvents
      String :
        Size : 14
        Data : events/device

  Entry 18
  Bitmap State : Written
    Written Entry 18
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : MQTTUsername
      String :
        Size : 7
        Data : badges

  Entry 20
  Bitmap State : Written
    Written Entry 20
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : MQTTPassword
      String :
        Size : 20
        Data : TPY_net1pvg*ywf.cjk

  Entry 22
  Bitmap State : Written
    Written Entry 22
      NS Index : 1
          NS : badge_config
      Type : I32
      Span : 1
      ChunkIndex : 255
      Key : MQTTPort
      Data (I32) : 8883

  Entry 23
  Bitmap State : Written
    Written Entry 23
      NS Index : 1
          NS : badge_config
      Type : STR
      Span : 2
      ChunkIndex : 255
      Key : DeviceName
      String :
        Size : 14
        Data : HaySupernova2

Extracting App0, App1 and Other Partitions#

While not the most needed, it is possible to pull out app0 using this program. This could be used to convert to an ELF, but at this time no program that I know of can convert this without errors.

└─$ python esp32_image_parser.py dump_partition badge_flash.bin -partition app0
Dumping partition 'app0' to app0_out.bin

Reviewing Creds found in NVS#

We see three big systems of interest in NVS

Wifi Creds#

We can pull the SSID and Password

SSID: WWHF Badges
Password: 77HackTheEsp3too@

There is nothing of interest using that as all transmissions are encrypted, but if you are not connected to the official Wi-Fi you can create your own.

AWS Bucket#

We see where the bin files are being stored

https://wwhf2024.s3.amazonaws.com/v2/wwhf2024.bin

and we can guess and see that there is another one at

https://wwhf2024.s3.amazonaws.com/v1/wwhf2024.bin

MQTT#

URL:  w6e1deed.ala.us-east-1.emqxsl.com
Username: badges
Password: TPY_net1pvg*ywf.cjk
MQTT Port: 8883

Subscriptions
	- broadcast/action
	- events/device
	- badges (Do not worry see extra for more info on this one)

Connecting to MQTT#

We can either use an online tool or download a MQTT client application

Online Tool#

I found this site to work the best

This tool only works with WebSockets, so set it to the WebSocket port of 8084. Use the rest of the credentials found in NVS.

Subscribe to the topics listed, or use +/# to subscribe to all. We have to use this as # is not allowed.

MQTT Client App#

I will use MQTT Explorer as the desktop client to see MQTT messages.

Use the settings found in NVS. Set validate certificate to false and encryption (TLS) to true.

Add a subscription to the topics you want. I recommend +/# as it will let you see every message.

2024 Deadwood Flags#

Deadwood Flag 1#

There are two ways to solve this: either by finding the string in the dump or by physically analyzing the badge.

Physical#

1. Begin by powering your badge and then recording the LED sequences flashing on the UFO. (I have a recording here)
2. Transcribe the 8 LEDs to binary strings

01010011
01001001
01000111
01111011
01100011
00110100
01101110
01110100
01011111
01110011
01110100
00110000
01110000
01011111
01110100
01101000
00110011
01011111
01110011
00110001
01100111
01101110
00110100
01101100
01111101

3. Construct a CyberChef recipe: FromBinary_8

Firmware Strings#

I threw the bin file found in the S3 bucket into a disassembler.

IDA Pro

This is probably the best tool to analyze the binary but with the high cost it may be unavailable to most. I searched for { in strings to hunt down the flag.

Ghidra

You will want to set your language to Xtensa Little Endian

It is still hard to pull out the string on this but if you scroll down you will see your string with a message.

Binary Ninja

This is not the best for decompilation, but strings are on point.

Strings

To show all strings

strings firmware.bin

You can filter down on URL

strings wwhf2024.bin | grep "\.com" -A 4

Or even use bulk extractor to get more info out of the binary

Deadwood Flag 2#

This is the serial message that will appear after the ASCII art. It will take a while for it to pop up.

[BADGE] Loading badge config...
[BADGE] Loading bounties...
  - Vendors: 26
  - Staff: 2
  - Tracks: 4
  - Badge: 4
  - SpecialEvents: 4
[BADGE] WWHF Badge v1.26
[BADGE] 24:58:7C:F4:8E:30
[WiFi] Wi-Fi ready
[WiFi] Station mode started
[WiFi] Sta[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station disconnected from AP
[WiFi] Station connected to AP
[WiFi] Station got IP address
[WiFi] Registering device with API server
[BADGE] Writing badge config...
[BADGE] Boounties: Staff 2 | Event 4 | Track 4 | Vendor 26 | Badge 4
[BADGE] Writing bounty tracker...
[WiFi] Registration success
[MQTT] Connecting to MQTT Broker as WrangleCelestial3...
[MQTT] Connected to MQTT broker
[MQTT] Subscribed to broadcast messages
[MQTT] Published registration messages
[BADGE] Added Voltage to index 28: 3.90 volts (59%) [Avg: 3.86 volts (52%)]
[BADGE] Added Voltage to index 29: 3.90 volts (61%) [Avg: 3.86 volts (52%)]
[BADGE] Added Voltage to index 30: 3.90 volts (59%) [Avg: 3.86 volts (52%)]
                           _╓▄▓▓▓╬╩^``▒_,░µ_ _
                         ,▓▓╬╢╩`╓Ü@D╚╩``╙╙╩Ü=_-╔___
                       ╓▓▓█╬╬Ü#R`Ü `         '|»░`░_
                      ║▓█▓╬▒░░Ü ````           `╙\²
                      ▓█▓█▓╬Ü`                   '
                     ▓█▓███╬Ü
                    ▐█▓▓██╬╩H
                    ║█▓██▓╬_
                    '▓▓▓██▓▒╓_   '    ___
                     █▓▓██╩▀▀▓▄▓_   _______
                     ▀║▓██▓▓Ö╠╬█▌,,`╠╠╩▓DHφ_  __,,,╔▄
                   '▀%╣▓█╣╠╬▒╠█▓  \_ ╠==      `      j
                    ' ║██▓╬▒╣███       ``    ,
                     ║▓▓╬╣╫╫▓██▒    `ⁿq∩
                     ╠▓█╣╬║▓███▓_   _  '_
                     ║▓▓█▓▓██████▒_
                     ╠▓█████▌╬▒╬Ü▒__╓_,_
                    |║▓█▓██╬███╬▀╙^`````╚▒
                     [╣█▓█╬╣▓█▒▒∩▒__
                     ╙╠▓▓╬╬╣██╣▒_╙`                     .╓╖__
                    ⁿ^╠║╬╠╬╩║╝Ñ╬▒__                      ╣▓▓███▓▄╖,_
                     |▒╩╣╬]╠ÜÜ╠╬╬R@╓╦∩                ,▓█████▓█▓▓▓▓▓██▓▄,
                     `╔╬╬╣▒╩▒▒∩Ü╠Ü║▒¼               _╣▓████▓█▓▓███▓▓▓▓▓▓▓██▄,
                     ,▄╣╬╬Ñ╬▒╬╬╩ÜÜ╩╩                ╔▓▓█▓▓▓▓▓▓▓█▓█▓█▓██▓▓▓▓▓▓██▄
                _╓▄██▓╬╬╠▒^ÜÅ╚╙▒[ÜÄ               ,╔▓█▓█▓▓▓▓▓▓█▓▓▓███▓█▓▓▓▓▓▓▓▓▓
             ,▄███████╬╬╬░Ü╙²-   ╠_  ,          ▄▄▓▓█▓██▓▓▓█▓▓▓▓▓▓██▓▓██▓▓█▓▓▓▓▓
           ▄████████████▓▒^▒UÜ _jÜ`=_        µ▓▓█▓█████▓█▓▓█▓▓▓▓██▓██▓█▓█▓▓▓▓▓█▓
         ╔█████████████████▓▓@▄▒╔╠╗▄,_╓-__╒,╦╬█████████████▓▓▓▓▓█▓▓▓▓█▓▓▓▓▓▓███▓
        ╔██████████████████████████████▓██▓▓████████▓████▓▓▓█▓██▓█▓▓██▓█▓▓█▓█▓██

        I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdHJpbmcuaD4KI2luY2x1ZGUgPHN0ZGxpYi5oPgoKdm9pZCByKGNoYXIgKnMsIGludCBzaGlmdCkgewogICAgZm9yIChpbnQgaSA9IDA7IHNbaV07IGkrKykgewogICAgICAgIGlmIChzW2ldID49ICdBJyAmJiBzW2ldIDw9ICdaJykgc1tpXSA9ICgoc1tpXSAtICdBJyArIHNoaWZ0KSAlIDI2KSArICdBJzsKICAgICAgICBlbHNlIGlmIChzW2ldID49ICdhJyAmJiBzW2ldIDw9ICd6Jykgc1tpXSA9ICgoc1tpXSAtICdhJyArIHNoaWZ0KSAlIDI2KSArICdhJzsKICAgIH0KfQoKaW50IG1haW4oaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkgewogICAgaWYgKGFyZ2MgIT0gMikgcmV0dXJuIDE7CiAgICBpbnQgc2hpZnQgPSBhdG9pKGFyZ3ZbMV0pOwogICAgY2hhciBmW10gPSAiRlZUe3JMcl90MF8zaTNlbGp1M2UzfSI7CiAgICByKGYsIHNoaWZ0KTsKICAgIHByaW50ZigiJXNcbiIsIGYpOwogICAgcmV0dXJuIDA7Cn0K
[BADGE] Added Voltage to index 31: 3.93 volts (65%) [Avg: 3.86 volts (53%)]

Extraction of string#

Extracting the base64 leaves us with

I2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxzdHJpbmcuaD4KI2luY2x1ZGUgPHN0ZGxpYi5oPgoKdm9pZCByKGNoYXIgKnMsIGludCBzaGlmdCkgewogICAgZm9yIChpbnQgaSA9IDA7IHNbaV07IGkrKykgewogICAgICAgIGlmIChzW2ldID49ICdBJyAmJiBzW2ldIDw9ICdaJykgc1tpXSA9ICgoc1tpXSAtICdBJyArIHNoaWZ0KSAlIDI2KSArICdBJzsKICAgICAgICBlbHNlIGlmIChzW2ldID49ICdhJyAmJiBzW2ldIDw9ICd6Jykgc1tpXSA9ICgoc1tpXSAtICdhJyArIHNoaWZ0KSAlIDI2KSArICdhJzsKICAgIH0KfQoKaW50IG1haW4oaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkgewogICAgaWYgKGFyZ2MgIT0gMikgcmV0dXJuIDE7CiAgICBpbnQgc2hpZnQgPSBhdG9pKGFyZ3ZbMV0pOwogICAgY2hhciBmW10gPSAiRlZUe3JMcl90MF8zaTNlbGp1M2UzfSI7CiAgICByKGYsIHNoaWZ0KTsKICAgIHByaW50ZigiJXNcbiIsIGYpOwogICAgcmV0dXJuIDA7Cn0K

which run through From Base64 in CyberChef gives us

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

void r(char *s, int shift) {
    for (int i = 0; s[i]; i++) {
        if (s[i] >= 'A' && s[i] <= 'Z') s[i] = ((s[i] - 'A' + shift) % 26) + 'A';
        else if (s[i] >= 'a' && s[i] <= 'z') s[i] = ((s[i] - 'a' + shift) % 26) + 'a';
    }
}

int main(int argc, char *argv[]) {
    if (argc != 2) return 1;
    int shift = atoi(argv[1]);
    char f[] = "FVT{rLr_t0_3i3elju3e3}";
    r(f, shift);
    printf("%s\n", f);
    return 0;
}

This appears to be a simple Caesar cipher. Using the CyberChef ROT13 brute force we can see an option that makes sense.

Amount =  1: GWU{sMs_u0_3j3fmkv3f3}
Amount =  2: HXV{tNt_v0_3k3gnlw3g3}
Amount =  3: IYW{uOu_w0_3l3homx3h3}
Amount =  4: JZX{vPv_x0_3m3ipny3i3}
Amount =  5: KAY{wQw_y0_3n3jqoz3j3}
Amount =  6: LBZ{xRx_z0_3o3krpa3k3}
Amount =  7: MCA{ySy_a0_3p3lsqb3l3}
Amount =  8: NDB{zTz_b0_3q3mtrc3m3}
Amount =  9: OEC{aUa_c0_3r3nusd3n3}
Amount = 10: PFD{bVb_d0_3s3ovte3o3}
Amount = 11: QGE{cWc_e0_3t3pwuf3p3}
Amount = 12: RHF{dXd_f0_3u3qxvg3q3}
Amount = 13: SIG{eYe_g0_3v3rywh3r3}
Amount = 14: TJH{fZf_h0_3w3szxi3s3}
Amount = 15: UKI{gAg_i0_3x3tayj3t3}
Amount = 16: VLJ{hBh_j0_3y3ubzk3u3}
Amount = 17: WMK{iCi_k0_3z3vcal3v3}
Amount = 18: XNL{jDj_l0_3a3wdbm3w3}
Amount = 19: YOM{kEk_m0_3b3xecn3x3}
Amount = 20: ZPN{lFl_n0_3c3yfdo3y3}
Amount = 21: AQO{mGm_o0_3d3zgep3z3}
Amount = 22: BRP{nHn_p0_3e3ahfq3a3}
Amount = 23: CSQ{oIo_q0_3f3bigr3b3}
Amount = 24: DTR{pJp_r0_3g3cjhs3c3}
Amount = 25: EUS{qKq_s0_3h3dkit3d3}

SIG{eYe_g0_3v3rywh3r3}

Alternate Method#

We can also find this large block of text through strings. Then follow similar methods to above.

strings wwhf2024.bin | awk 'length($0) > 200' | base64 -d

Deadwood Flag 3#

The LED in the bottom right will sometimes burst in a weird pattern. Setting up a YouTube live stream to catch this we can create a video.

Decoding leaves us with

.... .- -.-. -.- - .... . ... .. --. -. .- .-.. ...

Putting this into English gives us

hackthesignals

Deadwood Flag 4#

This one is very tricky but is the decryption of the mystery signal. If you monitored MQTT long enough you might have seen a mystery signal event pop up. In the data field is an encrypted blob that contains the flag.

{
  "broadcast_event": 12,
  "data": "WfFIAmqjR7RjIJ8fsPdkeUKIUxqrkeZSk9G2+rUKtVv5H1XOmrEWpZjyRUtZVL2AXp4yRFwLkc4C9MgnBwarOA==",
  "date": "10/09/24",
  "time": "05:51PM UTC",
  "message": "Mystery Signal"
}

We know that the badge can decrypt the message so we need some way to send it a message so the decryption key can be in memory. We made the badge get extra points by sending it a scan message. (see Extra for how this was done)

When we are ready to download memory we do

python -m esptool dump_mem 0x40380000 393216 out.bin

We choose this memory section based on the ESP32 docs. (S3 mem sections from @precurse)

To extract all AES keys that are the size we are looking for

strings out.bin | awk 'length($0) == 16'

Using the key to decrypt we get the message. CyberChef

2025 Mile High Flags#

Mile High Flag 1#

1. Turn on the badge and record the light flashes (video uploaded here)
2. Transcribe the 8 LEDs to binary strings

01010111
01000111
01001110
01111011
01110111
00110100
01101110
01110100
00110011
01100100
01011111
01100100
00110011
00110100
01100100
01011111
00110000
01110010
01011111
00110100
01101100
00110001
01110110
00110011

3. CyberChef Decode (LINK)

Mile High Flag 2#

This is the serial message that will appear after the ASCII art. It will take a while for it to pop up.

                           _╓▄▓▓▓╬╩^``▒_,░µ_ _
                         ,▓▓╬╢╩`╓Ü@D╚╩``╙╙╩Ü=_-╔___
                       ╓▓▓█╬╬Ü#R`Ü `         '|»░`░_
                      ║▓█▓╬▒░░Ü ````           `╙\²
                      ▓█▓█▓╬Ü`                   '
                     ▓█▓███╬Ü
                    ▐█▓▓██╬╩H
                    ║█▓██▓╬_
                    '▓▓▓██▓▒╓_   '    ___
                     █▓▓██╩▀▀▓▄▓_   _______
                     ▀║▓██▓▓Ö╠╬█▌,,`╠╠╩▓DHφ_  __,,,╔▄
                   '▀%╣▓█╣╠╬▒╠█▓  \_ ╠==      `      j
                    ' ║██▓╬▒╣███       ``    ,
                     ║▓▓╬╣╫╫▓██▒    `ⁿq∩
                     ╠▓█╣╬║▓███▓_   _  '_
                     ║▓▓█▓▓██████▒_
                     ╠▓█████▌╬▒╬Ü▒__╓_,_
                    |║▓█▓██╬███╬▀╙^`````╚▒
                     [╣█▓█╬╣▓█▒▒∩▒__
                     ╙╠▓▓╬╬╣██╣▒_╙`                     .╓╖__
                    ⁿ^╠║╬╠╬╩║╝Ñ╬▒__                      ╣▓▓███▓▄╖,_
                     |▒╩╣╬]╠ÜÜ╠╬╬R@╓╦∩                ,▓█████▓█▓▓▓▓▓██▓▄,
                     `╔╬╬╣▒╩▒▒∩Ü╠Ü║▒¼               _╣▓████▓█▓▓███▓▓▓▓▓▓▓██▄,
                     ,▄╣╬╬Ñ╬▒╬╬╩ÜÜ╩╩                ╔▓▓█▓▓▓▓▓▓▓█▓█▓█▓██▓▓▓▓▓▓██▄
                _╓▄██▓╬╬╠▒^ÜÅ╚╙▒[ÜÄ               ,╔▓█▓█▓▓▓▓▓▓█▓▓▓███▓█▓▓▓▓▓▓▓▓▓
             ,▄███████╬╬╬░Ü╙²-   ╠_  ,          ▄▄▓▓█▓██▓▓▓█▓▓▓▓▓▓██▓▓██▓▓█▓▓▓▓▓
           ▄████████████▓▒^▒UÜ _jÜ`=_        µ▓▓█▓█████▓█▓▓█▓▓▓▓██▓██▓█▓█▓▓▓▓▓█▓
         ╔█████████████████▓▓@▄▒╔╠╗▄,_╓-__╒,╦╬█████████████▓▓▓▓▓█▓▓▓▓█▓▓▓▓▓▓███▓
        ╔██████████████████████████████▓██▓▓████████▓████▓▓▓█▓██▓█▓▓██▓█▓▓█▓█▓██
        JVNJAAADAAAAABAAAAAP77YAAC4AAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAOD65A4AFUBHGSDOABJTGSCVDINFZSA4DSN5TXEYLNEBRWC3TON52CAYTFEBZHK3RANFXCARCPKMQG233EMUXA2DIKEQAAAAAAAAAAAUCFAAAEYAIDABZYFCHUAAAAAAAAAAAABYAAEIAAWAJQAAAAQAAAAAEAAAAAAAAABKRHAAAAAIAAAAAEAAAAAAAEAAAAEAAAAAACAAAAIAAAAAAAAAAAAQAAAAAAAAAAAAEAAAAAAAQAAAAAAAAAAMAGBBIAAAIAAAAQAAAAAAAQAAABAAAAAAAAAAAQAAAAAAAAAAAAAAAAABMCOAAAJ4AAAAAAIAAAAKAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAYAAAACECMAAAKQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAACAAAAAAAAAAAAAAAAAABAQAAACIAAAAAAAAAAAAAAAAAAXHIZLYOQAAAAFQA4AAAABAAAAAACAAAAAAEAAAAAAAAAAAAAAAAAAAAAACAAAAMAXHE43SMMAAAABIAUAAAACAAAAAABQAAAAAUAAAAAAAAAAAAAAAAAAAAAAEAAAAIAXHEZLMN5RQAAAMAAAAAADAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAAAAAEAAAAIIAAAAAAAAAAAAAAAAAAAAAAAAAIYJYAAAAAAAAAJAAAAAACAACQBPBAAAAMYBIAAAAQAAAAAIAAABQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGMAEABEAAAAAAEAAAEIAPYAQAAAEN4HAAAAKRUIQAAABBILAWKYXAADAO7QBAAAAIB3PB4AAACQ5MHIZ2AAHC5MAWB36AEAAABDPBYAAACX6AQGAQLOYAZZRAAAABIGSWAAJFIFAAKRCAIUBCAAABIACULTSAEAAA4EAAEAAABBKIJJUUQQBAAAQAAAAAAAAYAAAAB3DILRQFYZTAMZRHEAAAAAAAUAGYAAAADWACAAAEN7AAACYAIAAAQACAAACGU3UOJUW4Z3TAAAAAAEYAQAAALAAAAACGVKTADCAIAAACAAAAABDI5KUSRAAAAANIBAAAD4AAAAAENBGY33CAAAAAAAAAAAAEAAAAFLRIAQABEAAAAAA7IATGAAWAAAACAAAAAIQAAAAAIAAAAABAAAAABAAAAABCAAAAAGQAAAAAEAAAAABAAAAAAIAAAAAAAFJAEAQAAAAAAAAMAHOAD7ACBQALEA74AIGAAPAB2YBB4AB4AQAAADAAWYAO4AQMACAAHDQCBQAW4AMOAIGAB2ABRYBAYAJCAGHAEDAADQBY4AQMACEADDQCBQA2YAP4AIGAATQD7QBAYADEAH6AEDAANYCXMAQMAERAG5QCBQA3EA3WAIAAAAAAAIAAAAAAAABAAAQAAAACAALGAIAAA6QAAIAAEABCAAKAA5AAUBAAAAAAAERACRQCPIAAEAKIIAAAAAABEIAYIAUCAABACTSAAAAAAAIMGG6AEDAAAIAWAQAAAAAACIRRZABIEAACAAJADPACAIACEAN4AIGAAMQBXQBBIACSAG6AEIAAMIA3YARAABZADPACEAAIEAN4AIQABEQBXQBCAAFCAG6AEIAAWIA3YARAADBADPACAIANEAN4AIVABYQBXQBCUAICAEYAERABAIAFUBCMAEBADPACKYAPEAN4AIGAATQAWYA5YAC4AALABCQALQACMAE4ABOAANQA3IAFYACGADWAAXAAKYAWQAC4ABTAC7QALQAHMAMUABOABBQBVYAFYAEWAFUAAXAAUYAWQAEGADDADRAAQYANMAOQAA2AACIAAAAAEAAAAAAAAAAAAAAAAAAAAFDAEAAACIAAAAAAAAAAAAAAAAAGEAA6AAAAAAAAAAAAA6E233EOVWGKPQAMRQXIYIAKN4XG5DFNUXFE5LOORUW2ZIAIRSWE5LHM5QWE3DFIF2HI4TJMJ2XIZIAJZ2WY3DBMJWGKQLUORZGSYTVORSQAQLTONSW2YTMPFKGS5DMMVAXI5DSNFRHK5DFABKGC4THMV2EM4TBNVSXO33SNNAXI5DSNFRHK5DFABAXG43FNVRGY6KGNFWGKVTFOJZWS33OIF2HI4TJMJ2XIZIAIFZXGZLNMJWHSSLOMZXXE3LBORUW63TBNRLGK4TTNFXW4QLUORZGSYTVORSQAQLTONSW2YTMPFBW63TGNFTXK4TBORUW63SBOR2HE2LCOV2GKACSMVTFGYLGMV2HSUTVNRSXGQLUORZGSYTVORSQAQ3PNVYGS3DBORUW63SSMVWGC6DBORUW63TTIF2HI4TJMJ2XIZIAIFZXGZLNMJWHSUDSN5SHKY3UIF2HI4TJMJ2XIZIAJZ2WY3DBMJWGKQ3PNZ2GK6DUIF2HI4TJMJ2XIZIAIFZXGZLNMJWHSQ3PNVYGC3TZIF2HI4TJMJ2XIZIAKJ2W45DJNVSUG33NOBQXI2LCNFWGS5DZIF2HI4TJMJ2XIZIAKN4XG5DFNUXFE5LOORUW2ZJOKZSXE43JN5XGS3THABJXI4TJNZTQAZ3FORPUYZLOM52GQACUOJQWS3AAKRZGC2LMFZSGY3AAKBZG6Z3SMFWQAU3ZON2GK3IAJVQWS3QAKN4XG5DFNUXFEZLGNRSWG5DJN5XAAQ3IMFZAALTDORXXEABOMNRXI33SABJXS43UMVWS4RDJMFTW433TORUWG4YAKN4XG5DFNUXFE5LOORUW2ZJOINXW24DJNRSXEU3FOJ3GSY3FOMAEIZLCOVTWO2LOM5GW6ZDFOMAGOZLUL5BWQYLSOMAE6YTKMVRXIAAAAAACSUAAIAAESAD4ABQAANYANMAGGACYAB2QA4QAGIAG6ACYABQQANAAOEADIADVAB5AAAAAJS4BZ2CCTJQUTKJVWCEJLULXNEAAIIABAEEAGIAAAECSAAIBCEIQIIABAEHAIIABAECQOBYEDUBQQAQOAMQAACAEEAAQGCAFEAAQCHIDBCYD6X37CHKQUOQCAYHAGAAABYBQAAABBAAQACAAAAAAAAA6AEAACACUAILFO4TBOBHG63SFPBRWK4DUNFXW4VDIOJXXO4YBBAAQABYBAAAAAAB5AEABQLSOIVKEG33SMVAXA4BMKZSXE43JN5XD25RZFYYACACUBYKEM4TBNVSXO33SNNCGS43QNRQXSTTBNVSQQLSOIVKCAOJOGAFACAAFKRZGC2LMAAAAUAIAAVCGKYTVM4AAADABAADTCLRQFYYC4MAAAAFACAAFGEXDALRQAAAAKAIAAEAAABIBAAAAAAAIAEAAWAAAAAAAAAAAAAAABK74USRQAAKNKABAAAAAKUAAAAG4EYAABXAIAAAAAAAAAAAAAAAAAEAAAAATAAAAAJYAAAADCJYAAAYQSAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAUSTIRJR2K22BJA324CCRU4SZVEQ6NY7YAIAAAAEGOS4KVZWK4TTLRGWS23FEBDGK3DDNBOEIZLTNN2G64C4KRZGC2LMLRXWE2S4IRSWE5LHLRXGK5BZFYYFYVDSMFUWYLTQMRRAAU2IIEZDKNQADUVVUCSBXVYEEDJZFTKJB43R7SV7ZJBDEP2X432CDQOMMKOWDYEIAJYAAAAAAAAAAAAAAAE2E4AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIYJYAAAAAAAAAAAAAAAAAABPUG33SIV4GKTLBNFXAA3LTMNXXEZLFFZSGY3AAAAAAAAH7EUACAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAIAAAAAEAAABAAYAAAAAUAAACAAAAAAAAAAAAAAAAAAAAAAAAAQAAIAAAADQAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAQAAAANAAABAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAABIAMAABECAAAAJQAQAAAAAAAAAAAAAAAEYAI2AAAAAKYAFGAC7ABLAARIAKIAFGACJABHQATQAL4AESACOABDAATYAAAAAAAF5ATX74AAAAEAAAAABAAAAAAAAAAAACAAAAAAAAPYAAAAAAAAAAACAAAAAAEAAAAAAAAAAAAAAAAAAAAAAABCAAAAAAEAFMADBABZAARQANEAGYADFABEQA3QAMYAG6AAAAAAAAJAAAQAAAACUABZAAYIANYAHGADMABQQA5AANEAG6ADOAAAAAAAAAAALABHYAEAAAAIAKMAHIADSABUQA3QAM4AEMADJABWAAZIAJEAG4ADGABXQAAAA2QAQAAABAAYAAMAAGAADAABQAA2AAYQAGAAAAABMAADAAAIAIMAG6ADNABYAAYIANYAHSACOABQQA3IAMUAAAAAAABKAA4QAMEAGSADMAAAAANAAAYAACACGABUQA3AAMUAEIADFABZQAYYAOIAGSADQAB2AA2IAN4AG4AAAAAAAAVAAOIAGCADJABWAAAAAGAAAQAABABDAA2IANQAGKACWABSQA4QAOMAGSADPABXAAAAAAAADCABOAAYAALQAGAAC4ABQAAAAANAABIAACACJABXAA5AAMUAHEADOABQQA3AAJYAGCADNABSQAAAAKQAHEADBABUQA3AAFYAGIADMABWAAAAAFAAAEAABABGAAZIAM4AGCADMABBQA3YAOAAHSADSABUQAZYANAAHIAAAAAQAAAAAHQAAUAABABHQA4QANEAGOADJABXAAYIANQAEMADJABWAAZIANYAGCADNABSQAAAAKQAHEADBABUQA3AAFYAGIADMABWAAAAAFQAAMAABABIAA4QAN4AGIADVABRQA5AAJYAGCADNABSQAAAAAAAFIADSABQQA2IANQAAAABQAADAAAIAKAAHEADPABSAA5IAMMAHIACWABSQA4QAOMAGSADPABXAAAAAGEAC4ABQAAXAAMAAAAADQAAIAAAQAQIAOMAHGADFABWQAYQANQAHSABAABLAAZIAOIAHGADJABXQA3QAAAADCABOAAYAALQAGAAC4ABQAAAAAOCDAAAOUAIAAAAAAAAAAAAAAAHPXO7TYP3YNVWCA5TFOJZWS33OHURDCLRQEIQGK3TDN5SGS3THHURFKVCGFU4CEIDTORQW4ZDBNRXW4ZJ5EJ4WK4ZCH47A2CQNBI6GC43TMVWWE3DZEB4G23DOOM6SE5LSNY5HGY3IMVWWC4ZNNVUWG4TPONXWM5BNMNXW2OTBONWS45RREIQG2YLONFTGK43UKZSXE43JN5XD2IRRFYYCEPQNBIQCAPDBONZWK3LCNR4USZDFNZ2GS5DZEB3GK4TTNFXW4PJCGEXDALRQFYYCEIDOMFWWKPJCJV4UC4DQNRUWGYLUNFXW4LTBOBYCELZ6BUFCAIB4ORZHK43UJFXGM3ZAPBWWY3TTHURHK4TOHJZWG2DFNVQXGLLNNFRXE33TN5THILLDN5WTUYLTNUXHMMRCHYGQUIBAEAQDY43FMN2XE2LUPE7A2CRAEAQCAIBAHRZGK4LVMVZXIZLEKBZGS5TJNRSWOZLTEB4G23DOOM6SE5LSNY5HGY3IMVWWC4ZNNVUWG4TPONXWM5BNMNXW2OTBONWS45RTEI7A2CRAEAQCAIBAEAQDY4TFOF2WK43UMVSEK6DFMN2XI2LPNZGGK5TFNQQGYZLWMVWD2ITBONEW45TPNNSXEIRAOVUUCY3DMVZXGPJCMZQWY43FEIXT4DIKEAQCAIBAEA6C64TFOF2WK43UMVSFA4TJOZUWYZLHMVZT4DIKEAQCAIB4F5ZWKY3VOJUXI6J6BUFCAIB4F52HE5LTOREW4ZTPHYGQUPBPMFZXGZLNMJWHSPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABQAAAAFMG4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA===

Convert message#

Using CyberChef with Magic we can see that this is an exe and download it.

Seeing some of the strings output led me to believe that it is a C# application. We could verify that with Detect It Easy, but dotPeek can quickly tell us also.

dotPeek#

I used dotPeek to analyze the binary, but ILSpy and dnSpy (my favorite) work just as well.

// Decompiled with JetBrains decompiler
// Type: Program
// Assembly: Trail, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: E81CB84C-9A42-4961-A935-B08895D17769
// Assembly location: C:\Users\NSSte\Downloads\download.exe

#nullable enable
internal class Program
{
  private static string data = "P@I|`7kcXur2oXa4q4uz";

  private static string Trail()
  {
    char[] chArray = new char[Program.data.Length];
    for (int index = 0; index < Program.data.Length; ++index)
      chArray[index] = (char) ((uint) Program.data[index] ^ 7U);
    return new string(chArray);
  }

  private static void Main()
  {
  }
}

Script to undo#

def decrypt(data: str) -> str:
    return ''.join(chr(ord(c) ^ 7) for c in data)

encrypted_data = "P@I|`7kcXur2oXa4q4uz"
decrypted_text = decrypt(encrypted_data)

print(f"Decrypted text: {decrypted_text}")

Mile High Flag 3#

There is a mysterious signal message sent in MQTT

{
  "broadcast_event": 12,
  "data": "tnNHCuwT/ixFcK9BIcyufJDohSTwxb76IoU+SJXdwO8SI63YopxMUcU2Vu5/JnpY",
  "date": "02/04/25",
  "time": "02:36AM UTC",
  "message": "Mystery Signal"
}

I am thinking that the badge must be able to decode the data. So to send my badge this data I edit the NVS data on my badge to point to my own MQTT server. (see Editing NVS Data in Extra) Then I run the following command to dump most of memory.

python -m esptool dump_mem 0x40380000 393216 out.bin

We choose this memory section based on the ESP32 docs. (S3 mem sections from @precurse) (After further reading of docs we miss some of the upper parts but as this command works I am not going to deal with the headaches and change it)

Running strings on the binary file yields no useful results so instead I run stringsSquared (a tool I made for this, see Extra)

python stringsSquared.py out.bin | grep WGN{

Which outputs the flag

Decode: WGN{h1gh_n00n_sh0wd0wn}

Mile High Flag 4#

The LED in the bottom right can randomly flash.

https://youtube.com/shorts/ijG1FVzJa5s

The hardest part with this is seeing how many colors there are. It turns out there are only 4 (blue, red, green and cyan); the others are just the LED transitioning.

In our reading, the colors (red, blue, cyan) are “carriers” of the dot/dash information while green isn’t part of the signal at all – it is used as a separator. Moreover, when a letter is repeated three times (e.g. “RRR”, “CCC”, “BBB”) that indicates a long pulse (a “dash”), while a lone letter (e.g. “R”, “B”, “C”) is a short pulse (a “dot”). Finally, a single green “G” between pulses means “don’t break the letter” while a triple green “GGG” marks the end of a letter.

Let’s illustrate this with the data you provided. (We ignore the “///” header.)

Step 1. Separate out pulses from the green separators

The non‐green lines (the pulses) are interleaved with green lines. The single “G” lines mark a pause between pulses within one Morse–encoded letter, while a “GGG” signals that one letter is finished. (That is why sometimes you see a “GGG” on its own.)

For example, the very first part is:

RRR G R G C G R GGG

Here the pulses are:

• RRR – a long red pulse (→ “dash”)
• R – a short red pulse (→ “dot”)
• C – a short cyan pulse (→ “dot”)
• R – a short red pulse (→ “dot”)

So the first Morse symbol is: dash dot dot dot

Step 2. Interpret the dot/dash pulses as Morse code

Recall that in Morse code, dash dot dot dot is the letter B.

Now let’s briefly go through all the groups (each group being the pulses between “GGG” separators):

Step 3. Put it all together

Reading the letters in order gives:

B L A Z E T H E T R A I L

Mile High Flag 5+#

The images on the site have some interesting metadata.

https://www.aperisolve.com/d053eca26e2ceded99a82cdc14a707ed

This gives us how the messages will be organized.

Downloading all the images to a folder on my computer, I then run

strings * | awk 'length($0) > 30'

The output message is then the flag you put in.

Charger Fix#

The TP4056 chip has a trace issue on the PCB. This can be solved by soldering a wire from pin 4 to 8. This just jumps the 5v to the chip enable pin telling the chip to work.

Image (do not roast the solder job, it was rushed at the conference with an iron that complains too much):

Other Random Things About This Badge#

The eyes are IR LEDs and don't seem to do anything interesting.

My flash dump: https://bucket.ics.red/flash_contents_noscreen.bin

Further Reading#

TCM Certification (Affiliate Link)#

TCM Security IoT Hacking Course

https://certifications.tcm-sec.com/pipa/?ref=162

Matt Brown YouTube#

Channel: https://www.youtube.com/@mattbrwn

Discord: https://discord.com/invite/GjVxUnrQKC

Antisyphon IoT Hacking Class#

https://www.antisyphontraining.com/course/intro-to-iot-hacking-with-rick-wisser-and-dave-fletcher/

Custom Firmware#

https://github.com/Cooperw/ww-pirate-badge-fw

This can be used to add custom LED flash sequences to your badge.

Adding a Reset#

If you can talk to the board you might need to hit the reset "button". You need to bridge these two pins (top and bottom). I just soldered a wire.

Extra#

How the scanners report a scan#

You might notice some activity on MQTT when you scan your badge but this is not how the server determines if a scan takes place. It uses an HTTP POST request to /bounties.

It can be represented as

import requests

url = "https://hardwarelabs.io/bounties"

payload = "{\r\n    \"mac_address\": \"30:30:F9:7B:90:AC\",\r\n    \"rfid\": \"f4bfd940\"\r\n}"
headers = {}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

or

where rfid is the lowercase UID. We discovered the format through the serial messages produced by the badge reader.

Badge reader serial:

[BADGE] Loading badge config...
[BADGE] Loading bounties...
[BADGE] WWHF Badge v1.27
[BADGE] EC:DA:3B:5E:12:78
[WiFi] Wi-Fi ready
[WiFi] Station mode started
[BOUNTY] Mounted bounty cache filesystem
[WiFi] Station connected to AP
[RFID] Bounty Captured: f4bfd940

From here I wrote a script to brute force all the OUIs we saw on the network to try to hunt down the last event 5 scanner (We later found out this doesn't exist)

Scanner Brute Force#

import aiohttp
import asyncio
import json
import itertools
from tqdm import tqdm

url = "https://hardwarelabs.io/bounties"

# OUI of the scanners
ouis = ["34:B7:DA:5E","34:B7:DA:5F","34:B7:DA:5D"]

mac_suffix_range = range(0x00, 0xFF + 1)  # This will range from 00 to FF (0-255 in hex)

headers = {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer <your-api-token>'
}
rfid = "f4bfd940"

# Limit the number of concurrent requests
MAX_CONCURRENT_REQUESTS = 1000

async def send_request(session, mac_address):
    payload = json.dumps({
        "mac_address": mac_address,
        "rfid": rfid
    })

    async with session.post(url, headers=headers, data=payload) as response:
       # print(await response.text())
        #print(response.status)
        if response.status == 201:  # Only print if the status is 201
            response_text = await response.text()
            print(f"Testing MAC: {mac_address} -> Response: {response_text}")
            return True  # Indicating success
        return False  # Indicating failure

async def brute_force_mac_addresses():
    total_mac_addresses = len(ouis) * (0xFF + 1) * (0xFF + 1)
    progress = tqdm(total=total_mac_addresses, desc="Brute-forcing MAC addresses", unit="request")

    # Set up the aiohttp session
    async with aiohttp.ClientSession() as session:
        tasks = []
        for oui in ouis:
            for suffix1, suffix2 in itertools.product(mac_suffix_range, repeat=2):
                mac_address = f"{oui}:{suffix1:02X}:{suffix2:02X}"
                print(mac_address)

                # Create the task for each request
                task = asyncio.ensure_future(send_request(session, mac_address))
                tasks.append(task)

                # Send a batch of requests
                if len(tasks) >= MAX_CONCURRENT_REQUESTS:
                    results = await asyncio.gather(*tasks)
                    tasks = []  # Reset the task list
                    progress.update(MAX_CONCURRENT_REQUESTS)

        # Await any remaining tasks
        if tasks:
            await asyncio.gather(*tasks)
            progress.update(len(tasks))

    progress.close()  # Close the progress bar when done

if __name__ == "__main__":
    asyncio.run(brute_force_mac_addresses())

All scans solver#

This code is from @CW0 and his repo

# claim_bounties.py :: GPT-4o

# usage: python claim_bounties.py 7bdfd941

import requests
import sys
import argparse
import time
import os

'''
export API_BEARER_TOKEN="<your-api-token>"

7bdfd940 shiloh
f4b4d940 logix
7159d940 vort
fcb9d940 alex
a3c9d940 rsulliva
57b4d940 netwarsninja66
'''

def main():
    # Define the list of MAC addresses
    mac_addresses = [
        "EC:DA:3B:5D:D0:7C",
        "EC:DA:3B:5E:0C:24",
        "EC:DA:3B:5E:0C:34",
        "EC:DA:3B:5E:0C:88",
        "EC:DA:3B:5E:11:D8",
        "EC:DA:3B:5E:11:E8",
        "EC:DA:3B:5E:11:F0",
        "EC:DA:3B:5E:11:F4",
        "EC:DA:3B:5E:12:30",
        "EC:DA:3B:5E:12:34",
        "EC:DA:3B:5E:12:78",
        "EC:DA:3B:5E:12:8C",
        "EC:DA:3B:5E:12:90",
        "EC:DA:3B:5E:12:A8",
        "EC:DA:3B:5E:16:D0",
        "EC:DA:3B:5E:16:F0",
        "EC:DA:3B:5E:1F:80",
        "EC:DA:3B:5E:1F:C8",
        "EC:DA:3B:5E:48:30",
        "EC:DA:3B:5E:53:F8",
        "EC:DA:3B:5E:6D:48",
        "EC:DA:3B:5E:6D:54",
        "EC:DA:3B:5E:6D:5C",
        "EC:DA:3B:5E:6D:68",
        "EC:DA:3B:5E:6D:70",
        "EC:DA:3B:5E:6D:80",
        "EC:DA:3B:5F:5B:50",
        "EC:DA:3B:5F:FD:90",
        "EC:DA:3B:5F:FD:94",
        "EC:DA:3B:5F:FD:AC",
        "EC:DA:3B:5F:FD:B4",
        "EC:DA:3B:5F:FD:C0",
        "EC:DA:3B:5F:FD:C4",
        "EC:DA:3B:5E:17:30" # unlisted
    ]

    # Set up command-line argument parsing
    parser = argparse.ArgumentParser(description='Send POST requests to hardwarelabs.io/bounties.')
    parser.add_argument('rfid', type=str, help='RFID value to include in the POST request.')
    args = parser.parse_args()

    rfid = args.rfid

    endpoint = "https://hardwarelabs.io/bounties"

    # Retrieve the Bearer Token from environment variables
    bearer_token = os.getenv('API_BEARER_TOKEN')
    if not bearer_token:
        print("Error: API_BEARER_TOKEN environment variable not set.")
        sys.exit(1)

    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {bearer_token}"
    }

    success_count = 0
    error_count = 0

    for index, mac in enumerate(mac_addresses, start=1):
        payload = {
            "mac_address": mac,
            "rfid": rfid
        }

        try:
            response = requests.post(endpoint, json=payload, headers=headers)
            if response.status_code == 201:
                success_count += 1
                print(f"SUCCESS [{index}/{len(mac_addresses)}]: MAC {mac} - Status Code: {response.status_code}")
            else:
                error_count += 1
                print(f"ERROR   [{index}/{len(mac_addresses)}]: MAC {mac} - Status Code: {response.status_code} - Response: {response.text}")
        except requests.exceptions.RequestException as e:
            error_count += 1
            print(f"EXCEPTION[{index}/{len(mac_addresses)}]: MAC {mac} - {e}")

        # Rate limiting: Wait for 5 seconds before the next request, except after the last request
        if index < len(mac_addresses):
            time.sleep(5)  # Pause for 5 seconds

    print("\n=== Summary ===")
    print(f"Total Requests: {len(mac_addresses)}")
    print(f"Successful (201): {success_count}")
    print(f"Failed: {error_count}")

if __name__ == "__main__":
    main()

Badge Reader Firmware#

You can download it from here: https://bucket.ics.red/reader.bin

Simulating the Binary#

Cutter will attempt to simulate the code.

Extra MQTT Topic#

Badge registration is performed using the MQTT topic /badges/{BadgeName}

StringsSquared#

Decodes hex strings from memory

python stringsSquared.py mem_dump.bin

import subprocess
import argparse

def strings_and_hex_decode(file_path):
    try:
        # Step 1: Run `strings` on the file and capture the output
        result = subprocess.run(['strings', file_path], stdout=subprocess.PIPE, text=True)
        output = result.stdout

        # Step 2: Process each line of the output
        for line in output.splitlines():
            # Remove whitespace and check if it's a valid hex string
            clean_line = line.strip()
            try:
                # Attempt to decode as hex
                decoded_line = bytes.fromhex(clean_line).decode('utf-8')
                print(f"Original: {clean_line} | Decoded: {decoded_line}")
            except ValueError:
                # Skip lines that are not valid hex
                print(f"Not hex: {clean_line}")
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    # Argument parsing
    parser = argparse.ArgumentParser(description="Extract strings from a file and decode hex lines.")
    parser.add_argument("file", help="Path to the file to process")
    args = parser.parse_args()

    # Call the function with the provided file path
    strings_and_hex_decode(args.file)

Editing NVS Data#

git clone https://github.com/ladderlogix/esp_nvs_editor

Get nvs.bin from ESP32 Image Parser when dumping the partition.

python main.py json nvs.bin nvs.json

Open the JSON. Strings are hex encoded (will change in a future PR).

python main.py bin nvs.json nvs.patched

Flash to the chip (run from ESP-IDF 5.3, under components\partition_table):

python .\parttool.py --port COM5 write_partition --partition-name=nvs --input "D:\NVSReplacing\nvs.patched.bin"

binaryShiftDecode#

Tool to help read binary but if the data order is moved around. This was a tool I made in preparation for Mile High.

Takes in a file with binary data on each line, i.e.

0011
1011
0110

and will try to hex decode it.

python main.py

A GUI will pop up where you can pick a file.

import tkinter as tk
from tkinter import filedialog, messagebox

# Shift a binary string to the right
def shift_binary(binary):
    return binary[-1] + binary[:-1]

# Decode binary string to ASCII character
def decode_binary(binary):
    try:
        return chr(int(binary, 2))
    except ValueError:
        return "?"

# Load binary data from a file
def load_binary_data():
    """Prompt the user to select a file and load binary data."""
    global binary_data, current_data

    # Open file dialog to select a file
    file_path = filedialog.askopenfilename(
        title="Select a file",
        filetypes=(("Text Files", "*.txt"), ("All Files", "*.*"))
    )

    if not file_path:
        return  # User canceled the file selection

    try:
        with open(file_path, "r") as file:
            binary_data = [line.strip() for line in file.readlines() if line.strip()]

        # Validate binary strings
        for binary in binary_data:
            if len(binary) != 8 or not set(binary).issubset({'0', '1'}):
                raise ValueError(f"Invalid binary string: {binary}")

        # Set initial data and update the display
        current_data = binary_data[:]
        update_display()
    except Exception as e:
        messagebox.showerror("Error", f"Failed to load data: {e}")
        binary_data = []
        current_data = []

# Update the display
def update_display():
    """Update the binary strings and their decoded characters displayed in the GUI."""
    for i in range(len(binary_labels)):
        if i < len(current_data):
            binary = current_data[i]
            binary_labels[i].config(text=binary)
            decoded_labels[i].config(text=decode_binary(binary))
        else:
            binary_labels[i].config(text="")  # Clear unused labels
            decoded_labels[i].config(text="")

# Shift binary strings to the right and update the display
def next_page():
    """Shift all binary strings to the right."""
    global current_data
    current_data = [shift_binary(binary) for binary in current_data]
    update_display()

# Initialize the GUI
root = tk.Tk()
root.title("Binary Viewer with Shifts and Decoding")

# Initialize variables
binary_data = []
current_data = []

# Frame for binary strings and decoded characters
frame = tk.Frame(root)
frame.pack(pady=10)

# Create labels for binary strings and decoded characters
binary_labels = []
decoded_labels = []
rows_to_display = 10  # Adjust based on how many rows you want visible at once

for _ in range(rows_to_display):
    row = tk.Frame(frame)
    row.pack(side=tk.TOP, fill=tk.X, pady=2)

    binary_label = tk.Label(row, width=15, text="", anchor="w")
    binary_label.pack(side=tk.LEFT, padx=5)
    binary_labels.append(binary_label)

    decoded_label = tk.Label(row, width=5, text="", anchor="w")
    decoded_label.pack(side=tk.LEFT, padx=5)
    decoded_labels.append(decoded_label)

# Buttons for file loading and shifting
button_frame = tk.Frame(root)
button_frame.pack(pady=5)

load_button = tk.Button(button_frame, text="Load File", command=load_binary_data)
load_button.pack(side=tk.LEFT, padx=5)

next_button = tk.Button(button_frame, text="Next", command=next_page)
next_button.pack(side=tk.LEFT, padx=5)

# Start the GUI event loop
root.mainloop()

Securely Provision#

Anomaly 74-76: Tears of the Analyst-C++ Class Reversing#

Anomaly 74#

We can see that we are inheriting stuff from Citizen

Anomaly 75#

Looking at all the functions we see that this function is inherited

Anomaly 76#

We can see we are passing a string and two ints into the Citizen class

Protect and Defend#

Anomaly 21-25: TPS Report#

Anomaly 21#

Since we were not able to access it for a very long time and that the server just stored data we can mark it 6 Denial of Non-Critical Services

Anomaly 22#

Since no data was taken we give it 1 No Impact

Anomaly 23#

Since this was a public server it falls into cat 2 Business Network

Anomaly 24#

Since they were not able to access it then Availability was targeted

Anomaly 25#

We got to do some math and subtracting them 1715134320 - 1715128980 / 60 gives us 89

Anomaly 26-28: Nice Day for Phishing#

Ticket 1#

Spam, does not seem to try to impersonate, clone, etc.

Ticket 2#

First the from email stands out as very odd. But since it is targeting a high value individual it is whaling.

Ticket 3#

Since this is a text, this is smishing.

Anomaly 30: Trivia 02#

What is the primary purpose of a bind shell payload in a penetration testing scenario?

• a) To establish a reverse connection from the attacker's machine to the target system. - That is a reverse shell
• b) To execute arbitrary commands on the target system and return the results to the attacker. - Not the best answer
• c) To open a network port on the target system and listen for incoming connections from the attacker.
• d) To encrypt communication between the attacker and the target system to evade detection. - Not its goal

Anomaly 31: Trivia 03#

Explain the difference between symmetric and asymmetric encryption

• a) Symmetric encryption uses two different keys for encryption and decryption, while asymmetric encryption uses the same key for both processes.
• b) Symmetric encryption is faster than asymmetric encryption, while asymmetric encryption offers better security.
• c) Symmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption, while asymmetric encryption uses only one key for both processes.
• d) Symmetric encryption uses a single key for both encryption and decryption, while asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption.

Anomaly 32: Trivia 04#

Which of the following is a technique often utilized by attackers to evade detection by security tools and defenders, involving the encryption of malicious payloads to bypass signature-based detection mechanisms?

• a) Cross-site scripting (XSS) - This is an attack not an evasion mechanism
• b) DNS tunneling - This is a method of exfiltration but can be viewed and stopped
• c) Data exfiltration - This is just a term and not a method
• d) Payload obfuscation

Anomaly 33: Trivia 05#

In a penetration testing scenario, which of the following methods is commonly used to escalate privileges on a compromised system when traditional methods fail?

• a) Reverse engineering - Used to analyse malware
• b) Fuzzing - This is most commonly used to find flaws in a system
• c) Kernel exploitation
• d) DLL injection - While possible not that common

Anomaly 34: Trivia 06#

Which of the following is a technique used in a buffer overflow attack to redirect the program's execution flow to malicious code injected by the attacker?

• a) Code obfuscation - Not a bin attack
• b) Integer overflow - This just makes a number negative or positive, not touching control flow
• c) Return-oriented programming (ROP) - We are trying to overwrite the return address
• d) Cross-site scripting (XSS) - Not a bin attack

Anomaly 35: Trivia 07#

During a penetration test, the tester discovers an outdated FTP server running on the target network. Which of the following techniques would be MOST effective for exploiting this vulnerability?

• a) Directory traversal attack - Deals with paths
• b) Cross-site scripting (XSS) - Most common on websites
• c) SQL injection - Common on databases
• d) Buffer overflow exploit - Good if we have a function we are trying to access

Anomaly 36: Trivia 08#

In a penetration testing scenario, what is the primary purpose of using a reverse shell payload?

• a) To establish a connection from the attacker's machine to the victim's machine. - This is the definition of the attack
• b) To encrypt data transmitted between the attacker and the victim.
• c) To exploit a vulnerability in a web application.
• d) To perform a denial-of-service (DoS) attack on the target network.

Anomaly 37: Trivia 09#

In a penetration testing scenario, what is the primary objective of post-exploitation activities after gaining initial access to a target system?

• a) Deleting system logs to cover tracks - Not something we should do in a pentest we don't want to destroy our customer's network
• b) Extracting sensitive data from the compromised system
• c) Installing backdoors for persistent access - Not really needed in a pentest
• d) Patching vulnerabilities to secure the system - That is not our job we need to find vulns

Anomaly 38: Trivia 10#

In a penetration test, which of the following techniques would be most effective for escalating privileges after gaining initial access to a target system?

• a) Conducting a brute-force attack against system services. - Not the easiest way to get priv esc
• b) Exploiting misconfigured network shares to gain access to sensitive files. - We are not after files
• c) Leveraging a zero-day vulnerability to execute arbitrary code. - Rarely would you even know of a zero day or even use one, especially as a pen tester
• d) Exploiting a known vulnerability to escalate privileges via a privilege escalation exploit.

Anomaly 43: Trivia 15#

Which of the following is a key component of a firewall?

• a) Intrusion Detection System (IDS)
• b) Anti-virus software
• c) Router
• d) Access Control List (ACL) - Controlling access is their primary job

Anomaly 44: Trivia 16#

What is the main advantage of using asymmetric encryption over symmetric encryption?

• a) Faster encryption and decryption speed - Not true
• b) Requires only one key for both encryption and decryption - Not true
• c) Provides better security for key distribution - Breaks up keys
• d) Less complex implementation

Anomaly 45: Trivia 17#

What type of attack attempts to deceive users into visiting malicious websites by redirecting them from legitimate websites?

• a) Man-in-the-Middle (MitM)
• b) Cross-Site Scripting (XSS)
• c) Phishing
• d) SQL Injection

Anomaly 46: Trivia 18#

What is the purpose of a VPN (Virtual Private Network)?

• a) To hide IP addresses
• b) To secure network traffic over public networks
• c) To encrypt files on a local computer
• d) To prevent malware infections

Anomaly 47: Trivia 19#

Which of the following is NOT a common authentication factor?

• a) Password
• b) Biometrics
• c) Security Token
• d) Public Key - Usually a private key

Analyze#

Anomaly 05-11: gURLs Just Want to Have Fun#

Part 0#

So we are given a history file from a browser. This is in a SQLite database format so I will open it up with my SQLite data viewer.

I am looking at the table called urls for most of the parts.

Part 1#

We are looking for a download so let's search for the word download.

One entry catches my eye because in the title we see virus. Using the URL as the flag we get https://drive.usercontent.google.com/download?id=1BfPZslNaHvz3olaV8_3I6ppA_IbdlHLr&export=download

Part 2#

We are now looking for downloads so let's switch to the downloads table and see if we can find a quote.

We see a quote of the day site, so now let's look at the downloads_url_chains table to see if we can get a full URL.

Putting that URL into our browser we see the quote.

Part 3#

We are now looking for flights so we are back in the urls table searching for flights.

We see a Southwest page with a to and from in the URL request.

Checking it out shows us the state: New Hampshire

Part 4#

Searching for weather in the urls table.

This shows us the city right in the title: Shelburne

Part 5#

Searching for GitHub.

On this list the xz repo stands out to me since I know they had a big news piece. Looking up the associated CVE turns out to be the flag.

Part 6#

This one again we are going to search for the title.

Taking note of the id we can look it up in the visits table, putting the id in for url.

Part 7#

We will search for art.

I notice one gov site stands out: the National Gallery of Art.

Going to the URL of the painting that wasn't in the downloads table gives us the last name.

Anomaly 12-15: While My WAF Gently Weeps#

Preface#

I am loading these logs into Excel, but you can use any Snort log tool of your choosing.

Anomaly 12#

One of the columns has this interesting alert attached to it. Sorting by that reveals a couple of IP addresses.

Sorting and removing duplicates plus combining leaves me with

Anomaly 13#

So we know the return status was a 200, so let's sort by that first. Then we see that it is using a site called MeterWise Analytics; let's try filtering that down.

In my column I filter for MeterWise Analytics and see a few options, but one stands out. Having to re-add the one to the user agent gets us the flag.

Anomaly 14#

So we need to filter based on SQL injection, so I am looking for the word OR in the URI.

There is the latest one. In Excel I had to put it in the other time format.

Anomaly 15#

We are looking for path traversal, so we need to filter based on ../

One line doesn't have a Snort alert attached to it.

Anomaly 17: Ste-what-graphy v2#

After opening the email in Thunderbird and extracting the attachment into the tools folder:

We see some shorthand and a script that claims to be able to read it. Taking a ss of the image and running it through the script will pop a window with potential matches. I had to change the threshold to .8 to not keep getting false positives.

Putting the image into AperiSolve with the password:

Steghide finds the data and inside is the flag.

Oversee and Govern#

Anomaly 29: Trivia 01#

Which of the following is a technique used in post-exploitation to maintain persistent access to a compromised system without relying on traditional backdoors or implants?

• c) Scheduled task creation - This is correct because it is not something traditional and has to be created by you
• a) Kernel patching - This is incorrect because it would rely on a traditional backdoor
• b) Rootkit installation - This is a traditional method
• d) DLL hijacking - Not known to create persistence

Anomaly 16: COn365nt is Key#

Request 1#

Pass everything Approved

Request 2#

Since this app wants to sign in and when googling I can't find anything about conditional access, it fails DENIED:7

Request 3#

This request wants the permission Read and write all groups which is in the ban list BLOCK:4

Request 4#

This request is not an appropriate type because of a separate email sync DENIED:2

Request 5#

I cannot seem to find its app ID in the system or Google DENIED:3

Request 6#

Since this app wants to read full profiles which can contain data subject to breach notification laws, it fails nine BLOCKED:9

Energy#

Anomaly 39: Trivia 11#

The Department of Energy supports advancements in sustainable transportation. Which of the following is NOT a focus area?

• a. Electric vehicle (EV) infrastructure
• b. Biofuel production
• c. Hydrogen fuel cells
• d. Lead-acid battery research for EVs - We are trying new stuff

Anomaly 40: Trivia 12#

Which U.S. agency launched the "Building a Better Grid" initiative to expand and modernize the nation's electric grid?

• a. Environmental Protection Agency (EPA)
• b. Department of Energy (DOE) - https://www.energy.gov/gdo/building-better-grid-initiative
• c. Federal Energy Regulatory Commission (FERC)
• d. Department of Defense (DOD)

Anomaly 41: Trivia 13#

Which innovative technology was the Department of Energy exploring to enhance grid resilience against cyber-attacks in 2023 according to their GMI calls?

• a. Blockchain technology
• b. Quantum encryption communications - Link to energy.gov report
• c. AI threat detection systems
• d. Satellite grid monitoring

Anomaly 42: Trivia 14#

What should be the primary objective of a risk management strategy? CISM

• a. Determine the organization's risk appetite. - This is just being lazy
• b. Identify credible risks and transfer them to an external party. - We should not just give away all the risk
• c. Identify credible risks and reduce them to an acceptable level.
• d. Eliminate credible risks. - We can never eliminate risks

Anomaly 48: Trivia 20#

Based on the 2023 U.S. Energy Information Administration, this was the leading renewable energy source.

• a. Solar
• b. Hydropower
• c. Wind - Link
• d. Geothermal

Investigate#

Anomaly 49: Knock Knock…Who’s There?#

We have a list of encoded text in Base64 and hex; I will convert each back into ASCII.

Anomaly 50: Sloggin through these logins#

Looking at the log file we notice James's account having many incorrect creds: James