meetings

@j0nh4t discovered that you can escalate from user to SYSTEM on an unlocked Windows machine just by plugging in a Razer mouse and clicking in the right places. At this meeting we’ll take a look at how the specific exploit works and more interestingly how it falls into a no man’s land where there are probably a lot more bugs to find. We’ll look at how Windows identifies USB devices, decides which driver to install, and then where it downloads the driver from. Armed with that knowledge, we’ll take a ~$5 Digispark Kickstarter Attiny85 board (https://smile.amazon.com/s?k=digispark+kickstarter+attiny85) and emulate a Razer device to trigger the vulnerability. If you bring your own board you can go home with a Windows master key (assuming no patches are released). Please come with the Arduino IDE installed for the full DIY experience.

OrientDB is GraphQL under the hood, but implements its own dialect of SQL to make developers feel more comfortable. Unfortunately, despite being listed as fully supported, their Python library never quite implemented parameterized queries. This means that injection exploits are there for the taking if we can just figure out how to make them work using the non-standard SQL. This meeting will be spent getting back to basics on SQLi strategies. A test system will be available and at least one solution will be shared.

The CMU picoCTF is ongoing now (it is a two week event). Lots of challenges spread out in the normal categories.

Sometimes you come across a virtual machine or CPU description with an executable image that you want to reverse engineer. For instance, this challenge from Synacor has about 21 instructions: https://challenge.synacor.com/ . If we implement the CPU semantics in Ghidra, we should be able to get disassembly and decompilation. Feel free to download the challenge and attempt writing a VM emulator or getting a sense of the opcodes. During the meeting, we will work on adding support for the CPU architecture to Ghidra.

We will do a presenter-lead walkthrough of reversing an “easy” Android application and then have a second application for participant practice during the meeting.

https://exploit.education/phoenix/

This is a set of binaries with increasing level of difficulties to teach “textbook” exploitation on Linux. We will present a bit of theory first, and then dive into the challenges. The binaries are provided as a Qemu image, so try to set that up in advance.