tag: Linux

I forgot how did I compile all of that in those two stm32 posts, lol. The post will be very brief because this one is just a quick guide for me. I was kinda panic when I realized that I couldn’t quite recall what I have written myself… Full Pre-requisites sudo pacman -S arm-none-eabi-gcc gdb qemu-system-arm openocd stlink Compile ELF arm-none-eabi-gcc \ -mcpu=cortex-m3 \ -mthumb \ -mfloat-abi=soft \ -nostdlib \ -ffreestanding \ -Isrc -Iinc \ -T stm32f103c8t6.ld \ -Wl,-Map=build/blink.map \ -Wl,--gc-sections \ -Wl,--print-memory-usage \ src/vectors.c src/main.c \ -o build/blink.elf Convert to .bin arm-none-eabi-objcopy -O binary build/blink.elf build/blink.bin Since st-flash and QEMU expect raw binary. ...

This post today will be about Telly - a HackTheBox Sherlock about the shiny new vulnerability of Telnet where it grants you sudo from userspace, in a pretty trivial manner. I will do a walkthrough the tasks in Sherlock first, then we will go on how this particular CVE works. Scenario You are a Junior DFIR Analyst at an MSSP that provides continuous monitoring and DFIR services to SMBs. Your supervisor has tasked you with analyzing network telemetry from a compromised backup server. A DLP solution flagged a possible data exfiltration attempt from this server. According to the IT team, this server wasn’t very busy and was sometimes used to store backups. ...

Forewords Ah yes, finally, some Linux forensics tasks. Though, this one should have been on the difficulty level of easy, not medium (in my opinion of course, but don’t listen to this linux addict ;)) The most difficult part of this sherlock, in my opinion, is to figure out which tool would you need to read the kdump file, and henceforth, how to use crash. Introduction and Scenario A production server crashed unexpectedly and rebooted. The crash happened at a strange time, and we doubt it was a simple hardware fault. A kernel crash dump was captured. Your mission is to analyze it to find the real cause of the crash and determine if any other suspicious activity was present on the system. ...

Introduction When you compile C code for an ARM microcontroller, the compiler translates your high-level code into machine instructions. Reverse engineering tools like Binary Ninja, Ghidra, radare2, etc. can decompile those instructions back into pseudo-C code. This guide shows you how to read that decompiled output and understand what’s happening at the hardware level. The Example: STM32 LED Blink We’ll use a simple LED blink program for an STM32F103xx (ARM Cortex-M3) microcontroller, that I have published in another repo: https://github.com/Flock137/stm32_blinky_baremetal ...

TLDR Stop using both the usb and memory card at once. Else, it will be next to impossible to recover anything back, since the data cells got overwritten, instead of just being “unlisted”. On Window (Linux), you can just install Recuva (extundelete or fatcat) for free and point the app to your usb or memory card, you’re welcome. However, I would still prefer a more sure-fire way to preserve my data, hence the blog. ...

Introduction I chose to start my hardware hacking journey with an attempt to live debugging a piece of hardware. As I am waiting for the necessary parts I need to arrive, I did some emulations of the STM32, so I might have the binary ready to flash the binary into the hardware by the times the parts arrive. As weird as it is to write about a failed attempt on a blog post, this is written to at least temporary record what I did, for potential future references. The code for this attempt would not be released, as I definitely do not want to embarrase myself. ...

Downloading (yt-dlp) You use this command: yt-dlp -f "bestvideo[height=2160]+bestaudio" -x --audio-format flac "VIDEO_URL" In this command, I’m downloading from a 4K video (2160p), and I like my music to be in the .flac file. Feel free to change the quality and filetype into whatever you like. Update metadata (ffmpeg) Since the metadata won’t come with the file by default, you may like to add it manually. To do this, yt-dlp should also work. However, my preferred method is to use ffmpeg, instead: ...

In the case like this: warning: /etc/bluetooth/main.conf installed as /etc/bluetooth/main.conf.pacnew You may like to know what is the difference between these two, concisely. We use the command diff, a basic utility of Linux An example: diff /etc/bluetooth/main.conf /etc/bluetooth/main.conf.pacnew Output: 264a265,269 > # This enables the GATT client functionally, so it can be disabled in system > # which can only operate as a peripheral. > # Defaults to 'true'. > #Client = true > 311,315d315 < # This enables the GATT client functionally, so it can be disabled in system < # which can only operate as a peripheral. < # Defaults to 'true'. < #Client = true < 362c362 < #AutoEnable=false --- > #AutoEnable=true > indicate what appear in the latter file and < is pointing toward the former file. ...

Introduction For this purpose you actually have AppImageLauncher for the convenience, or the apps would actually self-generate this for you, but this doesn’t always happen. However, if you do mind the bloatness of said app (300 MB-ish), or the devs just don’t have the launcher ready, then you may consider making the launcher yourself, by hand. AppImage Launcher Template (AppName.desktop) This is my standard template for almost every AppImage: [Desktop Entry] Version=1.0 Type=Application Name=Application Name GenericName=App Type Categories=Utility; Comment=Brief description of the application Exec=/path/to/application.AppImage Icon=/path/to/icon.png Terminal=false StartupNotify=true Explanations (don’t copy this part to your file, please): ...

Intro This is actually my thought process of making this script https://github.com/Flock137/EOSxBlackArch, where I put the BlackArch repo on top of EndeavourOS for a quick Arch pentest environment, since BlackArch is a bit of a hassle for installing quickly. I hope it would help you in the case you wanna make an automation script yourself someday. First and foremost Install EndeavourOS. We will port our BlackArch repo into right after the former’s installation finish. ...