Sunday, January 28, 2024

ASIS CTF Quals 2015 - Sawthis Writeup - Srand Remote Prediction

The remote service ask for a name, if you send more than 64 bytes, a memory leak happens.
The buffer next to the name's is the first random value used to init the srand()

If we get this value, and set our local srand([leaked] ^ [luckyNumber]) we will be able to predict the following randoms and win the game, but we have to see few details more ;)

The function used to read the input until the byte \n appears, but also up to 64 bytes, if we trigger this second condition there is not 0x00 and the print shows the random buffer :)

The nickname buffer:

The seed buffer:

So here it is clear, but let's see that the random values are computed with several gpu instructions which are decompiled incorrectly:

We tried to predict the random and aply the gpu divisions without luck :(

There was a missing detail in this predcitor, but there are always other creative ways to do the things.
We use the local software as a predictor, we inject the leaked seed on the local binary of the remote server and got a perfect syncronization, predicting the remote random values:

The process is a bit ugly becouse we combined automated process of leak exctraction and socket interactive mode, with the manual gdb macro.

The macro:

Related links

  1. Hacks And Tools
  2. Hack Tools
  3. Hacking Tools Windows
  4. Wifi Hacker Tools For Windows
  5. Hacking Tools Pc
  6. Pentest Automation Tools
  7. Hacking Tools Online
  8. Easy Hack Tools
  9. Hacking Tools Github
  10. Hacker Tools For Pc
  11. Pentest Tools Find Subdomains
  12. Hackrf Tools
  13. Pentest Tools Subdomain
  14. Hacking Tools For Beginners
  15. Hacker Tools For Pc
  16. Hack Tools 2019
  17. Pentest Box Tools Download
  18. Hacker Tools Online
  19. Hacking Tools Online
  20. Hacker Tools Hardware
  21. Hack And Tools
  22. Hacking Tools For Windows Free Download
  23. Hacker Tools Mac
  24. Hacker Search Tools
  25. Pentest Tools Framework
  26. Best Pentesting Tools 2018
  27. Pentest Tools Android
  28. Pentest Tools Find Subdomains
  29. Hack Tool Apk
  30. Best Hacking Tools 2019
  31. What Is Hacking Tools
  32. Hacker Tools Hardware
  33. Beginner Hacker Tools
  34. Hacking Tools Hardware
  35. How To Hack
  36. Hacking Tools 2020
  37. Pentest Tools Bluekeep
  38. Best Hacking Tools 2019
  39. How To Install Pentest Tools In Ubuntu
  40. World No 1 Hacker Software
  41. Pentest Tools Framework
  42. Pentest Tools Website
  43. Hacker Tools Software
  44. New Hacker Tools
  45. Hack Tools 2019
  46. Pentest Tools Url Fuzzer
  47. Hacking Tools Github
  48. Pentest Tools Website
  49. Hacks And Tools
  50. Hacking Tools For Pc
  51. Pentest Tools Bluekeep
  52. Pentest Tools Tcp Port Scanner
  53. Hackrf Tools
  54. Hack App
  55. Hack Tools For Pc
  56. Top Pentest Tools
  57. Hack Tools For Pc
  58. Hacker Tools 2019
  59. Hacker Tools For Pc
  60. Hacking Tools For Windows
  61. Hacker Tools
  62. Hackrf Tools
  63. Hacker Tools Software
  64. Pentest Tools Android
  65. Hacking Tools Windows
  66. Hacker Hardware Tools
  67. Black Hat Hacker Tools
  68. Pentest Reporting Tools
  69. Hacking App
  70. How To Install Pentest Tools In Ubuntu
  71. Pentest Automation Tools
  72. Hackrf Tools
  73. Hacking Tools 2019
  74. Pentest Tools Android
  75. Pentest Tools Android
  76. Nsa Hack Tools
  77. Hacking Tools For Games
  78. Pentest Tools For Ubuntu
  79. Tools Used For Hacking
  80. Hacker Tools Apk Download
  81. Pentest Tools Nmap
  82. Growth Hacker Tools
  83. Hacking Tools
  84. Hack Website Online Tool
  85. Hacker Tools Mac
  86. Hacker Tools Apk
  87. Hacker Techniques Tools And Incident Handling
  88. Pentest Tools Find Subdomains
  89. Pentest Reporting Tools
  90. Pentest Tools Download
  91. Hacking Tools Free Download
  92. Hacker Tools For Pc
  93. What Are Hacking Tools
  94. Wifi Hacker Tools For Windows
  95. Pentest Tools Find Subdomains
  96. Pentest Tools Kali Linux
  97. Pentest Tools Open Source
  98. Pentest Tools Website
  99. Hacker Tools Online
  100. Hack Tools Github
  101. Hacker Techniques Tools And Incident Handling
  102. Computer Hacker
  103. Best Hacking Tools 2019
  104. Hacking Tools Github
  105. Hacker Tool Kit
  106. Pentest Tools For Mac
  107. Hack Tools 2019
  108. Hack Rom Tools
  109. Hacking Tools Mac
  110. Pentest Tools Linux
  111. Hack Rom Tools
  112. Hacking Tools Windows 10
  113. Hacking Apps
  114. Pentest Tools Bluekeep
  115. Hacking Tools For Kali Linux

Emulating Shellcodes - Chapter 2

 Lets check different  Cobalt Strike shellcodes and stages in the shellcodes emulator SCEMU.

This stages are fully emulated well and can get the IOC and the behavior of the shellcode.

But lets see another first stage big shellcode with c runtime embedded in a second stage.

In this case is loading tons of API using GetProcAddress at the beginning, then some encode/decode pointer and tls get/set values to store an address. And ends up crashing because is jumping an address that seems more code than address 0x9090f1eb.

Here there are two types of allocations:

Lets spawn a console on -c 3307548 and see if some of this allocations has the next stage.

The "m" command show all the memory maps but the "ma" show only the allocations done by the shellcode.

Dumping memory with "md" we see that there is data, and dissasembling this address with "d" we see the prolog of a function.

So we have second stage unpacked in alloc_e40064

With "mdd" we do a memory dump to disk we found the size in previous screenshot,  and we can do  some static reversing of stage2 in radare/ghidra/ida

In radare we can verify that the extracted is the next stage:

I usually do correlation between the emulation and ghidra, to understand the algorithms.

If wee look further we can realize that the emulator called a function on the stage2, we can see the change of code base address and  is calling the allocated buffer in 0x4f...

And this  stage2 perform several API calls let's check it in ghidra.

We can see in the emulator that enters in the IF block, and what are the (*DAT_...)() calls

Before a crash lets continue to the SEH pointer, in this case is the way, and the exception routine checks IsDebuggerPresent() which is not any debugger pressent for sure, so eax = 0;

So lets say yes and continue the emulation.

Both IsDebuggerPresent() and UnHandledExceptionFilter() can be used to detect a debugger, but the emulator return what has to return to not be detected. 

Nevertheless the shellcode detects something and terminates the process.

Lets trace the branches to understand the logic:

target/release/scemu -f shellcodes/unsuported_cs.bin -vv | egrep '(\*\*|j|cmp|test)'

Continuing the emulation it's setting the SEH  pointer to previous stage:

Lets see from the console where is pointing the SEH chain item:

to be continued ...

Related articles

Saturday, January 27, 2024

Why (I Believe) WADA Was Not Hacked By The Russians

Disclaimer: This is my personal opinion. I am not an expert in attribution. But as it turns out, not many people in the world are good at attribution. I know this post lacks real evidence and is mostly based on speculation.

Let's start with the main facts we know about the WADA hack, in chronological order:

1. Some point in time (August - September 2016), the WADA database has been hacked and exfiltrated
2. August 15th, "WADA has alerted their stakeholders that email phishing scams are being reported in connection with WADA and therefore asks its recipients to be careful"
3. September 1st, the domain has been registered
   Domain Name: FANCYBEAR.NET    ...    Updated Date: 18-sep-2016    Creation Date: 01-sep-2016
4. The content of the WADA hack has been published on the website
5. The @FancyBears and @FancyBearsHT Twitter accounts have been created and started to tweet on 12th September, reaching out to journalists
6. 12th September, Western media started headlines "Russia hacked WADA"
7. The leaked documents have been altered, states WADA

The Threatconnect analysis

The only technical analysis on why Russia was behind the hack, can be read here:

After reading this, I was able to collect the following main points:

  1. It is Russia because Russian APT groups are capable of phishing
  2. It is Russia because the phishing site "wada-awa[.]org was registered and uses a name server from ITitch[.]com, a domain registrar that FANCY BEAR actors recently used"
  3. It is Russia because "Wada-arna[.]org and tas-cass[.]org were registered through and use name servers from Domains4bitcoins[.]com, a registrar that has also been associated with FANCY BEAR activity."
  4. It is Russia, because "The registration of these domains on August 3rd and 8th, 2016 are consistent with the timeline in which the WADA recommended banning all Russian athletes from the Olympic and Paralympic games."
  5. It is Russia, because "The use of 1&1 webmail addresses to register domains matches a TTP we previously identified for FANCY BEAR actors."

There is an interesting side-track in the article, the case of the @anpoland account. Let me deal with this at the end of this post.

My problem with the above points is that all five flag was publicly accessible to anyone as TTP's for Fancy Bear. And meanwhile, all five is weak evidence. Any script kittie in the world is capable of both hacking WADA and planting these false-flags.

A stronger than these weak pieces of evidence would be:

  • Malware sharing same code attributed to Fancy Bear (where the code is not publicly available or circulating on hackforums)
  • Private servers sharing the IP address with previous attacks attributed to Fancy Bear (where the server is not a hacked server or a proxy used by multiple parties)
  • E-mail addresses used to register the domain attributed to Fancy Bear
  • Many other things
For me, it is quite strange that after such great analysis on Guccifer 2.0, the Threatconnect guys came up with this low-value post. 

The fancybear website

It is quite unfortunate that the analysis was not updated after the documents have been leaked. But let's just have a look at the fancybear . net website, shall we?

Now the question is, if you are a Russian state-sponsored hacker group, and you are already accused of the hack itself, do you create a website with tons of bears on the website, and do you choose the same name (Fancy Bear) for your "Hack team" that is already used by Crowdstrike to refer to a Russian state-sponsored hacker group? Well, for me, it makes no sense. Now I can hear people screaming: "The Russians changed tactics to confuse us". Again, it makes no sense to change tactics on this, while keeping tactics on the "evidence" found by Threatconnect.

It makes sense that a Russian state-sponsored group creates a fake persona, names it Guccifer 2.0, pretends Guccifer 2.0 is from Romania, but in the end it turns out Guccifer 2.0 isn't a native Romanian speaker. That really makes sense.

What happens when someone creates this fancybear website for leaking the docs, and from the Twitter account reaches out to the media? Journalists check the website, they see it was done by Fancy Bear, they Bing Google this name, and clearly see it is a Russian state-sponsored hacker group. Some journalists also found the Threatconnect report, which seems very convincing for the first read. I mean, it is a work of experts, right? So you can write in the headlines that the hack was done by the Russians.

Just imagine an expert in the USA or Canada writing in report for WADA:
"the hack was done by non-Russian, but state-sponsored actors, who planted a lot of false-flags to accuse the Russians and to destroy confidence in past and future leaks". Well, I am sure this is not a popular opinion, and whoever tries this, risks his career. Experts are human, subject to all kinds of bias.

The Guardian

The only other source I was able to find is from The Guardian, where not just one side (it was Russia) was represented in the article. It is quite unfortunate that both experts are from Russia - so people from USA will call them being not objective on the matter. But the fact that they are Russian experts does not mean they are not true ...

Sergei Nikitin:
"We don't have this in the case of the DNC and Wada hacks, so it's not clear on what basis conclusions are being drawn that Russian hackers or special services were involved. It's done on the basis of the website design, which is absurd," he said, referring to the depiction of symbolically Russian animals, brown and white bears, on the "Fancy Bears' Hack Team" website.

I don't agree with the DNC part, but this is not the topic of conversation here.

Alexander Baranov:
"the hackers were most likely amateurs who published a "semi-finished product" rather than truly compromising information. "They could have done this more harshly and suddenly," he said. "If it was [state-sponsored] hackers, they would have dug deeper. Since it's enthusiasts, amateurs, they got what they got and went public with it.""

The @anpoland side-track

First please check the hack  , I will be here when you finished it. This is a website for "Court of Arbitration for Sport's", and referring to the Threatconnect post, "CAS is the highest international tribunal that was established to settle disputes related to sport through arbitration. Starting in 2016, an anti-doping division of CAS began judging doping cases at the Olympic Games, replacing the IOC disciplinary commission." Now you can see why this attack is also discussed here.

  • My bet is that this machine was set-up for these @anpoland videos only. Whether is a false flag or it is real, hard to decide. It is interesting to see that there is no google search done via, it is used only once. 
  • The creator of the video can't double click. Is it because he has a malfunctioning mouse? Is it because he uses a virtualization console, which is near-perfect OPSEC to hide your real identity? My personal experience is that using virtualization consoles remotely (e.g. RDP) has very similar effects to what we can see on the video. 
  • The timeline of the Twitter account is quite strange, registered in 2010
  • I agree with the Threatconnect analysis that this @anpoland account is probably a faketivist, and not an activist. But who is behind it, remains a mystery. 
  • Either the "activist" is using a whonix-like setup for remaining anonymous, or a TOR router (something like this), or does not care about privacy at all. Looking at the response times (SQLmap, web browser), I doubt this "activist" is behind anything related to TOR. Which makes no sense for an activist, who publishes his hack on Youtube. People are stupid for sure, but this does not add up. It makes sense that this was a server (paid by bitcoins or stolen credit cards or whatever) rather than a home computer.
For me, this whole @anpoland thing makes no sense, and I think it is just loosely connected to the WADA hack. 

The mysterious Korean characters in the HTML source

There is another interesting flag in the whole story, which actually makes no sense. When the website was published, there were Korean characters in HTML comments. 

When someone pointed this out on Twitter, these Korean HTML comments disappeared:
These HTML comments look like generated HTML comments, from a WYSIWYG editor, which is using the Korean language. Let me know if you can identify the editor.

The Russians are denying it

Well, what choice they have? It does not matter if they did this or not, they will deny it. And they can't deny this differently. Just imagine a spokesperson: "Previously we have falsely denied the DCC and DNC hacks, but this time please believe us, this wasn't Russia." Sounds plausible ...


Let me sum up what we know:

It makes sense that the WADA hack was done by Russia, because:

  1. Russia being almost banned from the Olympics due to doping scandal, it made sense to discredit WADA and US Olympians
  2. There are multiple(weak) pieces of evidence which point to Russia
It makes sense that the WADA hack was not done by  Russia, because: 
  1. By instantly attributing the hack to the Russians, the story was more about to discredit Russia than discrediting WADA or US Olympians.
  2. In reality, there was no gain for Russia for disclosing the documents. Nothing happened, nothing changed, no discredit for WADA. Not a single case turned out to be illegal or unethical.
  3. Altering the leaked documents makes no sense if it was Russia (see update at the end). Altering the leaked documents makes a lot of sense if it was not Russia. Because from now on, people can always state "these leaks cannot be trusted, so it is not true what is written there". It is quite cozy for any US organization, who has been hacked or will be hacked. If you are interested in the "Russians forging leaked documents" debate, I highly recommend to start with this The Intercept article
  4. If the Korean characters were false flags planted by the Russians, why would they remove it? If it had been Russian characters, I would understand removing it.
  5. All evidence against Russia is weak, can be easily forged by even any script kittie.

I don't like guessing, but here is my guess. This WADA hack was an operation of a (non-professional) hackers-for-hire service, paid by an enemy of Russia. The goal was to hack WADA, leak the documents, modify some contents in the documents, and blame it all on the Russians ...

Questions and answers

  • Was Russia capable of doing this WADA hack? Yes.
  • Was Russia hacking WADA? Maybe yes, maybe not.
  • Was this leak done by a Russian state-sponsored hacker group? I highly doubt that.
  • Is it possible to buy an attribution-dice where all six-side is Russia? No, it is sold-out. 

To quote Patrick Gray: "Russia is the new China, and the Russians ate my homework."©

Let me know what you think about this, and please comment. 

Related posts

How To Automatically Translate Any Android App Into Any Language

There is the number of applications which are not having the features of translating apps to your favorite languages. This makes it difficult for the users to translate apps into their native language. Today, I am going to tell you about an application which will help you to Automatically Translate Any Android App into Any Language.
Nowadays there are around hundreds of application on play store which is having the feature of translate but some applications don't have this features. This is just because they don't have proper developers or sometimes translators.
There is an application launched by Akhil Kedia from XDA Developer which made it possible for all the users to translate the application to any language you need. This is something which everyone needs it.
Akhil Kedia built an Xposed module in which users can easily change the language of any application to whichever they like or love. Personally, we all love English language but there are peoples in many parts of the world they are suitable for other languages.
Automatically Translate Any Android App into Any Language
Automatically Translate Any Android App into Any Language

Automatically Translate Any Android App into Any Language

The best part about this Xposed Module is that it translates the application to any language whichever you like and there are around many languages which you can try it. The other best part about this application is that the user interface which is amazing.
In an Android application, the best thing is the user interface. This is something which helps users to download the module or application to run again and again. There are about many settings which can be changed from the application.
The setup process is a bit different from other applications but if you will look at the application you will definitely love it. Just because of too many settings and features available in the application and you can turn it to any language without any crashing issues of the application.


  • Rooted Android Phone
  • Xposed Framework installed on your phone.
  • Android 5.0 or higher.
  • Unknown Source enabled (You might be knowing it)
How to Automatically Translate Any Android App into Any Language
  • Download the module called as All Trans from here: Download
Automatically Translate Any Android App
  • Now, after installation, it will ask you to reboot your phone to activate the module
  • Now, you need to get the API Key to get it you need to sign up with Yandex first so sign up: Yandex Sign up
Automatically Translate Any Android App
  • Then after sign up you will get the API key just enter the API key in the All-Trans application.
Automatically Translate Any Android App
  • Open All Trans Application and the swipe right to Global Settings.
Automatically Translate Any Android App
  • Click on Enter Yandex Subscription key and then enter your key.
Automatically Translate Any Android App
  • In Global Settings click on Translate from and select the Language the application is already in. (Eg: English)
Automatically Translate Any Android App
  • Now, click on translate to and select your favorite language. This will change the language.
Automatically Translate Any Android App
  • Swipe left and select the applications which you need to translate and done.
Automatically Translate Any Android App
  • After selecting just open the application and the language is translated automatically.
Automatically Translate Any Android App

Final Words:

This is the best and easy way to Automatically Translate Any Android App into Any Language. I hope you love this article.Share this article with your friends and keep visiting for more tips and tricks like this and I will meet you in the next one.
Stay Updated Tune IemHacker

Read more

  1. Pentest Tools Subdomain
  2. Hack Tools For Mac
  3. Hacking Tools For Mac
  4. Pentest Automation Tools
  5. Bluetooth Hacking Tools Kali
  6. Hacking Tools Hardware
  7. Hacking Tools For Games
  8. Hacking Tools Download
  9. How To Install Pentest Tools In Ubuntu
  10. Hacker Tools 2019
  11. Hacking Tools Software
  12. Hack Tool Apk No Root
  13. Hacking Apps
  14. Hacking Tools Windows 10
  15. Pentest Tools For Windows
  16. Hacker Tools Hardware
  17. Hackrf Tools
  18. Hacker Tools Github
  19. Black Hat Hacker Tools
  20. Hack Tools 2019
  21. Pentest Tools Subdomain
  22. Hack Tools For Pc
  23. Hack Tools Online
  24. Hacker Hardware Tools
  25. Pentest Tools Subdomain
  26. Hacker Security Tools
  27. Hacking Tools For Games
  28. Pentest Tools For Android
  29. Pentest Tools Framework
  30. Hacker Tools Apk Download
  31. Pentest Tools Framework
  32. Pentest Tools Bluekeep
  33. Hack Tools Online
  34. How To Make Hacking Tools
  35. Install Pentest Tools Ubuntu
  36. Hacker Tools
  37. Hacking Tools 2020
  38. Best Pentesting Tools 2018
  39. Hack Tools Online
  40. Hacker Tool Kit
  41. Pentest Reporting Tools
  42. Hack Apps
  43. Hacker
  44. Pentest Automation Tools
  45. Nsa Hack Tools Download
  46. Pentest Reporting Tools
  47. Hacker Tools For Mac
  48. Hack App
  49. Hack Tools
  50. Pentest Tools Apk
  51. Hacking Tools For Pc
  52. Hack Tools 2019
  53. Underground Hacker Sites
  54. Hacking App
  55. Physical Pentest Tools
  56. Hacker Tools Apk Download
  57. Hack Tools For Ubuntu
  58. Computer Hacker
  59. Hack Tools Pc
  60. Pentest Tools Alternative
  61. Hacker Tools For Mac
  62. Hacking Tools Online
  63. Tools For Hacker
  64. Hacker Hardware Tools
  65. Hack Website Online Tool
  66. Pentest Tools Subdomain
  67. Hacking Tools Mac
  68. Hacking Tools Mac
  69. Pentest Tools Url Fuzzer
  70. Hacking Tools Online
  71. How To Make Hacking Tools
  72. Hacker Tools 2019
  73. Hacker Tools Online
  74. Hacking Tools 2019
  75. Nsa Hack Tools Download
  76. World No 1 Hacker Software
  77. Hacking Apps
  78. Hacks And Tools
  79. Hacking Tools Online
  80. Wifi Hacker Tools For Windows
  81. Hacker Tools Mac
  82. Tools For Hacker
  83. Hacker Hardware Tools
  84. Hacking Tools Pc
  85. Hacker Tools List
  86. Hacking Tools 2020