Tuesday, October 20, 2020

Wireshark - Filtering for a Port Knocking sequence

In a recent CTF, I was required to analyze a .pcapng file to find a Port Knocking sequence. I didn't know an easy way to do this, and Google only gave up some half useful answers, so after a bit of research, I decided to write this post in the hopes that someone may stumble upon it in the future :)

Filter: (tcp.flags.reset eq 1) && (tcp.flags.ack eq 1)



Make sure that the order number is correct (The "No." column goes from lowest to highest), and read the Port number on the left in the "Info" column.

In this case, the sequence is 7864, 8273, 9241, 12007, 60753, so a:

> knock 7864 8273 9241 12007 60753 -t 500

Would get you what you need. 

I found that sometimes you might need to knock 2 or 3 times before the filtered port opens for some reason, but there you go!

Wednesday, August 12, 2020

What looks like binary, but isn't?

Whilst doing a CTF, I came across a crypto challenge similar to the following that looked like binary:


After it failed decoding AS binary, I tried the Magic option on CyberChef which failed, and several variations of the Baconian cipher - Which also failed.

After much searching and many failings, I came across Spoon - An esoteric programming language whose code looks like binary. A quick Google search led me to this online interpreter from dCode. Pasting in the text and clicking the "Execute" button got me the result I needed!

Wednesday, July 8, 2020

Exploiting Webmin 1.890 through cURL

In a recent CTF, I came across a legacy version of Webmin with a Metasploit module. I prefer to do things without Metasploit, so decided to use cURL.

  • In the above, you can see that Webmin is running by the page title - "Login to Webmin" and the version - "Server: MiniServ/1.890"

    This specific version of Webmin has a backdoor with an associated Metasploit Module. The exploit looked easy enough, so I decided to do it manually.

  • Basic code execution.

  • We're already root...

  • And there's the flag. I won't cat it in this post, but there you go.