Shadowflux

JavaScript ( (__ = !$ + $)[+$] + ({} + $)[_/_] +({} + $)[_/_] )

2011-01-21T13:43:00.000-08:00

First off credit where credit is due.

Update 1: Well hello reddit and hackernews.

1) I didn't write this JavaScript.
2) I didn't find this JavaScript.

I saw it in a slide deck from BlackHat DC 2011. Called XSS Street-Fight. Most of the presentation was dry JavaScript /mod_security, but this caught my eye.

($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+
($$=($_=!''+$)[_/_]+$_[+$])])()[__[_/_]+__
[_+~$]+$_[_]+$$](_/_)

Care to guess what that does?

How about if I type it like this.

($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+
($$=($_=!''+$)[_/_]+$_[+$])])()[__[_/_]+__
[_+~$]+$_[_]+$$](document.cookie)

That's right this is an alert() if it lands anywhere in
an executable section of JavaScript/dom it pops up the cookie.

Go ahead and put it in a script tag in your browser it will pop up a "1"

That's when I couldn't put this down.

First there are really two lines here.

($ = [ $=[]] [ (__ = !$ + $ )[ _ = -~-~-~$] + ({} + $)[_/_] + ( $$ = (
$_ = !'' + $)[_/_] + $_[+$] ) ] )()

becomes sort()

[__[_/_]+__[_+~$]+$_[_]+$$](_/_)

becomes alert(1)

Let's start to tear this apart.

$=[] is a blank array

$=[$=[]] is an array with a reference to an array.

So $ derefs to the value 0.

Now we have a 0 we can freely reference.

__ = "false"via (__ = !$ + $ )
_ = -~-~-~$

(The ~ operator in JavaScript means -(N+1) so -~ = +1
if $ = 0 then -~-~-~$ = 3

_ = 3

thus _/_ = 3/3 = 1

(__ = !$ + $ )[ _ = -~-~-~$]
("false")[_]
("false")[3]
"false"[3] = s

({} + $)[_/_]
(" object")[_/_]
(" object")[1]
" object"[1] = o

$$ = ( $_ = !'' + $)[_/_]
$$ = ( "true")[1]
"true"[1] = r

$_[+$] = "true"[0] = t

$_ = "true"null
$$ = rt via

($$ = ( $_ = !'' + $)[_/_] + $_[+$] ))

!'' = "true"
$_ = (true)
$_[1] = r
$_[0] = t
$$ = rt

Thus the first line becomes sort()

($ = [ $=[]] ["s" + "o"+ "r"+ "t" ] )()

Sort takes a function as it's parameter to
execute thus firing the second line. It turns out this assumption was wrong on my first go. Scroll to the bottom for the updated explanation I quote from Benjaminsen .

[__[_/_]+__[_+~$]+$_[_]+$$](_/_)

$ = 0
_ = 3
__ = "false"
$_ = "true"
$$ = "rt"

[__[_/_]+__[_+~$]+$_[_]+$$](_/_)

becomes
[__[1] + __[3 + -1] + $_[3] + $$)(1);

becomes
["false"[1] + "false"[3 + -1 ] + "true"[3] + "rt"] (1)

[ a + l + e + r + t ](1)

alert(1)

From Benjaminsen @ reddit.

"


($=[]["sort"])()["alert"](1)

We can further break that into

a = []          // Create array
b = a["sort"]   // Get reference to sort method
c = b()         // Execute sort outside the context of an array to return a reference to window
d = c["alert"]  // Get reference to window.alert
d(1)            // Execute window.alert with the argument 1

So what happens is

window["alert"](1)

not

[1,2].sort(alert)

"

Enjoy!

LolCat 5509 Part 1

2009-07-19T10:16:00.000-07:00

About two years and a half ago I was looking for any type of high end Cisco equipment to learn on, fuzz, reverse, etc. As it turns out it isn't the easiest thing to get your hands on a piece of affordable top end gear. After spending a few months looking for some new equipment I called off the search and began to focus on other projects.

Not long after I quit looking I got a call from a friend that was at a computer recycling shop near where I lived. He had two Cisco 5509s for $80. Willing to take my chances that I'd be able to fix or part them back to health I had them purchased and he was kind enough to deliver them to my door the next week.

I cut a notch into a standard power cable and both booted right up! No fuss, no debugging, and no logic analyzer needed. I consoled into the device and our eyes both went wide at the same time. They still had their running configuration.

We paged through line after line of config, kerb keys, password hashes, username -> port assignment, acls, it was all still intact.

Dumbfounded we looked at each other and called our friends at the company domain that was listed.

By dumb luck we both knew several of the individuals on their security team and emailed them pictures of what we had found.

Apparently this caused a fire drill of which I am never allowed to speak. Much of the credential information we had gleaned was still valid on large parts of their network.

Having talked to them about the aftermath. Three different processes had failed. The company was supposed to wipe the gear before it was deracked. The reseller it was sold to promised to wipe the gear before it was sold. The recycler claimed they also wiped everything that came in the door. All three processes happily failed leaving me with two LolCat5509s.

Two years later I have no need for 12u worth of switch anymore. I've decided to spiff up my remaining 5509 and return it to the company from once it came. Stay tuned for more updates of the Lolcat5509.

Ride the Pwnie Down the Rainbow

2009-07-06T17:57:00.000-07:00

This last weekend at Toorcamp presented my current research on using CUDA to speed up more complex fuzzing operations like checksums and crypto algorithms. The slides are posted here.

Makerbot Part 3

2009-07-01T20:52:00.000-07:00

Bre crashed out at my place before ToorCamp and gave me a hand working some of the bugs out of my Makerbot. It turns out most of my problems came down to my surface mount soldering needing a bit of work. I didn't want to risk frying the ICs on the 11 makerbot boards so I did them by hand. Thus after hitting all of the pins again with a soldering iron all the electronics bugs went away.

It makes me happy that I got one of the models that required building the boards by hand. Seems the next models will be prefabbed. Bre spents a while getting the tension out of the z stage in the machine it turns out my screws needed a bit of love and he did a few hacks he learned taking his on the road. I gave him some feedback on the build process and docs.

Weee into the morning we got our first extrusion out of Raven and success was ours!

We both passed out for a few hours then the next morning Bre printed me a Makerbot Coin and I printed out a D20.

This was an amazing amount of fun to get together, and I'm hoping to hack it up more soon stay tuned!

Makerbot Part 2

2009-06-23T20:32:00.000-07:00

The second Round of making the um.. makerbot has been underway. I've been put at a stand still while I wait for the motor that feeds the plastic in the extruder.

: Small Dino: What relic is this? Big Dino: Relic?! Boy when I was your age this was top of the line plastic extruding nozzle. Relic HA Kids...

In the mean time I've made some good progress towards my goal and can't wait to get this thing online.

: Big Dino: For behold little one THE MONOLITH! Small Dino: *GASP*

Telecom Museum

2009-06-23T08:11:00.000-07:00

I finally made it out to the telecom museum this week after being on my todo list for nearly two years.

We got the grand tour from a nice man who showed us some of the museums more creatively acquired pieces.

Hearing the mechanical switches and relays clicking and clacking as a call was being routing was an amazing experience. I could have only wished there was more volume of calls to hear the machines at full tilt. It must have been deafening to work in those rooms.

Amoung the dust I spotted a magnetic core memory module and our tour guide and I geeked out about early memory designs and weaving.

A what?

2009-06-22T09:15:00.000-07:00

adamcecc: bought a 2x teleconverter today
person1: Yah?
adamcecc: yeah
person1: Has it arrived yet?
adamcecc: bought a 2x teleconverter today
adamcecc: so no
person1: You could have gone to a store. :)
adamcecc: a what?
person1: Hah.
person1: It's like someone used a 3d printer on a website.
person1: Less selection, though.

Westward

2009-06-14T17:14:00.000-07:00

JonM and I spent the better part of Saturday finishing up his house for sale. I haven't scrubbed that many floors since my days at Bob Evans.

We headed west with the destination of Ruby Beach in mind for some pictures and to get out of Seattle for a while.

We the took the edmonds ferry headed westward.

After a short stop in Port Glen we moved onto Dungeness Spit.

Sadly like in many of my hobbies both Time and Euclid were against us and it appeared if we weren't going to make Ruby Beach before sundown. We pulled into the spit for some pictures.

This fellow kept an ever watchful eye while we took pictures of the sunset.

As it turns out he wasn't alone.

Jon and I moved on to the larger spit and caught the sun as it was setting over Canada.

We stayed the night in Port Angelous and headed home way of this infernal machine.

It was an great way to chill out for a day and geek out with our cameras. We plan to head west again in search of Ruby Beach and other destination with more time in tow.

Makerbot Part 1

2009-06-12T20:44:00.000-07:00

I've had a bit of spare time these last two days and decided to tackle the Makerbot I ordered back in April. The kit comes completely disassembled down to the parts on the circuit boards.

The first part was to spray paint the body of the bot black. I'm planning to do green accents before final assembly. I can't have my mini cnc looking like everyone elses now can I?

Next was the large task of soldering together the 11 circuit boards.

Here are the three stepper motor driver boards parts.

This was way more surface mount soldering than I was willing to do! The makerbot instructions page recommends using the "hotplate reflow technique". The short of it involves squirting paste onto the circuit board carefully placing the components and cooking the board until the paste lightly sizzles. I was skeptical at first but $25 worth of hot plate and solder paste later it would seem this was the way to go.

The soldering went well until I lost a single surface mount capacitor which aren't things you can just run down to your local 5 and dime to pickup. I had some electronics laying around to gut looking for an identical one. In this case an XBox 360 HD-DVD drive was scalped for the replacement part. While I was there I pulled out a few limit switches and the laaaazor! I'll play with those another day.

Thus on I went with my reflowing. What happened late in the night I can't even begin to calculate the odds of. I lost this part

On this floor.

When I finally got all 11 boards assembled I dropped one on the floor. And the missing cap jumped up at me having been shaken loose by the gods!

I quickly snatched up the cap and my board! I don't know how much karma I burned but I'll take my cap back!

With all the boards ready to go I'm moving on to the software testing then assembling the main unit

JRuby, RMI, and Turd Burritos

2009-06-06T17:48:00.000-07:00

I'm pretty sure if I add up the "side projects" or the "can you look at this for a minute" time it is something close to 8x of my actual billing time. Not that I mind helping friends out. A fellow asked for some help on an application and these always tend to be a lot of fun.

Leviathan had been contracted to look at an old as in "your mom" application build on infrastructure dating all the way back to before there were keyboards and code was hammered out with chisels on stone tables. This particular application designer decided that the simplest route was to create a set of RMI request and bundle them into a Desktop client. A Java desktop client.

For those of you playing at home RMI is Remote Method Invocation. Think of it like shouting across the internet and telling a server to do something.

Java in all of its write once run anywhere glory has this funny way of being easily decompiled into source code. Thus once you distribute the client to a customer they basically can look at the internal guts of the application a lot easier than one would look at an application compiled in C or C++. Not that C/C++ can't be decompiled Java just makes it trivial to do.

Now my coworker has the client, the source code, and a valid account on the server in question. The world is basically his oyster, right? Well as it turns out some oysters don't like being opened.

Queue: The enterprise turd burrito. Turd Burrito or ETB for short. If you have a turd that you want your enterprise infrastructure to swallow than you just keep wrapping it in beans, rice and salsa until the IT guys that payed $9.50 don't realize "it's not meat".

To make RMI easier to use and more firewall friendly many J2EE providers wrapped RMI in multiple transport layers. Most notably HTTP, SSL, and some special sauce we'll call "Voodoo magic" This makes the IT guy happy. "I only have to open one port", the security guy shrug, and the developer only marginally less happy. They have to make sure all of their objects really cleanly Serialize (get turned into one long string), but they were going to have to do that anyways.

So just to make sure you've got all of the above in your head.

Client
-> Takes an object
-> Makes it serialize
-> Calls a method
-> RMI voodoo magic happens
-> Unknown Magic
-> HTTP
-> SSL
-> Turd burrito is flung across the internet at whatever server is supposed to eat it.

The way RMI is built it is supposed to make everything past "calls a method" look like magic. You aren't supposed to know where or how your method is being called or passed. This could be on the box next to your feet or calling a method on the Mars Rover. As a developer you're just supposed to call a function and get a value back. This is great if you are a J2EE developer that wants to take out that hottie from accounting. Bad if want the control required to tinker with the thing.

Proxying the RMI methods was not something I was willing to do. I wasn't peeling that many layers of beans and rice, then only to deal with serialization issues. I had the turd sitting right in front of me with the source and methods quietly mocking me. What I needed was a ETB eating machine.

Enter JRuby.

JRuby is the bastard child of a ruby interpreter written in Java and is my new very bestest friend. JRuby is the kind of friend that drools on you occasionally, has a gimp eye, but LOVES to chew up turd burritos. As a note Matasano wrote about using RMI via JRuby a while back.

Now what used to look a task of proxying.

Client
-> Takes an object
-> Makes it serialize
-> Calls a method
-> RMI
-> Unknown Magic
-> Http
-> SSL

Becomes one line of code.

com.XXXX.XXX.ui.net.Request.new(com.XXXX.XXX.ui.user.gadgets, cd, com.XXXX.XXX.ui.Function.DOSOMETHING, new Object[] { com.XXXX.XX.Thing.new(1) }).send();

Instead of unwrapping and rewrapping my ETB. I can inject my own chili peppers hoping the server can't handle the heat and pukes.

Thus like magic my drooling friend JRuby has given me all the control of a hacker, but the comfort and "going home at 5pm on the dot" developers view. Now if I can just find someone to take out in accounting...

So the lesson to be learned is.
1. Less is often more.
2. JRuby rocks my socks even if it does drool a bit.
3. Don't trust your users.
4. Yes someone will take the time to
Decompile the application. -> Find the right remote request -> Hook in with JRuby -> Make fake objects -> Send them off to the server -> Profit!

EIP?

2009-06-06T17:04:00.000-07:00

person1: "eip"?
adamcecc: Extended Instruction Pointer
adamcecc: It is the "next" instruction your computer is going to run
adamcecc: once you take over EIP you own the computer
adamcecc: It is basically what I do for a living
adamcecc: I put a single value in a single register
adamcecc: Sometimes this takes a ton of work
person1: Small job
adamcecc: but its a living
adamcecc: thirsty work.
person1: c'mon...I can think up single values all day
person1: 4
person1: There's one
adamcecc: its $1 to know where to put the value and $9999 for which value to put there ;)

A good weekend

2009-05-31T10:10:00.000-07:00

I finally am recovering

Password Mashement

2009-05-28T09:58:00.000-07:00

person1: So you work in security.
X: Yes.
person1: What do you do for password management?
X: Me? For like logins or web or servers?
person1: The web.
X: I mash the keyboard a few times.
person2: what?
X: I mash the keyboard or play a tune a few times and let firefox and fs crypto take care of the passwords.
person1: Really?
X: Yeah if I'm at a computer that doesn't have my password I just have the site reset it and check my email.
person2: wow.
X: (shrug) everything else is client certs.

How it all began...

2009-05-22T02:29:00.000-07:00

Yesterday I had a doctor visit and had to have blood drawn. It seems every time I go to a doctor these days they are taking more blood from my internal tubes and not giving me back any of the clones. I tweeted about this to which I received the replies

@adamcecc: It's because you're the super soldier, and they are using your blood to make more serum?
@adamcecc: Are you sure they're not just really good at destroying the originals?

Personally I'd have to assume super soldiers are good enough at killing themselves, but I can't help think somewhere my blood is being used to give someone 30 extra lives at Contra.

I have a small fear of needles. Mostly I just don't like getting jabbed or injected. Being stuck with a needle doesn't hurt, the whole experience of being drained is just unpleasant. It seems no matter the amount of blood taken I become light headed for a spell, which makes me wonder how fast my bleed out time really is. On a lighter note the vampire who stole my life essence yesterday had a odd accent. Her accent was so off I inquired about where she was from, turns out she is an immigrant from Transylvania, Romania and has been taking blood for 9 years.

And this my child is how the vampire war began....

Super Hero Pattern

2009-05-21T03:33:00.000-07:00

person1: IIW would likely have been a waste for you
X: yeah? how was it otherwise?

person1: I can see more clearly why you despise the OpenId/OAuth crew
X: :)

person1: It was good to verify what I thought about the identity technologies and space and fun to be in mountain view,but all of the useful conversations were with other CEOs or startups the sessions were very underwhelming
X: yar that's sad to hear

person1: apparently OpenId is a constant headache for implementers
X: and anything doing anything security related

person1: apparently OAuth had a workflow issue and needed to be tweeked last week
X: HA! "workflow issue" it's prob better i wasn't at the conference I'd have decked one of them

person1: I just assumed that people putting together a distributed security spec would be hard core crypto or hackers its more open web evangelists with sessions like "authentication without boring crypto"

X: So the crypto guys solved this problem in the 80s the hackers solved this problem in the 90s
X: the only thing I see these guys doing well is "wrong"

person1: it is huge marketing buzz to support "open" but if the spec is more concerned about how to get an XRD xml file onto a hosted blog then accidentally allowing anyone to request you make claims for them it is an issue but don't worry, these guys will save the day just in time, so they say http://informationcard.net/

X: so we'll call this the super hero pattern? My design is so corrupt it requires Batman to save it...
*X puts on a cape and cowl

I dare you...

2009-05-20T04:54:00.000-07:00

adamcecc: I need to pop into town this summer see you folk
person1: Come on July 4th. I sent U an invite.
adamcecc: Going to a missle silo for the 4th
adamcecc: http://toorcamp.org/
person1: Naturally.
person1: RME (Rolling My Eyes)
adamcecc: ??
person1: I say RME: Because its a weird thing to do on July 4th.
adamcecc: I dare you find me one thing more American than a missile silo
person1: Ah

Demands

2009-03-30T07:55:00.000-07:00

[15:38] * X demands a bowl of green m&ms
[15:39] < person1> We don't negotiate with terrorists.
[15:39] * X executes 2 of his 50 hostages
[15:45] < person2> Only two?
[15:45] < X> I have many demands
[15:46] < person2> Soon to be outnumbered by corpses?
[15:46] < person1> His demands could never be outnumberd by corpses.
[15:47] < person2> It could be fun to watch him try.
[15:47] < person1> From a remote location.
[15:52] < person3> are these hostages me and person4? :[
[15:52] < X> No I'm saving you two for a new laptop

Think

2009-03-09T06:10:00.000-07:00

(12:56:47 PM) person1: You wanna dict brute the secret password for registration?
(12:59:45 PM) adamcecc: it'll be easy to track who did it
(1:26:03 PM) adamcecc: look 40 hackers registered after all this traffic...
(1:26:05 PM) adamcecc: "hmm"
(1:27:33 PM) person1: After what traffic? And which hackers?
(1:27:46 PM) person1: Oohhh nvm
(1:28:02 PM) adamcecc: hahah
(1:28:05 PM) adamcecc: *think*

Sudo make me a sandwich robot (Brooklyn Part 2)

2009-02-27T01:24:00.000-08:00

The better part of my trip to New York was spent at NYCR making the sudo make me a sandwich robot!

Here is the video Bre made of our creation you should check out his blog for more incredible stuff!

Bre and I inspired by our hunger and the XKCD comic conceived the project on his last visit to Seattle.

The project used an Ardiuno board, two RepRap stepper motor controller boards, two random stepper motors, two servos, and one sacrificial toaster over.

This project was an amazing amount of fun.

Check out more picture from the project and both Bre's and my flickr streams.

The arduino code for this project is here.

Brooklyn Part 1

2009-02-24T02:43:00.000-08:00

I spent the weekend in Brooklyn hacking with Bre. (More on that soon)

In between the robotic madness we ran around taking pictures.

Highlights included this man who was washing his rags from a fire hydrant.

The Park Slope CO-OP is the first and last of it's kind.

Everyone that shops there is also required to work there 2.5 hours a month? (Don't recall the exact cycle) They manage 13,000 employees/customers/owners and the store is constantly busy. Bre signed me in as a guest the experience is quite interesting. The entire store literally crawls with such a high level of dedication and customer base the entire inventory turns over nearly daily.

Anyone can pickup the PA and ask for help or say pretty much whatever they want. As I found out later in the weekend one of my friend's mother was a founding member of the COOP.

On Suday I jumped a train across the bridge and shared dinner with Pratik and Stephanie. Always good company and food I do so miss them since they've move to NYC. We discussed the finer points of the Oscars, scalability, why people love people that are like cats, and Steph got me hooked on the Facebook game Mob Wars.

Cats shed, bite, scratch, purr, cuddle, and whine for food. (Very much like myself) However, the cat is such an independent creature that it really couldn't care whether you were alive or dead. Thus when a cat decides you are worth spending time, scratching, cuddling, whining to it reflects not on the cat, but how awesome you are.

Purrr.