Jekyll2021-12-12T11:31:06+05:30https://csea-iitb.github.io/IITBreachers-wiki/feed.xmlCTF-wiki of IITBreachers deuteriumzehrileLaunde@protonmail.com2021-02-28T00:00:00+05:302021-02-28T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2021/02/28/Intro%20to%20Linux%20Kernel%20ModulesRahulrahul.bt.bt@gmail.com

In this post, we will introduce the reader to writing Kernel Modules for Linux. What are Kernel Modules? Kernel Modules are pieces of code that can be loaded into the kernel while the kernel is already running. Modules extend the functionality of the kernel. Many modules are already loaded into the kernel by default (built-in modules) (eg. mouse and keyboard drivers). But what if we need some functionality that is not already built-in? This is where loading new modules without rebooting the system comes in handy (loadable modules) (eg. you plug in a printer whose driver was not already present). The examples provided mostly focus on device drivers but we can do pretty much anything with kernel modules. It is literally adding your code to the kernel which implies that these modules run with kernel privileges (ring 0) (In later posts we will write some rootkits as well :) ). It is advised to build these modules in a virtual machine to prevent corruption and to revert back to previous states of the operating system without much trouble. Now let’s begin. Writing a Simple Module Kernel modules are written in C. As always let’s start with writing Hello World!. The code for this is: #include <linux/init.h> #include <linux/kernel.h> #include <linux/module.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Rahul"); static int __init hello_init(void) { printk(KERN_ALERT "Hello World!\n"); return 0; } static void __exit hello_exit(void) { printk(KERN_ALERT "Module Removed!\n"); } module_init(hello_init); module_exit(hello_exit); We will walk through the above code line by line. Firstly we have few #include statements that include some macros that we have used in the program. Next we define the macros MODULE_LICENSE and MODULE_AUTHOR. Defining the license macro is important as without it, the kernel will complain while loading the module. GPL is the General Public License and if you do not have MODULE_LICENSE("GPL") then symbols that are exported via EXPORT_SYMBOL_GPL() will not be visible to your module. This is how Linux enforces what code is considered to be a derivative work of Linux. Next we have the init and exit functions that all modules MUST have. The init function hello_init in our case runs when the module is loaded into the kernel and the exit function hello_exit is called when the module is removed from the kernel. The init function is used to initialize variables and get information about hardware and other devices but here we just print “Hello World!”. The exit function is used to free memory and is used as a clean-up function (The kernel runs along with all user-space programs and does not have a lot memory. That is why freeing space is very important while working with the kernel) (On 32-bit systems the entire Linux kernel has only 1 GB of virtual memory). Notice the use __init and __exit macros while defining the function. These tell the kernel that these functions are used only while the module is loading and being removed respectively. The kernel can then allocate memory for these functions only while loading and unloading the module. Finally notice how we use printk instead of the usual printf. printk is the print utility function defined in the kernel. When the kernel is built there are no standard C libraries (glibc) in memory and hence the kernel needs it’s own printing function. Also, here we have the KERN_ALERT macro that sets the “level” of the message to be printed. Here, we use the high “alert” indicator so that our string is printed almost everywhere the kernel displays messages. We can also use lower levels by using KERN_INFO or KERN_DEBUG. Building Kernel Modules Now that we have written our module, it is time to build it. For that we use the make utility. Here is the Makefile. obj-m += hello.o all: make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules clean: make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean This is different from the usual Makefile. Here, the Kernel’s build utility takes care of the rest. Assuming your file is called hello.c running make will give you many intermediate files but also a hello.ko file. This is a kernel object file. To load it into the kernel, run insmod hello.ko (You will have to switch to root to do this). Now if you run dmesg which displays kernel messages you should find our message “Hello World!” at the bottom. It will probably be highlighted because we used 1KERN_ALERT. Now if you run rmmod hello you will find our exit message in the output of dmesg. You can list all loaded modules using lsmod. Finally, we have built our first module that does nothing :P. In later posts we will try to do something useful with our modules. For more resources on Linux and Kernel Modules: Linux Device Drivers Book LiveOverflow Linux Device Drivers Video

2020-08-01T00:00:00+05:302020-08-01T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/Hacking%20Sitesdeuteriumfarziemailid69@gmail.com

There are plethora of challenge/hacking sites where one could find cool challenges any time of the year. Some of them are ranked and have their own scoreboards while others are there just for learning sake.

2020-08-01T00:00:00+05:302020-08-01T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/contributionsdeuteriumfarziemailid69@gmail.com

This is an open-sourced website hosted on github pages! We aim to build an awesome cybersecurity community, and for a community we require active members and collaborators who share their knowledge!

2020-08-01T00:00:00+05:302020-08-01T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/what%20are%20assignmentsdeuteriumfarziemailid69@gmail.com

Assignments are the way to get quick hands on tasks and challenges. There will be plenty of hands-on experience through a guided set of static challenges.

2020-08-01T00:00:00+05:302020-08-01T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/What%20Are%20CTFsdeuteriumfarziemailid69@gmail.com

CTF or Capture The Flag in context of computer security, are special kind of information security competitions which serve as a gamified educational exercise to give participants experience in securing a machine as well as conducting and reacting to sort of attacks found in real world or some (supposedly) fun programming concept otherwise.

2020-08-01T00:00:00+05:302020-08-01T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/08/01/welcomedeuteriumfarziemailid69@gmail.com

Welcome to ctf-wiki and assignments page of CSE Cybersecurity Club, IIT Bombay

2020-07-27T00:00:00+05:302020-07-27T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/07/27/Buffer%20Overflow%20Part%201jsahil730jsahil730@gmail.com

Oh hey, welcome to the world of Buffer Overflows. Let’s embark on our journey to the world of binaries with the most basic exploits ever - Stack Overflows. We’ll learn a lot of stuff, including totally useless awesome assembly, and how binaries work :wink:

2020-07-27T00:00:00+05:302020-07-27T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/07/27/Game%20Hack%20IntroductionRahulrahul.bt.bt@gmail.com

Here, we’ll explain what game hacking is. What is Game Hacking? Game Hacking is finding “Game Logic” flaws (A recent Age of Empires 2 : Definitive Edition patch had a bug that increases ingame resources on spending them xD) or finding other ways to change the behaviour of the game. Although, nobody should cheat while playing games online (could get yourself banned and it also disrupts the community) it can be fun and can teach you many things related to processes, data structures, memory and also game developement. “Game Logic” flaws are exploited by speedrunners whose goals are to complete the game as fast as possible (like completing NFS:MW in 3 hours 41 minutes). Also, many professional hackers have said that they started getting into their profession through hacking games. So, how do we get started in game hacking? Getting Started There are various tools available online for game hacking. You can find books, video tutorials (Guided Hacking, ZeroMemory, LiveOverflow on YouTube), tools and much more on the internet. One of the most used tools is Cheat-Engine (Cheat-Engine is a free software. But be careful while installing it. During installation it will also prompt you to install adware which messes up your browser and is also not easy to remove :( But we can refuse to install the adware and now we are good to go :) ). Cheat-Engine allows us to modify a game’s (or any other process’s) memory while it is running. Why is modifying memory important? Every ingame property like our player’s HP (hit-points), ammo, armour or even the victory condition is stored in the memory. Now if we can modify these properties while the game is running we can do anything. Doing this manually every time can be boring and just useless really :P but we can write scripts to automate this. Online Games The above techniques do not work on most online games. This is because the main “Game Logic” runs on a server and modifying these variables locally will not do anything as these are maintained and updated by the server (It may still work if the server updates these variables from the client or the game is peer-to-peer). But this doesn’t stop us (again, do not try this in online competitive games. It may ruin another player’s experience. This is just for learning and having fun). We can still modify how the game interacts with the client i.e. we can write scripts to do what a normal human player cannot. We can create aim-assists, wall-hacks, movement hacks (We will write some of these in our later posts) for FPS (first person shooter) games and map-reveal and other hacks on RTS (Real Time Strategy) games. This is because all of this data is already present on the client or is dependant on client-interaction. Other Techniques Game Hacking can be as simple as changing memory using Cheat-Engine (or any other tool) to using advanced process injection techniques like DLL injection (Injecting our own dll into the the game’s process), DLL hijacking (Load our dll into the game’s process instead of the intented one), using Code Caves (Use unused bytes in the game’s process’ memory to inject our code) or any other technique (Read Game Hacking by Nick Cano for more). We can also patch our game binary to included our hacks. Mitigation To stop these cheats, games and online clients (Steam, Riot, Game-Ranger, Voobly, etc) use Anti-Cheat softwares. These softwares, like Valve Anti-Cheat (VAC), PunkBuster, Vangaurd and others, detect (or atleast try to detect) external programs interfering with the game. Developing these Anti-Cheat softwares is quite challenging as cheaters always find new ways to bypass these softwares and increase their stealth. So the fight between cheaters and anti-cheat developers is always progressing. Game clients and organizations encourage the community (i.e. us) to report cheaters and keep the online gaming environment clean and healthy. For more materials on Game Hacking: ZeroMemory YouTube Channel LiveOverflow Game Hacking Playlist Guided Hacking YouTube Channel

2020-07-27T00:00:00+05:302020-07-27T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/07/27/Writing%20CSGO%20Bhop%20ScriptRahulrahul.bt.bt@gmail.com

Here, we’ll explain what game hacking is and create a simple script. What is Game Hacking? If you have ever played multi-player games online you may have encountered them. These people will shoot you in the head even before you can see them or be completely invincible (Do not try this, you can get banned :P and it is not good for the community). They use bugs in game logic or write scripts to change game memory however they want. Anyways, game hacking can be a lot of fun and teach you more about process memory and data structures in general. How does Game Hacking work? Let’s start with an example. Counter-Strike:Global Offensive is a first person shooter (FPS) game. This game is a 5v5 where one of the goal is to eliminate the enemy team. Being multi-player and the way it is designed, the main “game logic” runs on a central server so we cannot modify game properties as those are maintained by the server. But what we can change is how the client i.e. ourselves interact with the game. We can write aim-assist scripts that automatically place our crosshair on our enemy or movement scripts like bunny-hopping (bunny-hopping or bhopping is a technique to move faster ingame. Bhopping uses continuous jumps while strafing to increase player velocity). Let’s write a script for bhopping :) Analyzing Memory First we need to find certain data-structures in our game’s memory. We can assume that our game has a structure for our current player (say Player1). We need to locate the starting address of Player1 in the process’s memory. We can inspect memory using Cheat-Engine and other tools but for now we will find these online (many repositories on github maintain global game offsets). As the game is updated regularly these offsets change but they are constant within an update or patch. Next we find whether our player is on the ground or in the air (OnGround variable inside the Player1 structure). This can be found online aswell. At the time of writing this post it is at 0x100 after the start of our Player1 structure. Player1 is at an offset of 0x00A77D2C from the start of client.dll which contains the client code of the game. Writing Code Now we begin to actually writing our script. First we create a class to contain the variables and methods that we need. class Game { public: DWORD ModuleBase; HWND window; DWORD player; DWORD pid; HANDLE handle; Game(const char* window_title); //Constructor ~Game(); //Destructor template <typename T> T* Read(DWORD addr); //ReadProcessMemory template wrapper bool OnGroundCheck(); //Check if player is on the ground DWORD GetModuleBase(const char* module_name); //Get base of loaded module (client.dll) }; Next, we need a handle to our game (A handle is an object that we can use to access our game inside our script) and find our module i.e “client.dll” inside its memory. To do that we use the standard Windows API. while (this->window == NULL) //Loop till find Game (Game Process may not have started) { this->window = FindWindow(NULL, window_title); if(this->window == NULL) { cout<<"Error finding window"<<endl; } } //Get PID GetWindowThreadProcessId(window, &this->pid); //Open process this->handle = OpenProcess(PROCESS_VM_READ, 0, (DWORD)this->pid); if(this->handle == NULL) { cout<<"Error opening process"<<endl; } this->ModuleBase = this->GetModuleBase("client.dll"); DWORD Game::GetModuleBase(const char* module_name) { HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, this->pid); if(snapshot == INVALID_HANDLE_VALUE) { cout<<"Error creating snapshot"<<endl; } MODULEENTRY32 module_entry; module_entry.dwSize = sizeof(MODULEENTRY32); BYTE* module_base = 0; if (snapshot && Module32First(snapshot, &module_entry)) { while (Module32Next(snapshot, &module_entry)) { if (lstrcmpi(module_entry.szModule, (LPCSTR)module_name) == 0) { module_base = module_entry.modBaseAddr; break; } } } CloseHandle(snapshot); return (DWORD)module_base; } Thirdly, we write a function to check if our player is on the ground or in the air. //Check if player is on ground bool Game::OnGroundCheck() { UINT16 flag = (UINT16)this->Read<UINT16>(this->player + 0x100); //OnGround flag at 0x100 from player if(flag == 256) { return FALSE; } return TRUE; } Then we keep spamming our jump key to constantly keep jumping. We do this using SendMessage function in the Windows API. while (1) { CSGO.player = (DWORD)CSGO.Read<DWORD>(CSGO.ModuleBase + 0x00A77D2C); //Player-Base offset in client.dll if (GetAsyncKeyState(VK_SPACE) && CSGO.OnGroundCheck()) { SendMessage(CSGO.window, WM_KEYDOWN, VK_SPACE, 0x390000); SendMessage(CSGO.window, WM_KEYUP, VK_SPACE, 0x390000); } } Putting it all together Now all that is left, is to combine everything and add few stdout lines for convenience. Our final code looks like this… //CSGO bhop script (KEEP SPACE PRESSED) (Compile with -fpermissive to neglect typecasting precision loss) //Just for fun :P #include <iostream> #include <Windows.h> #include <TlHelp32.h> using namespace std; class Game { public: DWORD ModuleBase; HWND window; DWORD player; DWORD pid; HANDLE handle; Game(const char* window_title); //Constructor ~Game(); //Destructor template <typename T> T* Read(DWORD addr); //ReadProcessMemory template wrapper bool OnGroundCheck(); //Check if player is on the ground DWORD GetModuleBase(const char* module_name); //Get base of loaded module (client.dll) }; //Constructor Game::Game(const char* window_title) { while (this->window == NULL) //Loop till find Game (Game Process may not have started) { this->window = FindWindow(NULL, window_title); if(this->window == NULL) { cout<<"Error finding window"<<endl; } } //Get PID GetWindowThreadProcessId(window, &this->pid); //Open process this->handle = OpenProcess(PROCESS_VM_READ, 0, (DWORD)this->pid); if(this->handle == NULL) { cout<<"Error opening process"<<endl; } this->ModuleBase = this->GetModuleBase("client.dll"); } //Check if player is on ground bool Game::OnGroundCheck() { UINT16 flag = (UINT16)this->Read<UINT16>(this->player + 0x100); //OnGround flag at 0x100 from player if(flag == 256) { return FALSE; } return TRUE; } //ReadProcMem template wrapper template <typename T> T* Game::Read(DWORD addr) { T* value; ReadProcessMemory(this->handle, (LPVOID)addr, &value, sizeof(T), NULL); return value; } //Get base of client.dll DWORD Game::GetModuleBase(const char* module_name) { HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, this->pid); if(snapshot == INVALID_HANDLE_VALUE) { cout<<"Error creating snapshot"<<endl; } MODULEENTRY32 module_entry; module_entry.dwSize = sizeof(MODULEENTRY32); BYTE* module_base = 0; if (snapshot && Module32First(snapshot, &module_entry)) { while (Module32Next(snapshot, &module_entry)) { if (lstrcmpi(module_entry.szModule, (LPCSTR)module_name) == 0) { module_base = module_entry.modBaseAddr; break; } } } CloseHandle(snapshot); return (DWORD)module_base; } //Destructor (Close handle to process) Game::~Game() { CloseHandle(this->handle); } Game CSGO = Game("Counter-Strike: Global Offensive"); int main(void) { cout<< "PID: " <<CSGO.pid<<endl; while (1) { CSGO.player = (DWORD)CSGO.Read<DWORD>(CSGO.ModuleBase + 0x00A77D2C); //Player-Base offset in client.dll if (GetAsyncKeyState(VK_SPACE) && CSGO.OnGroundCheck()) { SendMessage(CSGO.window, WM_KEYDOWN, VK_SPACE, 0x390000); SendMessage(CSGO.window, WM_KEYUP, VK_SPACE, 0x390000); } } return 0; } Now we can compile and and run our program along side CS:GO. Keep the Space (Jump) key pressed to enable our script. For more materials on Game Hacking: ZeroMemory YouTube Channel LiveOverflow Game Hacking Playlist Guided Hacking YouTube Channel

2020-07-24T00:00:00+05:302020-07-24T00:00:00+05:30https://csea-iitb.github.io/IITBreachers-wiki/2020/07/24/Hacking-a-PS4zer0zer0.h6ck@gmail.com

Hacking PCs is so 2000, let’s hack a PS4! Okay, hacking PCs is not so 2000s but still, for my first blog post here I decided to spice things up and show you guys a (now patched) race vulnerability that can be used for a local privilege escalation attack on the PS4 (and also FreeBSD 9 and 12).