The DMZ

« first day (2746 days earlier) ← previous day next day → last day (2155 days later) »

forest

1:50 AM

@JoshuaJones I was dead for a while, but I'm alive now.

8 hours later…

Anonymous

9:54 AM

@forest Dammit we missed each other again shrugs

Benoit Esnard

12:48 PM

To anyone in CTF team: Google CTF has started

Anonymous

1:00 PM

There was no post on Meta :'(

Anonymous

I probably dont have the skill or time anyway so >.>

Tom K.

1:40 PM

just came back from a wedding

my brain is mush :/

Anonymous

Oh yeah I remember you saying you're at a wedding.

Anonymous

I'm just looking at the Google challenges some of these look way over my skillset lol

Tom K.

if you have time, just give em a try

doesnt hurt ;)

Anonymous

Yeah that is true.

Anonymous

One thing I really need to learn at least a little bit about is JS

Tom K.

1:51 PM

except if your brain is mush

Anonymous

Because I know almost nothing about it.

Tom K.

nah, nobody needs to learn that

Anonymous

Well I see it everywhere especially in CTFs and Wargames.

Anonymous

And I read the code and I am constantly Googling what every line is doing pretty much lol.

Anonymous

I am aware of how horrible people say it is though.

daya

3:41 PM

Hey Joshua, JS is very easy to learn if you are already familiar with C language.

Anonymous

It's not difficulty that is the problem.

Anonymous

It is time.

Anonymous

I am going to change my name back to Josh so people don't call me Joshua all the time lol.

user2284570

5:05 PM

@Kepotx with recapthcha, if you only solve recaptcha without using other services, you’re likely to get classified as a bot. Even with the correct answers.

2 hours later…

forest

7:27 PM

JS is ugly.

I mean it can be useful to know just because it's so ubiquitous.

But it's ugly.

I take issue with your use of the phrase "absolutely no benefit". A user who could run sudo tcpdump -i lo0 would be able to see all traffic in plain text. If the microservices had sensitive data transmitting (i.e. DB and web server) this would expose that data. — Joe M 5 hours ago

lmao

I was going to delete my answer (since there's like 5 dupes), and came across this gem. TLS over localhost to prevent against tcpdump sniffing! Ha! I would love to know what this guy's threat model is.

Anonymous

8:22 PM

What Q is this on/

Anonymous

Also @forest I need your opinion on this RFC -crypto.stackexchange.com/questions/60207/…

Anonymous

Or rather I need help answering the question..

forest

8:42 PM

@JoshuaJones A sequence number and a nonce usually are distinct.

(Though sometimes a sequence number is used as a nonce, but it does not need to be).

Anonymous

Oj.

Anonymous

Oh*

Anonymous

But then its vulnerable to replays?

forest

A nonce is usually a value in cryptography that merely has to be unique so you can use the same key for multiple encryptions. If the nonce never repeats, then the key-nonce tuple is always distinct.

A sequence number might be authenticated or not. I don't know if it is in OSPF. I'll have to check the RFC.

routingfreak.wordpress.com/2011/04/05/…

> The cryptographic sequence number can protect us from what i call the intra-session replay attacks. However, it cannot protect us against inter-session replay attacks.

@JoshuaJones So it looks like, within a single session, you cannot replay a packet. However when the next session is established, the sequence will obviously repeat. So if you captured packet 6104 from the first session, you can't replay it again. But you can replay it right after packet 6103 in the second session.

Anonymous

Right......

Anonymous

8:47 PM

That makes so much more sense

Anonymous

I've been so confused with it for days.

forest

Also, from the RFC:

> The value used in the sequence number is arbitrary, but two suggestions
are the time of the message's creation or a simple message counter.

Anonymous

forest

And it looks like the sequence number "verification" is nothing more than checking whether or not a subsequent packet has a sequence number larger or smaller than the previous packet.

Anonymous

I've read it twice I just didn't get the sequence number bit.

forest

8:49 PM

Hence the requirement of "non-decreasing".

Anonymous

Ahhh

forest

So packet 1 could have sequence number 555. If packet 2 has sequence number 554 or 444 or 123, it'll be rejected. If it has sequence number 556, or 666, or 100000, it'll be accepted (and the next packet must have a sequence number larger than that).

Anonymous

Yeah that makes total sense.

Anonymous

I might finally be able to finish my answer.

forest

So a simple packet counter would work, or the packet creation time (as suggested by the RFC). It seems like this is done to prevent routing weirdness from causing packets to be received out of order, not so much to prevent active attacks.

Anyway that's the gist of my understanding from skimming the RFC.

> If the calculated digest does not match the received digest, the message
is discarded unprocessed. If the neighbor is in a state other than DOWN
or ATTEMPT and the received sequence number is less than the last one
received, the message likewise is discarded unprocessed. The received
sequence number must, of course, be stored by neighbor and zeroed upon a
"neighbor down" event. Acceptable messages are now truncated to "OSPF
Data Length" and treated normally.

I have to say, this is a very ugly protocol.

Anonymous

8:52 PM

OSPF?

Anonymous

Well it's very good for routing.

Anonymous

But it features no security.

forest

Also, you might find RFC 6863 interesting.

Anonymous

Apart from the fact of this MD5 authentication.

forest

So while in theory, intra-replay can be protected, OSPF does not do this.

So both intra- and inter-replay attacks are possible.

Anonymous

8:53 PM

Just as a note: post an answer.

Anonymous

Because I think you're understanding of reading the RFC is much better than the current answer.

Anonymous

Plus I think you will get a view UVs (One from me and an accept)

forest

For which question?

Anonymous

Q: What is the point of using a cryptographic sequence number if you're not using it as a nonce?

OSPF features the use of Auth Crypto Sequence Number however, from reading the RFC it would appear the sequence number is not being used as a nonce. In addition, a non-decreasing sequence number is included in each OSPF protocol packet to protect against replay attacks. This provides lo...

forest

Anonymous

8:56 PM

Meanwhile I am doing one of the boxes on HackTheBox and I am struggling to priesc.

Anonymous

My last theory is to try DirtyCow and if that doesnt work I will get back to it tomorrow.

forest

(Writing an answer now)

@JoshuaJones DirtyCow is not the only privesc vulnerability out there!

What kernel version is it?

Anonymous

I know. But I'm out of fucking ideas.

Anonymous

Been sat here for around three hours on and off.

Anonymous

And I literally cannot esc.

Anonymous

8:58 PM

Um let me log back in the box and find out.

Anonymous

Oh I closed my fucking vm

Anonymous

I will just take a break for tomorrow

Anonymous

Today*

forest

A: What is the point of using a cryptographic sequence number if you're not using it as a nonce?

The sequence number is not designed for cryptographic purposes, merely to mitigate pathological routing bugs. According to RFC 6863 § 3, the sequence number does not prevent replay attacks within the session, nor does it prevent replay attacks against subsequent sessions: As discussed, neithe...