diff --git a/Misc/12Sec_CTF_V1/01.md b/Misc/12Sec_CTF_V1/01.md new file mode 100644 index 0000000..e02f681 --- /dev/null +++ b/Misc/12Sec_CTF_V1/01.md @@ -0,0 +1,24 @@ +# **Challenge 1: "Serial Snitch"** + +As a skilled hardware hacker, you've intercepted a mysterious device recovered from a rogue tech syndicate. The device, dubbed **"Specter-1"**, controls access to a secret underground server, but its interface remains locked behind an unknown UART configuration. + +Your mission is clear: + +1. **Identify the UART pins** you've uncovered during your investigation. +2. **Determine the correct baud rate** to establish a stable connection. +3. **Access the device’s command interface** and unlock control over the system’s lighting grid. + +--- + +## Findings + +#### setup +![PwnPad main board](docs/pwnpad.png) + +The baudrate was a standard one, simply connecting the right wires using the corect baudrate I was able to gain access (and the flag) + +Of course I made a glitch-o-bolt config for this: [01_GoB_config.py](docs/01_GoB_config.py) + +It looks as follows: + +![glitch-o-bolt](docs/01_GoB.png) \ No newline at end of file diff --git a/Misc/12Sec_CTF_V1/01.md b/Misc/12Sec_CTF_V1/01.md new file mode 100644 index 0000000..e02f681 --- /dev/null +++ b/Misc/12Sec_CTF_V1/01.md @@ -0,0 +1,24 @@ +# **Challenge 1: "Serial Snitch"** + +As a skilled hardware hacker, you've intercepted a mysterious device recovered from a rogue tech syndicate. The device, dubbed **"Specter-1"**, controls access to a secret underground server, but its interface remains locked behind an unknown UART configuration. + +Your mission is clear: + +1. **Identify the UART pins** you've uncovered during your investigation. +2. **Determine the correct baud rate** to establish a stable connection. +3. **Access the device’s command interface** and unlock control over the system’s lighting grid. + +--- + +## Findings + +#### setup +![PwnPad main board](docs/pwnpad.png) + +The baudrate was a standard one, simply connecting the right wires using the corect baudrate I was able to gain access (and the flag) + +Of course I made a glitch-o-bolt config for this: [01_GoB_config.py](docs/01_GoB_config.py) + +It looks as follows: + +![glitch-o-bolt](docs/01_GoB.png) \ No newline at end of file diff --git a/Misc/12Sec_CTF_V1/README.md b/Misc/12Sec_CTF_V1/README.md new file mode 100644 index 0000000..33a5e43 --- /dev/null +++ b/Misc/12Sec_CTF_V1/README.md @@ -0,0 +1,23 @@ +12Sec CTF - PwnPad v1.0 +=============== + +This is where I am storing my documentation and solutions for the PwnPad CTF. + +![PwnPad main board](docs/pwnpad.png) + +## Status + +|done|#|Name|Topics|Description| +|---|---|---|---|---| +|[x]|1|Serial Snitch|`#UART`|Intercept and decode UART communication.| +|[x]|2|Echo Chamber|`#UART`|Intercept and decode UART communication, with security through obscurity.| +|[x]|3|Bus Whisperer|`#I2C`|Spy on I2C traffic to extract secrets.| +|[x]|4|Invisible Wires|`#I2C`|Attack I2C when slave devices are missing.| +|[x]|5|Code Heist|`#SPI` `#ISP` `#Flash` `#UART`|Dump and analyze firmware from flash.| +|[x]|6|Hard Leak|`#SPI` `#ISP` `#EEPROM`|Extract data from the internal EEPROM.| +|[x]|7|Power Trip|`#FaultInjection` `#UART`|Use glitching to bypass dead code statements.| +|[x]|8|Glitch Storm|`#FaultInjection` `#UART`|Use glitching to bypass password verification.| +|[x]|9|Clock Spy|`#SideChannel` `#UART`|Leak secrets using timing variations.| +|[x]|10|Tempo Leak|`#SideChannel` `#UART`|Leak secrets using timing variations with a twist.| +|[ ]|11|Chaos Chain: Glitchgate|`#FaultInjection` `#UART` |Combine UART and glitch attacks to break in.| +|[x]|12|Chaos Chain: Timebomb|`#UART` `#SideChannel`|Combine UART and chain timing leaks to break in.| diff --git a/Misc/12Sec_CTF_V1/01.md b/Misc/12Sec_CTF_V1/01.md new file mode 100644 index 0000000..e02f681 --- /dev/null +++ b/Misc/12Sec_CTF_V1/01.md @@ -0,0 +1,24 @@ +# **Challenge 1: "Serial Snitch"** + +As a skilled hardware hacker, you've intercepted a mysterious device recovered from a rogue tech syndicate. The device, dubbed **"Specter-1"**, controls access to a secret underground server, but its interface remains locked behind an unknown UART configuration. + +Your mission is clear: + +1. **Identify the UART pins** you've uncovered during your investigation. +2. **Determine the correct baud rate** to establish a stable connection. +3. **Access the device’s command interface** and unlock control over the system’s lighting grid. + +--- + +## Findings + +#### setup +![PwnPad main board](docs/pwnpad.png) + +The baudrate was a standard one, simply connecting the right wires using the corect baudrate I was able to gain access (and the flag) + +Of course I made a glitch-o-bolt config for this: [01_GoB_config.py](docs/01_GoB_config.py) + +It looks as follows: + +![glitch-o-bolt](docs/01_GoB.png) \ No newline at end of file diff --git a/Misc/12Sec_CTF_V1/README.md b/Misc/12Sec_CTF_V1/README.md new file mode 100644 index 0000000..33a5e43 --- /dev/null +++ b/Misc/12Sec_CTF_V1/README.md @@ -0,0 +1,23 @@ +12Sec CTF - PwnPad v1.0 +=============== + +This is where I am storing my documentation and solutions for the PwnPad CTF. + +![PwnPad main board](docs/pwnpad.png) + +## Status + +|done|#|Name|Topics|Description| +|---|---|---|---|---| +|[x]|1|Serial Snitch|`#UART`|Intercept and decode UART communication.| +|[x]|2|Echo Chamber|`#UART`|Intercept and decode UART communication, with security through obscurity.| +|[x]|3|Bus Whisperer|`#I2C`|Spy on I2C traffic to extract secrets.| +|[x]|4|Invisible Wires|`#I2C`|Attack I2C when slave devices are missing.| +|[x]|5|Code Heist|`#SPI` `#ISP` `#Flash` `#UART`|Dump and analyze firmware from flash.| +|[x]|6|Hard Leak|`#SPI` `#ISP` `#EEPROM`|Extract data from the internal EEPROM.| +|[x]|7|Power Trip|`#FaultInjection` `#UART`|Use glitching to bypass dead code statements.| +|[x]|8|Glitch Storm|`#FaultInjection` `#UART`|Use glitching to bypass password verification.| +|[x]|9|Clock Spy|`#SideChannel` `#UART`|Leak secrets using timing variations.| +|[x]|10|Tempo Leak|`#SideChannel` `#UART`|Leak secrets using timing variations with a twist.| +|[ ]|11|Chaos Chain: Glitchgate|`#FaultInjection` `#UART` |Combine UART and glitch attacks to break in.| +|[x]|12|Chaos Chain: Timebomb|`#UART` `#SideChannel`|Combine UART and chain timing leaks to break in.| diff --git a/Misc/12Sec_CTF_V1/docs/01_GoB.png b/Misc/12Sec_CTF_V1/docs/01_GoB.png new file mode 100644 index 0000000..2620b36 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/01_GoB.png Binary files differ diff --git a/Misc/12Sec_CTF_V1/01.md b/Misc/12Sec_CTF_V1/01.md new file mode 100644 index 0000000..e02f681 --- /dev/null +++ b/Misc/12Sec_CTF_V1/01.md @@ -0,0 +1,24 @@ +# **Challenge 1: "Serial Snitch"** + +As a skilled hardware hacker, you've intercepted a mysterious device recovered from a rogue tech syndicate. The device, dubbed **"Specter-1"**, controls access to a secret underground server, but its interface remains locked behind an unknown UART configuration. + +Your mission is clear: + +1. **Identify the UART pins** you've uncovered during your investigation. +2. **Determine the correct baud rate** to establish a stable connection. +3. **Access the device’s command interface** and unlock control over the system’s lighting grid. + +--- + +## Findings + +#### setup +![PwnPad main board](docs/pwnpad.png) + +The baudrate was a standard one, simply connecting the right wires using the corect baudrate I was able to gain access (and the flag) + +Of course I made a glitch-o-bolt config for this: [01_GoB_config.py](docs/01_GoB_config.py) + +It looks as follows: + +![glitch-o-bolt](docs/01_GoB.png) \ No newline at end of file diff --git a/Misc/12Sec_CTF_V1/README.md b/Misc/12Sec_CTF_V1/README.md new file mode 100644 index 0000000..33a5e43 --- /dev/null +++ b/Misc/12Sec_CTF_V1/README.md @@ -0,0 +1,23 @@ +12Sec CTF - PwnPad v1.0 +=============== + +This is where I am storing my documentation and solutions for the PwnPad CTF. + +![PwnPad main board](docs/pwnpad.png) + +## Status + +|done|#|Name|Topics|Description| +|---|---|---|---|---| +|[x]|1|Serial Snitch|`#UART`|Intercept and decode UART communication.| +|[x]|2|Echo Chamber|`#UART`|Intercept and decode UART communication, with security through obscurity.| +|[x]|3|Bus Whisperer|`#I2C`|Spy on I2C traffic to extract secrets.| +|[x]|4|Invisible Wires|`#I2C`|Attack I2C when slave devices are missing.| +|[x]|5|Code Heist|`#SPI` `#ISP` `#Flash` `#UART`|Dump and analyze firmware from flash.| +|[x]|6|Hard Leak|`#SPI` `#ISP` `#EEPROM`|Extract data from the internal EEPROM.| +|[x]|7|Power Trip|`#FaultInjection` `#UART`|Use glitching to bypass dead code statements.| +|[x]|8|Glitch Storm|`#FaultInjection` `#UART`|Use glitching to bypass password verification.| +|[x]|9|Clock Spy|`#SideChannel` `#UART`|Leak secrets using timing variations.| +|[x]|10|Tempo Leak|`#SideChannel` `#UART`|Leak secrets using timing variations with a twist.| +|[ ]|11|Chaos Chain: Glitchgate|`#FaultInjection` `#UART` |Combine UART and glitch attacks to break in.| +|[x]|12|Chaos Chain: Timebomb|`#UART` `#SideChannel`|Combine UART and chain timing leaks to break in.| diff --git a/Misc/12Sec_CTF_V1/docs/01_GoB.png b/Misc/12Sec_CTF_V1/docs/01_GoB.png new file mode 100644 index 0000000..2620b36 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/01_GoB.png Binary files differ diff --git a/Misc/12Sec_CTF_V1/docs/01_setup.png b/Misc/12Sec_CTF_V1/docs/01_setup.png new file mode 100644 index 0000000..2620b36 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/01_setup.png Binary files differ diff --git a/Misc/12Sec_CTF_V1/01.md b/Misc/12Sec_CTF_V1/01.md new file mode 100644 index 0000000..e02f681 --- /dev/null +++ b/Misc/12Sec_CTF_V1/01.md @@ -0,0 +1,24 @@ +# **Challenge 1: "Serial Snitch"** + +As a skilled hardware hacker, you've intercepted a mysterious device recovered from a rogue tech syndicate. The device, dubbed **"Specter-1"**, controls access to a secret underground server, but its interface remains locked behind an unknown UART configuration. + +Your mission is clear: + +1. **Identify the UART pins** you've uncovered during your investigation. +2. **Determine the correct baud rate** to establish a stable connection. +3. **Access the device’s command interface** and unlock control over the system’s lighting grid. + +--- + +## Findings + +#### setup +![PwnPad main board](docs/pwnpad.png) + +The baudrate was a standard one, simply connecting the right wires using the corect baudrate I was able to gain access (and the flag) + +Of course I made a glitch-o-bolt config for this: [01_GoB_config.py](docs/01_GoB_config.py) + +It looks as follows: + +![glitch-o-bolt](docs/01_GoB.png) \ No newline at end of file diff --git a/Misc/12Sec_CTF_V1/README.md b/Misc/12Sec_CTF_V1/README.md new file mode 100644 index 0000000..33a5e43 --- /dev/null +++ b/Misc/12Sec_CTF_V1/README.md @@ -0,0 +1,23 @@ +12Sec CTF - PwnPad v1.0 +=============== + +This is where I am storing my documentation and solutions for the PwnPad CTF. + +![PwnPad main board](docs/pwnpad.png) + +## Status + +|done|#|Name|Topics|Description| +|---|---|---|---|---| +|[x]|1|Serial Snitch|`#UART`|Intercept and decode UART communication.| +|[x]|2|Echo Chamber|`#UART`|Intercept and decode UART communication, with security through obscurity.| +|[x]|3|Bus Whisperer|`#I2C`|Spy on I2C traffic to extract secrets.| +|[x]|4|Invisible Wires|`#I2C`|Attack I2C when slave devices are missing.| +|[x]|5|Code Heist|`#SPI` `#ISP` `#Flash` `#UART`|Dump and analyze firmware from flash.| +|[x]|6|Hard Leak|`#SPI` `#ISP` `#EEPROM`|Extract data from the internal EEPROM.| +|[x]|7|Power Trip|`#FaultInjection` `#UART`|Use glitching to bypass dead code statements.| +|[x]|8|Glitch Storm|`#FaultInjection` `#UART`|Use glitching to bypass password verification.| +|[x]|9|Clock Spy|`#SideChannel` `#UART`|Leak secrets using timing variations.| +|[x]|10|Tempo Leak|`#SideChannel` `#UART`|Leak secrets using timing variations with a twist.| +|[ ]|11|Chaos Chain: Glitchgate|`#FaultInjection` `#UART` |Combine UART and glitch attacks to break in.| +|[x]|12|Chaos Chain: Timebomb|`#UART` `#SideChannel`|Combine UART and chain timing leaks to break in.| diff --git a/Misc/12Sec_CTF_V1/docs/01_GoB.png b/Misc/12Sec_CTF_V1/docs/01_GoB.png new file mode 100644 index 0000000..2620b36 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/01_GoB.png Binary files differ diff --git a/Misc/12Sec_CTF_V1/docs/01_setup.png b/Misc/12Sec_CTF_V1/docs/01_setup.png new file mode 100644 index 0000000..2620b36 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/01_setup.png Binary files differ diff --git a/Misc/12Sec_CTF_V1/docs/pwnpad.png b/Misc/12Sec_CTF_V1/docs/pwnpad.png new file mode 100644 index 0000000..80561e6 --- /dev/null +++ b/Misc/12Sec_CTF_V1/docs/pwnpad.png Binary files differ