96 lines
1.9 KiB
Markdown
Executable File
96 lines
1.9 KiB
Markdown
Executable File
# LAIN_Breakcore — Solution
|
|
|
|
**Difficulty:** Medium | **Category:** IoT | **Flag:** `ECW{LAIN_Br34k_CryPT0}`
|
|
|
|
## Overview
|
|
|
|
UART hardware/crypto/reverse challenge. Connect to the router's UART interface:
|
|
|
|
- **TX (port 1111)**: Read only — device output
|
|
- **RX (port 2222)**: Write only — send commands
|
|
|
|
## Available Commands
|
|
|
|
```text
|
|
help — list basic commands
|
|
flag — get the AES-encrypted flag
|
|
dump_bin — dump the firmware (XOR'd with the key)
|
|
settings — display the XOR key used for the firmware
|
|
whoami — current user info
|
|
show config — show device configuration
|
|
```
|
|
|
|
## Steps
|
|
|
|
### 1. Connect
|
|
|
|
```bash
|
|
# Terminal 1 — TX (read output)
|
|
nc <host> 1111
|
|
|
|
# Terminal 2 — RX (send commands)
|
|
nc <host> 2222
|
|
```
|
|
|
|
### 2. Get the XOR key
|
|
|
|
```text
|
|
settings
|
|
```
|
|
|
|
Returns the XOR key used to obfuscate the firmware dump.
|
|
|
|
### 3. Dump and deobfuscate the firmware
|
|
|
|
```text
|
|
dump_bin
|
|
```
|
|
|
|
Save the hex output, then XOR each byte with the key from `settings`:
|
|
|
|
```python
|
|
key = bytes.fromhex("<key_from_settings>")
|
|
firmware_enc = bytes.fromhex("<dump_from_dump_bin>")
|
|
firmware = bytes(b ^ key[i % len(key)] for i, b in enumerate(firmware_enc))
|
|
with open("firmware.bin", "wb") as f:
|
|
f.write(firmware)
|
|
```
|
|
|
|
### 4. Reverse the firmware to extract AES key and IV
|
|
|
|
```bash
|
|
strings firmware.bin | grep -iE "key|iv|aes|lain"
|
|
```
|
|
|
|
Or open in Ghidra/Binary Ninja and locate the AES key/IV in `.rodata`.
|
|
|
|
### 5. Get the encrypted flag
|
|
|
|
```text
|
|
flag
|
|
```
|
|
|
|
Returns the ciphertext in hex.
|
|
|
|
### 6. Decrypt the flag
|
|
|
|
```python
|
|
from Crypto.Cipher import AES
|
|
from Crypto.Util.Padding import unpad
|
|
|
|
key = b"<key_from_firmware>" # 16 or 32 bytes
|
|
iv = b"<iv_from_firmware>" # 16 bytes
|
|
ciphertext = bytes.fromhex("<hex_from_flag_command>")
|
|
|
|
cipher = AES.new(key, AES.MODE_CBC, iv)
|
|
print(unpad(cipher.decrypt(ciphertext), AES.block_size).decode())
|
|
```
|
|
|
|
## Flag
|
|
|
|
`ECW{LAIN_Br34k_CryPT0}`
|
|
|
|
## Author
|
|
|
|
neverhack
|