h3xstream

Starting at the URL http://web300.gosec.net:6473/, we can see a page serving a static image /troll.jpg. No special parameter can be found. The image is confirm to be static. Some stegano test were done on the image but nothing special is observe.

Hidden admin page

We scan the host for hidden files and directories using tachyon. The tool found the existence of /admin.php.

h3xstream

from binascii import hexlify,unhexlify

data = int('0b01001010 01110101 01110011 01110100 00100000 01000100 01101111 00100000 01001001 01110100'.replace(" ",""),2)
print unhexlify("%x" % data)

h3xstream

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
	<allow-access-from domain="*.ebay.com" secure="false"/>
	<allow-access-from domain="*.ebay.au" secure="false"/>
	<allow-access-from domain="*.ebay.at" secure="false"/>
	<allow-access-from domain="*.ebay.be" secure="false"/>
	<allow-access-from domain="*.ebay.ca" secure="false"/>
	<allow-access-from domain="*.ebay.com.cn" secure="false"/>
	<allow-access-from domain="*.ebay.fr" secure="false"/>

h3xstream

importPackage(org.parosproxy.paros.extension.history); //ExtensionHistory
importPackage(org.parosproxy.paros.control); //Control

extHist = Control.getSingleton().getExtensionLoader().getExtension(ExtensionHistory.NAME)
if (extHist == null) {
    println("ExtensionHistory not found.")
    exit;
}

// Loop through the history table, printing out the history id and the URL

h3xstream

import java.nio.file.FileSystems
import java.nio.file.Path
import java.nio.file.Paths
import java.nio.file.StandardWatchEventKinds;
import java.nio.file.WatchEvent;
import java.nio.file.WatchKey
import java.nio.file.WatchService;

class FileEvent {
    String kind

h3xstream

Here are the Card Manager Keys used for the cards we gave during the competition, so that you can load/delete applets on the card :

MAC_KEY : 20B2734C890D9F043208810E063B25D6
ENC_KEY : 1A1C5481DDF4A91D5AD25352846EFDF1
KEK_KEY : 065F678AC7C5EB46BC0DEA1ECCF1F03C

Make sure you use -keyver 1 and delete the previous applets as follows :

h3xstream

##Smart card

Wikipedia - Smart card application protocol data unit : Simple reference for the standard APDU structure

ISO 7816-4 - Coding of SW1 and SW2 : Meaning associate to each return code.

##JavaCard development

Writing a Java Card Applet: Tutorial on Oracle website

h3xstream

#Groupes utilisateurs à Montréal

##Programmation

Montreal Python: http://montrealpython.org/

PHP Québec: http://www.phpquebec.org/

Montreal Java: User Group: http://montreal-jug.eventbrite.com/

h3xstream

Petit solutionnaire pour le brute force du PIN code.

Spécification du protocole

Selon les spécifications, on peut deviner que le protocole ressemble à ceci:

Kiosque --[VERIFY PIN_CODE]-> Carte
Kiosque <-[    Pin Ok?    ]-- Carte

h3xstream

#!/usr/bin/python

"""
Small script to rename image in folder to 'folder.jpg' to comply with XBMC default filename for music album.
Usage :
	python folder.py /home/h3xstream/Music/
"""

import os
import sys