First think that I’ve learned has been because of a big problem at work with an Adaptec SAN device and a ext3 filesystem of 7.5Tb.  The controller stoped working and I started an impossible  filesystem recovery. The main thing that I’ve learned with this problem, has been that e2fsprogs has a library (called libext2fs)  that lets you modify the filesystem esially.  With that library you can go forward all the filesystem inodes and for example, mark half of the inodes as unused.

About IDA and Qemu, I followed the hexblog tutorial. It is quite useful to do things like that if  you don’t have an ARM CPU to test the code.

Last think that I’m working on now, is a ppc tool that I’ve to manually port to i386. This is my chance to learn about ppc asm.

And that’s all for me!

The idea is that each member will try to post something every week. That post musn’t be about security stuff, it can also be about any technical stuff. With this purpose, we try to know more about each others and to continue growing as a hacker group.

Lets start with my first post!

I never imagined setting & managing a server would be this much hard. It’s taking a much longer time than I expected.

On the other side, I am learning new stuff. So it’s good

After server is complete, Sapheads will structuraly be operated for given objectives. We had a meeting last week to discuss the mission of our group, and far more.

Soon will be another beginning for Sapheads, and hopefully we will be much stronger team (just a hope)

t1g3r

We are finally getting our own server rented from private server hosting company! We are very excited, but kinda scared by all the setting works that we need to do. :p However, once we receive the server, sapheads.org will also be moving to the new server with a brand new look. This blog will be moved to blog.sapheads.org, and sapheads.org will contain other information about Sapheads.

However, it won’t be done anytime soon, so please take your time to visit again later

I will post a new notice here, when everything is complete. Hope everyone’s doing well!

t1g3r

There are definitely things that we lacked, but will sure to make improvements on our second Hackjam.

If you want to help us to improve, please fill out our survey. (Then, we will randomly select 5 people and send them 4-port usb hubs)

http://hackjam.sapheads.org/?p=question

So the winners are:

1 CLGT (Vietnam)
2 ENOFLAG (Germany)
3 PlaidParliamentOfPwning (US)
4 nibbles (France)
5 sqrt0 (Korea)
6 TeamDiscoveryChannel (US)
7 lulz (England)
8 TheSeXMan (Korea)
9 haxistan (Germany)
10 rs (Spain)

You can check it out at http://hackjam.sapheads.org/?p=rank

(We will be contacting each team for prizes within a week via email they registered)

As you know, we have released a cartoon in every challenge. You can also see the full history here.

Also you can get the challenge binaries from here.

See everyone at next Hackjam!

Now we’re at irc.freenode.net #Sapheads !

What?:
Our Hackjam will consist of 10 challenges which relate to Binary Analysis, Reverse Engineering, Exploitation, Web Security, Forensics, and all the other materials that are required to be a hacker. I can guarantee that these problems are not like other CTF’s where they have to solve non-sense puzzle, instead of true hacking. We tried to create challenges that greatly resemble real world scenarios and environments, at the same time, adding fun and educational ingredients to them. Trust me, you won’t regret it.

When? :
Saturday, September 19, 2009 at 05:00:00 GMT
~ Monday, September 21, 2009 at 05:00:00
Local time for you: http://bit.ly/de05o

How? : http://hackjam.sapheads.org/?p=register

Prizes : Not decided. Will depend on sponsors.

Sponsors: Please contact t1g3r [\x40] sapheads [\x2e] org for more info.

IRC: irc.freenode.net #Hackjam or #Sapheads

t1g3r

Defcon 17 CTF

Intro
As we were the last team to be qualified for the final, we didn’t expect much initially. Also looking at monstrous other teams, we just wished that we wouldn’t end up last. But I have to say that Defcon 17 CTF was one of my best experiences of my life. I will never be able to forget our friendship.

July 29th
Mongii arrived at LAX from Seoul, to drive up from Los Angeles to Las Vegas with me. It was 4-5 hour drive, but wasn’t boring at all, as we were very excited to be at Defcon for the very first time.

Way to Defcon 17

Other members were to arrive at Vegas from Spain very late at night. So we met up with some people from Korean security industry, which include Matt Oh from eEye, Black & Green from Hackerslab, osiris & chpie & redd0g from lollerz. We went to eat Korean BBQ and also drank a little soju :p (thanks to Black for paying for all that )

Osiris, Mongii, Matt

redd0g, chpie, t1g3r

Black, Green, Justin

Little after midnight, we finally met up with other members (graz, hex, jvprat, seoman, whats). Although it was our very first encounter, it felt as if I already knew them for couple years now

Very first Sapheads group picture!

We checked in to the hotel room. Very first thing we did, was to take a group picture, and to crack hotel wireless :p It was very exciting to see all our members that we didn’t sleep until 6am. Instead, we were playing around doing random stuff.

Preparing for CTF

t1g3r pwning everyone else :p

t1g3r w/ beer

graz op3ning a beer

July 30th
30th was our only free day.

We got to meet up with pancake from Sexy Pandas, graz and hex work with pancake xD

We drank at a cafe in the afternoon, then went back to our hotel room to prepare for CTF, but in fact, we only messed around with our laptops and wireless :p

Then we realized, that our switch will not be enough for CTF. It only had 8 ports, when we needed at least 10 ports (7 members, 1 local server, 1 CTF server, 1 main network). We decided to get a new one the next morning then fell asleep.

July 31th

The day of CTF !! All of our members were very pumped up and excited!
graz, mongii, whats and I headed out to get a new switch from Fry’s near by. However, we got lost on our way there :’( then wasted our precious preparation time before CTF. but thank god that CTF didn’t start on time :p

graz with redbull, on the way to get a switch!

Oh, I forgot to mention that we finally couldn’t get a switch. Stupid me for driving w/o knowing the directions.

We just decided to use wireless connection of each other’s laptop to connect to the network. So we set the network, then nervously waited CTF to began.

CTF Area

Wowhacker Team

But oops.. our switch again.. the network cables ddtek provided were crossover cables.. and our switch only had a single crossover port.. no.. no.. no.. :_(
jvprat had another switch that he brought just in case, but we couldn’t use it since voltage range supported from that switch’s ac adapter didn’t include 110v.

so graz and I decided to go to Fry’s again. Our calculation was that we’ll lose an hour at most. No one can imagine how nervous we were :/ (later we found out, they were selling switches, routers @ defcon x( )

We finally came back with a brand new switch. Everything set to go!

No.. not again.. our connection to CTF server :S I believe couple more teams were having same kind of trouble, but sshd from our server was down.. took another 30 min to get resolved.. it was about little after 12pm when we got everything settled down, and started hacking…

We started looking through binaries, but couldn’t find any vulnerabilities.. and there we were, at the bottom of the CTF ranking.. until the end of the day..

After CTF session has ended, our team went straight back to our hotel room, to keep looking through binaries. Sapheads slept for couple hours, but mongii and I stayed up late to work more. As it was little past 1am, I found that my exploit for deltad worked! feeling some sort of achievement, I went to sleep.. but mongii, stayed up until the next morning. Other members except me also woke up around 3am to work on the challenges again.

August 1st

When I woke up in the morning, I found other sapheads working diligently, and felt little ashamed of myself for sleeping too much. :p As soon as we got to CTF area, after setting up our booth again, I tried exploiting deltad to our CTF server, which whats has written the shellcode for me. and YES! it worked! and that was our very first steal point! However, we were very nervous as we were still last place :_(

find whats and t1g3r

And with deltad, we also scored overwrite point, which allowed us to raise up our point “a little”, then we became 9th place for like 5 minutes, then back to 10th again.

Gladly, with our very first points, our team got more confident in CTF, which encouraged our members to focus better. But I started showing ADD symptoms and started to wonder around, chatting, smoking, going to restroom.. couldn’t focus anymore..

I felt bad for mongii for working so hard, without any sleep at all. However, he ended up like this aftewards. :p

Mongii sleeping

Mongii actually has solved several challenges till this time, but most of them we couldn’t exploit because either it was already patched, or misconfigured.

Graz and hex took care of all the server issues, they kept our SLA very high compared to the others also they sniffed other team’s traffic which got us sufficient hints for other challenges.

seoman, t1g3r, hex, graz, jvprat

After done showing ADD symptoms :p, I sat next to whats looking over what he was up to. Then eventually, ended up analyzing the binary with him. As I was about to go back to my seat, he solved cjd & cmd! Although the challenge itself wasn’t that hard, i guess not many other teams has done it. After submitting our steal points for this, we got bumped up to 7th place!!

Score board on second day

In the middle of night, while I was sleeping, I heard mongii screaming, “YES!!!”, then I found out that mongii has successfully overwritten EIP of tucod.

August 2nd

Last day, since this day was only for 4 hours, we concentrated on getting more keys of already exploited services. Also seoman sniffed some other packets to successfully exploit few other services.

And finally mongii has successfully exploited tucod, but ended up that all the other teams have patched their binaries already

After CTF has ended, whats and I attended the feedback meeting, where two people from each team came to give some reviews on CTF. Although I had many things to say, I was out of my mind as I was very tired from CTF

Although it wasn’t so long since we met, it was very sad to leave graz, hex, jvprat, seoman, whats stayed in Vegas to look around more, then to NY, but mongii and I came back to LA, where the reality was

Sapheads

Bye Sapheads, hope to see you all again next year!

Although we have many idlers, I am there most of the times by myself (usually talking to myself)

irc.smashthestack.org #Sapheads

Come chill with us! xD

t1g3r