20250112 ‐ SANS Holiday Hack Challenge ‐ Hardware Hacking Part 1 - rundas-r00t/blog GitHub Wiki
video here: https://rumble.com/v68kyw1-sans-holiday-hack-episode-8.html
This challenge introduces a UART controller, which is a device that translates signals from serial to USB.
it seems pretty straight forward enough.. the manual above gives you some clues how to set it up, as well as the image we reconstructed from the prior challenge, using the Heuristic Edge Detection python script:
between these two pieces of info, and a little experimentation with the wires and the 3v/5v toggle, you can easily get silver by...
Spoiler Alert
swapping the connections for TX,T,RX,R (TX<->R and RX<->T), as these pins are swapped on the motherboard you're hooking into.
opening Dev Tools while you're connecting the wires will give you an 'All Pinned Up' message when you've attached the proper pins correctly:
per the manual, need to set voltage to 3v otherwise you might see some smoke :-[]
After obtaining silver, the elf Jewel Loggins gives a hint that there's a way to bypass the hardware all together, implying there's some type of HTTP or JS manipulation that will produce the same success message.
I was a little stumped at this point (and admittedly had to go this walkthrough for a little nudge in the right direction), but like most WebApp attacks, it's a good idea to check the Dev Tools and see what's going on with the page. R-click the game --> open iFrame in a new tab, and then F12 to open dev tools. having the Network tab visible when clicking the 'S' (send payload) button on the UART controller inside the game produces this 200-Success message:
and we see a Date 'true' message in the console:
This is the message sent to the server https://hhc24-hardwarehacking.holidayhackchallenge.com/api/v2/complete that gives you the silver medal. ok good info. let's check the source code and see if we can find anything. Switching to the Debugger tab in Dev Tools, and scrolling through.. towards the bottom we see this series of comments in the source:
!!!!! there are two versions of the game! /api/v1 and /api/v2 ...the comments imply that v1 is vulnerable to brute-forcing, but obviously we're not dealing with password attacks here. but what if we
Spoiler Alert
edit the HTTP header to send the data to the v1 server?heading back to the Network tab, selecting the Silver 200-Success message, and clicking the Resend button on the right allows us some editing options for the message:
what if we
Spoiler Alert
change that `.com/api/v2/complete` to `/v2/complete` ? ..could it be that easy?-------------------------------------------------------------Side Note-------------------------------------------------------------
at this point in the video (around the 1:13:00 mark), i used the proper technique, but i used it on the wrong message. I thought i was using a success message, but if you look closely at the text, it shows this error message:
(video timestamp 1:17:45)
I did not notice this, mainly because our first attempt was successful, and i though the black pop-up would always contain a success message, and if you failed there would be no pop-up at all. I then spent some time going back and forth, wondering why it wasn't working, and ended up trying SamanthaCtF's instructions, which included a lot of typing that really wasn't even necessary, as per the steps below.
lesson learned from this is always read with a critical eye and don't assume that the GUI action you're seeing out of the corner of your eye is consistent.
-----------------------------------------------------------End Side Note-----------------------------------------------------------
Spoiler Alert
YES! AMAZING!
Who knew it could be that easy?
some might call this a replay attack, some might call it a downgrade attack... imo it's a bit of both, but regardless it's Gold ftw!