Public hangout for Tech Learning Collective community members. Be mindful of the social rules but otherwise have fun!
I'm really excited to see how the virtual Mr. Robot's Hacker Happy Hour y'all have planned will go. :) Good luck!
1 reply
Hi! I had a question about setting up a subscribable calendar using radicale, would anyone here have experience with this?
Context: I've set up a radicale server with a public address, but requires authentication to log in and create a calendar. I've successfully created a calendar and connected to it with my thunderbird client, but it requires putting in my username and password (which is expected). I wasn't sure the process if I wanted authentication required to write to the calendar, but someone could subscribe to a read-only version with just the url.
Yeah, I've set up Radicale before. By default, Radicale uses a "rights" file (as in, what rights does a given user have) to determine this. Their docs on "Authentication and Rights" describes this in some detail, but it's a bit terse. Is that what you need?
I think so, yah! I was reading through that, but wasn't sure if I was understanding the architecture correctly. Specifically, if this was something I should be configuring at the server level, or if it was something I could set on a particular calendar through the client.
2 replies
But it seems like I'd create a calendar on the server and note it's collection path, then in the rights file would say something like:
[read]
user = .* #all users, including anonymous ones
collection = 'collection_name'
permission = r
does that seem right?
Just chiming in to point out that, while it's not on the calendar at the moment, we do also have a workshop specifically about CalDAV servers. Radicale user rights aren't the specific topic, but the workshop might be of interest to anyone trying to do something like what you're doing. :)
Today is another webinar day! :) If you haven't got tickets for Clearing Away the Clouds: How Computer Networks, Servers, and the Internet Work, you still have just under 2 hours to grab 'em.
Hello! I am new here and I was drawn to the mission of tech learning collective.
I started working at a privacy-focused tech company about 6 months ago (nontechnical, marketing role). I am still getting my "sea legs" and I think this community would be a great place for me to learn. Thanks for all you do. Please let me know what resources you recommend for getting started.
9 replies
Anyone here practiced with Volatility? I'm playing in this weekend's CTF (thanks for inviting/pseudo-hosting, by the way!) and am not experienced enough with this tool to know what I'm doing wrong. I have a memory dump, but none of the
vol.py plugin commands give me meaningful output, as far as I can tell.
Hey y'all! I'm getting started on the DAWG CTF 2020. :) I just solved my first puzzle (Free Wi-Fi Part 1)! Would love to hear what other people are working on/can offer if you're playing the same game! https://umbccd.io/
8 replies
"On Lockdown" seems like an intro to buffer overflows, which led me to finding this really nice and relevant tutorial: https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/
We've published the first five in a series of over 20 new planned TLC Foundations learning modules yesterday. Enjoy!
Decent write-up of the various"Free Wi-Fi" challenges from last week's DawgCTF! https://github.com/m3ssap0/CTF-Writeups/blob/master/DawgCTF%202020/Free%20Wi-Fi/README.md I feel silly for not getting the simple client side validation one but good that we were on the right track about all the other clues we found in the pcap.
It also appears that WPICTF, starting in just three hours, will also have some beginner friendly challenges. I think I might check those out.
PlaidCTF and WPICTF are happening concurrently, so you can do both or either. :) We have four workshops this weekend (as usual, check our events page or subscribe to our calendar) so will be a little less available than usual to offer help or guidance but still encourage you to enjoy both of the games and have fun!
@zachmandeville_gitlab So you asked about RiceTeaCatPanda's "beginner 9" challenege. The input they gave us was base64 decoded, which is clear from the trailing
= sign at the end. Here's the last bit of input from the Beginner 10.txt file (Gitter won't let me post the whole thing) that they provided for the challenge:MmQgMmQgMmQgMmQgMmQgMjAgMmQgMmQgMmQgMmQgMmQgMjAgMmUgMmQgMmQgMmQgMmQgMjAgMmUgMmQgMmQgMmQgMmQgMjAggMmQgMmQgMmQgMmQgMjAgMmUgMmQgMmQgMmQgMmQgMjAgMmQgMmQgMmQgMmQgMmQgMjAgMmQgMmQgMmQgMmQgMmQgMjAgMmUgMmQgMmQgMmQgMmQ=
So we
base64 --decode and get a bunch of values like this:2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 0a 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 0a 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2e 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 20 2d 2d 2d 2d 2d 0a
The clear pattern is that these are all hex values, and that there are only a few different sets of them:
2d, 2e, and 20. We can use CyberChef to make this easier than I did it, but I went with a command-line approach. In hex, 20 maps to the ASCII space character. So this means that having actual spaces in the input here isn't what we want, so first I got rid of the spaces by replacing them all with a percent sign:base64 --decode "Beginner 10.txt" | sed -e 's/^/%/' -e 's/ /%/g'
The
-e to sed means "execute this script" and then I provide two scripts: the first one simply prepends the % to the very first location in the input and the next one replaces all the literal space characters with a percent sign. This gives me a URL-encoded string where the spaces are part of the encoded value, so now I have input like this:%2d%2d%2d%2d%2d%20%2d%2d%2d%2d%2d%20%2e%2d%2d%2d%2d%20%2e%2d%2d%2d%2d%20%2d%2d%2d%2d%2d%20%2d%2d%2d%2d%2d%20%2e%2d%2d%2d%2d%20%2d%2d%2d%2d%2d%0a%2d%2d%2d%2d%2d%20%2d%2d%2d%2d%2d%20%2e%2d%2d
Okay, from here, it's super easy to URL-decode it. I do this so often that I have an alias for it, but you can do it in one line of Python thanks to a module available in the Python standard library called
urllib:alias urldecode='python -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))"'
So now I can do
urldecode $(base64 --decode "Beginner 10.txt" | sed -e 's/^/%/' -e 's/ /%/g') and the result is a bunch of morse code, apparently:urldecode $(base64 --decode ~/Downloads/Beginner\ 10.txt | sed -e 's/^/%/' -e 's/ /%/g')
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- .---- -----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- .---- ----- .----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- .---- -----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- .---- ----- ----- .----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- ----- .----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- .---- -----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- ----- .----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- ----- ----- .---- -----
----- ----- .---- .---- ----- .---- .---- -----
----- ----- .---- ----- ----- ----- ----- -----
----- ----- .---- .---- .---- ----- ----- .----
So you can clearly see that these are sets of 8. Well, 8 bits in a byte, so it would be reasonable to assume that these are morse-code versions of 0's and 1's and wouldn't you know it, they are. In Morse code,
----- is the numeral 0 and a .---- is the numeral 1.
Okay so now we just need to actually convert this to 0's and 1's so we can use it the way computers would expect, since computers don't really use Morse code, sooooooo sed to the rescue again, with three simple substitution scripts.
First, replace the Morse code 0 with the numeral 0 gobally:
-e 's/-----/0/g'Then do the same thing with a Morse code 1:
-e 's/.----/1/g'and then get rid of the spaces so that we have a single "byte" per line:
-e 's/ //g'So the full command is now:
urldecode $(base64 --decode ~/Downloads/Beginner\ 10.txt | sed -e 's/^/%/' -e 's/ /%/g') | sed -e 's/-----/0/g' -e 's/.----/1/g' -e 's/ //g'
Which gives us:
urldecode $(base64 --decode ~/Downloads/Beginner\ 10.txt | sed -e 's/^/%/' -e 's/ /%/g') | sed -e 's/-----/0/g' -e 's/.----/1/g' -e 's/ //g'
00110010
00110110
00100000
00110101
00100000
00110010
00110110
00100000
00111001
00100000
00110010
00110101
00100000
00110010
00110010
00100000
00110010
00110110
00100000
00110010
00110101
00100000
00110010
00110110
00100000
00111001and the repeated 26 (and that no number is higher) makes me sense it's an alphanumeric cipher.
If we say a is 1 and z is 26, then the decoded is zeziyvzyzi
if we say a is 26 and z is 1, then the decoded is avarbeabar which seems like not complete gibberish.
"a var be a bar"
Right, this is the CyberChef recipe, using the "From Binary" operation. (Just throwing this here so we can share and bookmark.)
I'm not convinced that's right and I don't think either
rtcp{zeziyvzyzi} or rtcp{avarbeabar} work as flags.