According to the documentation on meshtastic.org, the T-Beam v0.7, although old, is a supported device. Every ESP32 firmware download should contain a file named “firmware-tbeam0.7-X.X.X.xxxxxxx.bin“.
However, if you download the latest Meshtastic stable/beta firmware release, v2.7.15.567b8ea at the time of writing, you will not find any file with that name. This means that at some point they silently dropped support for the T-Beam v0.7 and didn’t bother updating the documentation anywhere.
So I wrote a Python script that downloads all Meshtastic releases, unzips them, and looks for a file matching the expected pattern (which, by the way, turned out to be wrong: it’s “firmware-tbeam0_7...“, not “firmware-tbeam0.7...“, those pesky Meshtastic liars!).
Anyway, here it is, enjoy! The latest Meshtastic firmware release that supports the T-Beam v0.7:
You know how your neighbors sometimes set clever WiFi names on their networks? Something like “FBI Surveillance Van” or “It hurts when IP”.
I though there should be an application where we should be able to chat via WiFi network names, in a more convenient way.
Since the Gods of AI have blessed us with cursor, I (cough cough cursor) wrote the following Linux CLI application which does exactly that. Messages are sent as 802.11 beacons, and any beacons that match formatting are displayed.
WARNING: This firmware WILL brick your Sentry Mini or Sentry Plus. DO NOT use this firmware on a Sentry Mini or a Sentry Plus. In fact, do not use it on anything unless you know what you are doing. You WILL void your warranty when using firmware from unofficial sources.
Remember these? Don’t worry, uncle Dimme is back with the latest and the greatest!
My Sentry decided to update and of course I had to do some sniffy sniffy. Here is the latest firmware for those who are interested in being able to downgrade their devices:
And just in case this is the last firmware ever, here is the request sent by the iPad upgrade Sentry. It contains all information needed to perform a downgrade too.
An important factor is one’s prior experiences. It is very likely that I was coding, setting up web-servers, routers, hacking WiFi, and compiling Apache before you were born. Keep that in mind as I explain what worked for me. No I’m not 100 yet, just 37.
Beyond that, I have a Master’s in Computer Science, researched in Wireless Communications for 3 years, worked as an Embedded Software Developer for 3 more years, and worked as a Security Analyst in a SOC for a year and a half after that, before embarking on my OSCP journey. Why do I need the OSCP if I did all that? Personally, I don’t need it, but HR doesn’t care how may PhDs you have, or what you do in your free time. All that matters nowadays is certifications from private companies.
Timeline
Prior purchasing the OSCP course, I set up a plan on how to get there. I wanted to be structured and do as much as possible to maximize my chances of passing the exam. The plan was:
Complete TJ_Null’s list of Hack The Box OSCP-like machines.
Enroll in the OSCP/PEN-200 course and complete your certification.
I completed 1. Being super-motivated in the beginning, I started on TJ_Null’s list. I did a few machines on the list and a few others that attracted my attention (Lame, Brainfuck, Shocker, Bashed, BroScience). Then life got in the way, motivation kinda went down and I didn’t do much more.
On May 25th 2023 I purchased the OSCP course. Due to work and life, by mid-April 2024 (almost a year later) I had only gone through 18 out of the 25 chapters in the training material, and I had completed zero (0) challenge labs. With a bit over a month left in my subscription, I started panicking.
So what did I do? What I do best; isolated myself from the world and focused 110% on one single task. April 21st-23rd I finished all remaining chapters in the training material and did all of the Capstone exercises. I had decided that if I’m gonna have any chance to pass, I will need the 10 bonus points. That meant that I had a bit over a week to complete 30 out of the 57 challenge labs. Starting on April 23rd, I went full beast-mode on the challenge labs. By April 28th, and after I had lost 4 kgs, I had completed 37 our of the 57 challenge labs and therefore earned the aforementioned 10 bonus points. Btw, thanks to the guys and girls in the #pen-200-challenge-labs Discord! Invaluable help!
I decided this is enough, I got of out of my cave, and had a BBQ for May 1st with some friends, to replenish my lost weight during the week of horror.
The day is May 2nd, 08:00 AM, and the exam starts. I started with the AD-set, but I was struggling to gain foothold. At around 10:30 AM I gave up on the AD-set, and started focusing on the other independent machines. By 03:20 PM I had pwned all independent machines and took a breath of relief. I had technically passed the exam since I had 60 points + 10 bonus points = 70 points.
I took a break for half an hour or so, had a cup of coffee, and went back to tackle the AD-set. No kidding, I was banging my head on the AD set for hours and hours, until around 02:00 AM the NEXT day, without getting anywhere. Eventually, I gained foothold. I cannot go into details but I can say that OffSec loves their rabbit-holes. If you get stuck somewhere it is likely a rabbit-hole. Having gained foothold, I pwn the entire AD-set and get domain admin by 04:15 AM.
By that point I’m completely exhausted. I haven’t slept for over 22 hours. I spent another hour checking that my notes are compete, I checked out and went to bed. The next day I wrote the report as detailed as possible and uploaded it to the portal according to OffSec’s instructions. By May 5th I had the pass mail in my inbox, 12 days after I started working on the challenge labs.
Reflections
Was the exam hard? Not really. Not hard, but tricky. The recipe that works for me is curiosity. Privilege escalation was easy for me since I click and look everywhere and don’t even have to do any advanced enumeration to get there. What I suck at is initial enumeration. For that I probably needed a checklist, but my chaotic nature eventually worked out and I got in. What should you do? Do that works best for you.
Did I do any PG boxes? Nope, didn’t touch them. Just the training material, and the following challenge labs: Medtech, Relia, OSCP-A, OSCP-B, OSCP-C.
How did I take notes? What was my structure? I had no structure. Studying in constrained time conditions meant that I had to do the best I can with the limited time available to me. My tactic was to have a document and just dump any useful commands that I find in there. Then Ctrl+F in that document during the exam and hack on! How should you take notes? The way that works best for you!
Should I put more focus on A or B? All subjects within the OSCP study material are equally important. Just because I got something on the exam it doesn’t mean that you will get the same.
Do I have any final thoughts? Yes. Do like me: Assume that you suck at this and prepare for failure. The best way to prepare for failure is to ensure you have the 10 extra bonus points on the exam. By doing so, you may accidentally learn something and score 100 + 10 points on the exam.
We found the pins, guessed be baud rate and configuration bits based on… common sense? And we got the flag.
Mission Discover 1
Once we connected to the board using the UART port, we got to the following screen:
This task is about getting past the login screen. The username, root, is given in the description. The challenge is to find the password. Since the developer likes a lot of rock music, we thought of trying the rockyou password set on it.
Using the following script we found the password:
Once logged in we were presented with the flag:
PS: The board has some nasty behavior where it prefers only \r and weird things happen when you send \r\n as line terminators. We spent several hours on this issue.
Dumpling or Dumping
According to the developer, readout protection is not useful. Our task here is to prove him wrong. We did that by connecting the ST-LINK V2 programmer with the STM32F401 micro-controller using the SWD port.
st-flash can then be used to dump the firmware as such:
And we got the flag!
Super Power Intelligence
In this task we have to fetch the “secret” from the “other” memory chip. We start by connecting a logic analyzer to the SPI bus:
We select the option to show the secret in the menu, which will fetch it from the memory over the SPI bus. The “secret”, which also happens to be the flag is displayed on the screen as seen in the previous picture but it is “anonymized”:
While the data is being fetched, we are sniffing the SPI bus with the logic analyzer and decode the SPI binary data into ASCII:
We can read the flag as seen above.
Intelligence 2 Customer
Some data is protected inside the board’s memories alongside the serial number. There is an option in the menu to read the serial number. This operation happens over the I2C bus.
We start by connecting the logic analyzer on the I2C port (and ground):
Then, we trigger the “Display serial” function from chip nr 1:
Lastly, we record and decode using the logic analyzer:
And we got the flag!
Remote Access Medium
The pin (“PIN verification” menu) is only known by our client, and they claim I can’t find it. That is weird, it is right there when I login over the UART port:
The developer says that removing the debug ports isn’t useful. Let’s prove him wrong…
Let’s assume that the source code provided by the challenge, that is the verify_cipher_flag() function, is executed when we select item nr 4 in the main menu as seen in the picture above.
We connect with OpenOCD using the debug port so that we can examine the chip RAM:
And then we hook up GDB to the OpenOCD daemon:
We select option nr 4 over UART, which will execute verify_cipher_flag() and load the PIN into RAM:
We dump the RAM using GDB, and run strings on it to find the PIN. Here you need to do some research to find where the RAM on the STM32F401 resides, or you might end up dumping the firmware once again:
We got the PIN! Now we use the keypad on the device to type the PIN, and we get back the following on the UART connection:
Let’s decrypt it… Nah I’m kidding. Let’s dump the RAM once again:
Voila! Mr Hackerman strikes again!
Basic One Fail
In this challenge we have to exploit a stack overflow in order to get the next flag. Typing a very long username-password combination will trigger a “HARD FAULT”:
However, as time was limited, we didn’t complete this challenge.
Greetings, future me or anyone else who may stumble upon this message.
Have you encountered the unfortunate situation of being compelled to use a Sagemcom F@st 2404 ADSL modem? Perhaps you were daring enough to install OpenWRT on it, only to realize that you lack the necessary 3.3V serial cable to proceed past the “firstboot” screen.
Fear not, for Uncle Dimme once again comes to the rescue! No need to delve deep into the abyss of scouring Tunisian telecom-company forums in search of the original firmware.
WARNING: Do not use these firmware files on anything unless you know what you are doing. You WILL void your warranty when using firmware from unofficial sources.
Ah, ForeFlight (uAvionix cough cough) sure knows how to restrict your freedom when it comes to upgrading or downgrading your Sentry firmware.
But fear not, for Uncle Dimme is here to save the day!
By the way, I strongly advise against using any of these files for any purpose. I cannot accept any responsibility whatsoever… Seriously, I won’t take any blame.
Oh, and if you’re not a fan of the filenames, remember to direct your frustrations towards Alonzo!
If you are unfortunate enough to have been given a Telia WiFi router model F@st 5370e made by Sagemcom, you may have experienced that IP 1.1.1.1 is unreachable. [1, 2, 3]
1.1.1.1 is a public DNS server provided by Cloudflare that many of us prefer to use, instead of, let’s say, Telia’s own snooping DNSes or Google’s 8.8.8.8. Of course, an alternative is to use 1.0.0.1, which also provides the same service by Cloudflare, but where is your backup DNS in that case?
The reason it is unreachable is that the router is using this IP internally for an interface called “IP_BR_LAN_LXC“. LXC is a userspace interface that can be used to create and manage application containers.
You can disable the “IP_BR_LAN_LXC” interface by following the instructions given below:
Login to you router’s “admin” (sic) interface by browsing to http://192.168.1.1
If you’re using Firefox or Chrome, press “F12” and navigate to the “Console” tab.
Enter the following command and press Enter: $.xmo.setValuesTree(false,"Device/IP/Interfaces/Interface[Alias='IP_BR_LAN']/IPv4Addresses/IPv4Address[Alias='IP_BR_LAN_LXC']/Enable");
That’s it, 1.1.1.1 should now be reachable. I have not experienced any issues by disabling this interface. Maybe I’ve blocked Telia from using some remote tools to mess with my router? I call this a win in that case. If for some reason, you want to reverse the setting above and re-enable this interface, you can do so by typing the following command into the console:
Bonus: While you’re at it, block 8.8.8.8 and 8.8.4.4 from your network. Reason? Android, and in general Google devices, are using this DNS regardless of your DHCP settings. You can block them by going to this hidden path in your router and adding 8.8.8.8 and 8.8.4.4:
PS: You can either change the DNS servers on a per-device basis, or you can change the DNS servers that your DHCP server is announcing to your local network. This can be done using the following hidden URL:
Yes, I am alive. I know I haven’t posted anything in three years. There are many reasons behind this, but I will leave this for another time.
As I mentioned in an earlier post, I got into this aviation thing back in 2015. Since then, I have taken it further and completed a commercial pilot’s license with multiple engine and instrument ratings and some other stuff. What does this all mean? I can now fly the big birds for money if an operator decides to hire me. But to the big question, how do you get an operator to hire you?
It is not a simple task; you have to submit countless applications and be prepared never to hear back from anyone. They say there is a pilot shortage, hmm…? If you are lucky, you might be called to an assessment. What? You don’t know what an assessment is? Don’t worry. I got you covered.
In the aviation industry, assessments are what job interviews are in any other field of work. But since pilots are rich (we are rich, right? somebody, please confirm?), assessments have to be complicated money and time-consuming processes. I was partially lucky and got called to an assessment for an operator called SunExpress. Spoiler alert: I didn’t get the job. I have nothing but good things to say about SunExpress. They are very professional in what they are doing and have high standards for their pilots. The reason I failed in my assessment is purely my own fault.
It basically works like this: You get a phone call, which is some kind of unofficial first interview. If they are happy with you after the phone call, you get invited to do an online ITEP English proficiency test. If you pass the ITEP test, you get invited to do some psychometric tests at SunExpress’s own premises. If you pass the psychometric tests, you get invited to do a simulator test-flight in a full-motion Boeing 737-800 simulator. The simulator was a lot of fun to fly, but this is as far as I got. If you pass the simulator test, you get invited to a formal interview, and if you pass the interview, you get the job! Phew…
Boeing 737-800 Full Motion Simulator
So what are the psychometric tests? They are the Mollymawk psychometric tests, also used by other operators like CargoLux and Pegasus Airlines. They are split into two categories: skill tests and aptitude tests. The skill tests test your knowledge in math, science, and English. Those were the easy ones for me. The aptitude tests test your memory, orientation skills, and ability to multitask, divided into three computer “games” named “Working Memory” “Spatial Orientation” and “Time Sharing”.
To do the Mollymawk tests, you have to purchase two packages: skill and aptitude tests. Each package costs 150€, and if you fail one subject or game in one package, you have to re-purchase the whole package to do the failed test again. The first time I did the Mollymawk tests, I passed the skill tests but failed the aptitude tests. Thus I had to re-purchase the aptitudes package to do the tests a second time. Luckily the second time, I passed. You only get one second chance. In total, I spent 450€, not counting travel expenses, as a part of what essentially is a job interview for a job that I didn’t get.
I felt that more practice would give me a better chance to pass the aptitude tests on the first go. The aptitude tests are essentially a form of primitive computer games. When you purchase the aptitudes package, they give you 10 practice runs in each game you can play at home. They argue that the learning curve is logarithmic and that after 10 practice runs, you have asymptotically reached your optimum ability in playing the games, but I doubt that. As anyone knows, practice makes perfect. So I decided to code my own version of the games and help other pilots truly reach the optimum before doing the final tests.
I have created a Mollymawk test practice website, where I have implemented my own version of the Mollymawk games. A user can register an account and purchase one of the three time-limited packages for playing the games. The games may be played unlimited times!
I have also implemented an interface for the users to track their progress as they are getting better:
Why do I ask for money and not put it out for free if I truly care about the other pilots? Somehow, I have to make back the money I lost during my earlier “job interviews”. After-all, pilots are rich. We rich guys, right? Do we have no problems paying 19€ instead of 150€ for doing the tests a second time?
Anyhow, if you are a pilot and in need of my services, I truly hope I helped and wish you the best of luck!
And remember, when in doubt, go around! (preferably above 1000 feet GND in IMC, unlike me).
