Posts Tagged ‘en’

Telenet modem and Cisco switch [en]

mardi, avril 25th, 2017

This is one thing among many others i have to say against Telenet: once the modem reboots (and it can be quite often, always requested by Telenet), the port of the switch just shuts down and block all access to the modem. Very embarrassing…

Let’s see what’s going on in the switch via the serial console:

Switch#show interface status err-disabled

Port Name Status Reason Err-disabled Vlans
Fa0/23 err-disabled loopback

Something you need to know about the Cisco is that the switch send keepalive packets down all active ports. When the modem reboots, it’s echoing the keepalive packet back to the switch. The switch freaks out and disable the port, cutting you off the internet.

The solution is pretty easy: all you need to do to is to turn off keepalives for that interface:

Switch#config t
Switch(config)#Interface fa0/23
Switch(config-if)#no keepalive
Switch# copy running-config startup-config

Now that we disabled the keepalive,it’s time to re-enable the port. You have to manually shut it down and re-enable it to clear the err-disable state:

Switch#config t
Switch(config)#Interface fa0/23
Switch(config-if)#no shutdown

Enjoy your recovered internet. 🙂


Getting started with Juniper SRX platform [en]

vendredi, janvier 6th, 2017

I started to play with the Juniper SRX platform a few month ago. I got a SRX 220 on loan from Rafael and i bought a SRX100 for my experimentations. The JunOS operating system installed on the boxes is heavily based on FreeBSD, so we’re in familar Unix-land. This is going to be fun. 🙂

I have access to lab documentation, but i will not exactly reproduce the setup from the books: there will be some adaptations (mainly about port numbering) that will fit my lab setup, since I will work on those devices from a remote location and i will not enjoy 100% physical access during my exercises. To make matters even more interesting, i still have my old ADSL connection that will be used as a separate internet access.

The default configuration is a simple NATing firewall/router, similar to the one you might expect from a stock OpenWRT installation. There is a web interface, but i will just ignore it, so let’s dig out the Cisco serial cable and connect to the console port.

Configuring the SRXes over serial port is nice, but they are available only in limited quantity on my Terminator server, so we will start by setting up the devices for a more convenient ssh access from my home network. The config statements allow for comments: they start with the character ‘#’ and the commands will be peppered with them, so you can copy-paste huge blocks of text at once.

We will start with the SRX100: the management port is connected to port 7 on the firewall

# Set system root password (REQUIRED)
set system root-authentication plain-text-password 

# Check if config passes
commit check 

# Remove interface from bridge
delete interfaces fe-0/0/7 unit 0 

# Add ssh pubkey
set system root-authentication ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC98TAUD9PPuzRj5uyHWlxZiXGLm1JI7T2hPNwmW9pU5V/guoJ90VTNQ7lugEoX8HYxB7JC0/RA5ogJBkhcQHIAMIGT6yM7F2zzVv9LadbiMU0KrB2dZVmPKKxi49uqqj+d8zIWTbm4tLf7xdF42kr7c2AUl1kYzaD1ymlAXSavvHTg7y/h2/mZ36F7WZmVwa7Q6iI5Vuca66lauwGgl1ETS2lwneQn+CWDZFMSFDT9TmphR8mpISi8063oTwvvHa/t0bpeQnKltg1iqM2YGTlIGTgXuEWsiAARfF96zhOUAXseA9WHeCTDUITmycFau4+ILxVH47Z6oC11W52BtwIf frederic@pekko"

# Set IP address
set interfaces fe-0/0/7 unit 0 family inet address

# Put interface into mgmt zone and activate services
set security zones security-zone mgmt interfaces fe-0/0/7.0 host-inbound-traffic system-services http
set security zones security-zone mgmt interfaces fe-0/0/7.0 host-inbound-traffic system-services https
set security zones security-zone mgmt interfaces fe-0/0/7.0 host-inbound-traffic system-services ssh
set security zones security-zone mgmt interfaces fe-0/0/7.0 host-inbound-traffic system-services ping

# save changes

# From now, ssh is available and we can disconnect the serial interface. It won’t be used for the rest of the experimentations unless we need to move the management interface to another port. Now, let’s set up PPPoE…

set interfaces fe-0/0/0 unit 0 encapsulation ppp-over-ether
set interfaces pp0 unit 0 ppp-options chap local-name <YOUR_USERNAME>
set interfaces pp0 unit 0 ppp-options chap default-chap-secret <YOUR_PASSWORD>
set interfaces pp0 unit 0 pppoe-options underlying-interface fe-0/0/0.0
set interfaces pp0 unit 0 pppoe-options client
# When using PPPoE, always set MTU to 1492
set interfaces pp0 unit 0 family inet mtu 1492
set interfaces pp0 unit 0 family inet negotiate-address
# Explicitly tell to use the PPPoE interface as default route
set routing-options static route next-hop pp0.0 metric 0

At that point, the PPPoE session is established. Let’s check it:

run show interfaces terse

pimd up up 
pime up up 
pp0 up up
pp0.0 up up inet -->
ppd0 up up
ppe0 up up
st0 up up
tap up up
vlan up up
vlan.0 up up inet

This looks good ! We have an IP address from our ISP ! Let’s attack the SRX220…


A puzzle solved. [en]

mercredi, juillet 4th, 2012
Vasco Digipass 810

Vasco Digipass 810

Do you remember when i opened my bank calculator ? Beside replacing dead batteries, i wanted to see what made it tick and eventually replace it by an ordinary smartcard reader and some code running on a computer.

Turns out that other people had the same idea, but they beat me by having put more time and energy into that project and ended up producing something usable.

It’s just a Python script to talk to the card. The usage is very straightforward, here are some examples:

To authenticate with the M1 key and the 23543696 challenge, type the following command:

$ ./EMV-CAP -m 1 23543696
Using this software for real financial operations can lead to some risks.
Indeed advantage of using a standalone reader is is to isolate your banking
card from big bad malwares.
Using it in a non-secured reader is taking risk that a keylogger intercepts
your PIN, a malware accesses to your card informations, or even intercepts
your transaction to modify it or operates its own transactions.
Are you sure you want to continue?
If so, type 'YES', or anything else to quit:YES
Enter PIN (enter to abort) :
Response: 45108749

To sign a transaction the same way than the M2 key with the challenges 09356196 and 345, use the following command:

$ ./EMV-CAP -m 2 09356196 345
Using this software for real financial operations can lead to some risks.
Indeed advantage of using a standalone reader is is to isolate your banking
card from big bad malwares.
Using it in a non-secured reader is taking risk that a keylogger intercepts
your PIN, a malware accesses to your card informations, or even intercepts
your transaction to modify it or operates its own transactions.
Are you sure you want to continue?
If so, type 'YES', or anything else to quit:YES
Enter PIN (enter to abort) :
Response: 45201783

Thank you Jean-Pierre Szicora and Philippe Teuwen, nice work !! 🙂

An update to the wall wart hunting [en]

mercredi, avril 4th, 2012

There was some evolution since that article.

Velleman PSIN30012 with some desk clutter

The Power supply: a Velleman PSIN30012

power supply with brackets

I can has brackets ?

I finally decided to make the brackets and installed the power supply in my apartment.

The power supply can output 25A under 12V, should be enough for my applications at the moment.

I pulled some 6 mm² wires through my apartment, inside the same conduits as the network cables. There is one supply going to the datenklo (the toilet host my network, like at the Chaos Communication Camp) and two independent supplies are going to my desk. They only meet at the terminal blocks.

The power supply has been installed in the cupboard near the fuse box and is protected by a 6A breaker at the primary, sharing the circuit with the doorbell.

power supply in place

Installed and wired

6 mm² wires on the power supply

6 mm² wires on the power supply

temporary cable with XLR 4 pin female connector for the wireless router

Temporary cable with XLR 4 pin female connector

The connectors i use for the 12V power sockets are Neutrik XLR 4 pins, they are much more resilient and safer than cigarette lighter plugs (will be part of a rant in a separate article)


None so far, the power supply is running smooth and cool, but the fan is noisy like hell !!

My wireless router is running from that power supply and seems very happy about it.

The future

  • I will have to move the power supply to the datenklo: i have a noisy 24/7 ventilation in there. 🙂
  • Still need a way to integrate the XLR sockets with my light switches in such a way that it look like it’s coming straight from the manufacturer. Will be part of a separate article. 🙂
  • Rebuild my media-PC to work straight from a 12V DC source.
  • Connect LED strips to it: my bar and my kitchen will receive a bunch of LED strips.
  • Figure out how to work with pictures in WordPress, this article is a mess !!

Is there such a thing as « hackerspace burnout » ? [en]

samedi, janvier 28th, 2012

After the awesome Chaos Communication Camp 2011, i had some difficulties to get involved with projects in the space for about a month and half: it’s like i lost something.

To put in context, i’ve been co-driving the truck that carried the material and luggage of 3 belgian hackerspaces and one dutch space up to Finowfurt and back. My co-driver did all the paperwork for the truck, made the whole pickup schedule, did the initial loading at the starting point, and even did the cooking every day since we arrived at the camp, while also taking care of his son. Hats off to that guy that will certainly recognize himself when reading this. On my side, i was busy coordinating the set up of our party tent (we barely had enough hands to raise it), doing all the wiring and light setup, and helping installing the tables and the network. The weather was not friendly either. After the camp was the teardown, packing and filling the truck, Then the driving back and final delivery to the different spaces, all on a very compressed schedule.

Now i feel the same thing again: i’ve been working in the space over the last month on a quite regular basis: drink shopping, moving shelves, filling fridge, garbage collection, rebuilding the electric installation nearly from scratch and dealing with the sharp aspects of socializing.

I want to work on my own pet projects and stop working on infrastructure and janitorial stuff for a while. For the ByteNight, i already made it clear that i will not get involved in any aspect of it. I’ll be there as a customer, sipping my drink on the sofa.

Once i finish the last missing bits on the electric installation, i will freeze all infrastructure projects (Zoppas, Parallel port interface, last power circuit and relay board) for some time.

Reboot in March 2012 ?

Wall wart hunting [en]

mardi, janvier 17th, 2012

I found in my apartment about 10 wall warts and two linear power supplies that give the same (or similar) voltage for my equipment.

Spools of red and black wire with a power supply

Let the hunt begin

I would like to get rid of those power bricks and have a more consistent and centralized setup. I hope to make some savings in the process by using a more efficient oversized switch mode power supply. Another advantage is that if i want an UPS on that line, i just need to connect a SLA battery.

My apartment will be wired with 6 mm² wires carrying 12VDC: one branch go to the networking area, the other two go to my desk.

Let’s lay down some wires !!

Today in the physical mail box [en]

jeudi, juillet 14th, 2011
Package content

Package content

Today i received the GSM shield for Arduino from Open Electronics. I rushed to get a pre-paid SIM card to start playing with the new toy.

I just realised that i don’t have an arduino board yet in my personal toolbox, but i can borrow one from the hackerspace to start experimenting.

I have two projects in mind:

  • mailbox watcher: Since the mailbox is far from my apartment and not within my regular walking path, (and i am a lazy person ;-)), i want the board to send me an SMS when a letter is landing in the mailbox. This is also a nice opportunity to experiment aggressive power saving and see how long can a set of fresh batteries last.
  • Hackerspace door opener: I am also building a motorized lock for the local hackerspace. I don’t know yet what kind of remote control we can use, but it has to be democratic enough. This is not the most original project: the Ghent hackerspace already did it.


GSM shield assembled

GSM shield assembled

The shield come as a kit, some soldering is required, but nothing too serious (only through hole components, 2,54 mm pin spacing). In my case, only the switch SW1 was tricky to install.

That’s all for the moment, time to write code.


jeudi, mai 12th, 2011

Ce matin, à vélo, sur le chemin du travail (et pas loin de l’arrivée en plus).

This morning, on the bicycle, on the way to work (and very close to my destination).

Opening the Vasco Digipass 810 [en]

jeudi, février 24th, 2011
Vasco Digipass 810

Vasco Digipass 810

Many belgian and european banks are providing their customers with a device that look like a small calculator. This device, coupled with your bank card,  is used to secure and authenticate the transactions when using internet banking.

Since that device is fairly standard, there is nothing stopping you from using the reader from bank A with your card from bank Z and vice versa, because the crypto processing is happening on the chip of your card.

Knowing that the heavy crypto work is delegated to the bank card, it is safe to assume that the device is quite dumb: a keypad to feed data to the card, a screen to display the results and a micro-controller to do some simple housekeeping tasks, like update the screen, poll the keypad, clock the card and send/receive data.

I have no proof of what’s described above, but since mine had dead batteries after five years of use, it has become a prime candidate for exploration, so let’s open the case !! 🙂

Ugh !!

Digipass cracked open

Opened !!

It was a tough nut to crack !!

There are no screws and no clips holding it closed: the two halves of the case are welded together !! This is another prime example of planned obsolescence and wasteful engineering. There is no way to open it cleanly, you need to break it apart as careful as possible to get access to the main PCB and the batteries. Your ability to close the box afterward will fully depend on how you open it in the first place.

The batteries are nothing exotic: just two CR-2032 button cells. They are wired in series on the PCB, because many smartcards require a 5V power supply to work properly.

Circuit board detail

All test pads are clearly labelled !

When you observe the PCB, there are a lot of interesting test points, all properly labeled. A hacker’s dream. 🙂

Fried !!

Unfortunately, while groping at it with a multimeter set to continuity tester, i fried the microcontroller. Apparently, that kind of invasive measurement was enough to kill it.

I wanted to check the continuity between the SDATA test pad and the DATA line on the card connector, the SCLK and the CLOCK line of the card connector. There was no continuity between those points and the J2 pad is still a mystery of what the purpose could be. An optional eeprom maybe ?

I received a new reader to continue with my day to day banking operations, but i still want to see the data flowing between the card and the reader. My mistake is just a setback: i will change strategy and try to (ab)use the reader as-is, without opening the case. 🙂

More to come later. In the meantime, here are the Manufacturer’s information


IPv6 mining exploitation (digging tunnels) [en]

mardi, novembre 23rd, 2010

IPv6 in IPv4

This is the most common situation: you want your IPv6 connectivity on your road warrior through your VPN:


router: /etc/network/interfaces

auto tunv6
iface tunv6 inet6 v4tunnel
address 2001:cafe:babe:1::1
netmask 64
ttl 64

road warrior: /etc/network/interfaces

auto tunv6
iface tunv6 inet6 v4tunnel
address 2001:cafe:babe:1::2
netmask 64
gateway 2001:cafe:babe:1::1
ttl 64

Shell commands:

Machine A:

ip tunnel add v6tun mode sit remote local ttl 63
ip link set v6tun up mtu 1280
ip addr add 2001:cafe:babe:1::1/96 dev v6tun

Machine B:

ip tunnel add v6tun mode sit remote local ttl 63
ip link set v6tun up mtu 1280
ip addr add 2001:cafe:babe:1::2/96 dev v6tun

IPv4 in IPv6

The weirdest and most interesting one: suppose you have equipment that is not IPv6 compatible, yet you want to connect them through a v6-only link between the two endpoints

Machine A:

ip -6 tunnel add v4tun mode ipip6 local 2a00:ffde:4567:edde::4987 remote 2001:473:fece:cafe::5179
ip addr add dev v4tun
ip link set dev v4tun up

Machine B:

ip -6 tunnel add v4tun mode ipip6 remote 2a00:ffde:4567:edde::4987 local 2001:473:fece:cafe::5179
ip addr add dev v4tun
ip link set dev v4tun up


(Work in progress: this page will be syncronized with this one)