---
# System prepended metadata

title: IOT Range
tags: [CPENT]

---

# IOT Range
## Challenge 26-38
![image](https://hackmd.io/_uploads/SJr6ZSIseg.png)
![image](https://hackmd.io/_uploads/HklgMSLoxg.png)
![image](https://hackmd.io/_uploads/SymumU8iex.png)

### FileOne.bin
* ![image](https://hackmd.io/_uploads/H1kDXH8ixx.png)

* ![image](https://hackmd.io/_uploads/rkpc7SIilg.png)

* ![image](https://hackmd.io/_uploads/H1mCEr8oel.png)

* ![image](https://hackmd.io/_uploads/HkJJLr8sel.png)

* ![image](https://hackmd.io/_uploads/BJBPjrIiel.png)

* ![image](https://hackmd.io/_uploads/rynJaH8sle.png)

* ![image](https://hackmd.io/_uploads/Syel-LLiee.png)

* ![image](https://hackmd.io/_uploads/HkZr-IUoxx.png)

* ![image](https://hackmd.io/_uploads/B10HMUUjgl.png)

* ![image](https://hackmd.io/_uploads/rkoAQ8Ljle.png)

* ![image](https://hackmd.io/_uploads/H1dTVLLigx.png)

### Answer
* Challenge 26:`data`
* Challenge 27:`1.0.0`
* Challenge 28:`1550`
* Challenge 29:`squashfs`
* Challenge 30:
* Challenge 31:`447`
* Challenge 32:`asp`
* Challenge 33:`samba`
* Challenge 34:`pwnable`
* Challenge 35:`mips32`
* Challenge 36:`false`
* Challenge 37:`6`
* Challenge 38:`0x400640`


## Challenge 40-43
### FileTwo.bin
![image](https://hackmd.io/_uploads/r1gfrLIjxx.png)

* ![image](https://hackmd.io/_uploads/r1qprUIjxe.png)

* 看起來只是壓縮
    * ![image](https://hackmd.io/_uploads/Bkg4UL8sxe.png)

### Answer
* Challenge 40:`E826`
* Challenge 41:`False`
* Challenge 42:`True`
* Challenge 43:

## Challenge 44-45, 61
### FileThree.bin
![image](https://hackmd.io/_uploads/HkivnORiex.png)
![image](https://hackmd.io/_uploads/HkXFluyhee.png)


* 這支是有加密的, `binwalk -t`沒辦法直接查看資訊
    * ![image](https://hackmd.io/_uploads/HJ6-ztCjgg.png)

* XOR加密
    * ![image](https://hackmd.io/_uploads/Bk6OMK0sex.png)
```zsh=
hexdump -C FileThree.bin |tail -n 30
```

* xcat解密binary
    * https://github.com/mstrand/xcat
    * ![image](https://hackmd.io/_uploads/rJsXe_k3el.png)
```zsh=
./xcat.py -x '8844a2d168b45a2d' ../FileThree.bin >decrypt.bin
```

### Answer
* Challenge 44:`False`
* Challenge 45:`True`
* Challenge 61:`LZMA`

## Challenge 46-50
### IOT.bin
![image](https://hackmd.io/_uploads/SyQE4_J3xl.png)

* ![image](https://hackmd.io/_uploads/HJKCLu1hge.png)

### Answer
* Challenge 46:`0x20`
* Challenge 47:`0x3c`
* Challenge 48:`0x192728`
* Challenge 49:`piggy`
* Challenge 50:`squashfs`

## Challenge 51-55
### IOT2.bin
![image](https://hackmd.io/_uploads/H11sVuJ3ge.png)

* ![image](https://hackmd.io/_uploads/ByWku_J3gx.png)

### Answer
* Challenge 51:`0x1A0`
* Challenge 52:`0x160`
* Challenge 53:`26 MB`
* Challenge 54:`JFFS2`
* Challenge 55:`Little Endian`

## Challenge 56-58
### IOT3.bin
![image](https://hackmd.io/_uploads/Byh24O1hex.png)

* 挺複雜的這題, `binwalk -t`跑出一大堆xz壓縮檔, 但利用`-Me`還是找到關鍵的資料夾
    * ![image](https://hackmd.io/_uploads/ryBEptk2xl.png)

* 找半天在這個檔案裡
    * ![image](https://hackmd.io/_uploads/rJadb5Jhgx.png)

* 直接用答案格式下去找可能的檔案在下去翻
    * ![image](https://hackmd.io/_uploads/BkJlGcy2ex.png)
    * ![image](https://hackmd.io/_uploads/H1TfG9y3xx.png)


```zsh=
find . -type f -name "?????_??????"
```

### Answer
* Challenge 56:`squashfs`
* Challenge 57:`check_fwmode`
* Challenge 58:`0ee2cb110a9148cc5a67f13d62ab64ae30783031`


## Challenge 59-60
### IOT4.bin
![image](https://hackmd.io/_uploads/B1zbS_1nge.png)

* ![image](https://hackmd.io/_uploads/BJezV9khle.png)
* ![image](https://hackmd.io/_uploads/BytXhhgnll.png)

### Answer
* Challenge 59:`HNAP`
* Challenge 60:`SOAP`
