defcon34

bluetooth/classic_discoverable/src/conferences/2026BSidesPGH.h

@@ -0,0 +1,15 @@
+#if defined(EASY)
+#define RFHS_CHALLENGE_NAME "Bluetooth Classic Easy Fox"
+#define NAME "Chase BTC Easy Fox"
+#define MAC_ADDR {0xF2, 0x6B, 0x8C, 0x10, 0xEE, 0xBC}
+#define TIME_TO_WAKE 300
+#define TIME_TO_SLEEP 0
+#endif
+
+#if defined(HARD)
+#define RFHS_CHALLENGE_NAME "Bluetooth Classic Hard Fox"
+#define NAME "Marshall BTC Hard Fox"
+#define MAC_ADDR {0xF2, 0xC1, 0xD8, 0xA9, 0x7E, 0x0F}
+#define TIME_TO_WAKE 30
+#define TIME_TO_SLEEP 30
+#endif

bluetooth/classic_discoverable/src/conferences/9999skel.h

@@ -1,14 +1,16 @@
 #if defined(EASY)
-#define RFHS_CHALLENGE_NAME "Bluetooth Classic Easy Fox"
-#define NAME "Chase BTC Easy Fox"
+// RFHS_CHALLENGE_NAME "Bluetooth Classic Easy Fox"
+// FOX_KEYWORDS "Hunter should ask 'Are you the Bluetooth Classic Easy Fox?'"
+#define NAME "Molly BTC Easy Fox"
 #define MAC_ADDR {0x00, 0x01, 0x02, 0x03, 0x04, 0x05}
 #define TIME_TO_WAKE 300
 #define TIME_TO_SLEEP 0
 #endif
 
 #if defined(HARD)
-#define RFHS_CHALLENGE_NAME "Bluetooth Classic Hard Fox"
-#define NAME "Marshall BTC Hard Fox"
+// RFHS_CHALLENGE_NAME "Bluetooth Classic Hard Fox"
+// FOX_KEYWORDS "Hunter should ask 'Are you the Bluetooth Classic Hard Fox?'"
+#define NAME "Case BTC Hard Fox"
 #define MAC_ADDR {0x00, 0x06, 0x07, 0x08, 0x09, 0x0a}
 #define TIME_TO_WAKE 30
 #define TIME_TO_SLEEP 30

bluetooth/iBeacon/src/conferences/2026BSidesPGH.h

@@ -0,0 +1,31 @@
+#if defined(EASY)
+#define RFHS_CHALLENGE_NAME "BLE Easy Fox"
+#define DEVICE_NAME         "Skye BLE Easy Fox"
+#define BEACON_UUID         "F4162470-E0C1-42FD-B2CA-3FF8FA2B6CA9"
+#define MANUFACTURER_ID     0x4c00
+#define MAJOR               5
+#define MINOR               88
+#define SIGNAL_POWER        0xc5
+#define MAC_ADDR            {0xF2, 0xC4, 0xBD, 0x76, 0x16, 0xB3}
+
+#elif defined(MEDIUM)
+#define RFHS_CHALLENGE_NAME "BLE Medium Fox"
+#define DEVICE_NAME         "Rocky BLE Medium Fox"
+#define BEACON_UUID         "A57D0F5F-BBF4-4EEB-ABFA-5D0A64601482"
+#define MANUFACTURER_ID     0x4c00
+#define MAJOR               5
+#define MINOR               88
+#define SIGNAL_POWER        0xc5
+#define MAC_ADDR            {0xF2, 0x64, 0xA0, 0x14, 0xCB, 0x52}
+
+#elif defined(HARD)
+#define RFHS_CHALLENGE_NAME "BLE Hard Fox"
+#define DEVICE_NAME         "Rubble BLE Hard Fox"
+#define BEACON_UUID         "689236A5-DC8A-4C2A-93C5-E877710C5013"
+#define MANUFACTURER_ID     0x4c00
+#define MAJOR               5
+#define MINOR               88
+#define SIGNAL_POWER        0xc5
+#define MAC_ADDR            {0xF2, 0xF8, 0x20, 0xA7, 0x78, 0xA5}
+
+#endif

bluetooth/iBeacon/src/conferences/9999skel.h

@@ -1,6 +1,7 @@
 #if defined(EASY)
-#define RFHS_CHALLENGE_NAME "BLE Easy Fox"
-#define DEVICE_NAME         "Skye BLE Easy Fox"
+// RFHS_CHALLENGE_NAME "BLE Easy Fox"
+// FOX_KEYWORDS        "Hunter should ask 'Are you the BLE Easy Fox?'"
+#define DEVICE_NAME         "Bruce BLE Easy Fox"
 #define BEACON_UUID         "00000001-0002-0003-0004-000000000005"
 #define MANUFACTURER_ID     0x4c00
 #define MAJOR               5
@@ -9,8 +10,9 @@
 #define MAC_ADDR            {0x00, 0x01, 0x02, 0x03, 0x04, 0x05}
 
 #elif defined(MEDIUM)
-#define RFHS_CHALLENGE_NAME "BLE Medium Fox"
-#define DEVICE_NAME         "Rocky BLE Medium Fox"
+// RFHS_CHALLENGE_NAME "BLE Medium Fox"
+// FOX_KEYWORDS        "Hunter should ask 'Are you the BLE Medium Fox?'"
+#define DEVICE_NAME         "Cath BLE Medium Fox"
 #define BEACON_UUID         "00000006-0007-0008-0009-00000000000a"
 #define MANUFACTURER_ID     0x4c00
 #define MAJOR               5
@@ -19,8 +21,9 @@
 #define MAC_ADDR            {0x00, 0x06, 0x07, 0x08, 0x09, 0x0a}
 
 #elif defined(HARD)
-#define RFHS_CHALLENGE_NAME "BLE Hard Fox"
-#define DEVICE_NAME         "Rubble BLE Hard Fox"
+// RFHS_CHALLENGE_NAME "BLE Hard Fox"
+// FOX_KEYWORDS        "Hunter should ask 'Are you the BLE Hard Fox?'"
+#define DEVICE_NAME         "3Jane BLE Hard Fox"
 #define BEACON_UUID         "0000000b-000c-000d-000e-00000000000f"
 #define MANUFACTURER_ID     0x4c00
 #define MAJOR               5

foxhunt_instructions.txt

@@ -0,0 +1,14 @@
+Fox Instructions
+----------------
+Take the "I was the fox" patch, it is yours for agreeing to be our fox.
+Keep the Fox powered on and in the kit as you recieved it.
+For most of the foxes all steady leds means working correctly.
+Rapid blinking or alternating color is bad, contact your fox handler.
+When a hunter says the keyphrase in FOX_KEYWORDS, give them the whole kit.
+
+Fox Hunter Instructions
+-----------------------
+The challenge name on the scoreboard is in the RFHS_CHALLENGE_NAME field.
+The flag for the scoreboard is 'FOXFLAG'.
+Keep the patch that says "I found the fox".
+Return the remainder of the fox kit to the RF CTF desk.

make_conference_full.sh

@@ -2,56 +2,71 @@
 set -e
 set -u
 
+threewords() {
+  if [ ! -r '/usr/share/dict/cracklib-words' ]; then
+    printf 'Unable to find /usr/share/dict/cracklib-words\n'
+    exit 1
+  fi
+  dictionary='/usr/share/dict/cracklib-words'
+  shuf -n3 "${dictionary}" | tr '[:lower:]' '[:upper:]' | paste -sd ' ' | dos2unix
+}
+export -f threewords
+
 # Ensure we have a conference name
-if [ -z "${1:-}" ]; then
+if [ -n "${1:-}" ]; then
+  requested_conf="${1}"
+  conf="$(date +"%Y")${1}"
+else
   printf "Please provide conference name\n"
   exit 1
 fi
 
 # Check if that conference name already exists
 for challenge in bluetooth/iBeacon bluetooth/classic_discoverable wifi/wifi_ap_client; do
   pushd "${challenge}" > /dev/null 2>&1
-  if [ -e "src/conferences/$(date +"%Y")${1}.h" ]; then
-    printf "%s/src/conferences/%s%s.h already exists, please remove it or pick a different name\n" "${challenge}" "$(date +"%Y")" "${1}"
+  if [ -e "src/conferences/${conf}.h" ]; then
+    printf "%s/src/conferences/%s.h already exists, please remove it or pick a different name\n" "${challenge}" "${conf}"
     exit 1
   fi
   popd > /dev/null 2>&1
 done
-if [ -f "$(date +"%Y")${1}.txt" ]; then
-  printf '%s%s.txt already exists, please remove it or pick a different name\n' "$(date +"%Y")" "${1}"
+if [ -f "${conf}.txt" ]; then
+  printf '%s.txt already exists, please remove it or pick a different name\n' "${conf}"
   exit 1
 fi
 
-# Safety checks complete, define functions and do the thing
-threewords() {
-  if [ ! -r '/usr/share/dict/cracklib-words' ]; then
-    printf 'Unable to find /usr/share/dict/cracklib-words\n'
-    exit 1
-  fi
-  dictionary='/usr/share/dict/cracklib-words'
-  shuf -n3 "${dictionary}" | tr '[:lower:]' '[:upper:]' | paste -sd ' '
-}
-export -f threewords
-
-for challenge in bluetooth/iBeacon bluetooth/classic_discoverable wifi/wifi_ap_client; do
+for challenge in bluetooth/iBeacon bluetooth/classic_discoverable wifi/wifi_ap_client non-kitsune-foxes/fm_fox; do
   pushd "${challenge}" > /dev/null 2>&1
-  printf "Rolling %s for %s%s... " "${challenge}" "$(date +"%Y")" "${1}"
-  ./make_conference.sh "${1}"
-  if [ ! -e "src/conferences/$(date +"%Y")${1}.h" ]; then
-    printf "Something went wrong creating %s/src/conferences/%s%s.h, please scroll up\n" "${challenge}" "$(date +"%Y")" "${1}"
-    exit 1
+  printf "Rolling %s for %s... " "${challenge}" "${conf}"
+  if [ -x make_conference.sh ]; then
+    ./make_conference.sh "${requested_conf}"
+    if [ ! -e "src/conferences/${conf}.h" ]; then
+      printf "Something went wrong creating %s/src/conferences/%s.h, please scroll up\n" "${challenge}" "${conf}"
+      exit 1
+    fi
+    ln -snf "conferences/${conf}.h" src/current_conf.h
   fi
-  ln -snf "conferences/$(date +"%Y")${1}.h" src/current_conf.h
-  grep -e 'RFHS_CHALLENGE_NAME\|NAME\|UUID\|MAC_ADDR\|FSSID\|CHANNEL' "src/conferences/$(date +"%Y")${1}.h" | sed -e 's#{##' -e 's#}##' -e 's#0x##g' -e 's#, #:#g' | tee -a "${OLDPWD}/$(date +"%Y")${1}.txt" > /dev/null 2>&1
+  grep -e 'RFHS_CHALLENGE_NAME\|FOX_KEYWORDS\|NAME\|UUID\|MAC_ADDR\|FSSID\|CHANNEL' "src/current_conf.h" | \
+    sed -e 's#{##' -e 's#}##' -e 's#0x##g' -e 's#, #:#g' -e 's#// ##' -e "s/#define //" | tee -a "${OLDPWD}/${conf}.txt" > /dev/null 2>&1
   printf "complete\n"
   popd > /dev/null 2>&1
 done
-printf "Seeding keys for %s%s... " "$(date +"%Y")" "${1}"
-#sed -i \
-#  -e "/RFHS_CHALLENGE_NAME/i -\n----------------------------------------------------------------\n$(date +"%Y")${1}\n$(threewords)\n" \
-#  "$(date +"%Y")${1}.txt"
+printf "Formatting with conference name for %s... " "${conf}"
 sed -i \
-  -e "/RFHS_CHALLENGE_NAME/{h; s/.*/printf -- '-\\n----------------------------------------------------------------\\nConference: %s%s\\nFlag: %s\\n\\n' \"\$(date +%Y)\" \"${1}\" \"\$(threewords)\"/e; G;}" \
-  "$(date +"%Y")${1}.txt"
-sed -i '1iSet font to "Roboto Mono' "$(date +"%Y")${1}.txt"
+  -e "/RFHS_CHALLENGE_NAME/{h; s/.*/printf -- '-\\n----------------------------------------------------------------\\nConference: %s\\n' \"${conf}\"/e; G;}" \
+  "${conf}.txt"
 printf "complete\n"
+
+printf "Adding instructions..."
+sed -i -e "/FOX_KEYWORDS/{h; s/.*/printf -- '\n%s\n\n' \"\$(cat foxhunt_instructions.txt)\"/e; G;}" "${conf}.txt"
+printf "complete\n"
+
+printf "Seeding keys for %s... " "${conf}"
+#this works despite shell check thinking it does not
+#shellcheck disable=2016
+sed -i -e 's/\(.*\)[F]OXFLAG\(.*\)/printf "%s%s%s\\n" \x22\1\x22 "\$(threewords)" \x22\2\x22/e' "${conf}.txt"
+printf "complete\n"
+
+sed -i '1iSet font to "Roboto Mono"' "${conf}.txt"
+
+printf "Generation Complete\n"

non-kitsune-foxes/README.md

@@ -0,0 +1 @@
+This folder is full of pretend stubs so that make_conference.sh will create flags and directions for foxes we use for the RF CTF which are not actually part of kitsune.

non-kitsune-foxes/fm_fox/README.md

@@ -0,0 +1 @@
+This fox is a 12v dc fm transmitter like you can find at any gas station which has been modified to run on 5v.

non-kitsune-foxes/fm_fox/src/current_conf.h

@@ -0,0 +1,2 @@
+RFHS_CHALLENGE_NAME "Happy Hamster Fox"
+FOX_KEYWORDS "Hunter should ask 'Are you the hamster fox?'"

wifi/wifi_ap_client/src/conferences/2026BSidesPGH.h

@@ -0,0 +1,134 @@
+// Bash to generate MAC address
+// Note: least significant bit of first byte must be zero, here it's fixed to 0xF2
+// printf '0xF2, 0x%02X, 0x%02X, 0x%02X, 0x%02X, 0x%02X\n' $[RANDOM%256] $[RANDOM%256] $[RANDOM%256] $[RANDOM%256] $[RANDOM%256]
+
+//WIFI_POWER_19_5dBm 78
+//WIFI_POWER_19dBm 76
+//WIFI_POWER_18_5dBm 74
+//WIFI_POWER_17dBm 68
+//WIFI_POWER_15dBm 60
+//WIFI_POWER_13dBm 52
+//WIFI_POWER_11dBm 44
+//WIFI_POWER_8_5dBm 34
+//WIFI_POWER_7dBm 28
+//WIFI_POWER_5dBm 20
+//WIFI_POWER_2dBm 8
+//WIFI_POWER_MINUS_1dBm -4
+
+#if defined(AP)
+#if defined(EASY)
+#define RFHS_CHALLENGE_NAME "WiFi AP Easy Fox"
+// Network config
+#define FSSID "Zuma WiFi AP Easy Fox"
+#define PSK "0123456789"
+// set mac address
+#define MAC_ADDR {0xF2, 0x86, 0x9C, 0x93, 0x37, 0x38}
+// 1-13 permitted 0 means random
+#define CHANNEL 1
+// 0 broadcast 1 hidden
+#define SSID_HIDDEN  0
+// 1-4 permitted
+#define MAX_CLIENTS 1
+#define TIME_TO_WAKE 15
+#define TIME_TO_SLEEP 5
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TXPOWER WIFI_POWER_17dBm
+#endif
+
+#if defined(HARD)
+#define RFHS_CHALLENGE_NAME "WiFi AP Hard Fox"
+// Network config
+#define FSSID "Everest WiFi AP Hard Fox"
+#define PSK "0123456789"
+// set mac address
+#define MAC_ADDR {0xF2, 0xCA, 0xCF, 0x0A, 0x6B, 0x4C}
+// 1-13 permitted 0 means random
+#define CHANNEL 0
+// 0 broadcast 1 hidden
+#define SSID_HIDDEN 0
+// 1-4 permitted
+#define MAX_CLIENTS 1
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TIME_TO_WAKE 30
+#define TIME_TO_SLEEP 45
+#define TXPOWER WIFI_POWER_7dBm
+#endif
+
+#if defined(FIVEEASY)
+#define RFHS_CHALLENGE_NAME "WiFi 5GHz AP Easy Fox"
+// Network config
+#define FSSID "Rex WiFi 5GHz AP Easy Fox"
+#define PSK "0123456789"
+// set mac address
+#define MAC_ADDR {0xF2, 0x8B, 0x0A, 0x96, 0x8A, 0xA8}
+// 1-13 permitted 0 means random
+#define CHANNEL 36
+// 0 broadcast 1 hidden
+#define SSID_HIDDEN  0
+// 1-4 permitted
+#define MAX_CLIENTS 1
+#define TIME_TO_WAKE 15
+#define TIME_TO_SLEEP 5
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TXPOWER WIFI_POWER_17dBm
+#endif
+
+#if defined(FIVEHARD)
+#define RFHS_CHALLENGE_NAME "WiFi 5GHz AP Hard Fox"
+// Network config
+#define FSSID "Liberty WiFi 5GHz AP Hard Fox"
+#define PSK "0123456789"
+// set mac address
+#define MAC_ADDR {0xF2, 0xB4, 0x21, 0x54, 0x87, 0x8E}
+// 1-13 permitted 0 means random
+#define CHANNEL 0
+// 0 broadcast 1 hidden
+#define SSID_HIDDEN 0
+// 1-4 permitted
+#define MAX_CLIENTS 1
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TIME_TO_WAKE 30
+#define TIME_TO_SLEEP 45
+#define TXPOWER WIFI_POWER_7dBm
+#endif
+#endif
+
+#if defined(CLIENT)
+#if defined(EASY)
+#define RFHS_CHALLENGE_NAME "WiFi Client Easy Fox"
+// set mac address
+#define FSSID "Tracker WiFi Client Easy Fox"
+#define PSK "0123456789"
+#define MAC_ADDR {0xF2, 0x76, 0x99, 0x05, 0x5A, 0x0C}
+// Network config
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TIME_TO_WAKE 300
+#define TIME_TO_SLEEP 1
+#define TXPOWER WIFI_POWER_17dBm
+#endif
+
+#if defined(HARD)
+#define RFHS_CHALLENGE_NAME "WiFi Client Hard Fox"
+// Network config
+#define FSSID "Robo-Dog WiFi Client Hard Fox"
+#define PSK "0123456789"
+// set mac address
+#define MAC_ADDR {0xF2, 0xFD, 0xAD, 0x2B, 0x9F, 0xDE}
+// checks run during startup so we want to stay
+// running no longer than a few minutes to force
+// checks to run and led to update
+#define TIME_TO_WAKE 300
+#define TIME_TO_SLEEP 0
+#define TXPOWER WIFI_POWER_17dBm
+#endif
+#endif