What is this?

This is my writeup from the Større Faglige Opgave, a multi-day technical challenge handed out as part of the application process for the offensive security positions at Forsvarets Efterretningstjeneste (FE), through their Hackerakademi programme.

The Hackerakademi recruits and trains operators for the Danish foreign intelligence service. The application process consists of an IQ assessment, a smaller practice challenge (Operation Bad Primate), and finally the Større Faglige Opgave, the main technical evaluation.

You can read more about the programme at hackerakademi.dk/about and the practice challenge at hackerakademi.dk/challenge.

This writeup covers only the Større Faglige Opgave, not the practice challenge.

The scenario

The brief was framed as an operation against a fictional IoT device named DDING-3000, an “enterprise-grade Internet Service Bell” deployed at a fictional hotel. The device functioned as a network-connected reception bell with an integrated fingerprint reader, and the objective was to attack one of three exposed components in order to ultimately exfiltrate the fingerprint data.

The three attack vectors offered:

  1. netupsrv - a custom file upload protocol and its server
  2. update2d - a third-party update unpacker
  3. embedded femtium - the fingerprint reader’s own CPU running a Fenix kernel

Each vector was meant to be approached with three objectives in mind: exploitation, persistence, and exfiltration.

How it was handed out

The challenge was delivered as a VM containing three files:

The first task was to build a tool capable of extracting files from the U5FS image. The actual challenge material, including the briefing, attack vector descriptions, and supporting files, were only revealed after successfully implementing an extractor and unpacking the image.

What I worked on

My primary attack vector was netupsrv. Through traffic analysis of a provided pcap file and reverse engineering of the netup server binary, I reconstructed the protocol and built a working client capable of every operation the protocol supports, including read operations not exposed by the official client.

I then found a spool directory escape via a path.Clean quirk involving trailing slashes, which allowed arbitrary file writes outside the intended sandbox.

As a secondary vector I attacked update2d, where I found command injection in its handling of system() calls with unsanitized input from update files. Combined with the netupsrv escape, this gave me a chain ending in RCE via a custom u2d file that spawned a reverse shell, the foundation for both persistence and exfiltration.

The full report below documents:

Source code

The full source code (U5FS extractor, NetUp client, exploitation scripts, and u2d forging tool) is available as a zip archive:

Download FE_COGNITIO.zip

The archive structure mirrors the paths referenced throughout the writeup, and each subdirectory contains its own README.

Feedback from FE

After submitting my work I emailed Hackerakademi asking for feedback. They replied that due to the volume of submissions they couldn’t give detailed feedback, but they could confirm that my submission was good, however other participants performed better. They encouraged me to keep an eye on fe-ddis.dk for other IT roles at FE, and to keep practicing.

A note on what I cannot share

The original challenge materials, the U5FS image, the netup binary, the pcap file, and so on, are property of FE and won’t be redistributed here. The writeup focuses on my methodology, findings, and code. Snippets of protocol behaviour and binary analysis are included where necessary to explain reasoning.

The writeup itself is in English.