Hello, everyone, and welcome to live CTF.
This is our audio check for our live stream.
Hopefully, you guys can hear us.
Let us know in the chat if you can.
I'm cyphertex, or Jordan.
I'm going to be one of the commentators this weekend.
And with me is Carl.
Hi, I'm Carl, or Zita2.
We'll be commentating here with Jordan.
And, yeah, glad to be here.
Okay, I hope this is...
Yeah, we put a lot of work in.
This has been a lot of stress, but we're starting.
I think everything's working.
We're looking forward to seeing the teams compete.
So before we kind of get into the meat of it,
let's talk a little bit about the history,
what this event is, what we're doing,
what we're hoping to see from the teams.
So, you know, live CTF as a concept
has existed for quite some time.
Hey, triple six, we see you in there in the chat.
Yeah, definitely let us know if you're doing this.
We have to bring the camera in
if we get too many jokesters behind us.
It is DEF CON, so we're going to get that.
Live CTF has been around as a name.
GeoHot started several years ago.
It was streaming on Twitch and did a couple of these
kind of like live, it was playing capture and flag challenges
and wanted other people to see him doing it
and kind of interact, sort of early live streaming stuff.
There was a couple of different,
I guess, experiments or attempts.
I did one a couple years ago at DEF CON finals
where I messed up the audio and it wasn't live
and recorded it and it was a bit of a bummer.
So we've had a couple examples of that.
And then you also were running Pony Racing, right?
Yeah, exactly.
So a couple of years ago, we did for a year,
we run a monthly like live CTF show on YouTube
where we had four contestants trying to solve
the same challenge head to head
and like doing commentary on top of that.
It was pretty popular, actually.
A lot of people like, it's a lot of work though.
I think people don't, they underestimate
how hard it is to kind of get it.
So let's talk a little about like the kind of what it is.
So when we talk about live CTF,
right, obviously Capture the Flag,
we're talking about a hacking challenges.
There's a variety of different, you know,
CTF out there with different scoreboard and structure.
And so when we say live CTF,
we're specifically saying a small group of people
going head to head on the exact same challenge.
And in particular, we're watching them.
We want to see what they're doing.
That's what makes live CTF really interesting.
And this is exciting because we're bringing live CTF
to DEF CON CTF finals.
So certainly one of the premier Capture the Flag contests
is DEF CON CTF.
It's one of the, I think it is the oldest,
certainly continually running Capture the Flag event.
This is DEF CON 30.
I think, I mean, they've had DEF CON CTF.
I came in DEF CON nine, 21 years ago,
and there was, the CTF was already an established thing.
Like it's been around for many years.
And the idea is that we are going to have
all the teams that are here, they're playing DEF CON CTF.
So to be clear, the CTF as a whole
is going on around us.
Nautilus Institute is running the DEF CON CTF.
We are like a little side piece,
and kind of inside of that, right?
And so this is a part of the whole event.
If the teams do well here,
it will add to their score for the final event.
So we're trying to add some, like a little bit of a twist,
a little bit of spice to the competition,
like bring that excitement,
and also to make this accessible to the viewers
and see a little bit of what's going on
in like the minds and computers of these participants.
If you've ever been to DEF CON before
and you've walked through the CTF room,
nobody wants you to look what they're doing
because competitors will cheat and spy on one another.
And it's, you know, so they're all kind of like closed in
and it's not really spectator friendly.
Last several years,
teams have worked on cool visualizations.
And so we've got one kind of going on over here.
There's a 3D visualization from Nautilus
that's tracking their scoreboard.
AR, if you're talking about the DEF CON CTF scoreboard,
unfortunately, no, I don't actually think
we've asked Nautilus.
There is no public scoreboard right now for the main event.
We can give you updates throughout the event right now.
So actually at the end of this broadcast,
before we turn over to our next one,
if we had a little bit of time,
we'll actually let you know what the latest scores are.
Otherwise, find a friend who's at DEF CON
and have them come in here and take a picture.
I don't know what the plan is on their scoreboard.
The live CTF portion,
you'll see when we go back to like
our kind of intermission screens,
you'll see the brackets.
So what live CTF is going to be,
actually, Carl, what do you tell them about like
the structure of like what that bracket is
and how that's going to work?
Yeah, exactly.
So we're playing this as a traditional
single elimination knockout tournament.
So there will be,
so we have 16 teams in the DEF CON CTF.
So we're starting with the round of 16 today.
We will have four matches and then we'll continue tomorrow.
So yeah, the teams,
there will be one player from each team
sitting at these tables behind us.
Right behind us.
With one computer.
They are not allowed to communicate with their teammates.
They will be wearing earmuffs to block out our commentary.
And they both get the same CTF challenge at the same time.
And the first one to solve it wins.
The other team is eliminated.
The winners advance to the next round.
And in the end, we will have a winner of this tournament.
And then...
And each round, like, gets them points, right?
Yeah, exactly.
So depending on how far they make it in this tournament,
this will then add to their scores
of the whole, like, DEFCON CTF.
DEFCON, I mean, the DEFCON CTF is an attack-defense CTF.
So you have, like, different aspects of the scoring.
You typically have, like, for attacking
and for defending and stuff.
So this will be, like, another dimension
to the scoring of this event.
Yeah, in fact, that actually informed
kind of how the points were worked as Nautilus.
And we were talking about kind of the design of the game.
The goal is we want this to be
something teams take seriously.
We want them to send their best person.
We want them to really want to win
and do well because it will benefit them in the game.
But also not disrupt the whole game
if one team does well here and another team does well.
And, you know, like, we don't want to throw it off too much.
Right? So kind of finding that balance is tricky.
I like what Nautilus has done.
I think it's going to get us that.
And the other thing to point out
is the teams, we're going to have a lot of work.
We have a lot of work cut out for us.
We're going to have 15 total matches
throughout the next three days,
today, tomorrow, and Sunday.
But the teams have a maximum
of four events that they're in, right?
Because there's only four rounds
to go from 16 to eight to four to two to one.
And so the teams are out at most four hours
for if they get first or second place.
Yeah.
And in fact, the teams that, like, don't get any points,
they're done and gone and they can go back
to focusing the other events.
So we hope to not, like, disrupt too much
of the normal flow of what teams are doing.
Yeah, and we hope with the teams,
like, we've talked a little bit to the teams
and we've heard, like, some people,
they find this, you know, a little bit nervous,
like, being live on camera.
It's stressful, it is.
So, but we still, like, hope to make this, like,
an enjoyable experience for both the participants
and for all of you viewers as well.
Yeah, one of the, again, we said earlier,
you know, DEF CON is not accessible to a large extent.
You have to already be in the CTF community.
You have to already be very active
to even compete at the qualification round
to make it here.
And so we're hoping by having challenges here
that are a little bit more accessible,
you'll be able to follow along.
You'll be able to see kind of what they're doing
on a smaller scale.
And so speaking of that,
let's talk a little about the challenges themselves
and how they differ maybe from the challenges
that are going to be happening for the rest of the CTF.
Right.
So, I mean, normally in a CTF, a challenge can,
I mean, you can have varying difficulty
of your challenges, right?
But especially in a top tier competition,
such as DEF CON,
you typically have pretty difficult challenges.
It can take many hours to exploit these systems.
But we are aiming to have matches here
of about like 30 to 45 minutes,
which means that that also kind of puts some constraints
on the difficulty of our challenges.
They cannot be too difficult.
So we have had to like try to find that balance
between, you know...
Not so trivial, it's like five minutes.
You run one thing and you're done.
Yeah.
But also it can't take too long.
So hopefully we got it right.
We'll find out as the weekend progresses.
Yeah. And if we don't,
like if the matches are like, if they go too long,
we have a sudden death round thing
where we have prepared some very simple challenges
that we will then switch out.
So we will stop the normal challenge.
They will get this sudden death challenge instead.
And then it's really about being quick.
Those are five minute challenges.
Yeah.
They're meant to be like very, very straightforward and easy.
Yeah.
Hopefully we don't have to use them.
But if we do, they're there and they're ready.
With the idea that whether it's those or the normal ones,
the fastest team wins.
First person to solve it ends that particular round
and we set up for the next round and start all over.
So in terms of the type of challenges,
now like the DEF CON qualification rounds,
you often have a mixture of web and forensics
and all these different other things.
Finals though tends to be focused more on pwning, right?
Yeah.
Pwning, reversing, like that low level stuff.
Yeah.
And so we've mirrored that as well.
So if the teams were a little nervous about like,
well, wait a minute, I don't do a lot of web app stack.
Don't worry.
We are keeping things in line in part
because we want this to be representative
of what the teams are doing now.
Like if a little baby challenge is very similar
to the style of challenge, if not the same difficulty,
that they're doing in the final event.
So you can get a sense of kind of what's going on
at home as we follow along.
And speaking of following along, if you are in chat,
we are watching it, we're keeping an eye on it.
We're happy to answer questions
as we progress throughout the day.
Thanks earlier for the question about the scoreboard.
So just a quick update.
I'm looking at the scoreboard right now.
Currently, there's only a couple hundred points
separating first from last.
So they all started around 1600 points.
It looks like this is going to be a zero-sum game.
And so actually, one of the later streams,
we might bring on one of the Nautilus folks
and talk more about it if we have time.
And so we'll learn more about how they're doing it.
But zero-sum game where teams lose points
and then they go to other teams that gain it.
So in other words, if I get exploited by another team,
I lose some points in the form of my SLA
because I didn't have a secure service
and they gain some points that they've sort of taken from me.
Yeah, on the topic of bringing in other people as well.
So we will be on commentary throughout the weekend.
But we're also hoping to bring in some other commentators,
some remote commentators as well.
So yeah, hopefully, there will be a little bit of a mix
here as well on the commentator table.
Assuming we can figure out the logistics and the streaming
and everything as the connectivity gods are working for us,
we are going to, yeah, we will bring in a couple of folks
that you will probably recognize
if you do any online.
We don't want to like promise yet until it works out.
But we have some folks that I think you'll be excited to hear from.
And we're looking forward to having joined the commentary.
And so keep an eye on that.
But that will probably be in tomorrow.
Yeah, we have a question in chat here about whether each round
will have the same challenge or each match will be unique.
So each match will have a unique challenge.
And this is because, of course, we are broadcasting this.
So all the teams can watch the other matches.
And in fact, that might be like a good idea to get like a feel
for the type of challenges we are going for.
So definitely we couldn't have the same challenges for each match
because then you could just copy the solution of the previous match.
Yeah, the only way to do that would have been to sort of sequester
and take all the people in any given round into a room,
not let them out and let them one at a time.
And that just was we were going to waste people's time.
So instead we wasted our time and we made a lot more challenges.
It would have been a lot easier if we only had to make four challenges.
But by making 15 challenges,
yes, different teams will get different challenges.
We have actually told each team, though, the name of the challenge,
which is sometimes actually a pretty good hint as to what kind of challenge it is,
the category, whether it's reversing or a pwnable.
Today we have all pwnables.
And we have a mix of x86 and x64 binaries.
I think it was one x86 32-bit.
The rest are all 64-bit.
So that's the challenge we've got.
I love seeing the team hype keep up, you know, cheering on your favorite teams.
That's exactly what we want to see.
Speaking of favorite teams,
maybe we should just mention a little bit about how they ended up here as well.
Because as I said, we're here at the DEF CON Finals with the 16 teams.
They had to qualify early this year, I think it was back in May or April,
in really tough qualifiers.
Yeah, absolutely.
So, yeah, the top 16...
Well, actually, you have the winner of last year are pre-qualified for the DEF CON.
So in this case, it really was just the top 16, because it happened to be...
Yes, because that team was also playing the qualifiers.
I think officially the previous team didn't this year, as it was a clean break.
When I talked to Nautilus, they said, actually, it turned...
Normally, the team who won the previous year automatically gets a buy.
They weren't sure about that. In the end, it didn't matter.
Oh, OK.
Because the previous team qualified anyways.
But they were kind of treating it as a sort of fresh break.
So actually, what you're going to see in our bracket,
which... Actually, we can pull up the bracket now, and we can take a look at it.
You'll see the way the seeding has worked,
is the team who scored first place in the qualification event
is battling against the 16th place team from the qualification event, right?
And so throughout these events, that's just kind of how we split things up.
We chose a random order for which match happens when.
And we're going to be putting, again, these kind of random challenges out.
So you'll see where your favorite teams are
and kind of who they're battling as they make it through the rounds here this weekend.
Again, we're going to do four.
So round one will take us down from the field of 16 to a field of eight.
And we're going to do half of that round today.
So we've got four rounds today.
Tomorrow morning, Pacific time at 10 a.m., we're going to do the next four rounds.
And at that point, we'll be into round two.
Sorry, matches. I've got to be careful.
So just to be clear, we have four rounds,
and each round will have the number of competitors.
And then we're going to have 15 matches.
We have the language. I'll probably get it wrong.
We'll correct each other if we do it.
But that's the plan for this whole event.
So scoreboard update, maybe?
Or we get everything else? What do we need?
Yeah, I think that's where we're at right now.
As I said, pretty tight.
I mean, the DEF CON CTF just kicked off a few hours ago.
Almost four hours ago, yeah.
So it's still early days.
Three hours ago, rather.
Yeah, the teams are within percentages of each other.
But if you want to root on your favorite team, we'll do the top three.
So we have Water Paddler in first with 16,282 points.
Maple Mallard Magistrates, or as I plan to call them, the Mighty Ducks,
because that name is really long.
We're going to have to come up with names for a lot of these teams.
And in third place is Straw Hat.
Tied with MMM and Straw Hat, there's a lot of history in all these teams.
We're going to talk more later.
We're going to talk about the split of them.
Many of these teams, actually, I think almost all of them are actually conglomerate teams.
There are several teams that have come together.
Again, speaks to the nature, this is like the hardest, biggest competition
that several kind of elite teams come together to form a team to compete here.
Multiple different collaboration teams here.
Just to give an example, you have Sour Cloud,
which is like a collection of all the German CTF teams,
which they already have, like, really good CTF teams.
Individual teams, absolutely.
But then they, you know, bond together.
This tells a little bit about just how fierce the competition is at this event.
Yeah, so we're going to look forward to those.
We've got nine minutes until our first round.
Let's go ahead and go back to our intermission.
We're going to bring up our next two teams, get them set.
Cross your fingers for the challenge.
I'm really looking forward to seeing what the teams do.
And we'll see you all in about nine minutes.
And we'll see you all in about nine minutes.
And we'll see you all in about nine minutes.
All right, we are back, I hope.
We'll find out.
We are going to count us in.
We have our first two teams, PTBWTL and Shellfish,
battling in our first round of live CTF.
We've got the screens up.
They're here behind us.
We're going to count them in, in five, four, three, two, one.
It's live.
They're refreshing the page.
Round of applause for live CTF.
Okay, so now we'll watch and we'll see.
And make sure this is working.
We're going to go ahead and bring up both their screens,
and you can get a little sense of the layout
that we're going to be using for the event,
where you can actually see what they're doing, all right?
So, I see, I love the full-screen terminals, right?
Right, first thing we see.
Yes.
They've got a binary.
We told them it's a pwnable binary.
What was the name of this particular challenge?
It's a SysCallMeMaybe, right?
SysCallMeMaybe.
So, we've got like a little meme reference, CallMeMaybe.
We've also got a competitor webcam,
which has just got the laptop,
so you can't really see a whole lot of that.
We'll probably not use that particular view.
Yeah.
But we can see we've got IDA up and going.
We've got terminals.
Okay, so let's take a deep breath.
We can already see pretty straightforward.
In fact, we've even got some symbols here, right,
on this particular binaries.
Yes.
And let's, we've got on the left, we've got...
We have Pwnabytes, the PTB, PTL here,
and we have Shellfish on this side.
On the right, okay.
They're both using IDA for their disassembly.
I was hoping for, I did see Binger running.
I noticed Binger was actually running.
Yeah.
I think they're prepared, knowing a Binger developer was one of the organizers,
like, in case there's something terrible that Binger does better at,
we should leave it up.
Yes.
You see, it's a pretty small program here.
You can see on the Shellfish there,
you could get a glance of the code where it's a program,
reading in some commands, sorry, some arguments to whatever syscall you want to make.
And yeah, you can do this how many times you want,
and then from there you want to get code execution.
So, the vulnerability is there.
This is actually more of a Shell coding exercise than a,
like, you don't have to find the vulnerability.
It literally will just run whatever syscall you want,
and it's up to you to provide a series of syscalls.
So, like, can't I just, like, execve and run bash?
Immediately? Like, you know, is that not a valid solution?
Yeah, I mean, almost, except that, you know, to call an exec,
you need a string of the program you're executing.
So, they first need to get that string into memory somehow,
but then it should be just smooth sailing from there.
Yeah, and it's kind of ironic that, like, we give them full syscalls,
but they don't have the ability to just run Shell code, right?
So, because they don't have actual Shell code,
little things like just put some bytes directly into a piece of memory
is maybe a little bit trickier,
and so they're not going to be able to do that.
Let's talk about what's their goal.
What are they trying to do here to show that they've won?
Right. So, the goal of this challenge, and most of the challenges, actually,
is to gain code execution on the remote system.
And once you have that, there is a small program sitting there
that you can run to...
Let's go ahead and pick up Shellfish there,
because I saw them running the challenge.
Right. So, they've created kind of like a template
in their exploitation script
where they're just, like, setting up the interaction
with the program, like, inputting the different parameters,
just making sure that that works.
And then once they have that in place,
they can kind of, like, make an abstraction on top of that
and just make all the syscalls that they want.
So, they're just going to use, like,
Epone tools or something like that
to be able to interact with the service,
but then they're going to wrap that
so that it's this syscall, this parameters,
and it will handle the text formatting
and the new lines and all that kind of stuff.
Right. Just let them build their primitives.
And this is very common when you do this type of exploitation.
You kind of, like, transform functions in the program
to, like, more abstracted operations.
And we had a question here in chat,
if they have internet and they can Google and stuff.
Yes, they do have access to internet.
Actually, we can see it just now.
So, PDB just pulled up a reference here.
So, I think we're looking, if we switched over in time,
you're going to see them looking up syscall tables,
which makes a lot of sense. That was actually what we did
when we were testing this as well, right?
Yes.
In fact, the first thing they're looking for is execv-e,
exactly as we said, oh, I want to just run execv-e,
I'm going to run binbash, and that's where you're going
to first run into this, well, wait a minute,
how do I actually get the string?
As we, like, had some of the Nautilus members,
and as we talked about this with some folks,
everyone's first reaction is,
oh, that's immediately trivial, and then you're like,
yeah, but where do you get your string from?
You've got to have a pointer to a string,
and so you've got to think a little bit about that.
It's not super hard, but you have to figure out
how to get something into memory first
that's going to be the string that you're going to call.
Yeah. We can see here for Shellfish some debugging going on.
There was some GDB with the Jeff extension.
I'm a big fan. It makes life a lot easier.
I'm trying to see exactly what's going on.
They're trying to put some breakpoints somewhere,
looking at the memory mapping. Yeah, okay.
So they needed the base address there
to put the breakpoint in the right place,
although there is a function in Jeff to automate that.
But, however, you know, they're getting there.
What's the function?
It's called, like, pybreak, so they will, like,
do relative to the...
Oh, that's kind of handy.
Yeah. Does the math for you with the offset.
Yes. That's cool.
There's a lot of different nice tricks
with that extension framework.
So I want to talk a little bit just about the teams, too, right?
Because we've got, again, we've got a lot of,
like, these conglomeration teams.
And so, briefly, and we'll try not to miss,
so, yeah, you keep an eye on the teams
to make sure I'm not missing somebody, like, you know,
getting close.
But we've got Team Shellfish that has been around.
It's one of the longest-running CTF teams,
originally out of UCSB, but they've got,
kind of, I think, connections now a lot of different places.
So Team Shellfish is currently one of our battling teams.
And PTBWTL has pwned the bytes and...
Wrecked the line. Wrecked the line.
I don't remember that one exactly.
Both Romanian teams, right?
I believe so. I believe so.
I think they have other members as well,
but I think they're, like, primarily Romanian-based, at least.
And I think we do see that, especially in the DEF CON,
where the teams are, like, these megagroups are coming.
Sometimes they're just colleges or friends or online communities.
And sometimes they are just local, regional, or, you know,
country CTF teams that normally compete against each other.
And then they come together to form, like, a megagroup.
And so you've got, like, this sort of country-based representation.
Yes. Which also says something about, like, kind of, like, the,
you know, CTF community aspect of the whole thing.
I think it's really nice to see these, like, different,
like, regional communities, like, gathered together.
You're both competing against and also participating with.
We're losing video on one of our capsules.
We're not sure. Is it losing on the stream as well, or are we...
OK. So I apologize for the flicker.
We've got some probably loose cable somewhere.
Yeah. This is the joys.
But technically, you know, it could be a lot worse.
Like, it is... it appears to be working.
And so that's our big stress here.
So I saw some... was it, like, S-trace output or something from the P2B screen there?
Not sure.
OK. So, OK. I like that.
So look at it. I love that we're seeing the highlights, right?
So, mmap. We started with execve.
Yes, that's going to be your ultimate goal,
is you're probably going to want to trigger execve.
But, like, you've got to get your memory first.
And so we're seeing, like, someone's looking...
we're going to look for mmap to try to get something into memory,
get a piece of memory that we control.
But they're going to have to still get something into that region, right?
They're still going to have to actually get bytes at that address.
I'm seeing some very interesting thing here on the Shellfish side.
They're grabbing the address of the vsyscall memory region,
which was not involved in any of the proposed solutions when we were testing this.
I love it.
So I really would like to see what they're going for there.
And to be clear, we expect that there will be lots...
that this one in particular has an infinite number of solutions, right?
There's going to be all sorts of ways that we didn't think about.
So we have one in mind that we expected.
One of the things that I think is the most fun as an organizer
is when somebody solves your challenge in a way that you completely did not expect.
Yeah, yeah.
As long as it's not like...
So in this particular case, we're okay if they solve it quickly,
because that's the point, is to be as fast as possible.
Sometimes if you build a really difficult, hard CTF challenge
and somebody finds a trivial thing that you forgot, that's a little soul-crushing.
Yeah, yeah, yeah.
But as long as it's a cool solution or anything, then you just love to see it.
Yeah, although sometimes I love how CTF organizers will re-release a challenge, right?
Patch the easy bug you didn't intend, give them points still,
but then make them solve it the harder way as well, too.
So I think that's a decent trend and one good way to just get both out of it.
To reward them for what they did, but also keep doing that.
So we have...
Uh-oh, so we've got something happening here.
So we've got an mmap syscall.
Okay, so we're looking at PTB, and we've got mmap.
So we've got our syscall wrapper.
We're going to call the syscall by name.
So, the mmap syscall, what are we doing with that?
We know execve is going to run something,
but what's mmap going to do that's going to help us?
Yes, so we need to put the string somewhere in memory.
We don't know anything about what memory is mapped and so on,
so we'll just map, we'll use the mmap thing.
Okay, and we do, we didn't mention this earlier, I don't think,
but the output of the syscall you ran is returned to the user.
Like the return value.
Yeah, so if there is a return from that syscall,
they're going to get that information back.
So any of these syscalls that that's useful, we're going to see that.
So we had a comment, sorry, question here about what happens
if they don't solve the challenge in one hour.
So even before that, I think it's like 45 minutes or so.
Sometime around 45 minutes.
Yes, if they don't, we will switch to a sudden death challenge,
which is a very simple challenge that they will try to solve instead.
So we will just like discard all the stuff they did so far,
and we will switch to like a super, super simple challenge.
And mainly the reason that we're going to do that is just because
we've got so many matches that we have to run,
that if they each start taking longer and longer,
and we're off schedule, we'll be keeping people overnight,
and it would just be kind of a logistical headache.
So we hope we don't have to.
If we don't have any bugs in our challenges,
and they're all the appropriate difficulty, and the teams all do well,
you'll never see them. We'll save them for next year.
But those are going to be like really, really simple ones
that we hope they can solve within less than five or ten minutes.
So that's kind of the backup plan. We'll find out if we need it.
I have to say, so far, right on pace, super happy with this.
This is, I think, about what I would have hoped and expected.
We're seeing they've already got their frameworks up.
They know exactly what they have to do.
They're just building the right building blocks to kind of see it.
And this is also, I think, something that's always kind of a challenge for me
when solving these kind of challenges.
How much do you want to take the time and build the proper abstractions
and make your nice functions?
And how much do you kind of just want to take that leap of faith
and just throw together some really crappy code that might solve the thing?
That might work, but if it doesn't, then you have to backtrack,
and it's a whole mess.
I feel like there's a lot of game theory to it, almost,
in terms of risk-reward, explore-exploit kind of analysis,
where you have to figure out, is it worth it?
And you don't really know. You do develop, I think, a bit of an intuition.
You can kind of look at it, and you sort of have a sense of,
okay, no, I just need to bang this out and just hard-code a bunch of bytes in,
and that'll be fine.
In this particular case, oh, here we go. This is interesting.
So now we've got a read syscall.
This is... oh, we also saw the syscall list on the other side with shellfish.
But ptb, I think we have all the syscalls we need.
I think...
Read, mmap, yeah, exactly.
I think this is it. These are the right ingredients.
They just got to assemble them correctly.
Yeah, make that cake.
Yeah, yeah.
And then we should be... we may be looking at a winner,
but we'll also keep an eye on shellfish and see what's happening there as well,
and make sure that...
Yeah.
So they're using the fxv function, which I... that variant, I'm not...
I don't know. I'd have to look at the main page myself, yeah.
I mean, because these functions, they come in a bunch of different flavors, right?
So that's interesting.
And again, there is... I think one of the things the teams are going to realize
is that we didn't go for tricks.
We didn't... we tried not to go for tricky, gimmicky things.
It's tried to be pretty straightforward.
We want them to be fast and quick, and sort of the obvious thing you would think of
is at least our intended solution oftentimes.
That's not always the case.
Lots of CTFs, right?
You've got to find the very tricky thing, and that makes it fun.
It actually is super entertaining.
Yeah. Something you can also learn stuff from,
like it sends you down this rabbit hole of research and stuff,
but you don't really have time for that.
Right. So like Punnable.kr or those websites have amazing, really cool things you can learn.
But here, we're not trying to trick them.
Yeah. No Gidra users yet.
I have seen a couple of the participants in the room using Gidra.
Maybe we should keep a tally for the tournament.
It might be too depressing for me.
That might hurt my Binja soul.
Might be too hurt by that.
Yeah. So for those not aware, Jordan, one of the founders of Vector35,
making Binary Ninja, which is not used in this match.
But we hopefully will see it.
I hope we see it. And if all I want is one Binja user to win one round,
then that'll make my heart happy.
Go straight into the marketing material.
I mean, yeah, exactly. Exactly.
I will say, you know, the funny thing is,
Binary Ninja was actually designed for CTFs originally.
It was meant to be very, very fast and quick.
And like common things like patching things out were meant to be quick.
So that's probably kind of some of the things it does well.
So it is actually well-suited towards a very, very fast-paced environment.
But more important than that is knowing what you're doing.
All right, so back to Shellfish. What are you seeing?
So Shellfish, they are writing a small C program here, calling mmap.
Yeah, I think they're testing out, they're maybe like...
I like that idea.
...not completely sure about the arguments or so for the mmap.
So they're writing a small little test program
to just verify that they have the correct understanding of the situation.
That's actually a really, really good idea.
Very good idea.
Yeah, because, you know, you don't want to like...
You have the added complication of a network service and the text protocol
and your throwing script and your wrapper.
No, no, just get rid of that abstraction.
Test the syscalls in a row directly, and then once you've got it working,
then you can sort of port it to your throwing framework.
I think that's a great idea, so I'm happy to see that.
But we are seeing...
So we're seeing just the straight-up approach over here on WTL.
Let's watch them as they've got it.
Yeah.
Looking through...
Yes.
Is it buffered?
Is input buffered or not?
They're checking that.
Maybe they're looking for another piece of memory.
They're looking over here in the data segment,
so I wonder if they're looking for a place to reuse.
But this is ASLR, right?
I don't think we gave them information about where the binary is executing here,
because it is kind of up to them to sort of like make their own memory
with the syscalls that they've got.
Yeah, we can see here, going over to Shellfish again,
they are putting this together as the mmap syscall now.
And yeah, I think...
Are they like slightly behind the P2P at the moment?
You know, it's so hard to say, though.
Having done...
You know, we've both done, I think, several versions of these kind of events,
and it can be really tough.
Sometimes you think somebody's like not even close,
and all of a sudden, before you notice, they've solved it.
Yeah.
And sometimes you can see them kind of bringing it home.
Yeah.
Yes, Nick, I'm Jordan.
Hi, cyphertext on Twitter, the Vector35 BinaryNinja guy.
And David, we have thousands of BinaryNinja users.
There are many thousands of BinaryNinja users.
We'll see how many are here besides the one that we have from PTB,
even though they're not using it.
Maybe they just ran it just to like as a show of solidarity for me,
to make me feel better.
I'm a BinaryNinja user.
There we go. There are, yes, there are BinaryNinja users.
Yeah, but anyway, looking at the PTB screen here,
I think you can see that they're debugging the read, the calls here, right?
No, sorry, that's the input reading routine.
And they are doing the syscall zero, which is, is that the read?
And yeah, checking out some documentation about mmap.
Stack overflow, always check it.
But we have Shellfish.
Again, yeah, fixing the mmap.
Okay, so PTB just found map fixed.
So what they were looking for is they wanted to get the right flag
to be able to pass to mmap to request a fixed address.
So you can, there's different modes of mmap.
You can request memory and just take whatever you can get.
Or you can just say, no, no, I want this address.
Please give me this address.
And so they're just going to hard code some address
that they hope nothing runs against.
And this is kind of like a key to the challenge, right?
Where since, well, not necessarily, since you do get the return address.
They get the return address, so they could, but...
Slightly simpler variant is just to tell mmap,
like, no, we're going to allocate at this address.
It's one less moving part to worry about.
So yeah, I think you can go kind of either way.
And this is, so this is, we're about 20 minutes in.
This is where I think we'd be evaluating, are we going to give a hint?
And I don't think they need any hints.
They both really know, I think, generally what the shape of the problem is.
They're both working on it.
I have every confidence that they're going to,
I think they're going to finish it out in the next 20, you know, 10, 20 minutes.
Yes. We hope, we hope.
We're looking forward to seeing them do that.
All right.
We forgot to bring our water bottles over here
to make sure we could stay hydrated, but we'll do that.
We're having to, not only are we yelling over the house audio,
but we have our masks on,
and there have been easier streaming environments,
but I'm super excited to be here.
Yeah. So, going over to P2P again.
Well, and so, yeah, I think we mentioned this before,
but right, like this solid script they're running, they're running locally.
They got the binary locally, they're running it in debugger,
so they can analyze both halves of it.
And then once they have it working, then they're going to go ahead
and throw it against the real server remotely,
which is like standard operating procedure,
I feel like, for these kind of challenges, right?
Standard pwnable challenge.
Exactly. And that's also why it's nice to have,
it's nice to actually have an environment
where you can run it directly, right?
Whether it's the architecture you've got or the operating system.
Yes.
Teams were a little worried about having internet,
and we're like, no, no, no, we want to see you in internet.
And remember, these are some of the best teams in the world,
and they're still looking this stuff up.
We all are doing that.
Let's take a look over here at Shellfish again and see where we're at.
Yes. So, they have another syscall that they're setting up.
You see them, like, well, retrying that.
So, they're really making sure that the interaction here is working.
You have this, like, question from the programmer,
like, do you want to make another syscall?
So, they're just setting that up to answer yes on that.
And then you'll see they're about to set up another syscall.
Oh, there we go. So, we're looking at memory maps over on PTB.
So, they briefly, they tried to allocate the memory.
They went to look in the debugger and to see if the memory was allocated.
So, the only thing, I mean, if they're past that step,
the only thing left to do then is going to be to actually put binbash there, right?
Like, once they have the string binbash into that location,
they should be able to win.
They should be able to, yeah.
We have a question in chat about if the challenges
are going to be released to everyone after the finals.
I mean, we haven't really talked about that, but, I mean, impossible...
I assume so, yes.
Should the DA, is anything stopping us from doing that?
So, I'm going to say yes on that.
Provisionally, yes. Yeah, we'll double check with...
So, now's actually a good time to talk about,
if you keep an eye and make sure,
we're getting a little close over here on PTB.
So, Carl, if you watch that.
But we do have a lot of people who've been helping out so far.
So, there are three of us in person here at Vegas
that are doing all like this kind of stuff.
But we've had several other people contribute challenges remotely,
test challenges, do a lot of stuff.
We're looking real close over here.
Okay, so again, we've got our read, we've got an exec,
we've got our mmap, this might actually be it.
So, let's take a look and follow on PTB,
because I'm smelling blood in the water.
I think if there was...
Yeah, so they, like, maybe they need to fix some small thing here.
Oh, yeah, is that, they have some helper function there.
Unfortunately, I don't know really what it is.
It was like interactive.
Is it, oh, is it dead? Is it?
Oh, they're solving it.
That's it.
That's it. Is that it? Is that it?
Is that it? Is it going?
What?
What?
We already had it.
Oh, my God.
We were even looking at the right screen.
Congratulations.
Wow, that was so close.
That was so close.
Okay.
Well done.
I can't believe how close that was.
All right.
Oh, my God. Okay, so...
That was outrageous.
Yes.
Give me, so I will go over to the players.
You talk to the players.
You take it over here.
All right.
Yes.
That was unbelievable.
We even predicted.
We said we're going to miss one.
Yeah.
We're looking the wrong way.
All right, so let's do a real quick recap.
So we were between the screen kind of turning on and off a little bit on the shelf of Shy.
We were a little behind.
I mean, that was like seconds.
They were seconds away.
That was unbelievable.
What a great finish.
So just as a quick recap, perfect timing.
Super exciting.
Very well done to both of those teams.
That was so close.
So close.
So, again, once they were able to get their shell, all they had to do was run their script, put their team number in from the page that told them what they had done.
I'm happy we saw all of our infrastructure working, the overlay when we got a winner.
Congratulations to Team Shellfish.
But, man, well played, PTB.
That was so close.
Really, really well done.
We're going to let them go back to their teams and keep working on the rest of the challenges here.
We'll see if we can figure out how to turn off the winner script and get back to the stream.
We're going to leave the stream going, so keep watching here.
But remember, just on the hour, every hour, our goal, we're going to have a new round.
And so we're going to get set up.
We're going to get the next team.
And then we'll update our bracket now.
We have our first winner.
Congratulations to Team Shellfish.
Well done.
Very well done.
Oh, my God.
That was so good.
Oh, my God.
That was so good.
Yeah.
All right, that set a high bar for, I think, the competition for the rest of the event.
But what a way to kick it off.
We're going to leave you at the intermission.
You can check out the scoreboard.
And then we'll be back in about 35 minutes with the next round.
Yep.
See you later.
Take care.
See you later.
All right, and we're back. Welcome, everybody, to round two of, excuse me, round one, match
two of live CTF here at DEF CON CTF. You can see Carl behind me instructing the competitors.
Our next two teams up are team, I'm just going to call them slashers, slash, slash, slash,
because their official name is slash V, slash home, slash R, slash .bin, slash TW. I believe
it's a combination of team Binja, team Tokyo Westerns, a bunch of teams, and they've combined
themselves with, like, a path. So they're getting the instructions now on exactly what's
going to happen. They're hopefully about ready to go. You count it out. Count it out and
make it live. And let's go ahead and actually pull up both of their screens. We'll watch
them start here. And we'll, as soon as we give them the word that the server's live,
they'll be able to refresh and start going on challenge number two. You go ahead and
count it, count it in, count it in. All right, here we go. So we're going to go. All right,
go, go, make it go. All right, we'll just do that. No countdown. No countdown this time.
So we're going. Refresh the pages. We should be able to see them. There we go. Download
challenge. Download challenge. Okay. So not a little, little less fanfare than last time.
But hopefully we are going to be live. This challenge is specifically called open to
interpretation. We're not sure if all of our challenges are the right difficulty.
What we are sure is they all have great names. No, you didn't. Sorry. This is the wrong one.
You didn't replace the handouts. Oh, okay. Go tell them. Go tell them. Go to them. Sorry.
Technical glitch. All right. So we got to warn them this is not the right challenge.
One second. Okay. So this was still the old challenge. There's a couple of management
scripts. This is our first time transitioning from an earlier round. So real short intermission.
And we should be back. Unfortunately, we're still seeing some... I think we've done terrible
things to the USB inputs on one of our laptops. And so we keep restarting that capture card.
We do actually have a spare capture card that's arriving shortly as well. So we can switch to
if this ends up not working. So okay. We told them to try again. They're going to
download a new challenge. And let's take a look at a new binary. All right. Let's take a look at
that. Challenge. It's just called challenge. We should have named the challenge the actual
challenge name in hindsight. You learn all the lessons learned. All right. So we've got an IDA.
Is this... give me a program. Okay. All right. So we are on the right challenge now.
It looks like we're having some difficulty with our one capture card, unfortunately.
This one is problematic. We swapped out adapters, cards. We'll figure it out. We have backups for
everything. Yeah. We'll have our production look into that while we continue the commentary. And
when we say production, we mean Glenn. Yes. But you know, it sounds more professional when you
say production. We'll have backup house. The production crew look into it and let us know how
it's going. Yeah. So we've got our second challenge. They're at least going. Let's go
ahead and look at just team slash V slash whatever. Look at their desktop while we've got that working.
Yeah. And then we'll keep an eye on the other one so it comes back up. We will see if,
worst case, if we're not looking at one of the screens, we'll still see winner. So if we see
winner and we didn't, just like last time, we were looking at the wrong one. Yes. Shouldn't be a
problem. We should still be able to see that that's happened. All the challenges will be available to
download. Yeah. We're going to release them. We don't have a specific plan. So we'll probably
wait till just after we've recuperated a little bit after we get back from DEF CON. But we do
plan to release them. I like that you're guessing about what type of challenge it might be. So
open to interpretation. Is it a polyglot? I think it's more of a play on words of interpreter.
Yes. Yes. Right. I think we're not that clever with, you know, we're only moderately clever
with the naming here. Right. So, yeah, I think that's something like this. Yes. So we can see
here looking at the program in the item and starting to build up a simple phone tools script.
So PTRlib. Actually, I saw PTRlib. That's a good question. I'm not actually sure the name
of the individual players that we've got. If you all saw like home. Yeah. PTR. It is PTR.
And that makes sense that PTRlib. So this is their throwing script library. So I think we're
not looking at a PwnTools. I think we're looking at an actual like custom. Oh, nice. Yeah. Yeah.
From PTRlib import star. I see. Yeah. Some of my players prefer to like build their own little
thing. I mean, PwnTools has a million things, but also it has a million things. Yeah. Yeah.
And so it's like getting that whole box of stuff when you only need like the screwdriver. Yeah.
So there's certainly an argument. There's also Mpwn, which is another nice one. It's meant to
be a little simpler, kind of more standalone. Yeah. But so let's talk about the problem. We can
see this is explicitly, I believe, a custom situation. We've got a question mark and A.
So we saw that. Yeah. That little switch statement there again with the name open to interpretation.
And we think it's kind of like an interpreter. Yeah. Some sort of little virtual machine or
some sort of interpreter that's going to make some simple changes. I do love people. People
know this is like a live CTF because they start their throwing script like immediately, right?
Like they just immediately start building that up. And I think that's also
kind of a good way to, in a sense, document your understanding of the problem so far, like writing
down like the interactions, like the different things. And so you don't forget things. And you
kind of like, as you like, you'll often, as you put to do's, like, you know, you do this part,
but like, I need to do this later, but at least I'll remember it because that's my...
Yeah, I think you're right. I think people use their little throwing script almost as a
stand-in for like a, you know... Like a notes. Yeah, exactly. Notes or task tracking or like...
We can see some debugging going on now as well. Yeah, we're not going to interrupt
his throwing. You know, in the interest of fairness, we're not sure why we're having
glitches on our one capture, unfortunately, so we'll resolve it before the next round. But we're
not going to... Once we've started, we need to let him go until the first person solves it. Yeah, because this is so
hectic, like, the margins, like, as we saw in the previous match, for those who watched, like,
the, yeah, the seconds matter. Absolutely. Like, literally, there was, like, seven keystrokes,
but, like, between the... I don't think we will see a tighter match. I will be surprised. I mean, we basically
can't see a tighter match. I would be really surprised. Yeah, we would have to go down to, like, you know,
recording. Yeah, and so, exactly, we're seeing PwnDBG instead of... Yeah, these... What is your
preference on debugging libraries? Have you, like, Geph versus... So, I used to be a PwnDBG user,
but I have switched to Jeff. Yeah. I mean, a long time ago, I was a Peta user. Yeah, yeah. But then
that kind of just stopped developing for a bit or something. Anyway, I switched to PwnDBG,
then I went to Jeff. Yeah, that's my current preference. So, you can see, I think, just over
the shoulder here, some of the players. So, the people in chat that are wondering,
kind of depends on where we lean if we're, like, yeah, if we're letting him in. But we're also
trying to kind of... We have to block off their opponent's screen here, right? So, because we have,
well, at least one of the teams now visible on our little monitors that are in front of us.
And we've intentionally kind of, like, laid it out so that you can't see your opponent's,
you know, monitor over here that we're using to see them. So, we've kind of got them
angled down a little bit lower. Yeah, honestly, they're all better than, like, stock GDB.
Although, like, you know, TUI is not the worst thing. It's at least better, I feel like,
than, like, you know, stock command line. Yeah. I mean, I used to roll with, like, you know,
display slash whatever and, like, build up my own little kind of custom prompt. But
it is... I think I never really learned that. I went, like, directly from the vanilla. Honestly,
yeah, to a real tool. Yeah, one of those. Okay. So, we're back in IDA. And it's interesting,
too, because we started in hex arrays in the decompiler. And now we're just looking at
actual offsets here, right? So, we've got... So, some kind of overflow situation here going on?
Oh, okay. Yeah. So, we already see somebody writing Ds, which were, if we go back to that...
Oh, man. All right. You know what we might do? I might actually have... If you go
look over the shoulder and just to give us an update, come back and give us an update and see
how... On the Starbuck side. Yes. And let us... If I'm doing this right. Yeah. So, yeah. We'll...
We'll go... Yeah. You go check it out. Yeah. I'll go check it out. And then you can go back and
give us a report and let us know what kind of looks like where we're at. So, apologies for this.
This is going to be a wild and crazy weekend. We're going to have a lot of stuff. So,
this is the only real issue is we've got to figure out why our capture card is freaking out. We
actually do have another capture card we'll bring in and we'll get working in the break. So,
especially if this is a really fast match, that'll be really easy.
We will bring this in. Okay. So, yeah. There we go. We can see the switch statement
with the different options. Question A, D, S, W. And we notice that there's some...
Yep. Exactly. So, there's that comparison there, right? It was checking to zero. It was checking
128. But you'll notice, I think this is actually why earlier we saw PTR looking at the disassembly
is because in hex arrays, you don't always see the signs. Is the comparison signed or unsigned?
Right? And so, I suspect that's what we were seeing before is the switch over to disassembly
was saying, well, wait a minute, is this comparison signed or unsigned?
I think you can mouse over the comparison operator and it will say if I don't misremember. But yes,
it's still like to get the exact details, you might have to go down to the disassembly.
I mean, you could use binary ninja in high level IL where it tells you signed or unsigned comparison,
but I promise... Okay. Okay. I'll be good. I'll be good. I won't do that. And I will say,
me with binary ninja would not beat these folks with IDA, right? So, I'm not claiming that
it would make me infinitely better. So, to give a bit of an update on Starbucks,
it's actually very similar to the situation for... How do you choose to pronounce it? Homer.
Like, yeah. Homer bin. That's now what we call these. I've been saying slash.
Okay. Slash. Slash. Slash. Slash. Slash. Okay. Yes. However we do it. Yes. Anyway,
Starbucks, they were in a similar situation. They have done some analysis. They started out
the small Xbox screen, not quite as fleshed out yet as the one... A bit shorter, doing some
debugging, looking at the registry values, just making sure that they're completely understanding
what's going on. So, I would say at this point, it seemed like they're fairly similar progress
between the players. I will say, at least looking... So, I actually have not seen an official
solution for this one yet. So, some of the challenges we wrote, some of them other of
our teammates wrote, some of them we know the exploits and we tested them and some of them we
don't. Just knowing kind of generally what's going on here and looking at those comparisons,
I'm wondering... I mean, we're already... This looks like intention, right? It looks like we're
seeing... I have an idea of what we're doing. We've already contacted... Yeah. This looks like
really good progress only several minutes in. If you had asked me now, do we need a hint? I'm
like, you never really know. Yeah. But you can see here they're doing a leak. You see this
line starting with like libc base, if it's readable. So, they are reading eight bytes out
from the program and then they're subtracting the offset of the putchar address. And then,
I like a bit more as well. So, from this, they're calculating the base address of the libc library,
which then can be used to calculate the addresses of other functions you might want, such as system,
which is maybe like the go-to choice. Usually the choice, right? And so, before we were talking
about execve for the syscall challenge, the last one, and that's just going to be the raw syscall,
system's even better though, right? What's the advantage of system over an execve?
I mean, yes. So, for the system, you just give it one string argument, which is the thing you
want to execute, and that's it. You don't need to care about splitting up the command line
arguments into an array or all that stuff. It's just like... I wonder if we'll see somebody's
system straight to the payload or if they're going to get a shell first and then run to the payload.
They could kind of go either way on that, right? Yeah. I mean, personally, even though this is,
again, do you take it slow and methodically? Yeah, and be able to debug it along the way? Yeah.
So, I would just go for the shell because then the same solution also works out of the box locally
as well as remotely. Otherwise, they would need to... That's true. Well, if you get an error message
that would say, follow my pattern, you would see some sort of bug there. I would still feel more
comfortable doing, like, launching a shell and then going with that. You know, I think that's
interesting because, again, though, last round, literally seconds mattered. If one team went one
way and one went the other and they were that close, the team that threw the straight to the
submitter would win. So, we will see. We'll see. I don't expect it to match. I don't expect
it to be that close this time. There is, like, a small catch to that, though, because they don't
know, like, you need an absolute address for exec, right? Execve does have to have the full path.
Exactly, and they don't know the current working directory. So, they don't know the full
path of the submitter. Right, but if they're calling system, in this case, if they're just
finding system... Right, exactly, but I'm just... Oh, no, no, yeah, true, true, you're correct.
Like, on this one, you're right, last round... Yeah, they could not have done that. They could
not have done that nearly as easily, right, but whereas this one... Yes. Yeah, because the relative
pathing only works because of your shell, essentially, which, if you're going to call
system, it's going to run the shell for you. Okay, and thank you for the kind words. We
appreciate it, Grandma Bullet. You guys in chat, we're definitely keeping an eye on it, and
happy if you guys have questions, and I expect y'all will be seeing stuff that we miss, because
we're kind of trying to, like, juggle around and look at a lot of different things. In fact, I even
talked to one of the competitors in the room watching the stream in the last round, and he
was like, why didn't they use the breaks this call? Why didn't they? They were all watching,
like, you know, they're doing the regular CTF, but they were also, you know, checking out the
competition, seeing what the challenges are looking like, wisely preparing for future rounds,
and they were, you know, commenting on better approaches. So I imagine we'll have people in
chat here that have feedback and have ideas on things that they can do. I mean, you also should
keep in mind that, like, this is not your average CTF environment. Do we have it back? Oh,
it's teasing us. No, yeah, it's teasing us. Unfortunately, this is not your average CTF
environment, right? This is much more stressful for the players. Like, most of them are not used
to, like, you know, live stream when they're... And even if you are, even if you've done a lot
of streaming, it still is harder. It's just 100% always harder. There's people watching,
thinking, oh, did I clean up my desktop? Do I need to, like, is this my VM set up? You know,
there's just a lot more on your mind. And it's also kind of like an all-or-nothing situation,
right? And a normal CTF, usually, because we kind of moved away from the tradition of
first blood points. This is true. Nowadays, it's all about total score. It doesn't matter when.
It doesn't matter if you solve the challenge, like, five minutes into the competition or
when it's five minutes left of the competition. Here, it's everything. Like, either you win or
you don't. We might be getting pretty close here, because I am seeing... I did see... It looked like
we had maybe had a system leak or we're close to a system leak. So, let's watch. So, we're looking at
system provider. So, we've already got a convenient call. Again, there's a call to system
already in the binary. Oh, and Starbuck is... Yeah, yeah, yeah. Why don't we go ahead and do
another check, Carl, on Starbuck. Yeah, I'm gonna go play with him. No, we don't actually worry about
past people learning things for new ones, because again, the challenges are totally different.
Every match is a different challenge. Exactly. So, we don't have to worry about that.
The general setup, well, the way that we would compensate by that is, I will say,
we specifically put all the easiest things that we knew were easiest first, just because we wanted
to be guaranteed that they would get solved in time. So, the teams that go first had less
information. They knew less about the environment and what was going to happen and maybe...
but I don't know. It depends on the player. I think for some people, going first is actually
significantly better. You just get it out of the way and your nerves are over. And some people,
though, they really want to see what's happening and know. So, it's hard to say. It was totally
random selection in terms of which round happened when. So, we'll see what it is. And yes, everyone
not only has to use a laptop. So, one of the differences is that they're not only using a
laptop, but we plug in our video capture cards and those cards force a specific aspect ratio,
so their font size can be a little bit off. So, we are handicapping them unintentionally
a little bit that way as well, too. So, how's it going with Starbug?
Yeah. So, they have some good progress. I saw them looking at the debugger. I think they were
looking at the got. So, maybe a similar approach there with overwriting or leaking addresses.
I mean, very fast to find a bug. I think both teams, right? I mean, again, this is meant to
be an easy bug to find. It's even just wiring it all up, putting it all together, building the
payload. Yes. Avoiding all the mistakes. When you do these things, it's very unforgiving. The
smallest, you're off by one somewhere and things just don't work. It won't give you any meaningful
error messages or something like that, as you would get when you're developing normal software.
I love that we're getting debug information. So, we've got a logger info. They're actually
printing out their variables and stuff. Thank you, as a caster and as a commentator. It does
make it easy when we can see what your intentions are and kind of what you're doing.
When I write my exploit scripts, I'm definitely more on the cautious and structured side. I name
all my variables properly. I have logging statements. Do you put type hints? Do you
actually put Python 3 type hinting? Is that that level of... No, it has happened. That's a bridge
too far for CTF. It has happened, but no, no. Generally not. Well, I am the opposite, I think,
by nature. I was always quick and dirty. I mean, I wrote a lot of exploits with Bash. I would
literally just shove raw bytes in with Bash. If it works, it's faster, but when it fails,
it fails miserably. Yes, because when it fails, it fails and you have not gained any ground.
It fails and you're kind of still at zero, while the slow and methodical, it can fail,
but it's a very local fail. And it's easier to measure progress. Potentially,
you can instrument a little bit better and see kind of where you're at.
But then it comes at this additional cost. So I'm trying to see what they're doing. So there's a
question here. Every team sends only one player. Yes, correct. So for each match, the team chooses,
so they will get to know what type of challenge it is. So we might say like this is an x86,
64-bit Pwnable challenge, and they choose a player to send. They do not have to pick the
same player. If they win the match and advance to the next round, they can swap out for another
player. But if we, for example, switched up the architecture or made a reverse engineering
versus Pwnable or whatever other things we did, they have a chance to swap it out. So it's supposed
to be the best person from that team for that style of challenge and for the stress of being
on camera. Because some people are maybe better exploiters, but really nervous about sitting in
the room, which is a totally different experience. Yeah. And they are not allowed to get help from
their teammates. Yep. But they can look on the internet. They can have all these resources.
Although I don't think we've seen either one of these. They knew what they were doing. They went
straight in, they found the bug, they reverse engineered it, and they're writing their exploits.
But for example, the last one was a little bit different where they were building syscall
payloads. And so we did see both of them looking up a list of syscalls and the parameters. Yeah.
So if we have another look here and see what they're doing, we can see they're trying their
exploit script, doing some debugging here. They're checking the output of the script.
Comparing it to the debugger itself to see if the addresses line up.
Making sure you have your offsets and your lengths correct. So it's all good. Again,
I'm not super familiar. I think there's some kind of integer over underflow
business going on in this challenge. Actually, I'm curious if the challenge author who was in
chat last time is in now. Feel free to drop hints just for our YouTube chat and we'll see if
Negasora is still around. Okay, so it looks like a write primitive because we've got a target for
an overwrite. Oh, they're looking for one gadget. They want to figure out is there one now.
So to explain a little bit here, one gadget is both like a concept and a tool. So it turns out
that in various places in libc, if you jump to that address, you will execute the shell.
Just get a shell. Like it's going to call a system with binsh or binbash or whatever.
Some person or people have created this tool which will take a libc version and list what
these addresses are. Some of them have like conditions like, oh, this register cannot be
zero or... You know, several years ago, 1804, Ubuntu, standard installs, that was less common.
It would just tend to just work unconditionally. There was just addresses that were... that's why
it was called one gadget because it was literally one place you go. You jump there, all you needed
was control of instruction pointer and that would be all you got. Now we're actually looking for
ROPers. So we're actually looking for ROP gadgets to see how those work. I'm actually going to go
starbug. I want to get a hit there. Yes. So I'll leave you on the stream and I'll be right back
with an update. Definitely. I hope Jordan comes back with some nice updates there. I'm going to
lean over a little bit to see better this. So ROPER, one of several tools to find ROP gadgets
in a program. So they're running this on the program to find what gadgets are available to
you then use them to build up the ROP chain. So return oriented programming.
And it can be a bit tricky. As we see here, it didn't look that they had a lot of things to
choose. I didn't see if there was like any filter or anything going on there, but regardless,
so they were looking for specific gadgets with specific properties, like a call instruction,
I think there, to be able to put this into the ROP chain and then use that to develop their
exploits. Yeah, so again, we see them looking at... I did a little bit double checking what
they're doing. We can see that they're rewriting a part of their exploit. There's some kind of
address that they're going to trying to figure out what's the appropriate address. So here,
they're going for libc base plus an offset. So they're trying to go into one of these one
gadgets, I think. And we'll see. So they're just trying them one by one to just see if any of them
works and if they have the constraints satisfied for them to be able to do this.
But doesn't seem like it's working quite yet. Yeah. So what do you have, Jordan?
All right. So the update on Starbucks, I would just say Starbucks looks like they're still kind
of like thinking about the problem. I kind of get the impression that slash v slash home has
more of a sense of where they're going. Yeah. And they'll kind of get the building blocks there.
Could be wrong though. Again, it can be really hard to kind of get a sense of where people are
at in their head. We're just trying to kind of watch and gain understanding. But I definitely
saw some more just kind of poking around. It is interesting, we did see a true PwnTools user,
so it was PwnTools coming in from Starbucks versus the custom PTR lib that we're seeing here.
And Jeff, I don't know, is there like a canonical pronunciation? I just kind of
guessed because GDB, but yeah, I mean, I've heard both. I agree with the GDB being a GIF,
but I think it's funny. I think it's canonical. I think it's Jeff. It could very well be.
It's like in the name Jeff. Yeah. So we've definitely got some fans. People are excited
to see both their favorite players. And yeah, Fabio, it depends. Some of these challenges,
there are absolutely things that you want to look up. You might be looking up a bug in the tool
or something you're doing. This particular one is kind of very classic. I feel like
they know their tools. They know what they're doing. They're not looking up the help for
PwnTools because they're using features that they've used a lot. They're not looking up the
help for these things just because they're more familiar with it. All right. So it seems like
we've got code execution, right? If they're already looking for gadgets, they've got code
execution. They're really just trying to redirect. Exactly. GIF or GIF, Jeff or GIF. I love it.
Exactly. Yes. So we're trying to kind of pivot, get us a gadget that gets us closer to our one
gadget, right? So they need to... See that they were looking for a move RSP gadget. So they want
to pivot the stack and potentially to use that to have like a longer ROP chain, potentially.
Another technique they might have used to get a longer ROP chain, too, is sometimes you can just
actually pivot back into the same program, right? Into like another read or another receive depending
on the program. So let's see. We're looking at some padding going down in here into the payload.
So they're just increasing it.
And it is fun, too, because the speed at which people operated at this tier...
We're done! We have a winner! Oh, I'm so sorry. We didn't see it on screen,
but congratulations! Round two winner! Very good. I wish we had that one on stream. I'm very
sorry for the capture problems. We're going to make sure we take this time and we're going to
swap out our capture card so that we don't have that happen again. But thanks again for hanging
with us. We'll be back with a better view of both team screens this time. And we'll see you just in
a few minutes. Thanks, everybody.
So
A little pause... and we are back.
All righty, everybody, we are back.
We've swapped out a capture card.
I think we're going to be good.
So let's go ahead and get everybody to help count me in.
You ready?
We're going to do a countdown.
Five, four, three, two, one, go.
And refresh.
Let's bring up the team screens.
Production, bring up our team screens.
They are live.
They've already got the binary, and they are going.
There we go.
Okay, so let's get up our team views, and we're off.
We're back this round with Maple Mallard Magistrates, which,
I mean, that's the Mighty Ducks, right?
I've decided that's what we're going to call them.
We're going to call them the Mighty Ducks.
And they're competing against OSUSEC, or OSUSEC.
Yep.
Do you know who they are?
I believe they're from OSU, either Oklahoma State,
or I assume it's a state university.
Yeah, I mean, I would guess, but...
But I don't know for certain.
Yeah, I'm also not super familiar with, like,
all the universities in the U.S. and stuff, so, yeah.
Yes, but that sounds very plausible.
What do we have here on the competitors' screens?
So we're looking at source code.
So I guess we gave source code on this particular challenge,
because nobody's got Ida or Binja open.
They're just going straight to...
So let's see, we've got the handouts.
Right, that's some Capstone library calls, right?
Oh, this is interesting.
We've got...
Okay, so we've got Capstone.
And they're going to run.
They're going to try it locally,
and they're going to see how it works.
Now, this program, this challenge, is called Knop Coding.
Okay, so it's not showing...
Oh, did we lose...
Oh, no.
We lost this.
Did you lose that?
No, it's back.
It's back.
But, like, did you lose it on the capture?
Because I think it's just our power.
Yeah, okay, cool.
We're fine.
So I think we're losing...
There's power...
Something power with this is causing trouble.
You know what?
Bring the brightness way down.
Yes.
Let's see if we can do this.
Yes.
So someone's saying Oregon State University.
Someone's saying Ohio State University.
So...
I mean, they're all good guesses, but I don't know which it is.
Yes.
Anyway, while that's, you know, sorted out, we do have...
Let's see if we decrease our power draw on our monitor here, if that'll...
Yeah.
Let's hope that's better.
Let's hope that works.
Okay.
Anyway, off to a bit of a rocky start again, but hopefully we'll recover.
New challenges each time.
There we go.
Go beavers.
So is this actually...
The beavers would be...
Beavers versus ducks.
Well, the ducks are Oregon, but Ohio State...
No, Ohio State's the Buckeyes.
It is Oregon State.
Okay.
All right.
All right.
Thank you.
Thank you, chat, for filling us in.
Can confirm.
So I apologize.
We should have...
We're bad casters.
We should have had better, you know, intel on our teams.
But you know how they say, like, the best way to get an answer...
Is to say a wrong one?
Yeah, yeah.
Oh, that's how I, like, run a business.
That works great.
I just, you know, I say something, and then my coworkers are like, no, you're wrong.
I'm like, okay, but now I know the right answer, so...
Yeah, yeah.
So we can see here that...
We should be streaming it.
If we're not streaming at 720p, it is either YouTube or it's just our bandwidth.
Because we should be streaming at 1080.
And the VOD that we're recording is also going to be 1080.
So if we need to upload a higher quality afterwards, we will get that.
All right.
Oh, this is interesting.
Okay, okay.
So wait a minute.
I'm seeing indecisive over here on...
So remind me.
I've got...
Maple Mount.
Okay.
So I've got...
Mighty Ducks.
I've got the Mighty Ducks over here, and I'm already seeing something really interesting.
Start your clocks.
This could actually be fastest solve from what I'm seeing over here, okay?
So this challenge was called Knop Coding.
And what they're doing is they're told you must get a shell, but everything that you run must be a knop.
Which kind of doesn't really make sense.
Sounds impossible?
Yeah.
Knop doesn't do anything.
But we did give them a hint, actually, right?
So if it's locked at 720...
Yeah, we apologize.
It is probably just our stream bandwidth, because I believe we're streaming at 1080p.
And actually, let's go ahead and go full screen to one of the teams, and we'll try to keep the full screen ones.
Let's do the one without the...
If we're at 720, we want it to be real full screen.
So we'll get rid of all the pretty artwork, and we'll just do...
Let's do the bigger one that's clear without even that.
Yeah, so this will get us looking at Oregon State.
So we're seeing the preload.
Right, so what they're trying to do now is they're going to run it with their capstone.
Yeah, they're just trying to make the binary work so that they can debug the stuff.
You see, they do some LD preloads to get the proper libraries running.
No, these are not two local teams, as far as I know.
I don't believe...
It's funny that they're duck-themed, right?
So the duck theme is...
Yeah, we are making progress, right?
Okay, so what we're looking at here is we've got a text file on the right that is a NOP, right?
And we're assembling it, so it's test.s, and this is being created as a NOP.
But when we disassemble it, now it's not a NOP, right?
So the reason why we're doing that, and we gave them a hint,
we told them that the binary they're given is a 32-bit binary on this particular... I believe?
The point is that there's a mismatch here.
It's being disassembled as 32-bits, but it's executed as 64-bits.
So it's going to be run as 64.
The other way around.
It's disassembled as 64-bit, but executed as 32-bit.
So if your bytes disassemble as an x64 NOP, but run as a 32-bit actual instruction, it will be run.
And so, yeah, we are definitely... I can't tell from this angle.
I don't have a good view on OSU.
They're looking at the code here.
Clearly, the ducks are, I would say, in a strong...
Running your NOPs, they should have...
They know. They completely understand.
Like I said, this could be one of our faster solves, because they are absolutely...
They get it.
Now, how long will it take them to build a payload, and can our beavers catch up?
That's going to be the question we've got to figure out.
You can see that they are looking up the Capstone CSV.
So that is a good thing to do, because a lot of people, when we tested this challenge,
just assumed it was disassembling the same architecture with.
And so actually double-checking that call to Capstone, checking the parameter,
checking that information, is actually not a bad idea.
I just think we're seeing our duck over here make...
They looked at it, and they just knew.
They're like, oh, I get this. I understand exactly what this challenge is.
I mean, sometimes you're just on the same kind of frequency as the challenge author,
and like, I see where you're going with this.
So MMM, and actually, MMM is a very similar name to PPP.
Yeah, what a coincidence.
What a strange coincidence.
So we mentioned earlier we're seeing a lot of these teams kind of join together.
And certainly if we look over...
We can see an opcode reference here, which is exactly what you want here.
You want to see what's the opcodes that will disassemble into the knobs
while at the same time have a different meaning in the 32-bit context.
Now, again, though, I wouldn't say that there is sort of like once you get the right one that works,
the rest kind of flows pretty easily, I feel like.
Having seen at least a solution to this, we expect there's probably multiple,
but one of them, like once you kind of get the right mismatch,
you don't need to build this really complicated payload.
It can be relatively straightforward.
So I say that to mean that it could be, I guess, not out of reach yet.
Like while I certainly, if I, you know, we're in Vegas.
If I was going to make a bet, I might put it now on MMM.
Yeah.
But this is not out of reach.
There's no question because if it's...
Okay, right.
So they just found out, for example, floating point knobs are not considered knobs
because it actually says FNOP.
So it's FNOP or however you actually pronounce it.
And I'm also kind of wondering what the hell is FNOP in the first place.
FNOP?
It's a knob that happens in the floating point instruction space.
Right.
But, like, what?
Yeah.
Actually, if memory serves, it's even a funny opcode.
I think it's D9D0 because, you know, 90 is the regular knob.
And so I believe let's...
I'm not sure.
But, like, you know, chat.
Somebody check me out, chat.
Open up your Binary Ninja and type D9D0 and hit, you know, P, disassemble it.
Or we can look.
Yeah, we can look here.
So we're seeing working over through the knobs.
Okay, we're back in Capstone.
So have we found out the key yet?
So let's see.
Yeah, they're looking at the Capstone header.
I think they're trying to figure out exactly what the different constants mean, like the different arguments.
Which is definitely the key to understand this challenge, then, to realize, like, exactly in what way it's disassembled.
Now, you could go too far, though, right?
So, like, one of the, I think, the most important things to figure out is how much do you spend into one sinkhole before you move to another topic?
Or are you going too deep?
Especially in this one, where you know there is a solution that should be doable in 20, 30 minutes, right?
Right.
And this is a little bit like a metagaming thing.
We just saw it at FNOP over there as well, too.
Nice.
So they're looking through the different operations.
Yeah.
But a little bit like a metagaming thing in the CTF.
Like, because you know that there is a solution, like, it shapes how you approach the problem.
And, like, you start thinking about, like, okay, what could the author have been thinking about, and so on.
Well, and that's one where, again, I feel like, you know, we saw immediately a 32-64 mismatch coming out of MMM.
So that was just somebody who looked at it and instantly thought, if I was making a challenge like this, about like this, here's probably what happens.
And then it just, they tested it, and it worked.
And that's where, like, the experience really comes into play.
So, Iron, we currently have MMM, which sounds suspiciously like PPP.
They're a duck-themed team.
The full name is Maple Mallard Magistrates.
I call them the Mighty Ducks.
And they're playing against the OSU SEC, the Oklahoma State University Beavers.
So we have a duck versus beaver match.
What?
Coincidentally.
And actually, for context, the seeding for these challenges...
Oh, I do see our stream bitrate kind of going up and down.
So I apologize for the 720.
We are at the mercy of the bandwidth that we've got here.
But the good news is we have local feeds, and we will make sure that we put...
Upload the videos of this, the recordings.
Yeah, we'll do the good ones later.
There was a question here, like, they can only use NOP in shellcode.
And yes, it's like, yes, but no.
I said Oklahoma, didn't I? I meant Oregon.
Thank you, Lucas. I apologize.
Yes, this is Oregon State University.
We're not operating on much sleep.
Is this like the U.S. version of, like, Sweden, Switzerland?
Oh, there's lots of them.
It's just O universities.
There's Oklahoma, Ohio.
I know, I know.
Listen, we didn't sleep a whole lot the last few days.
Like, we've been hard at work getting this done.
So I guarantee you that's not the worst mix-up that we're going to have.
All right, so I'm starting to see...
This is interesting.
Okay, so let's go back over to the ducks.
And we've actually got, like, a payload here.
So we're writing...
We've got this 0xf and 1f.
Or no, 0xf and 1f.
Okay, so we've got a bunch of NOPs that the behavior...
Oh, I think they're just brute-forcing.
They're just trying all different combinations of, like, opcodes to see...
I don't think so.
I think this is a little different.
I think what we're doing is we know something is disassembled wrong,
and we're just trying to either, like, increment a pointer or something.
This feels further along to me.
No, no, you see that.
They loop over all the 256, like...
Oh, immediate values?
No, you're right, you're right.
I take that back.
They're trying to explore, basically building up a playbook, I guess,
of what they have to work with.
Well, AR, I will say that of all the O universities,
only one is represented at DEF CON CTF.
So by definition, I think you might be right.
I think certainly in the CTF community, right now anyway,
Oregon State does have that edge on all of their other O universities.
The other thing I think is really interesting,
I love looking at the tooling.
I love to see somebody's using BBEdit with very tight indentation limits
so you can see a lot of code.
This is sort of personal preference in how people work.
Some people are using Vim in the shell,
and some people are using actual IDEs,
or some people are just using text editors.
So I'm really curious to see more of that as well as we go.
And then, yeah, Hex Fiend as well,
just to be able to get a quick analysis.
In fact, when this challenge was being tested,
one of the things I saw done that I thought was really nifty
was open up the binary.
And I think you could do this in Gitter, or IDA, or Binja.
It works really well in Binja, though,
to be able to just type a bunch of hex bytes
and have them disassembled simultaneously in each of the widths.
Oh, nice.
Actually, no, I take that back.
You can't actually have overlapping architectures in IDA or Gitter.
But you could easily wire up objdump to do the same thing,
just disassemble them both side by side,
let me fiddle with a bunch of bytes, and work from there.
We're looking through a bunch of these.
I think once the right one is found, it'll go quickly.
Right, so is there one or two operations here that are key?
There's at least one that, when I saw it get done,
when Glenn was producing the answer for, was definitely key.
And in fact, we've got plenty of time left,
but if we hit the 30-minute mark or the 25-minute mark,
what we'll probably do is go tell them a hint,
like the mnemonic that they should be aiming for.
And that might help them get a little bit further along.
So we've talked before about what happens
if teams don't solve this in time.
Uh-oh. Oh, that's a good-looking list.
Oh, this is interesting. I see some inks and decks.
Oh, that's useful.
Yeah, what could you do interesting if you could ink or deck a pointer?
Well, now I expect we're going to go back and look at...
No, you need the actual disassembly at this point, though, right?
Or a debugger. So there we go.
We're going to see Ghidra, we're going to see a debugger.
I think we've got a gadget.
And now it's a question of what can we do with it.
Yeah. It's like incrementing...
Very useful to either do self-modifying code
or just manipulate pointers.
Just align some pointer at something else, right?
Like, what can we point it at?
Right. You have an ink ESP there, for example.
Oh, and there's a segfault, right?
So writing a bunch of those.
So we know there's something malicious happening.
Right.
But how do we ensure that?
So, Fabio, to answer your question about why they're using a hex editor,
they're usually going to be using a hex editor here
because they wanted to just enter a bunch of different bytes in
and see how they were decoded,
how they were disassembled as 64-bit and 32-bit disassembly.
Because that's, again, the sort of crux of this challenge
is that the program tells you it's only going to run your self-code
if it only contains all NOPs.
But it's not actually true
because it's going to disassemble them for one architecture
and then run them for the other.
And so that's what you're trying to exploit.
Let's double-check back on our...
Oh, man, this is tempting.
Yeah, but let's go back over to OSU.
Let's go back to OSU and let's see where we're at over here.
Yes. So they are also looking at an opcode reference.
They've started writing a script.
So they're on the same path.
If they get that ink, they're only a minute behind.
Yes.
Honestly, if you've got an ink, they've still got a shot.
Again, Batman, I still know as much as where I put it.
So let's keep our eye on back on the ducks
and see where the mighty ducks are at.
And we're already looking at memory maps.
We should keep a vote of Jeff versus Pwnbag
or all the different other options.
So here we go.
So they're using Gitter as well for the...
But I'm waiting for like...
I think they're just so much faster than me
because they flip the Gitter and they flip away immediately.
I don't remember if they just remember the disassembly so much.
Yeah.
Maybe they just wanted to double-check one small detail.
If you have one question that you want answered, just check.
Look back at it.
What was the size of that buffer?
Again, we've got the choice here between
what register do we want to increment?
And so that's the key question.
Which one is most useful?
And I will say a debugger also makes a lot of sense here too.
Yeah, AR, absolutely.
I think everybody is impressed with OSUsec.
In particular, the most impressive thing about OSUSEC
is that they're one of the few teams that didn't combo up
with a million other teams.
Because a lot of these other teams...
To our knowledge, they are actually just OSUSEC.
Yeah, and it sounds like we've got a lot of their fans in the chat.
And yeah, that's super impressive.
You definitely get an underdog vibe.
And you want them to do well because they're competing
against these CTF giants that have been around for 10 years
and they're combining four of the teams.
Going up against PPP plus friends, that's rough.
That's daunting.
I've lost a lot to PPP without friends.
We all have.
Over the years.
All right, so take a look in the debugger.
It seems like there's some kind of controlled values in there
and is that a stack they're looking at?
Yeah, let's look at the stack pointer.
Look at the memory maps.
Again, looking at disassembly.
What is RPOSX64?
I don't know that.
No, that's RP++.
That's another ROP gadgets finder.
I tend to use that one.
I think all the cool kids nowadays use ROPR.
But I think before that, RP++ was the good stuff.
I'm still kind of using that.
This is one of the things I'm actually excited about too,
is seeing the new toys and tools.
Because I don't actively...
Oh, we got a little bit of a...
Oh, there we go.
We were looking for...
It looked like God entries maybe.
I saw a bunch of a list of function pointers.
I haven't actively played CTF in several years now.
I know enough to maybe make a small challenge an easy challenge.
And I know it's going to get destroyed by really good people.
But it's fun to see what are the latest tools.
I kind of missed out on watching people do that.
To recap, we're 19 minutes in.
And we've got at least one team...
Let's go take a look back over at OSU.
Because we are in a debugger.
That might be a good sign.
You can see them stepping through a whole bunch of NOPs,
which doesn't really give them anything so far.
But it's going to say NOP, whether it is or not, in the output.
Did you see what they sent in?
No, but you see in the debugger, it's also listed as NOP.
And also in the output to the left, it's listed as NOP.
So they haven't found the key mismatched yet.
Correct.
Or they haven't exploited it yet.
Or actually taken advantage of it.
However, you can see here over at MMM,
that you have a sequence of hex values listed here in their exploit script.
So it looks like they are going somewhere, putting together...
Oh, I wonder if they're putting together a shellcode payload in these immediates.
See, it's called smuggle32, right?
Oh, nice. I like that.
Also, again, with nice naming of things.
We've gone boring now. Now it's just x32.
Yeah, so we lost the more interesting name.
Yeah, I mean smuggle32, I think.
Oh, there we go. So at ink ESP...
Oh, no, sorry, not shellcode. Pointers, right? Clearly.
Executable code.
Yes.
So they're going to have this x32, which is going to let them rot potentially.
And they're going to be able to ink the stack pointer.
This sounds like a great technique.
Yes.
Ink the stack pointer, override the return address, maybe.
And go from there.
And you've got to end in maybe either one gadget or multiple gadgets,
or you've got a sort of straightforward shot.
Oh, there's a win function.
Or maybe you could go, oh, you know what, though?
If a team doesn't actually open this thing up in a disassembler,
if they only use a debugger, they won't see win.
Well, they have the source code.
Oh, they have the source code.
They have the source code.
That's a good point.
But this is definitely the thing that you can, like, you know,
because I think it's maybe like at the top of the,
like it's a small function at the top of the file.
Like, you know, if you just scroll past that because you don't notice.
And then you build your mental model all around, like, you know,
a rough chain or something.
It's the kind of thing that happens a lot in this environment.
When you're doing a live CTF, and you're under pressure,
and you're out of the gun, or you remembered it,
but it's 20 minutes later, and now you've forgotten it.
Right.
So it's possible we see somebody get tunnel vision and miss that.
I mean, I've done that, like, in several CTFs where, like,
oh, there was actually this memory region that was, like,
writable or executable or something.
And, like, you didn't see it.
The binary is actually executable even though,
because it's running an emulator or something,
and you assumed that the permissions were, yeah, were fixed.
Yeah, it's, you know, it can lose you a lot of hours.
All right, so we've got our ink ESP pattern.
We've got our, and we are using PwnTools, right?
So we're seeing PwnTools.
I don't think we have a payload yet.
We're still got, unfortunately for OSU,
I think we don't have an understanding yet.
Right.
I think we're kind of lost in the weeds.
So this is not looking good over there.
We're going to keep it on the ducks
and see if we can, see if this will come in.
Right.
Because this is, I mean, this is looking really good, right?
We've got the ability to misalign the stack,
which gets us a return address overwrite,
which gets us an instruction pointer,
and we've got a win function.
Right, it looks like they're dumping this to a file now.
Do we have ASLR?
Do we need to know if it's randomized or is it...
Yeah, this is...
I believe if the source, if they pull up the source again,
the first line of the source was the build instruction
that was used to compile that binary.
So we would know if they flashed that again real quick.
We've got not coding that C, so we're one away.
It makes you want to touch the screen.
Yeah, we should have some kind of plug-in on the computer.
Yeah, just like, no, no, we need to look at this.
Well, really, yeah.
The later iteration of this, we're going to have more,
I think, machines here,
but we're already overloading the number of available USB ports
even with several hubs.
Yeah.
So I'm curious.
I know there's a lot of Beaver fans in the chat.
Y'all still got faith?
Are you still in hope?
Or are you...
There we go.
See, hanging.
So there are still the Oregon fans out there.
Right, Oregon?
I said it right this time?
Okay, good.
I'll get it right.
All right.
You can just keep rotating around by...
Just different O's each time?
Yeah.
Ohio, Oklahoma, Oregon.
Switch to all of them.
Yeah.
All right.
So...
You can see there, again, doing some, like...
Brute force.
Looking for something else.
Yeah.
So this, to me, is like somebody stepping back saying,
I'm not sure I have all the gadgets.
Like, I think that was all the gadgets they needed.
I think that was sufficient to win.
Glenn, is that sufficient?
Or is there more to it?
We're getting it mostly from Glenn.
Yeah.
And I can't hear him at all.
I can't hear you, unfortunately, over there.
We're just going to roll with it and say that, you know,
they might need a few instructions.
But, I mean, it should be able to...
Because, sure, you can increment the stack pointer, right?
But then you need to actually modify the value.
So you need one more thing to actually, like...
No, no.
If your buffer is on the stack, then you don't need to do any such thing.
You can just return when it points to your...
If your input that you send in is on the stack...
Oh, right. Yes.
You just need to line it up.
Yeah, yeah, yeah.
So you do...
Okay, of course.
Right.
So I think a variant of that is possible in this particular binary.
But your input is still slightly constrained, then.
Like, let's say you would put a return address or something there.
I don't remember the source code if this was string operations,
if a null terminate will break it or not.
Ah, I see. Okay, right.
Yeah, so you could potentially smuggle it behind the other stuff.
But, yeah.
But, no, you give it binary because it doesn't assemble your...
That's right, that's right.
You give it the hex and it's actually going to put that buffer as those bytes.
Yeah, yeah, yeah.
Presumably do it.
Right.
Five minutes to a fresh start.
No, no, no, no, no.
We have...
So they have plenty of time left.
Yes.
Well, so we are coming up on...
This is the point where if neither team had made progress,
we'd walk over to them and we'd say,
you need to misalign your 64, your 32,
and you need to find a gadget that's going to let you get the payload.
But because we're already seeing at least...
Once at least one team has sort of made it to that point...
Yeah, and clearly that's the case.
Which has been for several minutes now.
We're not going to do it now.
That said, if we come up on 45 minutes, we do hit sudden death mode.
And we will swatch over.
So there is 20 minutes left where if the duck doesn't successfully finish this challenge
in the next 20 minutes, there is still a chance that we go to sudden death
and our beavers could have a chance.
Yes.
So that is absolutely possible.
Let's...
All right, I'm going to just look for a second and try to get caught up here
where we're at because it's a little concerning
when I see going back to the well of trying to find more gadgets.
Right.
And I'm wondering...
We're still looking for more patterns, but as far as we know,
we think there's enough gadgets there.
Yeah.
I have actually not looked at our reference solution for this.
So I don't know exactly what instructions it contains, but...
I thought it was an ink ESP, actually.
Or ink or deck ESP.
One of the two to misalign the stack pointer into a buffer you controlled.
Right, so we've got a question about the sudden death thing.
Yeah, so we have this thing.
So there's a time limit of 45 minutes.
So if they hit that, we will stop the challenge
because then it was...
Well, we don't want to drag this on for too long.
So in particular, the whole match on every team versus team matchup
really needs to stay under an hour.
Otherwise, the schedule starts slipping and throws off all the other events.
Right.
What's that?
All right, do you want to get on the mic and do it
or do you just want to tell us from there?
You have a mic over there.
Actually, that mic is even still live.
So careful rubbing it on things.
But if you talk into that mic, it might just be easier to hold it
and try to put it on. It's up to you.
There we go. So I think we've got Glenn.
It looks like your levels are up.
All right, let's see if this is working.
So our producer Glenn and challenge author Glenn is going to come here.
We'll tell you a little bit more, Rakesh, about sudden death in a second.
Let's let Glenn talk a little bit more about what the expected solution is here.
All right, so...
This is why the competitors have those earmuffs on,
so they can't hear us as we're talking about all these details.
Yeah, let me just make sure the levels are actually working.
All right.
So generally speaking, the way that this works is
since you have the difference between x86-32 and 64 bits,
you can get what the MMM player has found,
which is like a REX-W NOP,
which basically on x86-64,
it disassembles to a NOP.
On 32-bit, it disassembles to a decrement stack pointer NOP.
From this, you can gain control over the stack pointer.
You can go either direction,
but the way that the reference solution works is
it just changes the stack pointer to point into the buffer of NOPs
that you send to the server.
And since the binary is not pi,
and so the addresses are fixed,
and there's a win function,
you should be able to just get the stack pointer
such that when the function returns,
it returns to the win function.
I think we need to give a hint.
And here's my proposal.
Here's the hint that I'm going to give.
I think MMM missed the fact that this does not have pi.
And so they're looking for a more complicated one.
But I also think that OSU has missed the 30-bit 64.
We can give them the same hint to both of them
and help them both out equally,
which is that we can tell them
they need to double-check how these binaries were compiled.
They need to check the first line of source code
that tells them how the binary was compiled.
That will tell them both something useful
to the state that they're at.
All right?
So do you want to go get one?
I'm going to go do that,
because we did not add the messaging thing.
Yeah, yeah.
I'll go tell them.
Or just write a note out,
and then just hand them each the note.
Right. Where's your notebook?
Here we go.
We'll do this now.
We'll give them each that little bit hint.
Yeah.
And to answer...
Oh, sorry.
Glenn, kill the volume level on that third...
Yeah.
Mute that.
Sorry for the ASMR there on the microphone as we set it down.
We've got to be like, yeah.
I got you, Penn.
Yeah. Okay. Awesome.
I'm tethered in,
because I wired my microphone through my vest this last time,
so I can't go anywhere.
Yeah, looking good.
But you can explain sudden death.
Right.
So the sudden death plan...
Just keeping an eye on our duck,
just to see if they've got anything else.
The sudden death plan is that if we get into a situation
where both teammates are stuck,
neither one's making more progress,
it's not looking like they're going to solve it in time,
we have a totally different challenge.
We have an easier, simpler, quicker challenge
that we will field,
that is meant to just break a tie, essentially,
because we don't want to have something in
where neither one can solve it.
So if we get to the point where we have...
So 15 more minutes.
If we get to that point,
we will deploy a sudden death challenge.
We'll change it and say,
sorry, you didn't solve it in the 45 minutes.
Here's another challenge.
Try that.
We haven't figured out if that takes too long.
We just kind of have to wait until that gets done.
So hopefully those...
But those are intended to be, like,
the easiest possible challenges that we could do.
So that's what we're doing with that.
We're writing out the same hint to both teams.
First line of source code.
So we're going to tell them
that they should each double check
how the binary was compiled.
I think that'll be nice,
both fair and yet also useful to both of them.
So we'll go ahead and do that
and get that to both the teams.
Because what's going to happen here is, again,
if the duck can finish this out,
if they can actually successfully solve this,
they have a shot at it.
But if they don't,
then they're going to basically kind of be reset.
They're both going back to zero on this new challenge.
So the new challenge will be, like,
fresh territory for both of them.
So let's switch, maybe,
to one of the other cameras
and we can see in the background
as Carl's going to go deliver our hints
to both competitors.
And we'll see if this has an impact on them.
In the meantime, thank you.
Is it down down or dawn dawn?
I forget. I feel like I should remember this
because I know I've seen the hint before.
So that's a good question.
What is osusec up to?
We're just looking at the source again, it looks like.
So we have deployed the hint to both players.
And it's hard to tell because they're just looking at the...
Yeah, that's not a bad idea, Peter.
They might need a bigger hint.
We could give them both an explicit hint
of something like the binary is not ASLRed
and this is 64 32-bit misalignment
to get them both past the next down.
Thank you, down down.
Or maybe it was down dawn.
It could be one of each.
So we do have a bigger hint we might have to give
to both of them.
We will see.
I would not be surprised.
And again, this is one of those things
where if you're playing at home,
you look at this and you think,
oh man, all you have to do is move the stack pointer.
You should totally be able to finish this out.
It is so different.
It's so different when you are on the camera,
when you've been stuck on the step for a while,
you get kind of into rabbit holes.
You're thinking, surely there's some other gadget
that I'm missing.
Surely there's some other thing that I need to find.
Or if you feel like you just don't even have a way to do it.
So let's go ahead and prepare the next hint
that we'll give them in a couple minutes.
If one of them starts to make more progress,
maybe we'll hold off
and we'll see what happens.
If we give them the opcode,
we're giving one team what the other one already has.
So I think this hint should say...
Yeah, maybe we can...
Yeah, let's think.
What's the clock at?
Yeah, I think...
Give it a few more minutes, right?
So there's a question about how long...
So the idea is that at 45 minutes,
we will switch to the...
And we start every match on the hour.
So we started for us at 4 p.m. Pacific time.
So we're 34 minutes in.
So we have 11 more minutes before we...
So we're...
Are we brute-forcing?
Maybe we're done brute-forcing.
Yeah, they've removed the for loop.
Okay, so we're not...
They're putting some address in there.
This is test.py.
Okay.
So this...
Python quit unexpectedly.
Wait a minute.
Execve launch.
Maybe we are close.
Yeah.
Okay.
This is a good sign.
Okay, yes.
Oh, look, he's looking for system.
Okay, okay.
This looks positive.
I think the realization has stuck home.
I think we're about to watch it come home stretch.
I still don't see osusec, unfortunately,
coming up with that key 3264 insight.
Even after they hinted the binary was compiled for 32-bit,
but the disassembly is 64-bit.
So we're looking for a bin as a string.
We're going to pass it as an argument to system.
Right, so they're going to skip the win function.
They're going to just put the...
But this is...
Again, there's literally a win function.
They just need the address of that.
But luckily this is 32-bit, right?
So they can just put the argument on the stack.
I mean, it's marginally more difficult.
You would need to put two addresses on the stack instead of one address.
As long as there's room, and I believe there is plenty of room.
Not a huge loss, but definitely could have cost them.
This is looking real close.
We're getting the last address in.
Let's see if this does it.
Again, we predicted this earlier.
Like I said, the win function we gave them the source, it's very easy to miss.
You 100% can get tunnel vision and totally either have forgotten about it or never seen it.
In fact, in this case, I wouldn't even be surprised to have never seen it.
Because there's not been a lot of poking around in the...
No, because they were so quick at understanding what the source code was.
And that's the thing.
Then you build this abstraction in your head.
This mental model.
This thing just doesn't exist.
There it is! Congratulations!
All right, we have a win.
Congratulations to our ducks.
I'm excited we didn't need a sudden death.
That is our third round complete.
We will see you all back here in about...
Wait, wait, wait.
Hold on.
That was just local.
No, no, it's not.
Submitter.
It ran.
Did it run?
It ran, right?
No, no, no.
Sorry.
You didn't trigger it, right?
I saw it trigger on...
Yeah, yeah.
We're done, we're done, we're done.
All right, congratulations.
Okay.
We will see everybody back here at the top of the next hour.
Very, very fun match.
Thanks to both the teams.
We'll see everybody in a few minutes.
We out.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Bye.
Welcome back, everybody.
We are here again, the last round of the day.
Apologies for the 10-minute delay on this one.
We're trying to hunt down a bad cable.
Somewhere in our infrastructure is a bad cable, and it's causing one of our streams to have issues.
So we might have some intermittent connectivity for one of our players.
Apologies for that.
We're going to go ahead and get a kickoff right away.
We want to get these team members back to their teams as soon as we can.
So let's go ahead and get a countdown of 5, 4, 3, 2, 1.
Go!
And now they're off.
Okay.
So we've already got the first one downloaded.
And this particular one...
Actually, can you grab me my notebook over there with our teams and whatnot?
This one, we've got the new organizers.
And I believe we've got Team Taiwan was the name that they requested.
Because it's, again, another one of these mega teams that has a conglomeration of many different teams.
So we've got Team Balsan, Team 217, Team TSJ.TW.
So there's another team that has TW in the name that's Tokyo Westerns, a Japanese team.
But this is the Taiwanese team because it's .TW.
So let's go ahead and take a look at Team Balsan.
It should be the one that I've got over here on my monitor.
And they are already off, and they're in IDA looking at our challenge.
Now, again, you'll notice all of our challenges are named Challenge, just the way that our Docker deployment kind of works.
The official name of this challenge is called Nerd Sniped.
Right.
So what are things you can get Nerd Sniped by?
A lot of things.
Yeah.
We'll see how that plays out.
I get Nerd Sniped by, like, a Rubik's Cube.
Yeah.
A good puzzle, maybe.
Yeah, a good puzzle.
Maybe something like that.
That'll do it.
So we got you 1080p back and going.
Hopefully, we'll figure out our issue with our HDMI cable, and we'll have much better consistent capture across both team members tomorrow.
Something about this cable is like it's heating up or something.
We had several hours of testing last night with no problem, and something's going on now.
So we'll give that a run.
And sure enough, I literally just saw a rename solve puzzle.
So we've renamed this function Solve the Puzzle.
So what they're looking for, they know it's a puzzle of some sort.
I'm curious if we get someone just kind of running it and interacting with the binary, or if we're going to do more static analysis.
But actually, yeah, this should be much higher quality with the full 1080.
Unfortunately, we don't have even the local recordings.
We're also not 1080.
They were only in 720 as well.
So I apologize for those first couple matches.
We're not going to have the higher quality video for those either.
But all 12 other matches from here on out are going to be in high def because we have a lot of these to go.
So you'll see your favorite players that won in the first couple rounds.
They're going to come back.
We're going to see them again.
Oh, no, that was cool.
I didn't notice that website.
Have you seen that one before?
No.
I'm curious what that was.
So now they're on the Ubuntu repo.
They're getting a particular glibc version, which makes sense.
That's often common.
Now, I think for most of these, we included a libc if we thought it was necessary.
Yes.
So it's kind of a hint to the teams.
We're trying to give out everything that we could, make it as self-contained as possible.
And so we'll see if that one ends up being useful.
But we've got our binary challenge.
This one is starting to be a little bit more difficult, though, I would say.
Our challenge difficulty is cranking up a tiny bit.
And we're going to see that kind of trend throughout the whole rest of the weekend.
I'm sure we'll have some easier ones, some that somebody finds an amazing solution to, solves it quickly.
But on the topic of difficulty, we have an idea of what's more difficult and what's easier and so on.
But, of course, we can be wrong.
People can have different specializations in their skill sets and so on.
So something that we might think is...
In both directions, right?
Exactly, yes.
So something that we might think is easy might be actually kind of tricky and then the other way around.
So it's going to be interesting to see what's going on.
There's still some reverse, like the initial reverse engineering going on of the program.
For example, this kind of step was not really needed in the previous challenge
where we just gave them the full source code with names and everything.
As an organizer, you have a lot of levers to pull.
It's ironic because we have the organizers here playing,
although, unfortunately, they're on our non-capture screen, unfortunately.
I just had to make sure that we had them lined up right.
I freaked out for a second not realizing.
They are the right halves.
But the team organizers, we're not seeing them.
But as a challenge organizer, as somebody making challenges,
you can strip a binary. You can not strip a binary.
You can include debug symbols.
Different levels of optimizations.
Because a lot of optimization also kind of acts as a slight obfuscation.
Mild obfuscation, yeah.
We have all seen these optimized mem copies and everything,
but you have all this bits magic stuff going on.
Yeah, you get vector operations in your mem copies.
And that's where, to some degree, you can make an easy challenge hard
with just tedious things.
So it is interesting that you see a lot of, I would say,
cheap challenge design where it's like,
yeah, we just made it harder by doing X.
And it didn't make it more interesting, it just made it
slightly more annoying to do the thing that you want.
So sometimes a really good easy challenge is actually
you're just really focusing on that one core thing that you want to do,
which makes a lot of fun for what we're doing here.
Right.
So still, we mentioned trying to name different things.
We've seen they name the functions, like solvePuzzle,
and you see some variables getting named, like the input.
It's all trying to get an understanding of what is this program doing.
And there are kind of two parts to it.
First of all, what's the intended functionality of the program?
And then from there, you can start to understand
in what way is it acting not as intended?
Like, where is the bug?
Or, in this case, where the author intended a bug.
Right.
But in the normal case where it's unintended vulnerabilities.
Yeah, exactly.
Or in this case, what's the surface level intended?
What's it claimed to be able to do?
Yes.
And then what does it actually do that may be different?
Right.
So let's see what we're doing.
And this is nice, too, because we're actually getting...
This is the first time we've seen a little reverse engineering workflow.
Yes.
A lot of the other ones have been, like, basically a quick glance
at the code or disassembly has kind of, like, revealed what's going on.
Here, they actually need to kind of understand what is going on.
Okay.
So we're still sort of starting our framework for our exploit here.
But I think it's just getting the menus and interacting with it, right?
And so we're looking.
Oh, okay.
So there's a current puzzle state.
All right.
So...
Puzzle.
That puzzle looked interesting.
It looked like maybe, like, a 9x9 grid of numbers.
With numbers.
Yeah.
It could be maybe, like, a Sudoku.
I think that's a great guess.
Yeah.
And, of course, you know, we're a little spoiled here, a little tainted knowledge.
But this is indeed a Sudoku.
In fact, when somebody was, like, kind of play testing and validating this challenge,
we sort of were like, wait a minute.
You just solved a Sudoku, and that's it?
And the author was like, no, no, no, no, no.
And that's not actually possible.
So it is a little bit trickier than that.
So we'll see as our teams discover it's not just a straight put it into a Sudoku solver,
get a correct answer, and win.
It is going to be a little bit more tricky.
And this is one I am almost positive we're going to need a hint on.
Right.
So I'm going to propose at, like, 15 minutes in, if we don't see...
Like, progress.
Progress.
In fact, actually, why don't you go ahead and take a look at the organizers, maybe, too.
Yes, I will do that.
And if we're looking for them to kind of have a hint as to what they're doing.
Like, indicate that they know what they're doing.
Yeah.
Yeah.
Oh, does it come on occasionally?
Okay.
So it's apparently flickering in and out.
Occasionally we're getting our video.
We swapped out the capture card.
That worked for a while until it didn't.
And then we swapped out the USB-C cable.
And that worked for a while until it didn't.
And so now we're convinced that it's just the HDMI cable itself that is causing trouble.
And I think this has been true even if we were direct wired into the laptop.
So it's not the capture on the other side.
Yes, because we also did swap out the USB-C adapter once, too.
So we swapped every component except the HDMI cable.
Partly because they're, like, taped to the floor and they're a 30-foot long cable.
So we've got to go and get some...
Oh, there we go.
I saw a...
I did see a solver pop up briefly.
I saw a Sudoku solver.
Yeah, I was just going to say, also, the player from the organizers copy-pasted the current state of the puzzle into...
And they Googled for a Sudoku solver.
So we'll see to what extent that will help them.
Again, I'm not completely familiar with the intended solution here.
But I would assume that it still involves solving the Sudoku, but not only doing that.
It is trickier than that.
Yeah, that's right.
So I have a little bit more info.
Yeah, we're still seeing that kind of solver flashing in and out occasionally on the display.
There's going to be some memory corruption here.
There is indeed.
This is not just...
Now, although I will say, it is actually a perfectly valid category of challenge in a lot of CTFs, right?
Where you would actually do have a more programming challenge or a puzzle.
That happens.
And I think, honestly, even in moderation, I think those can be fun and enjoyable mixed in amongst a traditional happy competition.
Yeah, typically they are branded as PPC.
It's the category in normal CTFs, which I think is like professional programming challenge or something like this.
People familiar with like, you know, ICPC style algorithms competitions or so might find.
Although usually they're kind of like framed slightly differently.
But it's kind of like the same general idea there.
Yeah, and there's no security flaw.
There's really just rather solving some hard mathematical problem with the right algorithm or with the right approach to kind of get it working.
But that's not the case here.
There's an aspect of that, but that's not enough.
This is truly a point of all.
There is memory corruption involved.
Although I will say, and I'm looking to see if somebody finds the sort of like win function.
When you have a correct solve Sudoku, I think we're going to see...
So this function here, they've named it check, returns whether or not we've successfully calculated a value, a valid solve.
The result of that is going to determine basically what you call a win function.
So it is going to kind of do the win for you.
So you already sort of know that you have to solve it.
Your question is, okay, what mechanic will actually get me to solve it?
And can I cheat it?
Do I have to have a combination of a solver plus a cheat?
What is that ratio going to entail?
Because at face value, it kind of looks like you just solve the Sudoku and you win.
But you know, like DEF CON finals, even being a sort of easy live CTF, I would think people would be like,
no, wait a minute, there's something here.
And I think if you can also...
There's not a lot of values here.
And so I don't know.
I think the idea is that these are just not solvable because there's not enough information.
Some Sudoku balls are very minimal, but they're designed to be solved.
They're made to be solvable.
I think I remember that if you have 13 digits, you're guaranteed to have a unique solution.
Okay, so this one definitely has more than that.
But there's going to be some other issues with it still.
I'm not sure if my trivia is correct here.
I vaguely remember, like, if you have 13 digits, you have a unique solution.
You can have a unique solution with fewer digits, but it's not guaranteed.
I don't know that that's true because I can just give you all of the ones, for example.
But that's just nine.
And all the twos.
And that doesn't give you enough information to know where all the other numbers are.
Maybe.
Maybe it's 21 or something then.
There is a number.
Where is our cracking the cryptic phone of friends?
And go to the YouTube stream.
Yeah, great channel.
So here we go.
We're seeing Sudoku solver Python.
So we're seeing people investigate that.
All right, we are now 15 minutes in.
I think we should be preparing our hint.
Because I actually think this one is a little too subtle.
And we're going to have to point them in the right direction without actually giving them the hint.
Yeah, and we should notice now that even though the time is 24, we started late because of technical difficulties.
So they are only 15 minutes into the challenge.
Correct.
So we have more time than the clock looks like compared to the other ones where we started much closer to on time.
So we're trying a solver.
Again, so trying a solver on here, which is not going to be sufficient.
So I think we need to figure out if there is an official hint from the challenge author.
So we've got Glen over in the production booth, as it were, which is otherwise known as the other side of the table that we're sitting on here.
Yeah.
It's going to reach out and see if we have an official...
We have like three times the number of computers compared to the number of crew members for this setup.
We have a lot of displays and, I mean, an order of magnitude more cables, I think, than...
Yeah, but it's...
And once we find out what is breaking our secondary capture...
Actually, speaking of which, I'm going to go ahead and take a look at the organizers.
I want to see if they're making progress while we figure out what we're doing with that hint, if we're going to give it.
And if you guys have any questions about where we're going, let us know.
Yep.
And I'll be back with an update.
Great. So while Jordan does that, we can try to see that we...
Okay, so I've just been informed that the puzzle that you were given is impossible to solve.
That's kind of the trick here.
So at face value, everything looks fine, you just need to solve this Sudoku, but actually there is no solution.
This is an invalid state for the Sudoku.
So once they...
And this is something that can really throw you off, right?
Because if you take this and you put it into a solver or something, and the solver says, like, no, there's no solution,
you might be starting to think, like, maybe the solver has a bug, or maybe the format of my input is wrong, or something like this.
And only later you might question the impossibility of the puzzle.
So this is where they have to then cheat to solve the impossible Sudoku to then get this win function.
We can see here on the Battlezone screen that they are looking still at the kind of decompilation here, thinking hard about this.
Trying to figure out, like, what is going on here? Like, why is this not working?
They have this... it's this check function, right?
So they're trying to think about, like, in what way does this function not behave correctly, maybe?
Maybe they have realized that, like, you're given an impossible puzzle.
So, let's see, they're going to try to...
Seems like they're writing, like, a small, like, formatting function.
They're looping through, like, the X and Y axes and printing something.
So, yeah.
Still unsure exactly where they're going with that, but let's see here how they run it.
So, a quick update is, both teams are taking the sort of wrong approach now, and they're still looking for solves.
So, the hint they're both going to get is, you can't win, you need to cheat.
Right.
Which is... almost feel like there's some kind of deeper philosophical thing here.
I mean, it's a true life statement, probably.
Yeah.
Yeah.
It's...
Yeah, I had a lot of thoughts about that, but let's not go too off topic.
Too deep.
Yeah.
I, you know...
So, here's the other question. Do we want to give them a little bit more of a hint?
Do we want to tell them exactly kind of how, like, more of a hint as to what they want to check?
I think we have time, right?
No, no, we have time. Let's do that.
And, yeah.
In fact...
Well, that's too late now.
I mean, I was thinking in terms of, like, since this is the last match of the day, we could have afforded, like, you know, extending the standard game time.
Yeah, but...
But I don't know if it's fair to do that once...
Well, we do it to the same two players. Either way, it's only fair relative to each other.
Because every match is different. Different challenges, different conditions, and so to some degree...
Right, right.
So, that doesn't matter.
You could argue that it's fair, but...
But let's see, you can't win, you need to cheat, you need memory corruption.
Yes.
It's dangerous to go alone, like, take this memory corruption.
Yeah, it's dangerous to go alone, take this memory corruption. I love it.
Alright, here goes the first hint.
Yes.
We'll see if this gets them on the right track again, or if we need to...
In the meantime, I'm trying to decipher what this script is doing.
They have a solve function there, which then will not really help them, since you can't solve this.
It's...
Yeah, it's still a little bit unclear where the players are in this.
Unfortunately, we can't read the minds of the players.
That would be immensely helpful when doing this type of commentary.
We can just try to guess based on what we're seeing on the screen.
Yeah, again, if you have any questions or comments from all of you watching this...
I got some smiles. I wish you all could have seen it, but there was like, oh yeah, of course, okay, okay.
So they were both going down the solver approach, so I think we're going to see a lot more IDA now.
Right.
We're going to see them actually dig into the binary and follow it that way.
So that's nice to hear, that the hint was appropriately leveled and that it was useful to the players.
Yeah, I think they both were at a spot where it's going to help both of them.
We'll see if either one starts to take advantage of that or not.
So we're looking at checksec, we're looking at the binary properties.
And that's actually a great habit to be into. I really think that a lot of people overlook that.
Again, we saw that last one with the mallard, with the ducks, where it not being randomized, I think added a little bit of extra slowdown there.
Right, yes, definitely.
Because you could have gone straight into...
I think I have this as a pretty good habit. Always run file, always run checksec.
It's kind of like when you're doing reversing engineering challenges.
Always run strings, always binwalk.
Just out of habit, it's just the things that you do.
Alright, so let's watch this.
Okay, so now we're seeing them actually where we want them.
Now they're back to reverse engineering.
They're looking for vulnerabilities.
And what they're going to do is they're going to use the vulnerability to win.
They're going to use the memory corruption to not code execution directly, but to the win state.
So what they're going to do is they're going to need to corrupt in such a way that they can create a solved board.
And they should hopefully still remember this, right?
Because they know that the point was to win.
They saw that. They saw the win state.
They saw that's why they were trying to solve the puzzle.
So I think they know that.
The question is, are they going to be able to figure out the memory corruption in time?
So that's the question that we're looking for.
And this is kind of interesting, I think.
This type of pwnable where, like a lot of pwnables, you have kind of this standard workflow
where you try to gain control of certain aspects of memory.
Yeah, yeah. It's a pointer overwrite.
Or it's something that gets you a memory write.
So you get a pointer overwrite.
To a ROP chain, to like, you know.
But here you're just doing kind of like, maybe we call it like a local memory corruption.
Or it's not quite a logic vulnerability in that it is memory corruption, but it's not useful.
It's not being used for control flow hijacking.
You're using it specifically to just change the state and change the behavior.
Yeah, the functionality through its normal legitimate means,
but by entering a memory state that it didn't intend for you to enter.
Right. So in a lot of these cases, the program wouldn't crash, for example,
if the exploit is slightly wrong.
Yeah, you just failed to get a correct puzzle. It's just not solved, right?
Yeah.
Which is not to say that they couldn't crash with this vulnerability necessarily.
It depends on how it's actually constructed.
But there are certainly use cases, or there are cases where an exploit isn't actually exploitable
in the direct code execution state.
It is rather just by exercising some other logical state of the program.
And I think, in general, everything we say here about pwnables and general ideas,
there are a lot of ifs and buts and stuff to all of these exceptions.
We're trying to make some broad strokes here about different types of challenges.
I'm a little nervous. This one feels like the first one we might have to unleash a sudden death.
I'm hoping we don't.
Right.
And I like the challenge because, like we were talking about, I think it has that good twist.
You're going to not get a pointer overwrite, but you're going to influence the state of the binary.
So I'm hoping. And we've seen great work from all the teams so far.
So we know we have high-quality people. We'll see how it's going.
This is also, I say, one of the larger binaries.
We all get very small binaries, very, very self-contained.
This one's a little bigger. It's still, I think, small on the CTF scale of things,
which in CTF is smaller than real-world binaries.
Oh, yeah.
But relative to the live CTF binaries, this is larger than some of them.
Yeah, luckily they don't have to sift through a 300 megabyte binary.
What? Who doesn't love sorting out massive binaries?
Yeah, I think I remember opening the Minecraft binary in IDA at some point.
Then I went to bed and continued the day after.
No, I think it was just barely finished, but it took eight or nine hours to analyze that.
Big binary or even obfuscated binaries can take a long time to analyze for sure.
All right, here we go. So let's look. We're seeing an int64 int.
So making sure the types are correct.
That's good. I think analyzing the types is useful.
Although what I will say is that just looking at decompiled code
is maybe not the best way to analyze any kind of type issues, right?
No, I think it's a good start to give you the big picture.
But then at some point you might have to drill down on things.
And I think this is also kind of interesting again with different types of pwnable challenges.
Some pwnable challenges like the bug is obvious and the exploitation is difficult.
And then you have these more like reversing heavy pwnables
where you have to figure out very complex data structure.
But once you have kind of sorted everything out, the bug just like appears.
And then from there it's typically not that hard.
And I think our previous examples, several of our previous challenges
were more on the side of like it's obvious where the bug was
but actually landing it was sort of the tricky part.
Like we just let you run syscalls, but which ones? That's the tricky part.
Like actually your payload, the execution.
Same thing with like not coding. Like we just ran your bytes.
Sort of you had to like do that.
I think there's those sort of like shell coding heavy
and those sort of like constrained environments are some of my favorite challenges.
Probably because I'm just bad at the more, I don't want to say tedious,
but the more in-depth long-term reversing engineering.
Right, complex.
So I mean, I'm more of a reverse engineer myself, so I like those things.
But then, for example, when you get to these complex heap exploitation things,
then I'm completely out of luck there.
Well, there's always just kind of familiarity and experience with it.
One of the things I was going to mention,
and I say this, that I don't do the reversing heavy ones
as an author of a reverse engineering tool.
Well, maybe that's why you built the tool, right?
Well, that's also why I have coworkers who are much better than I am.
That's the other, I highly recommend that approach.
But one of the things that I was going to comment on is that I like,
one of the things that Ghidra I think really does well,
that a lot of, both Ida and Binja have actually changed as a result,
is their side-by-side view.
Having the synchronized side-by-side decouplation with this assembly,
I think was a really important improvement in the standard workflow.
And so now you'll see Ida and Binja both have much better split-pane,
synchronization, those kind of workflows.
Very much inspired, I mean, I assume Ilfac also was inspired and was like,
oh yeah, I like the way that Ghidra does that too.
But certainly from Binja's perspective, we definitely did that as well.
So I do think it's good seeing difference.
Oh, here we go, we've got...
Is that the same? That's just the same screen.
But we are...
So they're looking at libc...
trying to download the appropriate libc version, right?
So they're using this web page where you can put in offsets
for different functions to like...
To match up with...
Yeah, like fingerprint the libc version and then download it.
But sometimes I think you need like two offsets
and then it will match to which version of libc is running.
So again, when we're building these challenges,
if we don't think they need libc, we're not providing it.
Now, that's not true in all competitions though.
So they may not trust us yet.
I think this is like...
It is a convention among, I would say, experienced organizers within this.
Right, because why make that an extra tedious step
that is just mechanical and you just go to the...
We all know about the website. We all know how you would do that.
However, if you come up with a solution that's different than the intended one,
you might have a solution which does require libc
and then you might go this route anyway.
Yeah, so it's not necessarily bad.
It is just...
It should be a hint that maybe you're not taking the intended route.
Right. Doesn't mean that you're wrong,
but you might be venturing into unknown territory.
All right, so let's be thinking about our next hint,
because like I said, I'm a little concerned.
We might need to do a different one.
I don't know, triple-tap control and get the spoken dictation pop-up.
I'm going to go...
Oh, nope, there's somebody else in the background excited about something.
Yeah.
I thought for a second we had a surprise win off-screen.
I'm going to go ahead and check in with...
Organizers is...
Organizers is unfortunately not being captured.
So we're kind of in the dark there.
So I'm going to see if I can get a little bit more of an insight.
Hopefully we're making good progress there and I can come back with a little bit of an update.
Yep.
And then maybe then go ahead with some hints based on current status.
So, yeah.
Again, they're looking at figuring out libc versions or downloading an Ubuntu image.
I'm not entirely sure what's going on there.
But, yeah.
We'll see if we can manage to see in what direction they're going with this.
But, yeah.
It would be very interesting to see if they have figured out where this check function is going on.
Unfortunately, I don't have the reference solution.
So I'm not super familiar with exactly where it's doing something incorrect.
But, yeah.
It's also going to be interesting to hear what the organizers are up to if they have good progress.
So we're also kind of a little bit in the dark on that.
But, hopefully, I think we are going to give them a hint.
I see Jordan and Ben are discussing a little bit.
But what's the exact hint that we want to give them here to point them in the right direction?
You can see here in the lower corner, from time to time, we have the organizers' screen flickering in and out.
Unfortunately, that's the tech situation right now.
In the meantime, I can give you a little bit of an update on the combined scoreboard for the DEFCON CTF.
We have still a fairly tight race.
We have a span of about 18,000 points for the leaders, Katsubin, down to 14,000 points for the team in 16th place.
Everyone is definitely still in the game, with top three being Katsubin, MMM and Perfect Roots.
And they are all within less than some percent or so of each other.
Or maybe like 10% of each other.
Definitely a good competition there.
So, Jordan is coming back here. So what's the status? What's the organizers doing?
We're going to need some hints. They're both still looking. I don't see any kind of progress.
So, we're going to drop a hint.
There's a couple of hints we considered.
One is, have you considered fuzzing?
Because literally just sending in a bunch of bytes will actually overwrite your game state.
So that's the key thing they need to figure out.
If they send in just too big of a solution, it will actually corrupt the state.
And they'll get weird boards.
And then it's a matter of, okay, how do I now create a board that would be solvable?
So, one that we considered.
The other one was, don't let yourself be boxed in to your solution.
It's a Sudoku puzzle. That's a little probably more obscure.
So, I think we're going to go with just, how big is your solution again?
Or how many bytes is your solution?
As our next hint.
And I think we're going to give them that, because there's still some work to be done.
And we want to give them both a shot at getting it.
Otherwise, we're going to go to our sudden death.
So, that's the hint we're going to go with.
In the meantime, we had a comment here from KigEff.
These seem interesting C challenges. I think I would try them all, but I'm sure I would take a lot longer.
I would too, so that's okay.
But it is a good idea, in general for CTFs, to try out challenges after they've been solved.
Normally, for a lot of CTFs, people publish write-ups.
So, you can try the challenges that you didn't manage to solve.
And then use a write-up or so as a reference and guide your attempt as well to learn more.
I think the idea is that we are releasing all the challenges.
It might take a few days for us to recover from this weekend.
We have 15 matches, so another 11 matches to go after this one.
But yeah, we will definitely publish them.
You can even organize your own mini-tournament in your own CTF team or hacker space.
I know that I heard from before the competition that Shellfish actually did some practice for this tournament.
By doing a small mini-competition of their own within the team, which I think is really cool.
And it paid off. At least it appears it paid off.
As one of the winning teams.
Yeah, we'll see how far they can go.
So, we have the hints prepared. Jordan is going to go and hand that off to the players.
We are... what's the clock at?
We are 5.45, so we are 35 minutes into the game.
Which means that we are running up against the sudden death clock here.
Let's see if they can manage to figure out this.
On the other hand, this is also kind of a similar situation to the previous challenge.
Where we were 35 minutes into the game and then it kind of just clicked for one of the players.
And they managed to go all the way.
It's going to be really exciting to see what's going on.
Still a bit difficult to get a read on Balson's progress or their understanding.
They're kind of looking at the code, probably thinking very hard about it.
You can see the mouse moving around, trying to build this mental model of what's going on.
You're kind of running the code in your head.
What if this has this value? How does that propagate?
It's probably the least interesting part of a live CTF, right?
That's the only downside when you have a more reverse engineering heavy challenge.
Is that you're just seeing people maybe name stuff if you're lucky or add comments.
But most of the time it's just looking at it.
You know you're getting closer when you start seeing a crash in a debugger and a payload being written.
And we don't have it yet.
I'm going to go ahead and keep an eye on the organizers just briefly.
And see if we get any kind of that similar progress.
Right, so we have...
Oh, okay. We did have a comment somebody else pointed out. Thank you for clarifying.
The reason that somebody was looking for the libc was to actually run it.
Because if you don't have the same VM handy, you can't run that libc.
So you can just grab the libc from another version of Linux to be able to run the binary.
So that is another completely valid reason that you might do that.
Yes.
Probably just easier to maybe look at a previous stream.
I don't think we told people what platform all of our challenges were created on.
That's actually a good note for future things.
Because again, normal in a CTF happens all the time.
You have to figure out the OS that it was created for, match version information and whatnot.
Not our intention to make that part of the challenge here.
No. And it's a thing. Ubuntu 22 somewhat recently went in LTS release.
And a lot of people haven't updated to that yet.
I will accept shared responsibility on this.
Because, you know, update your computers, people.
20.04, 22.04 would probably be Ubuntu's most common.
Or Debian. Certainly it's frequently.
But all right. I'm going to go take a look at the organizers. I'll be back and we'll see how it's going.
Awesome.
So I was talking about something when it comes to these challenges.
Trying to get back on my train of thought there.
With...
Oh, yes.
So, you know, with this looking at another player, looking at code, trying to figure things out.
A lot of times when I talk to people who are not experienced CTF players or don't know what CTFs are.
You often get the question.
Oh, is this some kind of esports thing?
Or could you make this into some kind of esports thing?
To an extent, this is kind of what we're trying to do here.
But, of course, it has its shortcomings that like some aspects of CTF is kind of like watching someone else take a maths exam.
It's, you know, occasionally not the most exciting.
So we're really trying to by adding this commentary and trying to understand what the players are doing.
We're trying to make this an interesting and educational experience for all of you viewers there.
So I hope you do enjoy this and, you know, have some takeaways and definitely check out the challenges afterwards.
To also kind of get a feel for that's, you know, it might some of these might seem simple.
But when you're sitting here and actually trying to do it, you have to consider and take into account all these small little details.
If you're just off by one, like a small bit somewhere, like the whole thing doesn't work.
You need to do all this troubleshooting, debugging.
And I think I mentioned it earlier, but like when you're writing exploits, you are essentially...
It's like software development, but with your like hands tied behind your back.
You don't get like all the nice tools and helps and error messages that you get like during normal software development processes.
Where, you know, you have all of these modern tools to help you.
But here you're kind of like you're trying to bend something in a way that was not like intended to be used.
You're messing with like a state of memory and so on.
So it's you really have like everything stacked against you.
And that is like a big part of the challenge when doing these Pwnables, these memory corruption challenges.
Looking here at the code here, we can see that the Bowser player is writing some small helper function here to send a number.
Maybe they're gonna try to, you know, use this to try to send different number of numbers.
And, you know, see if they get any kind of reaction out of that.
Haven't really seen yet what...
So now they're gonna send like a thousand zeros. That's interesting.
So we comment here like, yeah, it's unsolvable.
Yeah, like the Sudoku itself is unsolvable.
And that's kind of like the twist of this whole thing that, you know, at face value just sold a Sudoku and win.
But then it's unsolvable.
So, yeah, that's kind of like the recap for people just recently tuning in.
And speaking of recap, just to tell you again a little bit about what we're doing here.
So we're here in Vegas on site at DEFCON.
So organizing this live CDF as part of the official DEFCON CDF.
So this is kind of like a sub-event where all the 16 participating teams participate in this like single elimination knockout tournament.
Where in each match the teams send one player to go head-to-head against the other team to be the first one to solve a relatively simple CDF challenge.
I mean, relatively is relative.
Yes, yes. I really want to stress relatively.
And I want to be clear. I wouldn't personally solve half of the ones that we're fielding in the allotted time.
I tried some of them and, you know, I could get them but maybe take a little bit longer.
So I have a lot of respect for these people.
They're all very, very good.
And they're dealing with the pressure of being on camera.
There's a crowd standing around them watching them.
It can be pretty nerve-wracking.
So I'm predicting...
Oh, that is quite the visual effect there.
Yeah, you know, the photosensitivity warnings here.
I think it's only on our monitor. I don't see it on the screen as well.
No, no, it's on the screen as well. Yes, we have some glitching.
I'm not sure what that's about. It feels like our whole infrastructure is slowly melting.
No, no, it's fine. Stay with us.
Wow, that is unusual.
Maybe we're getting hacked by the players through the HDMI cables.
They're playing the other game, the other CTF challenge.
I mean, we would be lying if we would say that we did not have a discussion about what shenanigans could the teams try to pull off.
And how we would measure against it or what we would do.
Doing that kind of threat analysis or threat modeling.
We have three more minutes.
This has been a very fast 45 minutes.
It's looking unlikely that either one...
I did see some debugger action.
I'm going to make one last pass.
If we see somebody very close and they're making progress, we might be able to give them just a little bit extra.
But basically, we're about ready to deploy.
Or if they actually want to extend it.
That's not a bad idea.
If they both say they want to extend it, we'll let them go because they're the last one.
So the rules are, if one of them says they want to go sudden death, then we go sudden death.
If both of them want to extend it, then it's fine.
Exactly right. We'll see what they say.
But ask them one on one.
To not give any pressure.
It would be cool to see a solution on this.
Since we have been keeping up with the schedule, we do have that kind of time.
But again, it's difficult to say what the players want.
This is also a game theory thing.
Do you want to go to sudden death or not?
It's a high risk environment.
When they're going super fast.
Also, you don't know the progress of the other player.
Do you think you have better progress than the other player in this challenge right now?
And if you don't, do you think you have a better chance of beating them in the sudden death one versus catching up with them in the current challenge?
It's definitely not an easy decision to make by the players.
So what's the verdict?
What do you think?
If you're in their shoes...
Oh no, I would say extend it.
Absolutely.
So we have a game here.
I'm happy with this because I don't want to change the rules in a way that they're unhappy with.
But they both want to solve it.
Nobody wants to give up on a challenge that you've been working hard.
You have a little bit of an idea.
I'm glad.
I really want to see them see this through.
We'll let them go.
It's the last one of the day.
So we're not running over anything else.
I'm actually kind of excited.
So a story related to that.
So I was playing in the qualifiers for the DEF CON CTF with our Scandinavian team, Norse Code.
And I was basically sitting all weekend with one challenge.
I mean, I took breaks and met some friends and stuff.
But there was a lot of hours.
This is the Paris Challenge.
This was the Paris Challenge.
It was the crypto-pwnable thing.
So I don't know if I spent...
I don't remember if it was like 10, 20 or 30 hours on this.
But regardless, I solved it like two minutes after the CTF ended.
And that... yeah.
On the one hand, it's crushing.
And on the other hand, though, you still solved it.
You still solved it.
And that's the thing.
When the time ran out, I could have just stopped.
Because it doesn't matter anymore.
We're not going to get any points.
But I was so close.
I did not want to stop there.
So the only saving grace, or what you want to call it, for that was that in the end,
solving that challenge or not would not have affected whether we qualified or not.
That would have been crushing.
That's a little demoralizing.
Luckily, even with those points, we would have been just below the qualifying limit.
So at least you had clarity there either way.
Yeah, I was comfortable with that.
And also that means that I could be part of this without having to betray the team.
So yeah.
So we are...
There's a question here about whether it was MCAT.
No, this was the crypto-pwnable challenge.
It was about a function closure thing.
C++.
We could go ask Perry.
She just was in the room.
She just left.
Right.
But yeah, I've heard a number of people that worked on that.
It was a great challenge.
I enjoyed it a lot.
But it was tough.
Okay.
So we don't have a hard time with it now.
Now it's basically we're just going to let it go until either we are convinced it's going to take way too long
or we'll see at this point.
But they both want to keep going.
I would love for one of them to get it.
It not only means we get to save one of our sudden deaths,
but I think it's just way more fulfilling for them and for the audience to see the hard one solved.
So we're looking forward to it.
It is interesting that we've got ROP gadget address.
It looks like a template, I think, that this existed.
Because hopefully they have an idea that that is...
Someone is writing something very deliberate here, right?
This is like to print out the board somehow.
But let's see.
They are trying to see.
I mean, this double loop there is to print out some states.
But that part above, you see something where they're like cutting off.
They're swapping.
All right.
Oh, is this just to generate a solution?
I mean, I would just search the internet for solve Sudoku board and copy and paste it.
But if that is what they're doing, that would be valid too.
All right. So the idea is that you want to kind of overflow and stuff to basically insert...
To modify the state into something that's either solvable or already solved.
And so they need to have that.
Okay. So we're seeing interesting. We're seeing calculations.
We're seeing length calculations.
Unfortunately, I was hoping we'd get some more video from the new organizers.
Oh, it came in briefly.
Yes. With some debugger output there, right?
Yeah. We'll leave it up for a second and just kind of show them both.
And we might be able to see a little bit.
Yep. See there? It's coming on.
Man, that's tantalizing. That's so mean.
Yeah.
This cable has been...
Yeah. We might have to do some shopping.
Oh, there is definitely a shopping run tonight.
So we should be able to have this solved and out of the way.
And that way we've got a long day, eight hours tomorrow of hopefully uninterrupted stream.
We'll see. We'll see if that turns out to be the case.
I mean, given that it's only been...
We swapped out the capture card, the USB-C cable.
The HDMI is the only thing we haven't swapped out.
But it's been that same side of the table consistently that's been having these problems.
Makes me think that, yeah, we've just got an HDMI cable that is suspicious.
So we'll see if we can get that going.
All right.
Actually, I'm going to go ahead and do another in-person look.
I'm going to go ahead and take a look at new organizers.
And we'll be back with an update shortly.
Because debugger is generally a good sign.
Yes.
Oh, wait.
Uh-oh.
I saw a bin bash string in the debugger there somehow.
But that doesn't really make sense, right?
Well, I mean, with the intended solution, that doesn't mean they're not going to do...
Oh, no. Yeah.
And there also is the...
So I'm trying to remember how the win function runs.
It may be from the win function on the stack as well, too.
I don't remember.
But no, they shouldn't be getting to that.
Yes.
Let's see.
I don't see the...
In the meantime, I wanted to just ask people who are watching whether you are, like...
Is anyone here in Vegas attending DEF CON?
Or are you watching from all over the world?
Like, who do we have here?
We saw someone from Kenya even chimed in earlier.
Oh, wow.
So we know we do have some worldwide watchers.
It will be interesting to go and see those analytics afterwards to see who's watching.
But, yeah, do we have any people?
By the way, if you are here at DEF CON, feel free to come by the CTF area.
We probably won't be able to talk a ton, but hopefully we'll get some breaks.
If you come during matches, you can watch the matches.
If you come between matches, you can have a chat with us, hopefully, if we're not panicking.
Yeah, someone's watching from the CTF floor.
Okay, nice.
And also from Europe, in the hotel room, giving your feet a break.
Yeah, that's a wise decision, I think.
I'm ready for my feet, my throat, like, several parts of me need a break.
Oh, yeah, yeah.
We've been talking here for, like, several hours now.
Okay, so this is interesting.
Those ASCII values are being converted to integers.
So we're looking at debugger dump of the game state, right?
Nice, nice.
So we do see the game state.
It's really obvious to see those numbers.
Cool.
Yeah, and you can see, look at that base thing there.
You have, like, generating a list of integers from 0 to 96, which is interesting.
Yeah, we have watchers from Estonia, Brazil, people who are saying they want to go visit DEF CON in the future.
Yeah, I think DEF CON is, like, it's a cool event to visit.
I think they're trying to increase the amount of streaming and online presence as well, too.
So you probably will be able to find other streams.
I think there's even some webcam, like, 360-degree webcam, virtual cameras they're putting up in a couple of the rooms where you can watch what's going on.
So they're trying to improve, like, the accessibility.
I mean, certainly with COVID in general, most conferences have tried to adapt better for...
Oh, okay, we have somebody watching right next to our camera. Let's hope they don't bump it.
But anyway, again, checking the code here they're writing.
I'm trying to get a better feel for what they're doing.
Again, they're generating, like, a list of numbers.
Oh, okay.
Also, they need to find, like, the right offset for their overflow.
This actually looks really good.
Yes.
This actually does, like, really good.
I'm glad we let them go.
Because, like, once they finish this...
Yeah, yeah, if they get the right offsets.
Let me go look at the other one, but we might be closing in.
Yes.
So that's really cool.
Like, once they get that thing, it's going to be real quick.
Like, we are probably going to miss...
There's a big risk we're going to miss, like, the moment.
So, basically, if I'm reading this correctly, what they're trying to do is, like, find the offset in memory.
They're overflowing something, and then, like, how far into this do they want to put whatever they are placing there, which should be the solved or solvable state.
So, yeah, they might definitely be onto something.
They're switching the numbers around a little bit.
Maybe it's that they...
So they switched the zeros to a one, which seemed to have crashed the program.
And then checking why this is happening.
Yeah, we have someone from Morocco as well. Cool.
It's cool to see we have people all over.
I guess I'm trying to, like, work out, like, what time it is across the world at the moment.
But, wait, that's the people watching from Europe. It's, like, in the middle of the night there.
So, that's dedication.
I hope you're enjoying it.
I'm trying to see here. They're just quickly looking at the disassembly again.
Trying to... maybe looking for some specific offset or so.
Yes, they did get some specific offset to put a breakpoint there, right?
And then they're also looking at the base.
Oh, yeah, to make the breakpoint. Or maybe not the breakpoint.
The offset, where to inspect the memory.
Oh, yeah.
Oh, yeah, people saying they're watching from, like, yeah, definitely middle of the night.
You know...
Awesome. Netherlands represented as well.
So, I'm seeing some interesting stuff there, but what did you see from the organizers?
Yeah, so, I mean, I hate to take bets, because I've lost a lot of money at this table so far.
If this was a gambling arrangement, I would not be doing so well.
But, I also feel like I tend to favor my side of the table.
And then we've had all these surprise victories from the other ones pop up several times.
But, all that said, I do think Team Taiwan has a little bit of a lead.
So, looking at the new organizers, we've got a script.
It's a mixture of GDB, some PwnTools, and then as well as sending inputs and kind of breaking in.
I didn't get the sense that they had an overall plan for what to do.
Right. But again, definitely the one thing I've learned is that I don't know what I'm doing anyways.
It is really hard to understand exactly what's going on in their heads, and so you're not always right.
Whereas, I will say, it certainly looks like with that offset, right?
We're seeing a valid, solved Sudoku, trying to find the right offset to line it up.
Which sounds like, from what I understand of it, is the intended solution.
So, we'll see.
Yep.
Can we get some confirmation?
If it's just misaligning the correct board, the certain number of bytes, will that trigger it, essentially?
Any correct board at the right offset.
So, just put the right amount of padding bytes in, and then it will override it the right...
Say again?
Yep.
Then you mark it as solved? Yeah.
Oh, just send anything, and it will just mark it as solved?
Right.
Okay.
So, what our producer there said was that, first you send a solvable state,
you override the thing, the state, with the solvable one,
and then you just send something to trigger the recheck, and have it be solved,
and you get the win there.
We can see here, they are working out in a text editor...
Yeah, it still looks like they're trying to solve the state as it exists, not overwrite the state with their solve.
I wonder, I'm a little afraid, they got the overwrite, but if their exploit didn't try to send another round for validation,
it overwrote it, but then never...
Oh, wow, that would be terrible.
So, it is possible that they potentially had the right solution,
just didn't re-trigger it to be able to actually get to the win function.
So, we will see.
We're only a little bit late.
Actually, technically, we have two more minutes before the original length of this,
and we're letting them run long just because of the last one of the day,
and we prefer they have a chance to if they can, but our voices will give out,
and there will be some point which we say, sorry, we're cutting you off.
But none of us want that to happen, so we'll see.
Yeah, we're taking a bet here and hoping this will work.
We're also about to lose power on our chat.
Yes.
Tunisia, excellent, welcome.
Yeah, I've been to Tunisia for a CTF competition.
Have you really? I think I got invited to speak there one time at a conference.
Yeah.
There we go.
Let's see if that actually powers it.
I don't know what this is plugged into at this point.
Yeah, we have power on one of our screens here.
All right, good.
We also have a graphical glitch on the Balsam screen.
But it's just blocking the ads, so I'm okay with it.
That sounds great.
I wish all of my graphics glitches just blocked out ads as I surfed on the web.
Oh, yeah.
So as an employee of a big ad tech company, I would have to...
A large tech company whose revenue might depend heavily on ad?
Yeah.
Yeah.
Yeah, are you allowed to run ad blockers?
Nah, I'm not going to make you talk at work.
I'm not going to make you talk at work.
All right, all right.
I'm not going to do that.
All right, so here we go.
So this still feels like we're trying to solve it.
I don't see the exploit.
I don't see them actually exploiting it.
Well, I mean, this might still work if their idea is to just overwrite a couple of values,
and then make it solvable, and then put it in the solution.
It's not a fast solution.
They're going to inherently have to overwrite the whole thing, though, right?
Because they're just linearly overwriting it.
Well, I mean, it might be that they think that they can only overwrite the beginning of it,
or something like this.
You're still going to have a null at the end.
No, no, no, not necessarily, because it's going to convert in red.
Yeah, no, that's fair.
I mean, it could work.
It's not the intended play, but it could probably work.
So, yeah.
Unless there's a question mark at the very end of the puzzle.
If there's an unallocated one at the very end, that would have to be...
Well, we'll see.
Yeah.
We'll see.
All right.
A few more bits.
Thanks, everybody, for hanging with us.
This has been just utterly exhausting and super exciting.
Just as a quick recap from our earlier games, we had a nail-biter of a finish at the very beginning from Shellfish versus PTB WTL.
Oh, yeah.
They were, I think, within a few keystrokes of each other.
You can't get a tighter match.
I know.
We were looking at one screen as they were...
About to declare a winner.
Yeah, and then the other one...
When all of a sudden, it popped.
It just was so quick.
Yeah.
So that was fantastic.
Make sure you go back and check the replay on that one.
We're going to end the stream today when we're done with this particular challenge.
Oops, sorry about that.
I hit the microphone.
We're going to end the stream today once we're done with this challenge and we wrap it up.
But we'll be back tomorrow.
A long day tomorrow.
So the stream is going to run for eight hours straight.
Actually, I guess nine at least because we've got eight...
No, no, that's right.
Eight total hours.
Each one is a one-hour thing.
Yeah.
We'll see.
We may end up needing a break.
We're going to try to get breaks by trading off.
You're going to see some guest commentators.
We're going to have some other people come in and fill out different roles.
Should we...
I think it was already written on Twitter.
But the idea is to have...
We have LiveOverflow, hopefully joining in.
And Gamoso, Brandon Falk.
Yeah.
So two popular people in the security content creation space.
Yeah.
I'm excited, looking forward to chatting with both of them.
And I'm also looking forward to have a break.
And as we each get to maybe alternate every other round.
So one of us will get to take a rest.
And also make sure we give our producer, Glenn, a break as well.
So we'll be cycling through that.
We've got a variety of different challenges.
Maybe for any of the teams that happen to be listening,
we want to talk about the overall types of challenges that we have.
No super-spoilers, but I will say I think we're pretty representative.
Right.
We've seen heavy-pwned focus, a little bit of RE.
Yes.
There's certainly a little bit like shell-coding or constrained exploitation.
Just having a quick look here again.
Yeah, trying to get caught back up.
Oh, man.
So they have a solution there, right?
They have a solved solution, but...
Yeah.
There's a hashtag, FreeJordanGlenn and Kalle in the chat.
Yes.
So, yeah, just to clarify, that's my nickname.
HackHarder. Thank you.
Yes.
I mean, thank you, Negasoro, this random person who showed up in our chat.
Certainly not the author of this particular challenge
that has stymied our opponents for so long.
Right.
Yeah, but you're not wrong.
If they just would hack harder, we could take a break and we could...
Yeah, we could get some dinner.
So let us consider this.
I would say we are going to have to hit sudden death pretty soon
because we're looking at another several minutes of sudden death as well.
So...
We'll take a look.
Maybe I'll take one more pass at new organizers.
We'll talk about having a, you know, securing up a sudden death.
We'll kind of consider what we want to go.
Yeah.
I'll go ahead and give a bit of a...
Oh, just use a data glove.
What is a data glove?
That's a reference I don't get.
Isn't that the game controller thing?
No, that's a power glove.
That's a power glove.
Yeah, yeah.
The child of the 80s, of course.
Yeah, yeah.
No, no.
That's a thing from before I was born.
Sam, no trolling.
No trolling.
Please stay.
No, stay.
No, no.
We will find you.
You're in the room.
We remember this.
We don't talk like that.
That's...
Yeah.
Next you're going to be asking for network forensics or something.
Something crazy.
Yeah.
We might call the goons.
Yeah.
Have them take you out of the room.
Yeah.
All right.
I'll go check out new organizers and we'll be back.
Definitely.
I'll give an update on the DEF CON CTF scoreboard in the meantime.
So, we have like a slightly larger spread now with like spanning from just below 14,000
up to just above 18,000 points between the 16th and the 1st place with Katsubin in 1st
place, MMM in 2nd place and Perfect Root in 3rd place.
And if I'm not misremembering, I think last year we did have like a top fight between
Katsubin and PPP as well.
They have kind of pulled ahead, those two teams, and created like a slight gap down
to 3rd place.
So, I do think this like mirrors some of what we saw last year with regards to like the
standings.
But, this is only the first day of the DEF CON CTF.
A lot of stuff can happen.
This is like far from over.
So, we're going to be keeping an eye on that throughout the weekend and give you updates.
If you're here in the CTF room, you can see this really funny visualization the Nautilus
Institute have put up.
It's like some 3D animation of like a bunch of weird machines, one for each team, like
spitting random objects at the other teams, like showing...
I guess it's showing like who is attacking whom.
Possibly, there's like seashells and stuff flying around.
I guess there's some joke there about like shells and seashells and you know that.
But, again, taking a look at the screen of Balsun here.
I'm still not entirely sure.
They have this like partial solution or like a solution.
They have split up the solution into two parts and then trying to send some...
Like they're sending some data and then they're sending the other solution.
Still not exactly sure what's going on.
So, we have an explanation.
Data handler, crazy keyboards.
Yeah, I will have to look that up afterwards.
But, yeah, I'm still thinking power gloves would, you know, really help out in this situation.
Maybe you could have them like, you know, different like rock gadgets and stuff mapped
to the different buttons and stuff.
That's, you know, the way to go.
Anyway, you can see them like in the debugger here inspecting the memory there a little bit.
So, I'm looking at the global variables.
You can see you have the standard in and standard out object.
And then further down they have these objects.
And you can see the byte values there in the like the middle of the printed out block
with the different digits of the Sudoku solution.
Yeah, it feels like they are very close to getting it,
but still like a bit unsure exactly what's going on.
So, yeah, we have Jordan coming back here now.
So, we'll get an update on where we are.
We are going to give them a sudden death hint.
We're going to give them a hint that is just because here's the thing that we have missed
talking about it so far.
I was looking back over with the example solution.
And the nuance here is that there's a length check that has been kind of showing up a little bit.
Now, length check basically prevents you from even if you overwrite it with a fully solved board
from actually solving it on that throw.
So, you overwrite the state of the board all but the last one.
Right.
And the last one you leave empty.
And then you can just solve it by overwriting the correct last answer.
I see.
So, it's a little bit along the lines of what we've been talking about,
but it seems that they've done a weaker variant of that where they didn't have as good of a solution.
There's a question here about is there anywhere that explains the CTF format?
There's an AD going on as well as these one-in-ones.
Yes.
The main CTF, the DEFCON CTF, is the traditional DEFCON attack-defense that we all know and love.
Although, there have been variants and twists to it over the years.
Then, within this competition, this live CTF is like a sub-event
where it's running parallel to the attack-defense aspect of this.
Each team sends one player for each match and then we play this knockout tournament.
At the end, this will generate a ranking from the knockout tournament,
which is then fed back in and will affect the scores of the main CTF event.
So, this will be valuable and might definitely affect the final standings of the DEFCON CTF.
I'm not completely aware of what the weighting factor is, how the scoring model works for the CTF.
So, I couldn't tell you exactly how valuable it is to win the tournament versus getting second place.
But, we've been trying to find a balance where the teams can definitely...
I'll tell you in a second. But, first I'm going to deliver the hints and I'll be right back.
And we'll see if we can bring this one home.
Right. Can you just read me the hints here first?
Here we go. First attempt, overwrite almost all. Second attempt solves due to length check.
Yes. Sounds great.
And we will see if this does it.
This is almost like a straight-up solution. This could almost be like a write-up for the...
You have to understand what the program does. And that's the state that they've got.
Yeah, but they have that.
So, now we're going to give them the final, hopefully final hint here.
They will just hopefully blow this case wide open and have them solve it from there.
Did we get any reaction from the players on that?
I was too busy coming back. I should have watched.
Okay, okay. I see.
Yeah, we got some forehead touching.
Okay.
Says our producer.
Yes.
So, we'll see. Will it...
I think this was... This one, I think, is on us.
Yeah.
I think this was a little too subtle for what we're kind of aiming for.
And again, being in a high-pressure thing, this is not to say that these are not excellent exploiters.
It is just very hard. And this was a little bit of nuance, a little subtle nuance.
Oh, yeah.
Because of the way that the length check happens in the binary, you can't actually fully overwrite and expect it to do it.
It will already know that it's an invalid attempt, and so it's not solvable.
But then you have overwritten the correct state such that you can then solve it because you moved it from an insolvable state to a solvable state.
Right.
Somebody else might have got it. You don't know.
But it's definitely... This is definitely a little harder.
Certainly, it's more subtle than some of our previous challenges.
Yes.
But we'll see. We'll do our best to keep dialing in the difficulty and see how it goes.
So, let's keep an eye out for the winner.
We may see, because we're not looking at the new organizers, we might get that off screen, or we might see Team Taiwan pull it off here in the main window.
So, I keep rooting for whoever we have the capture card working on, just by the very nature of being on my side of the table.
Yeah, yeah, yeah.
But...
But, you know, like, being a Swiss, not citizen, but Swiss resident, I'm, you know, kind of like maybe rooting for organizers a little bit.
Oh?
So, yeah.
Are they a Swiss team?
So, they are a Swiss-British-American team, I think.
Okay.
Oh!
There we go!
All right.
So, there...
We have the winner.
Congratulations.
Congratulations. Awesome, awesome.
Oh, my God.
Down to the end.
It happened again. It happened again.
So, I'm going to go...
Go congratulate them. Go talk to the team. I'm going to go ahead and see you all out.
Just a quick summary. I think we've already kind of covered what's happening the rest of the day.
We're going to go recuperate.
We're going to fix our HDMI cables, so we'll come back with...
Tomorrow, we'll hopefully have the ability to see both screens more effectively instead of having the flickering that we had this time.
And we look forward to seeing eight challenges.
We're going to have eight more rounds.
We're going to finish up in the morning.
Four more rounds of round one.
And then, in the afternoon, we're going to move straight into round two.
And we're going to go all the way from eight teams all the way down to four by the end of tomorrow.
So, come back and see that long day.
Look forward to seeing you then.
Take care and have a good one.
Bye.
Bye.
Bye.