start	end	text
314630	317650	Hello, everyone, and welcome to live CTF.
317710	319630	This is our audio check for our live stream.
319630	321210	Hopefully, you guys can hear us.
321330	322850	Let us know in the chat if you can.
322970	324410	I'm cyphertex, or Jordan.
324410	326350	I'm going to be one of the commentators this weekend.
326350	327510	And with me is Carl.
327510	329530	Hi, I'm Carl, or Zita2.
329550	331510	We'll be commentating here with Jordan.
331690	333490	And, yeah, glad to be here.
333730	335630	Okay, I hope this is...
335630	337330	Yeah, we put a lot of work in.
337450	340970	This has been a lot of stress, but we're starting.
340970	341870	I think everything's working.
341870	345450	We're looking forward to seeing the teams compete.
345710	347330	So before we kind of get into the meat of it,
347330	349570	let's talk a little bit about the history,
349570	351750	what this event is, what we're doing,
351750	353350	what we're hoping to see from the teams.
353610	355430	So, you know, live CTF as a concept
355970	357970	has existed for quite some time.
357970	359470	Hey, triple six, we see you in there in the chat.
359470	361350	Yeah, definitely let us know if you're doing this.
361510	362470	We have to bring the camera in
362470	364030	if we get too many jokesters behind us.
365210	367970	It is DEF CON, so we're going to get that.
369290	372730	Live CTF has been around as a name.
373030	375030	GeoHot started several years ago.
375230	377530	It was streaming on Twitch and did a couple of these
377530	379830	kind of like live, it was playing capture and flag challenges
379830	381950	and wanted other people to see him doing it
381950	385070	and kind of interact, sort of early live streaming stuff.
385070	386070	There was a couple of different,
386070	388030	I guess, experiments or attempts.
388210	390070	I did one a couple years ago at DEF CON finals
390070	391930	where I messed up the audio and it wasn't live
391930	394390	and recorded it and it was a bit of a bummer.
394390	397790	So we've had a couple examples of that.
397790	399350	And then you also were running Pony Racing, right?
399350	400090	Yeah, exactly.
400090	403530	So a couple of years ago, we did for a year,
403530	408170	we run a monthly like live CTF show on YouTube
408170	411610	where we had four contestants trying to solve
411610	413490	the same challenge head to head
413490	415510	and like doing commentary on top of that.
415690	418310	It was pretty popular, actually.
418530	420370	A lot of people like, it's a lot of work though.
420370	422370	I think people don't, they underestimate
423050	424590	how hard it is to kind of get it.
424590	427150	So let's talk a little about like the kind of what it is.
427150	428450	So when we talk about live CTF,
428450	430290	right, obviously Capture the Flag,
430290	432910	we're talking about a hacking challenges.
433350	434930	There's a variety of different, you know,
434930	437830	CTF out there with different scoreboard and structure.
438130	439430	And so when we say live CTF,
439430	441750	we're specifically saying a small group of people
441750	443950	going head to head on the exact same challenge.
444030	445610	And in particular, we're watching them.
445610	446610	We want to see what they're doing.
446610	448710	That's what makes live CTF really interesting.
448950	451850	And this is exciting because we're bringing live CTF
451850	453750	to DEF CON CTF finals.
453750	457450	So certainly one of the premier Capture the Flag contests
457450	458570	is DEF CON CTF.
458570	460830	It's one of the, I think it is the oldest,
460830	464370	certainly continually running Capture the Flag event.
464390	465530	This is DEF CON 30.
465530	467770	I think, I mean, they've had DEF CON CTF.
468090	470890	I came in DEF CON nine, 21 years ago,
470890	473110	and there was, the CTF was already an established thing.
473110	474910	Like it's been around for many years.
475290	477950	And the idea is that we are going to have
477950	481010	all the teams that are here, they're playing DEF CON CTF.
481010	482810	So to be clear, the CTF as a whole
482810	484310	is going on around us.
484310	487390	Nautilus Institute is running the DEF CON CTF.
487430	489290	We are like a little side piece,
489290	490430	and kind of inside of that, right?
490430	493170	And so this is a part of the whole event.
493170	494290	If the teams do well here,
494290	496530	it will add to their score for the final event.
497210	499990	So we're trying to add some, like a little bit of a twist,
500050	501610	a little bit of spice to the competition,
501610	504110	like bring that excitement,
504110	507390	and also to make this accessible to the viewers
507390	509710	and see a little bit of what's going on
509710	512490	in like the minds and computers of these participants.
512490	514010	If you've ever been to DEF CON before
514010	515790	and you've walked through the CTF room,
515790	516950	nobody wants you to look what they're doing
516950	519350	because competitors will cheat and spy on one another.
519610	521670	And it's, you know, so they're all kind of like closed in
521670	523830	and it's not really spectator friendly.
524010	524710	Last several years,
524710	526210	teams have worked on cool visualizations.
526210	527690	And so we've got one kind of going on over here.
527690	529890	There's a 3D visualization from Nautilus
529890	531270	that's tracking their scoreboard.
531650	534850	AR, if you're talking about the DEF CON CTF scoreboard,
534850	536490	unfortunately, no, I don't actually think
536490	537630	we've asked Nautilus.
537630	540530	There is no public scoreboard right now for the main event.
540530	544430	We can give you updates throughout the event right now.
544430	545590	So actually at the end of this broadcast,
545590	547170	before we turn over to our next one,
547170	548150	if we had a little bit of time,
548150	550350	we'll actually let you know what the latest scores are.
551550	553090	Otherwise, find a friend who's at DEF CON
553090	554470	and have them come in here and take a picture.
555050	557470	I don't know what the plan is on their scoreboard.
557570	559270	The live CTF portion,
559270	560750	you'll see when we go back to like
560750	562230	our kind of intermission screens,
562230	563450	you'll see the brackets.
563610	564810	So what live CTF is going to be,
564810	566030	actually, Carl, what do you tell them about like
566030	568070	the structure of like what that bracket is
568070	568670	and how that's going to work?
568670	569330	Yeah, exactly.
569330	571630	So we're playing this as a traditional
572450	574750	single elimination knockout tournament.
574750	575630	So there will be,
575630	578450	so we have 16 teams in the DEF CON CTF.
578450	582510	So we're starting with the round of 16 today.
582510	586270	We will have four matches and then we'll continue tomorrow.
586810	587870	So yeah, the teams,
587870	589770	there will be one player from each team
590290	592310	sitting at these tables behind us.
592310	593690	Right behind us.
593910	595190	With one computer.
595210	598150	They are not allowed to communicate with their teammates.
598150	603270	They will be wearing earmuffs to block out our commentary.
603670	607710	And they both get the same CTF challenge at the same time.
607710	609850	And the first one to solve it wins.
609850	610970	The other team is eliminated.
610970	612990	The winners advance to the next round.
613010	616170	And in the end, we will have a winner of this tournament.
616190	616490	And then...
616490	618830	And each round, like, gets them points, right?
618830	619570	Yeah, exactly.
619570	623110	So depending on how far they make it in this tournament,
623110	625070	this will then add to their scores
625070	628190	of the whole, like, DEFCON CTF.
628610	632010	DEFCON, I mean, the DEFCON CTF is an attack-defense CTF.
632010	635050	So you have, like, different aspects of the scoring.
635050	636290	You typically have, like, for attacking
636290	637270	and for defending and stuff.
637270	640070	So this will be, like, another dimension
640070	641950	to the scoring of this event.
641950	643230	Yeah, in fact, that actually informed
643230	646230	kind of how the points were worked as Nautilus.
646230	648890	And we were talking about kind of the design of the game.
648930	650870	The goal is we want this to be
651350	652650	something teams take seriously.
652650	653950	We want them to send their best person.
653950	654990	We want them to really want to win
654990	656750	and do well because it will benefit them in the game.
656750	659170	But also not disrupt the whole game
659170	662830	if one team does well here and another team does well.
662830	664910	And, you know, like, we don't want to throw it off too much.
664910	666790	Right? So kind of finding that balance is tricky.
667030	668330	I like what Nautilus has done.
668330	670010	I think it's going to get us that.
670190	671230	And the other thing to point out
671230	673510	is the teams, we're going to have a lot of work.
673510	675150	We have a lot of work cut out for us.
675150	676950	We're going to have 15 total matches
677490	679230	throughout the next three days,
679230	680630	today, tomorrow, and Sunday.
681250	683070	But the teams have a maximum
683070	684690	of four events that they're in, right?
684690	685970	Because there's only four rounds
685970	688470	to go from 16 to eight to four to two to one.
688910	692110	And so the teams are out at most four hours
692110	693990	for if they get first or second place.
693990	694350	Yeah.
694530	696810	And in fact, the teams that, like, don't get any points,
696810	698330	they're done and gone and they can go back
698330	700090	to focusing the other events.
700090	701830	So we hope to not, like, disrupt too much
701830	704410	of the normal flow of what teams are doing.
704410	706110	Yeah, and we hope with the teams,
706110	708050	like, we've talked a little bit to the teams
708050	710330	and we've heard, like, some people,
710330	713150	they find this, you know, a little bit nervous,
713150	714510	like, being live on camera.
714510	715630	It's stressful, it is.
715630	718310	So, but we still, like, hope to make this, like,
718310	720570	an enjoyable experience for both the participants
720570	723310	and for all of you viewers as well.
723310	724910	Yeah, one of the, again, we said earlier,
724910	728290	you know, DEF CON is not accessible to a large extent.
728290	730390	You have to already be in the CTF community.
730410	731990	You have to already be very active
732430	734890	to even compete at the qualification round
734890	735930	to make it here.
736010	738890	And so we're hoping by having challenges here
738890	740610	that are a little bit more accessible,
740610	742150	you'll be able to follow along.
742150	743230	You'll be able to see kind of what they're doing
743230	744650	on a smaller scale.
744790	746230	And so speaking of that,
746230	747870	let's talk a little about the challenges themselves
747870	749570	and how they differ maybe from the challenges
749570	751510	that are going to be happening for the rest of the CTF.
751510	751930	Right.
751930	755510	So, I mean, normally in a CTF, a challenge can,
755510	757710	I mean, you can have varying difficulty
757710	758890	of your challenges, right?
758890	761730	But especially in a top tier competition,
761730	762550	such as DEF CON,
762550	764990	you typically have pretty difficult challenges.
764990	770390	It can take many hours to exploit these systems.
770390	773090	But we are aiming to have matches here
773590	776570	of about like 30 to 45 minutes,
776570	778950	which means that that also kind of puts some constraints
778950	780810	on the difficulty of our challenges.
780810	782230	They cannot be too difficult.
782530	785070	So we have had to like try to find that balance
785070	786850	between, you know...
787390	788910	Not so trivial, it's like five minutes.
788910	790350	You run one thing and you're done.
790350	790550	Yeah.
790550	792570	But also it can't take too long.
792570	793770	So hopefully we got it right.
793770	795590	We'll find out as the weekend progresses.
795590	796790	Yeah. And if we don't,
796790	799910	like if the matches are like, if they go too long,
799910	804130	we have a sudden death round thing
804130	809670	where we have prepared some very simple challenges
809670	811610	that we will then switch out.
811610	813070	So we will stop the normal challenge.
813070	815190	They will get this sudden death challenge instead.
815370	817430	And then it's really about being quick.
817430	818290	Those are five minute challenges.
818290	818650	Yeah.
818650	821050	They're meant to be like very, very straightforward and easy.
821050	821410	Yeah.
821410	822550	Hopefully we don't have to use them.
822550	824610	But if we do, they're there and they're ready.
824690	827310	With the idea that whether it's those or the normal ones,
827310	828530	the fastest team wins.
828530	831450	First person to solve it ends that particular round
831450	834170	and we set up for the next round and start all over.
834170	836190	So in terms of the type of challenges,
836190	838210	now like the DEF CON qualification rounds,
838210	841030	you often have a mixture of web and forensics
841030	842450	and all these different other things.
842590	844610	Finals though tends to be focused more on pwning, right?
844610	844890	Yeah.
845030	849150	Pwning, reversing, like that low level stuff.
849150	849670	Yeah.
849730	851430	And so we've mirrored that as well.
851490	853110	So if the teams were a little nervous about like,
853110	854910	well, wait a minute, I don't do a lot of web app stack.
854910	855790	Don't worry.
856010	858210	We are keeping things in line in part
858210	860550	because we want this to be representative
860550	861870	of what the teams are doing now.
861870	863530	Like if a little baby challenge is very similar
863530	866670	to the style of challenge, if not the same difficulty,
866670	867810	that they're doing in the final event.
867810	869650	So you can get a sense of kind of what's going on
869650	871070	at home as we follow along.
871390	873890	And speaking of following along, if you are in chat,
873890	875530	we are watching it, we're keeping an eye on it.
875530	876730	We're happy to answer questions
876730	878550	as we progress throughout the day.
878790	883710	Thanks earlier for the question about the scoreboard.
883810	885030	So just a quick update.
885030	886910	I'm looking at the scoreboard right now.
886910	889910	Currently, there's only a couple hundred points
889910	891350	separating first from last.
891350	894090	So they all started around 1600 points.
894470	896790	It looks like this is going to be a zero-sum game.
896790	898330	And so actually, one of the later streams,
898330	900370	we might bring on one of the Nautilus folks
900810	903150	and talk more about it if we have time.
903510	905830	And so we'll learn more about how they're doing it.
905830	908110	But zero-sum game where teams lose points
908110	909570	and then they go to other teams that gain it.
909570	911950	So in other words, if I get exploited by another team,
911950	914170	I lose some points in the form of my SLA
914170	915870	because I didn't have a secure service
915870	919350	and they gain some points that they've sort of taken from me.
919410	923030	Yeah, on the topic of bringing in other people as well.
923030	925890	So we will be on commentary throughout the weekend.
926130	929990	But we're also hoping to bring in some other commentators,
929990	932510	some remote commentators as well.
933150	935950	So yeah, hopefully, there will be a little bit of a mix
935950	937250	here as well on the commentator table.
937250	938990	Assuming we can figure out the logistics and the streaming
938990	942050	and everything as the connectivity gods are working for us,
942050	943950	we are going to, yeah, we will bring in a couple of folks
943950	945070	that you will probably recognize
945070	946550	if you do any online.
946550	949250	We don't want to like promise yet until it works out.
949250	951790	But we have some folks that I think you'll be excited to hear from.
951790	954430	And we're looking forward to having joined the commentary.
954970	956490	And so keep an eye on that.
956490	958570	But that will probably be in tomorrow.
958570	961430	Yeah, we have a question in chat here about whether each round
961430	963370	will have the same challenge or each match will be unique.
963370	966570	So each match will have a unique challenge.
966570	969470	And this is because, of course, we are broadcasting this.
969470	972950	So all the teams can watch the other matches.
972950	976810	And in fact, that might be like a good idea to get like a feel
976810	978830	for the type of challenges we are going for.
979490	982790	So definitely we couldn't have the same challenges for each match
982790	984890	because then you could just copy the solution of the previous match.
984890	986970	Yeah, the only way to do that would have been to sort of sequester
986970	989590	and take all the people in any given round into a room,
989590	990930	not let them out and let them one at a time.
990930	992810	And that just was we were going to waste people's time.
992950	995590	So instead we wasted our time and we made a lot more challenges.
995590	997910	It would have been a lot easier if we only had to make four challenges.
998150	1000370	But by making 15 challenges,
1000370	1002390	yes, different teams will get different challenges.
1002390	1005770	We have actually told each team, though, the name of the challenge,
1005770	1009070	which is sometimes actually a pretty good hint as to what kind of challenge it is,
1009070	1012190	the category, whether it's reversing or a pwnable.
1012230	1013710	Today we have all pwnables.
1013710	1016630	And we have a mix of x86 and x64 binaries.
1016630	1018470	I think it was one x86 32-bit.
1018590	1021370	The rest are all 64-bit.
1021590	1023450	So that's the challenge we've got.
1023450	1026490	I love seeing the team hype keep up, you know, cheering on your favorite teams.
1026490	1028370	That's exactly what we want to see.
1029070	1031930	Speaking of favorite teams,
1032550	1037930	maybe we should just mention a little bit about how they ended up here as well.
1037930	1041350	Because as I said, we're here at the DEF CON Finals with the 16 teams.
1041350	1047290	They had to qualify early this year, I think it was back in May or April,
1047290	1050870	in really tough qualifiers.
1051130	1051850	Yeah, absolutely.
1052330	1054030	So, yeah, the top 16...
1054030	1059950	Well, actually, you have the winner of last year are pre-qualified for the DEF CON.
1059950	1063450	So in this case, it really was just the top 16, because it happened to be...
1063450	1065310	Yes, because that team was also playing the qualifiers.
1065370	1068850	I think officially the previous team didn't this year, as it was a clean break.
1068850	1070610	When I talked to Nautilus, they said, actually, it turned...
1070610	1073890	Normally, the team who won the previous year automatically gets a buy.
1074050	1075950	They weren't sure about that. In the end, it didn't matter.
1075950	1076250	Oh, OK.
1076570	1078890	Because the previous team qualified anyways.
1079090	1081170	But they were kind of treating it as a sort of fresh break.
1081170	1083450	So actually, what you're going to see in our bracket,
1084010	1087390	which... Actually, we can pull up the bracket now, and we can take a look at it.
1087390	1089670	You'll see the way the seeding has worked,
1089670	1093050	is the team who scored first place in the qualification event
1093990	1097210	is battling against the 16th place team from the qualification event, right?
1097210	1100770	And so throughout these events, that's just kind of how we split things up.
1100770	1104630	We chose a random order for which match happens when.
1104870	1108250	And we're going to be putting, again, these kind of random challenges out.
1108330	1110370	So you'll see where your favorite teams are
1110370	1115430	and kind of who they're battling as they make it through the rounds here this weekend.
1115430	1116550	Again, we're going to do four.
1116550	1120250	So round one will take us down from the field of 16 to a field of eight.
1120410	1121970	And we're going to do half of that round today.
1121970	1123410	So we've got four rounds today.
1123570	1128910	Tomorrow morning, Pacific time at 10 a.m., we're going to do the next four rounds.
1129110	1130950	And at that point, we'll be into round two.
1130950	1133110	Sorry, matches. I've got to be careful.
1133110	1135210	So just to be clear, we have four rounds,
1135210	1137730	and each round will have the number of competitors.
1138270	1139810	And then we're going to have 15 matches.
1140370	1141770	We have the language. I'll probably get it wrong.
1141770	1144010	We'll correct each other if we do it.
1144470	1148210	But that's the plan for this whole event.
1148210	1150430	So scoreboard update, maybe?
1150430	1152930	Or we get everything else? What do we need?
1153810	1159610	Yeah, I think that's where we're at right now.
1159650	1162150	As I said, pretty tight.
1162150	1166870	I mean, the DEF CON CTF just kicked off a few hours ago.
1167170	1168650	Almost four hours ago, yeah.
1168650	1171750	So it's still early days.
1171750	1172330	Three hours ago, rather.
1172330	1176490	Yeah, the teams are within percentages of each other.
1177070	1179890	But if you want to root on your favorite team, we'll do the top three.
1179890	1184010	So we have Water Paddler in first with 16,282 points.
1184170	1188630	Maple Mallard Magistrates, or as I plan to call them, the Mighty Ducks,
1188630	1190170	because that name is really long.
1190170	1192290	We're going to have to come up with names for a lot of these teams.
1192410	1194270	And in third place is Straw Hat.
1194270	1202210	Tied with MMM and Straw Hat, there's a lot of history in all these teams.
1202210	1203310	We're going to talk more later.
1203310	1205110	We're going to talk about the split of them.
1205250	1208730	Many of these teams, actually, I think almost all of them are actually conglomerate teams.
1208730	1210010	There are several teams that have come together.
1210010	1213410	Again, speaks to the nature, this is like the hardest, biggest competition
1213410	1217790	that several kind of elite teams come together to form a team to compete here.
1217810	1219970	Multiple different collaboration teams here.
1219970	1222090	Just to give an example, you have Sour Cloud,
1222090	1225490	which is like a collection of all the German CTF teams,
1225490	1229750	which they already have, like, really good CTF teams.
1229750	1230670	Individual teams, absolutely.
1230710	1232390	But then they, you know, bond together.
1232390	1237550	This tells a little bit about just how fierce the competition is at this event.
1237630	1239830	Yeah, so we're going to look forward to those.
1239830	1241450	We've got nine minutes until our first round.
1241530	1243210	Let's go ahead and go back to our intermission.
1243210	1246330	We're going to bring up our next two teams, get them set.
1246470	1247730	Cross your fingers for the challenge.
1247730	1249770	I'm really looking forward to seeing what the teams do.
1249770	1251690	And we'll see you all in about nine minutes.
1488030	1489230	And we'll see you all in about nine minutes.
1489230	1490630	And we'll see you all in about nine minutes.
1828410	1831030	All right, we are back, I hope.
1831030	1832130	We'll find out.
1832710	1834610	We are going to count us in.
1834610	1839030	We have our first two teams, PTBWTL and Shellfish,
1839030	1841430	battling in our first round of live CTF.
1841450	1842470	We've got the screens up.
1842470	1843230	They're here behind us.
1843230	1849570	We're going to count them in, in five, four, three, two, one.
1850290	1851730	It's live.
1851910	1853190	They're refreshing the page.
1853190	1855090	Round of applause for live CTF.
1856970	1860830	Okay, so now we'll watch and we'll see.
1860830	1861690	And make sure this is working.
1861690	1863890	We're going to go ahead and bring up both their screens,
1863890	1865750	and you can get a little sense of the layout
1865750	1868810	that we're going to be using for the event,
1868810	1872270	where you can actually see what they're doing, all right?
1872570	1876070	So, I see, I love the full-screen terminals, right?
1876070	1877150	Right, first thing we see.
1877150	1877510	Yes.
1877590	1878490	They've got a binary.
1878490	1879950	We told them it's a pwnable binary.
1879950	1881950	What was the name of this particular challenge?
1882830	1884190	It's a SysCallMeMaybe, right?
1884570	1884950	SysCallMeMaybe.
1884950	1888090	So, we've got like a little meme reference, CallMeMaybe.
1888610	1890510	We've also got a competitor webcam,
1890510	1891990	which has just got the laptop,
1891990	1892990	so you can't really see a whole lot of that.
1892990	1895690	We'll probably not use that particular view.
1896010	1896310	Yeah.
1896350	1899570	But we can see we've got IDA up and going.
1899570	1900850	We've got terminals.
1900850	1902850	Okay, so let's take a deep breath.
1902850	1905390	We can already see pretty straightforward.
1905390	1907130	In fact, we've even got some symbols here, right,
1907130	1908230	on this particular binaries.
1908230	1908910	Yes.
1908910	1912470	And let's, we've got on the left, we've got...
1914570	1919410	We have Pwnabytes, the PTB, PTL here,
1919410	1921410	and we have Shellfish on this side.
1921410	1921770	On the right, okay.
1921770	1925510	They're both using IDA for their disassembly.
1925510	1927230	I was hoping for, I did see Binger running.
1927230	1928570	I noticed Binger was actually running.
1928570	1929010	Yeah.
1929010	1932270	I think they're prepared, knowing a Binger developer was one of the organizers,
1932270	1934950	like, in case there's something terrible that Binger does better at,
1934950	1935970	we should leave it up.
1935970	1936610	Yes.
1936650	1938210	You see, it's a pretty small program here.
1938210	1941790	You can see on the Shellfish there,
1941790	1947330	you could get a glance of the code where it's a program,
1947330	1953010	reading in some commands, sorry, some arguments to whatever syscall you want to make.
1953630	1955810	And yeah, you can do this how many times you want,
1955810	1957470	and then from there you want to get code execution.
1957470	1959910	So, the vulnerability is there.
1959910	1965810	This is actually more of a Shell coding exercise than a,
1965810	1967710	like, you don't have to find the vulnerability.
1967710	1971230	It literally will just run whatever syscall you want,
1971730	1973950	and it's up to you to provide a series of syscalls.
1973950	1977310	So, like, can't I just, like, execve and run bash?
1977310	1979530	Immediately? Like, you know, is that not a valid solution?
1979770	1983090	Yeah, I mean, almost, except that, you know, to call an exec,
1983090	1986070	you need a string of the program you're executing.
1986070	1988870	So, they first need to get that string into memory somehow,
1988870	1991870	but then it should be just smooth sailing from there.
1991870	1994830	Yeah, and it's kind of ironic that, like, we give them full syscalls,
1994830	1997530	but they don't have the ability to just run Shell code, right?
1997530	1999510	So, because they don't have actual Shell code,
1999510	2002870	little things like just put some bytes directly into a piece of memory
2002870	2005010	is maybe a little bit trickier,
2005010	2006550	and so they're not going to be able to do that.
2007410	2009730	Let's talk about what's their goal.
2009730	2011810	What are they trying to do here to show that they've won?
2011810	2015190	Right. So, the goal of this challenge, and most of the challenges, actually,
2015190	2018530	is to gain code execution on the remote system.
2018670	2022030	And once you have that, there is a small program sitting there
2022030	2024350	that you can run to...
2024350	2025470	Let's go ahead and pick up Shellfish there,
2025470	2027370	because I saw them running the challenge.
2027370	2029910	Right. So, they've created kind of like a template
2030450	2033110	in their exploitation script
2033110	2035770	where they're just, like, setting up the interaction
2035770	2038430	with the program, like, inputting the different parameters,
2038430	2039910	just making sure that that works.
2039990	2041610	And then once they have that in place,
2041610	2043970	they can kind of, like, make an abstraction on top of that
2043970	2045550	and just make all the syscalls that they want.
2045550	2046570	So, they're just going to use, like,
2046570	2047790	Epone tools or something like that
2047790	2049270	to be able to interact with the service,
2049270	2050250	but then they're going to wrap that
2050250	2052510	so that it's this syscall, this parameters,
2052510	2053710	and it will handle the text formatting
2053710	2055070	and the new lines and all that kind of stuff.
2055070	2056770	Right. Just let them build their primitives.
2056770	2059290	And this is very common when you do this type of exploitation.
2059290	2062990	You kind of, like, transform functions in the program
2062990	2066170	to, like, more abstracted operations.
2067210	2068650	And we had a question here in chat,
2068650	2070390	if they have internet and they can Google and stuff.
2070390	2071530	Yes, they do have access to internet.
2071530	2072690	Actually, we can see it just now.
2072690	2076110	So, PDB just pulled up a reference here.
2076490	2079350	So, I think we're looking, if we switched over in time,
2079350	2081250	you're going to see them looking up syscall tables,
2081250	2082730	which makes a lot of sense. That was actually what we did
2082730	2084130	when we were testing this as well, right?
2084130	2084690	Yes.
2085690	2088050	In fact, the first thing they're looking for is execv-e,
2088050	2090650	exactly as we said, oh, I want to just run execv-e,
2090650	2092090	I'm going to run binbash, and that's where you're going
2092090	2094310	to first run into this, well, wait a minute,
2094310	2095610	how do I actually get the string?
2095890	2098750	As we, like, had some of the Nautilus members,
2098750	2100550	and as we talked about this with some folks,
2100550	2102170	everyone's first reaction is,
2102170	2104910	oh, that's immediately trivial, and then you're like,
2104910	2106450	yeah, but where do you get your string from?
2106450	2108790	You've got to have a pointer to a string,
2108790	2110990	and so you've got to think a little bit about that.
2111050	2113890	It's not super hard, but you have to figure out
2113890	2115450	how to get something into memory first
2116010	2117550	that's going to be the string that you're going to call.
2117550	2121650	Yeah. We can see here for Shellfish some debugging going on.
2121650	2125030	There was some GDB with the Jeff extension.
2125050	2128710	I'm a big fan. It makes life a lot easier.
2129470	2131510	I'm trying to see exactly what's going on.
2131510	2133550	They're trying to put some breakpoints somewhere,
2133550	2135930	looking at the memory mapping. Yeah, okay.
2136190	2138090	So they needed the base address there
2138090	2139730	to put the breakpoint in the right place,
2139730	2142510	although there is a function in Jeff to automate that.
2142510	2144730	But, however, you know, they're getting there.
2144730	2145650	What's the function?
2145770	2148030	It's called, like, pybreak, so they will, like,
2148030	2148930	do relative to the...
2148930	2149990	Oh, that's kind of handy.
2149990	2152250	Yeah. Does the math for you with the offset.
2152250	2152990	Yes. That's cool.
2154130	2156750	There's a lot of different nice tricks
2156750	2159990	with that extension framework.
2160690	2162990	So I want to talk a little bit just about the teams, too, right?
2162990	2164390	Because we've got, again, we've got a lot of,
2164390	2166110	like, these conglomeration teams.
2166310	2169190	And so, briefly, and we'll try not to miss,
2169190	2170510	so, yeah, you keep an eye on the teams
2170510	2172370	to make sure I'm not missing somebody, like, you know,
2172370	2173350	getting close.
2173530	2175930	But we've got Team Shellfish that has been around.
2175930	2178350	It's one of the longest-running CTF teams,
2178350	2181010	originally out of UCSB, but they've got,
2181010	2183370	kind of, I think, connections now a lot of different places.
2184650	2188630	So Team Shellfish is currently one of our battling teams.
2188750	2192910	And PTBWTL has pwned the bytes and...
2192910	2194390	Wrecked the line. Wrecked the line.
2194630	2195930	I don't remember that one exactly.
2195930	2197590	Both Romanian teams, right?
2197590	2199150	I believe so. I believe so.
2199150	2201630	I think they have other members as well,
2201630	2204190	but I think they're, like, primarily Romanian-based, at least.
2204190	2206310	And I think we do see that, especially in the DEF CON,
2206310	2208430	where the teams are, like, these megagroups are coming.
2208530	2211330	Sometimes they're just colleges or friends or online communities.
2211330	2214230	And sometimes they are just local, regional, or, you know,
2214230	2216810	country CTF teams that normally compete against each other.
2216830	2219150	And then they come together to form, like, a megagroup.
2219150	2222510	And so you've got, like, this sort of country-based representation.
2222850	2225630	Yes. Which also says something about, like, kind of, like, the,
2225630	2229350	you know, CTF community aspect of the whole thing.
2229350	2232250	I think it's really nice to see these, like, different,
2232250	2233810	like, regional communities, like, gathered together.
2233810	2237210	You're both competing against and also participating with.
2237330	2239510	We're losing video on one of our capsules.
2239510	2241750	We're not sure. Is it losing on the stream as well, or are we...
2241750	2244410	OK. So I apologize for the flicker.
2244410	2246910	We've got some probably loose cable somewhere.
2246910	2249050	Yeah. This is the joys.
2249050	2252010	But technically, you know, it could be a lot worse.
2252010	2254110	Like, it is... it appears to be working.
2254110	2255710	And so that's our big stress here.
2255710	2262110	So I saw some... was it, like, S-trace output or something from the P2B screen there?
2263050	2263890	Not sure.
2263970	2265190	OK. So, OK. I like that.
2265190	2266990	So look at it. I love that we're seeing the highlights, right?
2266990	2269070	So, mmap. We started with execve.
2269090	2271250	Yes, that's going to be your ultimate goal,
2271250	2272910	is you're probably going to want to trigger execve.
2273170	2274950	But, like, you've got to get your memory first.
2274950	2278170	And so we're seeing, like, someone's looking...
2278170	2282110	we're going to look for mmap to try to get something into memory,
2282110	2283890	get a piece of memory that we control.
2284430	2286850	But they're going to have to still get something into that region, right?
2286850	2289070	They're still going to have to actually get bytes at that address.
2289690	2293590	I'm seeing some very interesting thing here on the Shellfish side.
2293590	2297590	They're grabbing the address of the vsyscall memory region,
2297590	2302110	which was not involved in any of the proposed solutions when we were testing this.
2302110	2302990	I love it.
2302990	2306930	So I really would like to see what they're going for there.
2307870	2310630	And to be clear, we expect that there will be lots...
2310630	2313470	that this one in particular has an infinite number of solutions, right?
2313470	2316390	There's going to be all sorts of ways that we didn't think about.
2316390	2318390	So we have one in mind that we expected.
2319210	2322250	One of the things that I think is the most fun as an organizer
2322250	2326490	is when somebody solves your challenge in a way that you completely did not expect.
2326490	2327330	Yeah, yeah.
2327690	2329450	As long as it's not like...
2329450	2332230	So in this particular case, we're okay if they solve it quickly,
2332230	2334650	because that's the point, is to be as fast as possible.
2334710	2337970	Sometimes if you build a really difficult, hard CTF challenge
2337970	2341950	and somebody finds a trivial thing that you forgot, that's a little soul-crushing.
2341950	2342370	Yeah, yeah, yeah.
2342370	2347170	But as long as it's a cool solution or anything, then you just love to see it.
2347170	2352230	Yeah, although sometimes I love how CTF organizers will re-release a challenge, right?
2352230	2355190	Patch the easy bug you didn't intend, give them points still,
2355190	2357490	but then make them solve it the harder way as well, too.
2357490	2362190	So I think that's a decent trend and one good way to just get both out of it.
2362190	2364670	To reward them for what they did, but also keep doing that.
2365630	2366810	So we have...
2366810	2368730	Uh-oh, so we've got something happening here.
2368810	2369970	So we've got an mmap syscall.
2369970	2374270	Okay, so we're looking at PTB, and we've got mmap.
2374430	2375850	So we've got our syscall wrapper.
2375850	2378230	We're going to call the syscall by name.
2379810	2382490	So, the mmap syscall, what are we doing with that?
2382490	2384710	We know execve is going to run something,
2384710	2386790	but what's mmap going to do that's going to help us?
2387070	2390950	Yes, so we need to put the string somewhere in memory.
2390970	2394130	We don't know anything about what memory is mapped and so on,
2394130	2396290	so we'll just map, we'll use the mmap thing.
2396290	2399170	Okay, and we do, we didn't mention this earlier, I don't think,
2399170	2402730	but the output of the syscall you ran is returned to the user.
2402730	2403750	Like the return value.
2404210	2407350	Yeah, so if there is a return from that syscall,
2407350	2408550	they're going to get that information back.
2408550	2412150	So any of these syscalls that that's useful, we're going to see that.
2412450	2414510	So we had a comment, sorry, question here about what happens
2414510	2416390	if they don't solve the challenge in one hour.
2416390	2419110	So even before that, I think it's like 45 minutes or so.
2419110	2420170	Sometime around 45 minutes.
2420170	2423630	Yes, if they don't, we will switch to a sudden death challenge,
2423630	2428890	which is a very simple challenge that they will try to solve instead.
2428890	2431450	So we will just like discard all the stuff they did so far,
2431450	2433650	and we will switch to like a super, super simple challenge.
2433650	2435990	And mainly the reason that we're going to do that is just because
2435990	2438990	we've got so many matches that we have to run,
2438990	2440790	that if they each start taking longer and longer,
2440790	2442830	and we're off schedule, we'll be keeping people overnight,
2442830	2445010	and it would just be kind of a logistical headache.
2445010	2447090	So we hope we don't have to.
2447130	2449570	If we don't have any bugs in our challenges,
2449570	2452370	and they're all the appropriate difficulty, and the teams all do well,
2452370	2454470	you'll never see them. We'll save them for next year.
2455450	2457890	But those are going to be like really, really simple ones
2457890	2460570	that we hope they can solve within less than five or ten minutes.
2460750	2463490	So that's kind of the backup plan. We'll find out if we need it.
2463490	2467230	I have to say, so far, right on pace, super happy with this.
2467230	2469970	This is, I think, about what I would have hoped and expected.
2470830	2473090	We're seeing they've already got their frameworks up.
2473090	2474750	They know exactly what they have to do.
2474770	2477650	They're just building the right building blocks to kind of see it.
2477790	2481470	And this is also, I think, something that's always kind of a challenge for me
2481470	2483230	when solving these kind of challenges.
2484070	2487890	How much do you want to take the time and build the proper abstractions
2487890	2489710	and make your nice functions?
2489850	2492930	And how much do you kind of just want to take that leap of faith
2492930	2498130	and just throw together some really crappy code that might solve the thing?
2498190	2501010	That might work, but if it doesn't, then you have to backtrack,
2501010	2502410	and it's a whole mess.
2502410	2504950	I feel like there's a lot of game theory to it, almost,
2504950	2509530	in terms of risk-reward, explore-exploit kind of analysis,
2509530	2514890	where you have to figure out, is it worth it?
2514890	2517750	And you don't really know. You do develop, I think, a bit of an intuition.
2518210	2520210	You can kind of look at it, and you sort of have a sense of,
2520210	2524290	okay, no, I just need to bang this out and just hard-code a bunch of bytes in,
2524290	2525190	and that'll be fine.
2525310	2528290	In this particular case, oh, here we go. This is interesting.
2528490	2530350	So now we've got a read syscall.
2530370	2533170	This is... oh, we also saw the syscall list on the other side with shellfish.
2533170	2537070	But ptb, I think we have all the syscalls we need.
2537310	2537930	I think...
2537930	2539930	Read, mmap, yeah, exactly.
2539930	2542810	I think this is it. These are the right ingredients.
2542850	2545070	They just got to assemble them correctly.
2545090	2546190	Yeah, make that cake.
2546190	2547350	Yeah, yeah.
2547350	2549790	And then we should be... we may be looking at a winner,
2549790	2555550	but we'll also keep an eye on shellfish and see what's happening there as well,
2555550	2557410	and make sure that...
2557410	2558370	Yeah.
2558370	2564490	So they're using the fxv function, which I... that variant, I'm not...
2564490	2567170	I don't know. I'd have to look at the main page myself, yeah.
2567170	2571410	I mean, because these functions, they come in a bunch of different flavors, right?
2571770	2572770	So that's interesting.
2572770	2576930	And again, there is... I think one of the things the teams are going to realize
2577450	2579130	is that we didn't go for tricks.
2579610	2582630	We didn't... we tried not to go for tricky, gimmicky things.
2582630	2584170	It's tried to be pretty straightforward.
2584170	2588110	We want them to be fast and quick, and sort of the obvious thing you would think of
2588110	2590230	is at least our intended solution oftentimes.
2590450	2591730	That's not always the case.
2591730	2593350	Lots of CTFs, right?
2593690	2597270	You've got to find the very tricky thing, and that makes it fun.
2597270	2598610	It actually is super entertaining.
2598610	2601270	Yeah. Something you can also learn stuff from,
2601270	2603550	like it sends you down this rabbit hole of research and stuff,
2603550	2605350	but you don't really have time for that.
2605350	2611750	Right. So like Punnable.kr or those websites have amazing, really cool things you can learn.
2611990	2614870	But here, we're not trying to trick them.
2615710	2617730	Yeah. No Gidra users yet.
2617730	2620970	I have seen a couple of the participants in the room using Gidra.
2621170	2623950	Maybe we should keep a tally for the tournament.
2624190	2625650	It might be too depressing for me.
2625650	2627550	That might hurt my Binja soul.
2627550	2629850	Might be too hurt by that.
2629850	2634550	Yeah. So for those not aware, Jordan, one of the founders of Vector35,
2634550	2637370	making Binary Ninja, which is not used in this match.
2637370	2638770	But we hopefully will see it.
2638770	2642670	I hope we see it. And if all I want is one Binja user to win one round,
2642670	2644570	then that'll make my heart happy.
2644570	2646430	Go straight into the marketing material.
2646430	2648050	I mean, yeah, exactly. Exactly.
2648110	2649890	I will say, you know, the funny thing is,
2649890	2653150	Binary Ninja was actually designed for CTFs originally.
2653150	2655110	It was meant to be very, very fast and quick.
2655110	2658630	And like common things like patching things out were meant to be quick.
2658630	2660310	So that's probably kind of some of the things it does well.
2660310	2664530	So it is actually well-suited towards a very, very fast-paced environment.
2664530	2666770	But more important than that is knowing what you're doing.
2666770	2668230	All right, so back to Shellfish. What are you seeing?
2668230	2677470	So Shellfish, they are writing a small C program here, calling mmap.
2677470	2679490	Yeah, I think they're testing out, they're maybe like...
2679490	2680370	I like that idea.
2680370	2684930	...not completely sure about the arguments or so for the mmap.
2684930	2686810	So they're writing a small little test program
2686810	2689350	to just verify that they have the correct understanding of the situation.
2689350	2690490	That's actually a really, really good idea.
2690490	2691170	Very good idea.
2691170	2692750	Yeah, because, you know, you don't want to like...
2692750	2695730	You have the added complication of a network service and the text protocol
2695730	2697670	and your throwing script and your wrapper.
2697830	2699370	No, no, just get rid of that abstraction.
2699630	2702790	Test the syscalls in a row directly, and then once you've got it working,
2702790	2704830	then you can sort of port it to your throwing framework.
2704830	2707150	I think that's a great idea, so I'm happy to see that.
2707930	2708890	But we are seeing...
2708890	2713250	So we're seeing just the straight-up approach over here on WTL.
2715330	2717350	Let's watch them as they've got it.
2719870	2720570	Yeah.
2720570	2721690	Looking through...
2721690	2722170	Yes.
2722170	2723830	Is it buffered?
2723830	2725170	Is input buffered or not?
2725170	2726410	They're checking that.
2726670	2728610	Maybe they're looking for another piece of memory.
2728730	2731210	They're looking over here in the data segment,
2731210	2733530	so I wonder if they're looking for a place to reuse.
2733530	2735130	But this is ASLR, right?
2735130	2740590	I don't think we gave them information about where the binary is executing here,
2740590	2743290	because it is kind of up to them to sort of like make their own memory
2743290	2744390	with the syscalls that they've got.
2744390	2750250	Yeah, we can see here, going over to Shellfish again,
2752230	2757710	they are putting this together as the mmap syscall now.
2759410	2761170	And yeah, I think...
2761170	2765550	Are they like slightly behind the P2P at the moment?
2765550	2767650	You know, it's so hard to say, though.
2767650	2768250	Having done...
2768250	2770790	You know, we've both done, I think, several versions of these kind of events,
2770790	2771850	and it can be really tough.
2771850	2773450	Sometimes you think somebody's like not even close,
2773450	2775790	and all of a sudden, before you notice, they've solved it.
2775790	2776110	Yeah.
2776110	2779030	And sometimes you can see them kind of bringing it home.
2779030	2779530	Yeah.
2779710	2782790	Yes, Nick, I'm Jordan.
2782790	2786750	Hi, cyphertext on Twitter, the Vector35 BinaryNinja guy.
2786910	2789830	And David, we have thousands of BinaryNinja users.
2789830	2792290	There are many thousands of BinaryNinja users.
2792690	2796410	We'll see how many are here besides the one that we have from PTB,
2796410	2797930	even though they're not using it.
2797930	2800930	Maybe they just ran it just to like as a show of solidarity for me,
2800930	2801810	to make me feel better.
2801810	2802810	I'm a BinaryNinja user.
2802810	2805570	There we go. There are, yes, there are BinaryNinja users.
2805570	2809050	Yeah, but anyway, looking at the PTB screen here,
2809590	2814950	I think you can see that they're debugging the read, the calls here, right?
2814950	2817630	No, sorry, that's the input reading routine.
2817970	2824070	And they are doing the syscall zero, which is, is that the read?
2825690	2832630	And yeah, checking out some documentation about mmap.
2832810	2834270	Stack overflow, always check it.
2834270	2837190	But we have Shellfish.
2840090	2843950	Again, yeah, fixing the mmap.
2844930	2847770	Okay, so PTB just found map fixed.
2847910	2851330	So what they were looking for is they wanted to get the right flag
2851330	2855450	to be able to pass to mmap to request a fixed address.
2855450	2857070	So you can, there's different modes of mmap.
2857070	2859130	You can request memory and just take whatever you can get.
2859130	2861230	Or you can just say, no, no, I want this address.
2861230	2862370	Please give me this address.
2862370	2864510	And so they're just going to hard code some address
2864510	2865910	that they hope nothing runs against.
2865910	2867630	And this is kind of like a key to the challenge, right?
2867630	2872890	Where since, well, not necessarily, since you do get the return address.
2872890	2874790	They get the return address, so they could, but...
2874790	2877150	Slightly simpler variant is just to tell mmap,
2877150	2878590	like, no, we're going to allocate at this address.
2878590	2881030	It's one less moving part to worry about.
2881390	2884210	So yeah, I think you can go kind of either way.
2884390	2886130	And this is, so this is, we're about 20 minutes in.
2886130	2889630	This is where I think we'd be evaluating, are we going to give a hint?
2889630	2891210	And I don't think they need any hints.
2891210	2894710	They both really know, I think, generally what the shape of the problem is.
2894910	2896550	They're both working on it.
2896570	2898450	I have every confidence that they're going to,
2898450	2901690	I think they're going to finish it out in the next 20, you know, 10, 20 minutes.
2901690	2903450	Yes. We hope, we hope.
2903450	2905830	We're looking forward to seeing them do that.
2908310	2909290	All right.
2909490	2911390	We forgot to bring our water bottles over here
2911390	2914630	to make sure we could stay hydrated, but we'll do that.
2914850	2919750	We're having to, not only are we yelling over the house audio,
2919750	2921270	but we have our masks on,
2921270	2924550	and there have been easier streaming environments,
2924550	2926390	but I'm super excited to be here.
2926730	2931290	Yeah. So, going over to P2P again.
2932250	2934010	Well, and so, yeah, I think we mentioned this before,
2934010	2936810	but right, like this solid script they're running, they're running locally.
2936810	2938850	They got the binary locally, they're running it in debugger,
2938850	2940810	so they can analyze both halves of it.
2940810	2943410	And then once they have it working, then they're going to go ahead
2943410	2944890	and throw it against the real server remotely,
2944890	2947850	which is like standard operating procedure,
2947850	2949190	I feel like, for these kind of challenges, right?
2949190	2950690	Standard pwnable challenge.
2950690	2953190	Exactly. And that's also why it's nice to have,
2954950	2956850	it's nice to actually have an environment
2956850	2958530	where you can run it directly, right?
2958530	2962230	Whether it's the architecture you've got or the operating system.
2963610	2964190	Yes.
2964190	2965590	Teams were a little worried about having internet,
2965590	2967890	and we're like, no, no, no, we want to see you in internet.
2967890	2970270	And remember, these are some of the best teams in the world,
2970270	2971390	and they're still looking this stuff up.
2971390	2972710	We all are doing that.
2972710	2976630	Let's take a look over here at Shellfish again and see where we're at.
2976630	2981390	Yes. So, they have another syscall that they're setting up.
2981390	2985350	You see them, like, well, retrying that.
2985350	2989850	So, they're really making sure that the interaction here is working.
2989850	2991370	You have this, like, question from the programmer,
2991370	2992790	like, do you want to make another syscall?
2992790	2995450	So, they're just setting that up to answer yes on that.
2995450	2997810	And then you'll see they're about to set up another syscall.
2997850	3000730	Oh, there we go. So, we're looking at memory maps over on PTB.
3000730	3003430	So, they briefly, they tried to allocate the memory.
3003430	3006350	They went to look in the debugger and to see if the memory was allocated.
3006350	3010210	So, the only thing, I mean, if they're past that step,
3010210	3015470	the only thing left to do then is going to be to actually put binbash there, right?
3015470	3019350	Like, once they have the string binbash into that location,
3020210	3021610	they should be able to win.
3021610	3023030	They should be able to, yeah.
3023350	3025530	We have a question in chat about if the challenges
3025530	3028070	are going to be released to everyone after the finals.
3028070	3031450	I mean, we haven't really talked about that, but, I mean, impossible...
3031450	3032150	I assume so, yes.
3032170	3034410	Should the DA, is anything stopping us from doing that?
3034410	3037630	So, I'm going to say yes on that.
3038070	3039990	Provisionally, yes. Yeah, we'll double check with...
3039990	3042050	So, now's actually a good time to talk about,
3042050	3043430	if you keep an eye and make sure,
3043430	3045870	we're getting a little close over here on PTB.
3045910	3047250	So, Carl, if you watch that.
3047570	3050890	But we do have a lot of people who've been helping out so far.
3050890	3054270	So, there are three of us in person here at Vegas
3054270	3056050	that are doing all like this kind of stuff.
3056130	3059950	But we've had several other people contribute challenges remotely,
3059950	3062070	test challenges, do a lot of stuff.
3062070	3063830	We're looking real close over here.
3063830	3067470	Okay, so again, we've got our read, we've got an exec,
3067470	3069870	we've got our mmap, this might actually be it.
3069870	3072270	So, let's take a look and follow on PTB,
3073490	3075430	because I'm smelling blood in the water.
3075430	3077030	I think if there was...
3078810	3083010	Yeah, so they, like, maybe they need to fix some small thing here.
3083610	3086070	Oh, yeah, is that, they have some helper function there.
3086070	3088010	Unfortunately, I don't know really what it is.
3088050	3089230	It was like interactive.
3089270	3091610	Is it, oh, is it dead? Is it?
3092770	3094090	Oh, they're solving it.
3094090	3094870	That's it.
3096270	3098090	That's it. Is that it? Is that it?
3098090	3099370	Is that it? Is it going?
3101630	3102230	What?
3102230	3102690	What?
3102690	3103310	We already had it.
3103310	3104250	Oh, my God.
3104250	3105490	We were even looking at the right screen.
3105750	3106470	Congratulations.
3107790	3110390	Wow, that was so close.
3110430	3112370	That was so close.
3112370	3112930	Okay.
3113270	3114510	Well done.
3114650	3116870	I can't believe how close that was.
3117430	3117830	All right.
3117830	3119170	Oh, my God. Okay, so...
3119170	3120710	That was outrageous.
3120770	3120810	Yes.
3121490	3123970	Give me, so I will go over to the players.
3123970	3124590	You talk to the players.
3124590	3125690	You take it over here.
3126030	3126330	All right.
3126330	3126910	Yes.
3126910	3128330	That was unbelievable.
3128570	3129650	We even predicted.
3129650	3130930	We said we're going to miss one.
3130930	3131290	Yeah.
3131290	3132430	We're looking the wrong way.
3132590	3134890	All right, so let's do a real quick recap.
3135130	3139410	So we were between the screen kind of turning on and off a little bit on the shelf of Shy.
3139410	3140370	We were a little behind.
3140370	3142530	I mean, that was like seconds.
3142530	3144390	They were seconds away.
3144610	3146070	That was unbelievable.
3146070	3147190	What a great finish.
3148050	3151270	So just as a quick recap, perfect timing.
3151810	3152710	Super exciting.
3152710	3154770	Very well done to both of those teams.
3154990	3157030	That was so close.
3157030	3158310	So close.
3159310	3167810	So, again, once they were able to get their shell, all they had to do was run their script, put their team number in from the page that told them what they had done.
3167970	3172510	I'm happy we saw all of our infrastructure working, the overlay when we got a winner.
3173170	3174690	Congratulations to Team Shellfish.
3174690	3176350	But, man, well played, PTB.
3176350	3177970	That was so close.
3178430	3179650	Really, really well done.
3179690	3184770	We're going to let them go back to their teams and keep working on the rest of the challenges here.
3184790	3191170	We'll see if we can figure out how to turn off the winner script and get back to the stream.
3192290	3195090	We're going to leave the stream going, so keep watching here.
3195090	3199590	But remember, just on the hour, every hour, our goal, we're going to have a new round.
3199590	3200650	And so we're going to get set up.
3200650	3201830	We're going to get the next team.
3202190	3203910	And then we'll update our bracket now.
3203910	3205090	We have our first winner.
3205090	3206990	Congratulations to Team Shellfish.
3207330	3208170	Well done.
3208170	3209070	Very well done.
3209070	3209890	Oh, my God.
3209890	3210450	That was so good.
3210450	3210930	Oh, my God.
3210930	3211770	That was so good.
3211770	3212230	Yeah.
3212230	3215910	All right, that set a high bar for, I think, the competition for the rest of the event.
3215910	3217650	But what a way to kick it off.
3218010	3219550	We're going to leave you at the intermission.
3219650	3220710	You can check out the scoreboard.
3220710	3225090	And then we'll be back in about 35 minutes with the next round.
3225130	3225790	Yep.
3225850	3226550	See you later.
3226550	3227170	Take care.
3308010	3308110	See you later.
5655060	5661340	All right, and we're back. Welcome, everybody, to round two of, excuse me, round one, match
5661340	5666780	two of live CTF here at DEF CON CTF. You can see Carl behind me instructing the competitors.
5666780	5672520	Our next two teams up are team, I'm just going to call them slashers, slash, slash, slash,
5672520	5679580	because their official name is slash V, slash home, slash R, slash .bin, slash TW. I believe
5679580	5686740	it's a combination of team Binja, team Tokyo Westerns, a bunch of teams, and they've combined
5686740	5691560	themselves with, like, a path. So they're getting the instructions now on exactly what's
5691560	5699640	going to happen. They're hopefully about ready to go. You count it out. Count it out and
5699640	5704220	make it live. And let's go ahead and actually pull up both of their screens. We'll watch
5704220	5709120	them start here. And we'll, as soon as we give them the word that the server's live,
5709120	5714000	they'll be able to refresh and start going on challenge number two. You go ahead and
5714000	5721540	count it, count it in, count it in. All right, here we go. So we're going to go. All right,
5721540	5726880	go, go, make it go. All right, we'll just do that. No countdown. No countdown this time.
5727960	5732500	So we're going. Refresh the pages. We should be able to see them. There we go. Download
5732500	5738340	challenge. Download challenge. Okay. So not a little, little less fanfare than last time.
5738800	5743980	But hopefully we are going to be live. This challenge is specifically called open to
5744480	5748780	interpretation. We're not sure if all of our challenges are the right difficulty.
5748820	5752820	What we are sure is they all have great names. No, you didn't. Sorry. This is the wrong one.
5752820	5757120	You didn't replace the handouts. Oh, okay. Go tell them. Go tell them. Go to them. Sorry.
5757180	5761260	Technical glitch. All right. So we got to warn them this is not the right challenge.
5761260	5766360	One second. Okay. So this was still the old challenge. There's a couple of management
5766360	5771820	scripts. This is our first time transitioning from an earlier round. So real short intermission.
5772240	5777800	And we should be back. Unfortunately, we're still seeing some... I think we've done terrible
5777800	5784660	things to the USB inputs on one of our laptops. And so we keep restarting that capture card.
5784840	5789280	We do actually have a spare capture card that's arriving shortly as well. So we can switch to
5790180	5797200	if this ends up not working. So okay. We told them to try again. They're going to
5797200	5805320	download a new challenge. And let's take a look at a new binary. All right. Let's take a look at
5805320	5810860	that. Challenge. It's just called challenge. We should have named the challenge the actual
5810860	5816840	challenge name in hindsight. You learn all the lessons learned. All right. So we've got an IDA.
5816840	5823600	Is this... give me a program. Okay. All right. So we are on the right challenge now.
5824060	5827700	It looks like we're having some difficulty with our one capture card, unfortunately.
5828300	5833860	This one is problematic. We swapped out adapters, cards. We'll figure it out. We have backups for
5833860	5840160	everything. Yeah. We'll have our production look into that while we continue the commentary. And
5840160	5844180	when we say production, we mean Glenn. Yes. But you know, it sounds more professional when you
5844180	5849260	say production. We'll have backup house. The production crew look into it and let us know how
5849260	5857180	it's going. Yeah. So we've got our second challenge. They're at least going. Let's go
5857180	5863800	ahead and look at just team slash V slash whatever. Look at their desktop while we've got that working.
5863800	5869540	Yeah. And then we'll keep an eye on the other one so it comes back up. We will see if,
5869540	5873220	worst case, if we're not looking at one of the screens, we'll still see winner. So if we see
5873220	5876640	winner and we didn't, just like last time, we were looking at the wrong one. Yes. Shouldn't be a
5876640	5882260	problem. We should still be able to see that that's happened. All the challenges will be available to
5882260	5886040	download. Yeah. We're going to release them. We don't have a specific plan. So we'll probably
5886040	5891380	wait till just after we've recuperated a little bit after we get back from DEF CON. But we do
5891380	5898000	plan to release them. I like that you're guessing about what type of challenge it might be. So
5898000	5904080	open to interpretation. Is it a polyglot? I think it's more of a play on words of interpreter.
5904440	5912100	Yes. Yes. Right. I think we're not that clever with, you know, we're only moderately clever
5912100	5916320	with the naming here. Right. So, yeah, I think that's something like this. Yes. So we can see
5916320	5928500	here looking at the program in the item and starting to build up a simple phone tools script.
5928880	5934500	So PTRlib. Actually, I saw PTRlib. That's a good question. I'm not actually sure the name
5934500	5940680	of the individual players that we've got. If you all saw like home. Yeah. PTR. It is PTR.
5941140	5945960	And that makes sense that PTRlib. So this is their throwing script library. So I think we're
5945960	5952500	not looking at a PwnTools. I think we're looking at an actual like custom. Oh, nice. Yeah. Yeah.
5952500	5957440	From PTRlib import star. I see. Yeah. Some of my players prefer to like build their own little
5957440	5962140	thing. I mean, PwnTools has a million things, but also it has a million things. Yeah. Yeah.
5962140	5967800	And so it's like getting that whole box of stuff when you only need like the screwdriver. Yeah.
5968100	5973020	So there's certainly an argument. There's also Mpwn, which is another nice one. It's meant to
5973020	5978440	be a little simpler, kind of more standalone. Yeah. But so let's talk about the problem. We can
5978440	5985740	see this is explicitly, I believe, a custom situation. We've got a question mark and A.
5985740	5991560	So we saw that. Yeah. That little switch statement there again with the name open to interpretation.
5991560	5995560	And we think it's kind of like an interpreter. Yeah. Some sort of little virtual machine or
5995560	6000460	some sort of interpreter that's going to make some simple changes. I do love people. People
6000460	6005820	know this is like a live CTF because they start their throwing script like immediately, right?
6005820	6010740	Like they just immediately start building that up. And I think that's also
6010740	6016520	kind of a good way to, in a sense, document your understanding of the problem so far, like writing
6016520	6019760	down like the interactions, like the different things. And so you don't forget things. And you
6019760	6023180	kind of like, as you like, you'll often, as you put to do's, like, you know, you do this part,
6023180	6025500	but like, I need to do this later, but at least I'll remember it because that's my...
6026300	6030440	Yeah, I think you're right. I think people use their little throwing script almost as a
6032360	6036980	stand-in for like a, you know... Like a notes. Yeah, exactly. Notes or task tracking or like...
6036980	6042520	We can see some debugging going on now as well. Yeah, we're not going to interrupt
6043960	6050740	his throwing. You know, in the interest of fairness, we're not sure why we're having
6050740	6054420	glitches on our one capture, unfortunately, so we'll resolve it before the next round. But we're
6054420	6058680	not going to... Once we've started, we need to let him go until the first person solves it. Yeah, because this is so
6058680	6062800	hectic, like, the margins, like, as we saw in the previous match, for those who watched, like,
6062800	6069140	the, yeah, the seconds matter. Absolutely. Like, literally, there was, like, seven keystrokes,
6069140	6074600	but, like, between the... I don't think we will see a tighter match. I will be surprised. I mean, we basically
6074600	6078860	can't see a tighter match. I would be really surprised. Yeah, we would have to go down to, like, you know,
6079740	6086880	recording. Yeah, and so, exactly, we're seeing PwnDBG instead of... Yeah, these... What is your
6086880	6094720	preference on debugging libraries? Have you, like, Geph versus... So, I used to be a PwnDBG user,
6094720	6103460	but I have switched to Jeff. Yeah. I mean, a long time ago, I was a Peta user. Yeah, yeah. But then
6104240	6109080	that kind of just stopped developing for a bit or something. Anyway, I switched to PwnDBG,
6109080	6115980	then I went to Jeff. Yeah, that's my current preference. So, you can see, I think, just over
6115980	6121140	the shoulder here, some of the players. So, the people in chat that are wondering,
6121140	6125580	kind of depends on where we lean if we're, like, yeah, if we're letting him in. But we're also
6125580	6130680	trying to kind of... We have to block off their opponent's screen here, right? So, because we have,
6130680	6135760	well, at least one of the teams now visible on our little monitors that are in front of us.
6136440	6140220	And we've intentionally kind of, like, laid it out so that you can't see your opponent's,
6140220	6144100	you know, monitor over here that we're using to see them. So, we've kind of got them
6144480	6150060	angled down a little bit lower. Yeah, honestly, they're all better than, like, stock GDB.
6150060	6155960	Although, like, you know, TUI is not the worst thing. It's at least better, I feel like,
6156900	6162860	than, like, you know, stock command line. Yeah. I mean, I used to roll with, like, you know,
6162860	6166280	display slash whatever and, like, build up my own little kind of custom prompt. But
6166280	6170820	it is... I think I never really learned that. I went, like, directly from the vanilla. Honestly,
6171580	6177380	yeah, to a real tool. Yeah, one of those. Okay. So, we're back in IDA. And it's interesting,
6177380	6181520	too, because we started in hex arrays in the decompiler. And now we're just looking at
6181520	6187900	actual offsets here, right? So, we've got... So, some kind of overflow situation here going on?
6187900	6193560	Oh, okay. Yeah. So, we already see somebody writing Ds, which were, if we go back to that...
6196540	6200800	Oh, man. All right. You know what we might do? I might actually have... If you go
6201360	6205080	look over the shoulder and just to give us an update, come back and give us an update and see
6206420	6212960	how... On the Starbuck side. Yes. And let us... If I'm doing this right. Yeah. So, yeah. We'll...
6213700	6216320	We'll go... Yeah. You go check it out. Yeah. I'll go check it out. And then you can go back and
6216320	6220640	give us a report and let us know what kind of looks like where we're at. So, apologies for this.
6222080	6226800	This is going to be a wild and crazy weekend. We're going to have a lot of stuff. So,
6226800	6233280	this is the only real issue is we've got to figure out why our capture card is freaking out. We
6233280	6238300	actually do have another capture card we'll bring in and we'll get working in the break. So,
6238300	6243080	especially if this is a really fast match, that'll be really easy.
6243740	6247520	We will bring this in. Okay. So, yeah. There we go. We can see the switch statement
6248500	6253890	with the different options. Question A, D, S, W. And we notice that there's some...
6254730	6259950	Yep. Exactly. So, there's that comparison there, right? It was checking to zero. It was checking
6259950	6269010	128. But you'll notice, I think this is actually why earlier we saw PTR looking at the disassembly
6269010	6274470	is because in hex arrays, you don't always see the signs. Is the comparison signed or unsigned?
6274530	6280330	Right? And so, I suspect that's what we were seeing before is the switch over to disassembly
6280330	6284010	was saying, well, wait a minute, is this comparison signed or unsigned?
6284250	6294210	I think you can mouse over the comparison operator and it will say if I don't misremember. But yes,
6294210	6298350	it's still like to get the exact details, you might have to go down to the disassembly.
6298350	6304090	I mean, you could use binary ninja in high level IL where it tells you signed or unsigned comparison,
6304090	6309970	but I promise... Okay. Okay. I'll be good. I'll be good. I won't do that. And I will say,
6309970	6314750	me with binary ninja would not beat these folks with IDA, right? So, I'm not claiming that
6315270	6320110	it would make me infinitely better. So, to give a bit of an update on Starbucks,
6320110	6327330	it's actually very similar to the situation for... How do you choose to pronounce it? Homer.
6327330	6332570	Like, yeah. Homer bin. That's now what we call these. I've been saying slash.
6332570	6337490	Okay. Slash. Slash. Slash. Slash. Slash. Okay. Yes. However we do it. Yes. Anyway,
6338090	6344010	Starbucks, they were in a similar situation. They have done some analysis. They started out
6344010	6351950	the small Xbox screen, not quite as fleshed out yet as the one... A bit shorter, doing some
6351950	6355650	debugging, looking at the registry values, just making sure that they're completely understanding
6355650	6359950	what's going on. So, I would say at this point, it seemed like they're fairly similar progress
6359950	6366750	between the players. I will say, at least looking... So, I actually have not seen an official
6366750	6371090	solution for this one yet. So, some of the challenges we wrote, some of them other of
6371090	6374130	our teammates wrote, some of them we know the exploits and we tested them and some of them we
6374890	6379890	don't. Just knowing kind of generally what's going on here and looking at those comparisons,
6381330	6385410	I'm wondering... I mean, we're already... This looks like intention, right? It looks like we're
6385410	6389990	seeing... I have an idea of what we're doing. We've already contacted... Yeah. This looks like
6389990	6396150	really good progress only several minutes in. If you had asked me now, do we need a hint? I'm
6396150	6402270	like, you never really know. Yeah. But you can see here they're doing a leak. You see this
6402790	6408210	line starting with like libc base, if it's readable. So, they are reading eight bytes out
6408210	6413090	from the program and then they're subtracting the offset of the putchar address. And then,
6413090	6422250	I like a bit more as well. So, from this, they're calculating the base address of the libc library,
6422250	6429190	which then can be used to calculate the addresses of other functions you might want, such as system,
6429190	6435250	which is maybe like the go-to choice. Usually the choice, right? And so, before we were talking
6435250	6439650	about execve for the syscall challenge, the last one, and that's just going to be the raw syscall,
6439650	6443310	system's even better though, right? What's the advantage of system over an execve?
6443490	6448350	I mean, yes. So, for the system, you just give it one string argument, which is the thing you
6448350	6453250	want to execute, and that's it. You don't need to care about splitting up the command line
6453250	6458470	arguments into an array or all that stuff. It's just like... I wonder if we'll see somebody's
6458470	6462830	system straight to the payload or if they're going to get a shell first and then run to the payload.
6462830	6466810	They could kind of go either way on that, right? Yeah. I mean, personally, even though this is,
6466810	6471590	again, do you take it slow and methodically? Yeah, and be able to debug it along the way? Yeah.
6471650	6476830	So, I would just go for the shell because then the same solution also works out of the box locally
6476830	6480590	as well as remotely. Otherwise, they would need to... That's true. Well, if you get an error message
6480590	6484050	that would say, follow my pattern, you would see some sort of bug there. I would still feel more
6484050	6489050	comfortable doing, like, launching a shell and then going with that. You know, I think that's
6489050	6493630	interesting because, again, though, last round, literally seconds mattered. If one team went one
6493630	6498610	way and one went the other and they were that close, the team that threw the straight to the
6498610	6506810	submitter would win. So, we will see. We'll see. I don't expect it to match. I don't expect
6506810	6512670	it to be that close this time. There is, like, a small catch to that, though, because they don't
6512670	6521310	know, like, you need an absolute address for exec, right? Execve does have to have the full path.
6521310	6525930	Exactly, and they don't know the current working directory. So, they don't know the full
6525930	6528970	path of the submitter. Right, but if they're calling system, in this case, if they're just
6528970	6532450	finding system... Right, exactly, but I'm just... Oh, no, no, yeah, true, true, you're correct.
6532450	6535730	Like, on this one, you're right, last round... Yeah, they could not have done that. They could
6535730	6540330	not have done that nearly as easily, right, but whereas this one... Yes. Yeah, because the relative
6540330	6543410	pathing only works because of your shell, essentially, which, if you're going to call
6543410	6548950	system, it's going to run the shell for you. Okay, and thank you for the kind words. We
6548950	6552910	appreciate it, Grandma Bullet. You guys in chat, we're definitely keeping an eye on it, and
6553530	6558370	happy if you guys have questions, and I expect y'all will be seeing stuff that we miss, because
6558370	6561870	we're kind of trying to, like, juggle around and look at a lot of different things. In fact, I even
6561870	6567270	talked to one of the competitors in the room watching the stream in the last round, and he
6567270	6570350	was like, why didn't they use the breaks this call? Why didn't they? They were all watching,
6570350	6574290	like, you know, they're doing the regular CTF, but they were also, you know, checking out the
6574290	6578630	competition, seeing what the challenges are looking like, wisely preparing for future rounds,
6578630	6583350	and they were, you know, commenting on better approaches. So I imagine we'll have people in
6583350	6588590	chat here that have feedback and have ideas on things that they can do. I mean, you also should
6588590	6595470	keep in mind that, like, this is not your average CTF environment. Do we have it back? Oh,
6595470	6599530	it's teasing us. No, yeah, it's teasing us. Unfortunately, this is not your average CTF
6599530	6606270	environment, right? This is much more stressful for the players. Like, most of them are not used
6606270	6610210	to, like, you know, live stream when they're... And even if you are, even if you've done a lot
6610210	6615270	of streaming, it still is harder. It's just 100% always harder. There's people watching,
6615270	6619750	thinking, oh, did I clean up my desktop? Do I need to, like, is this my VM set up? You know,
6619750	6623010	there's just a lot more on your mind. And it's also kind of like an all-or-nothing situation,
6623010	6628490	right? And a normal CTF, usually, because we kind of moved away from the tradition of
6628490	6634110	first blood points. This is true. Nowadays, it's all about total score. It doesn't matter when.
6634110	6637070	It doesn't matter if you solve the challenge, like, five minutes into the competition or
6637070	6643830	when it's five minutes left of the competition. Here, it's everything. Like, either you win or
6643830	6650990	you don't. We might be getting pretty close here, because I am seeing... I did see... It looked like
6650990	6656770	we had maybe had a system leak or we're close to a system leak. So, let's watch. So, we're looking at
6656770	6663510	system provider. So, we've already got a convenient call. Again, there's a call to system
6663510	6669250	already in the binary. Oh, and Starbuck is... Yeah, yeah, yeah. Why don't we go ahead and do
6669250	6677010	another check, Carl, on Starbuck. Yeah, I'm gonna go play with him. No, we don't actually worry about
6677450	6681230	past people learning things for new ones, because again, the challenges are totally different.
6681230	6686370	Every match is a different challenge. Exactly. So, we don't have to worry about that.
6686530	6690950	The general setup, well, the way that we would compensate by that is, I will say,
6690950	6697550	we specifically put all the easiest things that we knew were easiest first, just because we wanted
6697550	6701690	to be guaranteed that they would get solved in time. So, the teams that go first had less
6701690	6704910	information. They knew less about the environment and what was going to happen and maybe...
6705850	6710410	but I don't know. It depends on the player. I think for some people, going first is actually
6710410	6714870	significantly better. You just get it out of the way and your nerves are over. And some people,
6714870	6718770	though, they really want to see what's happening and know. So, it's hard to say. It was totally
6718770	6724470	random selection in terms of which round happened when. So, we'll see what it is. And yes, everyone
6724470	6728730	not only has to use a laptop. So, one of the differences is that they're not only using a
6728730	6735610	laptop, but we plug in our video capture cards and those cards force a specific aspect ratio,
6735610	6740310	so their font size can be a little bit off. So, we are handicapping them unintentionally
6740310	6743590	a little bit that way as well, too. So, how's it going with Starbug?
6743670	6748630	Yeah. So, they have some good progress. I saw them looking at the debugger. I think they were
6748630	6757430	looking at the got. So, maybe a similar approach there with overwriting or leaking addresses.
6759950	6765210	I mean, very fast to find a bug. I think both teams, right? I mean, again, this is meant to
6765210	6769910	be an easy bug to find. It's even just wiring it all up, putting it all together, building the
6769910	6776570	payload. Yes. Avoiding all the mistakes. When you do these things, it's very unforgiving. The
6776570	6783230	smallest, you're off by one somewhere and things just don't work. It won't give you any meaningful
6783230	6789350	error messages or something like that, as you would get when you're developing normal software.
6789350	6792950	I love that we're getting debug information. So, we've got a logger info. They're actually
6792950	6799590	printing out their variables and stuff. Thank you, as a caster and as a commentator. It does
6799590	6804690	make it easy when we can see what your intentions are and kind of what you're doing.
6804690	6812990	When I write my exploit scripts, I'm definitely more on the cautious and structured side. I name
6812990	6817570	all my variables properly. I have logging statements. Do you put type hints? Do you
6817570	6823070	actually put Python 3 type hinting? Is that that level of... No, it has happened. That's a bridge
6823070	6828770	too far for CTF. It has happened, but no, no. Generally not. Well, I am the opposite, I think,
6828770	6833590	by nature. I was always quick and dirty. I mean, I wrote a lot of exploits with Bash. I would
6833590	6838110	literally just shove raw bytes in with Bash. If it works, it's faster, but when it fails,
6838110	6846490	it fails miserably. Yes, because when it fails, it fails and you have not gained any ground.
6846750	6852490	It fails and you're kind of still at zero, while the slow and methodical, it can fail,
6852490	6855310	but it's a very local fail. And it's easier to measure progress. Potentially,
6855310	6857490	you can instrument a little bit better and see kind of where you're at.
6857490	6865770	But then it comes at this additional cost. So I'm trying to see what they're doing. So there's a
6865770	6870590	question here. Every team sends only one player. Yes, correct. So for each match, the team chooses,
6870590	6876490	so they will get to know what type of challenge it is. So we might say like this is an x86,
6876490	6883070	64-bit Pwnable challenge, and they choose a player to send. They do not have to pick the
6883070	6886570	same player. If they win the match and advance to the next round, they can swap out for another
6886570	6891690	player. But if we, for example, switched up the architecture or made a reverse engineering
6891690	6896850	versus Pwnable or whatever other things we did, they have a chance to swap it out. So it's supposed
6896850	6903910	to be the best person from that team for that style of challenge and for the stress of being
6903910	6909290	on camera. Because some people are maybe better exploiters, but really nervous about sitting in
6909290	6915250	the room, which is a totally different experience. Yeah. And they are not allowed to get help from
6916330	6921830	their teammates. Yep. But they can look on the internet. They can have all these resources.
6921830	6925210	Although I don't think we've seen either one of these. They knew what they were doing. They went
6925210	6929030	straight in, they found the bug, they reverse engineered it, and they're writing their exploits.
6929290	6932110	But for example, the last one was a little bit different where they were building syscall
6932430	6937410	payloads. And so we did see both of them looking up a list of syscalls and the parameters. Yeah.
6937410	6941290	So if we have another look here and see what they're doing, we can see they're trying their
6941290	6946490	exploit script, doing some debugging here. They're checking the output of the script.
6946490	6948950	Comparing it to the debugger itself to see if the addresses line up.
6948950	6955670	Making sure you have your offsets and your lengths correct. So it's all good. Again,
6955670	6960610	I'm not super familiar. I think there's some kind of integer over underflow
6961390	6968530	business going on in this challenge. Actually, I'm curious if the challenge author who was in
6968530	6978550	chat last time is in now. Feel free to drop hints just for our YouTube chat and we'll see if
6980530	6988990	Negasora is still around. Okay, so it looks like a write primitive because we've got a target for
6988990	6995170	an overwrite. Oh, they're looking for one gadget. They want to figure out is there one now.
6995170	7002950	So to explain a little bit here, one gadget is both like a concept and a tool. So it turns out
7002950	7010610	that in various places in libc, if you jump to that address, you will execute the shell.
7010610	7014210	Just get a shell. Like it's going to call a system with binsh or binbash or whatever.
7014570	7020850	Some person or people have created this tool which will take a libc version and list what
7020850	7025610	these addresses are. Some of them have like conditions like, oh, this register cannot be
7025610	7031950	zero or... You know, several years ago, 1804, Ubuntu, standard installs, that was less common.
7031950	7035870	It would just tend to just work unconditionally. There was just addresses that were... that's why
7035870	7040870	it was called one gadget because it was literally one place you go. You jump there, all you needed
7040870	7044870	was control of instruction pointer and that would be all you got. Now we're actually looking for
7044870	7050650	ROPers. So we're actually looking for ROP gadgets to see how those work. I'm actually going to go
7050650	7055270	starbug. I want to get a hit there. Yes. So I'll leave you on the stream and I'll be right back
7055270	7060070	with an update. Definitely. I hope Jordan comes back with some nice updates there. I'm going to
7060070	7068010	lean over a little bit to see better this. So ROPER, one of several tools to find ROP gadgets
7068010	7074570	in a program. So they're running this on the program to find what gadgets are available to
7074570	7079250	you then use them to build up the ROP chain. So return oriented programming.
7081590	7086330	And it can be a bit tricky. As we see here, it didn't look that they had a lot of things to
7086330	7090250	choose. I didn't see if there was like any filter or anything going on there, but regardless,
7090930	7096750	so they were looking for specific gadgets with specific properties, like a call instruction,
7096750	7103790	I think there, to be able to put this into the ROP chain and then use that to develop their
7103790	7115270	exploits. Yeah, so again, we see them looking at... I did a little bit double checking what
7115270	7120970	they're doing. We can see that they're rewriting a part of their exploit. There's some kind of
7120970	7125270	address that they're going to trying to figure out what's the appropriate address. So here,
7125270	7130370	they're going for libc base plus an offset. So they're trying to go into one of these one
7130370	7139150	gadgets, I think. And we'll see. So they're just trying them one by one to just see if any of them
7139150	7144970	works and if they have the constraints satisfied for them to be able to do this.
7145110	7151430	But doesn't seem like it's working quite yet. Yeah. So what do you have, Jordan?
7151430	7156330	All right. So the update on Starbucks, I would just say Starbucks looks like they're still kind
7156330	7163950	of like thinking about the problem. I kind of get the impression that slash v slash home has
7163950	7168690	more of a sense of where they're going. Yeah. And they'll kind of get the building blocks there.
7168890	7172550	Could be wrong though. Again, it can be really hard to kind of get a sense of where people are
7172550	7176270	at in their head. We're just trying to kind of watch and gain understanding. But I definitely
7176270	7182170	saw some more just kind of poking around. It is interesting, we did see a true PwnTools user,
7182170	7191350	so it was PwnTools coming in from Starbucks versus the custom PTR lib that we're seeing here.
7192370	7199230	And Jeff, I don't know, is there like a canonical pronunciation? I just kind of
7199230	7209610	guessed because GDB, but yeah, I mean, I've heard both. I agree with the GDB being a GIF,
7209610	7215430	but I think it's funny. I think it's canonical. I think it's Jeff. It could very well be.
7215510	7223470	It's like in the name Jeff. Yeah. So we've definitely got some fans. People are excited
7223470	7230890	to see both their favorite players. And yeah, Fabio, it depends. Some of these challenges,
7230890	7234970	there are absolutely things that you want to look up. You might be looking up a bug in the tool
7234970	7240810	or something you're doing. This particular one is kind of very classic. I feel like
7242350	7247370	they know their tools. They know what they're doing. They're not looking up the help for
7247370	7250890	PwnTools because they're using features that they've used a lot. They're not looking up the
7250890	7259710	help for these things just because they're more familiar with it. All right. So it seems like
7259710	7262930	we've got code execution, right? If they're already looking for gadgets, they've got code
7262930	7268330	execution. They're really just trying to redirect. Exactly. GIF or GIF, Jeff or GIF. I love it.
7268710	7277590	Exactly. Yes. So we're trying to kind of pivot, get us a gadget that gets us closer to our one
7277590	7282910	gadget, right? So they need to... See that they were looking for a move RSP gadget. So they want
7282910	7291350	to pivot the stack and potentially to use that to have like a longer ROP chain, potentially.
7293350	7296710	Another technique they might have used to get a longer ROP chain, too, is sometimes you can just
7296710	7301850	actually pivot back into the same program, right? Into like another read or another receive depending
7301850	7307110	on the program. So let's see. We're looking at some padding going down in here into the payload.
7308650	7310610	So they're just increasing it.
7317020	7321220	And it is fun, too, because the speed at which people operated at this tier...
7322320	7325020	We're done! We have a winner! Oh, I'm so sorry. We didn't see it on screen,
7325020	7331440	but congratulations! Round two winner! Very good. I wish we had that one on stream. I'm very
7331440	7335680	sorry for the capture problems. We're going to make sure we take this time and we're going to
7335680	7342540	swap out our capture card so that we don't have that happen again. But thanks again for hanging
7342540	7347860	with us. We'll be back with a better view of both team screens this time. And we'll see you just in
7347940	7350220	a few minutes. Thanks, everybody.
7577310	7578710	So
8519330	8522130	A little pause... and we are back.
8950380	8952320	All righty, everybody, we are back.
8952400	8954160	We've swapped out a capture card.
8954240	8955840	I think we're going to be good.
8956000	8959200	So let's go ahead and get everybody to help count me in.
8959200	8959460	You ready?
8959460	8960480	We're going to do a countdown.
8960480	8966820	Five, four, three, two, one, go.
8967640	8968580	And refresh.
8968580	8970480	Let's bring up the team screens.
8971800	8973400	Production, bring up our team screens.
8973400	8974140	They are live.
8974140	8976320	They've already got the binary, and they are going.
8976680	8977400	There we go.
8977400	8980680	Okay, so let's get up our team views, and we're off.
8980680	8985500	We're back this round with Maple Mallard Magistrates, which,
8985500	8987600	I mean, that's the Mighty Ducks, right?
8988000	8989380	I've decided that's what we're going to call them.
8989380	8990560	We're going to call them the Mighty Ducks.
8990860	8993680	And they're competing against OSUSEC, or OSUSEC.
8993680	8994040	Yep.
8994580	8995940	Do you know who they are?
8996260	8999560	I believe they're from OSU, either Oklahoma State,
8999560	9001640	or I assume it's a state university.
9001640	9003420	Yeah, I mean, I would guess, but...
9003420	9004560	But I don't know for certain.
9004560	9006360	Yeah, I'm also not super familiar with, like,
9006360	9008720	all the universities in the U.S. and stuff, so, yeah.
9009600	9011940	Yes, but that sounds very plausible.
9012200	9015140	What do we have here on the competitors' screens?
9015140	9016820	So we're looking at source code.
9016820	9021400	So I guess we gave source code on this particular challenge,
9021400	9024340	because nobody's got Ida or Binja open.
9024740	9026960	They're just going straight to...
9026960	9029100	So let's see, we've got the handouts.
9030260	9033500	Right, that's some Capstone library calls, right?
9033500	9034360	Oh, this is interesting.
9034360	9034620	We've got...
9034620	9036280	Okay, so we've got Capstone.
9038320	9039860	And they're going to run.
9039860	9040940	They're going to try it locally,
9040940	9041800	and they're going to see how it works.
9041800	9045540	Now, this program, this challenge, is called Knop Coding.
9045540	9048980	Okay, so it's not showing...
9048980	9049600	Oh, did we lose...
9049600	9050320	Oh, no.
9051860	9052800	We lost this.
9052800	9053780	Did you lose that?
9053780	9054620	No, it's back.
9054620	9055260	It's back.
9055260	9057060	But, like, did you lose it on the capture?
9057060	9058560	Because I think it's just our power.
9058980	9059680	Yeah, okay, cool.
9059680	9060160	We're fine.
9060160	9060960	So I think we're losing...
9060960	9061720	There's power...
9061720	9063940	Something power with this is causing trouble.
9064540	9065440	You know what?
9065460	9067020	Bring the brightness way down.
9067800	9068480	Yes.
9069300	9070940	Let's see if we can do this.
9071640	9072260	Yes.
9072260	9074880	So someone's saying Oregon State University.
9074880	9077020	Someone's saying Ohio State University.
9077380	9077620	So...
9077620	9080640	I mean, they're all good guesses, but I don't know which it is.
9080640	9081480	Yes.
9081860	9087080	Anyway, while that's, you know, sorted out, we do have...
9087080	9091260	Let's see if we decrease our power draw on our monitor here, if that'll...
9091740	9092520	Yeah.
9092820	9094220	Let's hope that's better.
9094220	9095300	Let's hope that works.
9095420	9096020	Okay.
9096020	9102000	Anyway, off to a bit of a rocky start again, but hopefully we'll recover.
9102000	9104180	New challenges each time.
9104180	9104660	There we go.
9104660	9105040	Go beavers.
9105040	9106100	So is this actually...
9106100	9108260	The beavers would be...
9108660	9109420	Beavers versus ducks.
9109420	9111840	Well, the ducks are Oregon, but Ohio State...
9111840	9113420	No, Ohio State's the Buckeyes.
9113420	9114320	It is Oregon State.
9114320	9114860	Okay.
9114860	9115240	All right.
9115240	9115400	All right.
9115400	9116140	Thank you.
9117300	9119140	Thank you, chat, for filling us in.
9119340	9120320	Can confirm.
9120320	9121140	So I apologize.
9121140	9122240	We should have...
9122240	9123180	We're bad casters.
9123180	9127760	We should have had better, you know, intel on our teams.
9127760	9130960	But you know how they say, like, the best way to get an answer...
9130960	9131760	Is to say a wrong one?
9131760	9132360	Yeah, yeah.
9132360	9133900	Oh, that's how I, like, run a business.
9133900	9134640	That works great.
9134680	9137140	I just, you know, I say something, and then my coworkers are like, no, you're wrong.
9137140	9138720	I'm like, okay, but now I know the right answer, so...
9138720	9139260	Yeah, yeah.
9139460	9140880	So we can see here that...
9140880	9142180	We should be streaming it.
9142180	9147800	If we're not streaming at 720p, it is either YouTube or it's just our bandwidth.
9147800	9149900	Because we should be streaming at 1080.
9150380	9153080	And the VOD that we're recording is also going to be 1080.
9153080	9157080	So if we need to upload a higher quality afterwards, we will get that.
9157080	9157560	All right.
9157560	9158980	Oh, this is interesting.
9159260	9159880	Okay, okay.
9159880	9160260	So wait a minute.
9160260	9162340	I'm seeing indecisive over here on...
9162340	9162900	So remind me.
9162900	9164040	I've got...
9164040	9164960	Maple Mount.
9164960	9165280	Okay.
9165280	9166520	So I've got...
9166520	9167360	Mighty Ducks.
9167600	9171900	I've got the Mighty Ducks over here, and I'm already seeing something really interesting.
9172740	9173940	Start your clocks.
9173940	9177140	This could actually be fastest solve from what I'm seeing over here, okay?
9177140	9179500	So this challenge was called Knop Coding.
9179600	9188200	And what they're doing is they're told you must get a shell, but everything that you run must be a knop.
9188200	9190620	Which kind of doesn't really make sense.
9190620	9191180	Sounds impossible?
9191180	9191720	Yeah.
9191780	9192900	Knop doesn't do anything.
9192900	9195700	But we did give them a hint, actually, right?
9195820	9197300	So if it's locked at 720...
9197300	9198360	Yeah, we apologize.
9198360	9204640	It is probably just our stream bandwidth, because I believe we're streaming at 1080p.
9205500	9210700	And actually, let's go ahead and go full screen to one of the teams, and we'll try to keep the full screen ones.
9210740	9212100	Let's do the one without the...
9212100	9214540	If we're at 720, we want it to be real full screen.
9214540	9218420	So we'll get rid of all the pretty artwork, and we'll just do...
9218420	9220740	Let's do the bigger one that's clear without even that.
9220740	9224580	Yeah, so this will get us looking at Oregon State.
9225620	9227520	So we're seeing the preload.
9227520	9230180	Right, so what they're trying to do now is they're going to run it with their capstone.
9231560	9235100	Yeah, they're just trying to make the binary work so that they can debug the stuff.
9235100	9240100	You see, they do some LD preloads to get the proper libraries running.
9240480	9242660	No, these are not two local teams, as far as I know.
9242660	9244320	I don't believe...
9244320	9245980	It's funny that they're duck-themed, right?
9245980	9247420	So the duck theme is...
9247420	9249920	Yeah, we are making progress, right?
9249920	9256460	Okay, so what we're looking at here is we've got a text file on the right that is a NOP, right?
9256460	9260800	And we're assembling it, so it's test.s, and this is being created as a NOP.
9260800	9264280	But when we disassemble it, now it's not a NOP, right?
9264280	9267440	So the reason why we're doing that, and we gave them a hint,
9267440	9273260	we told them that the binary they're given is a 32-bit binary on this particular... I believe?
9273260	9275660	The point is that there's a mismatch here.
9275740	9281420	It's being disassembled as 32-bits, but it's executed as 64-bits.
9281420	9282460	So it's going to be run as 64.
9282460	9284260	The other way around.
9284600	9287540	It's disassembled as 64-bit, but executed as 32-bit.
9287540	9296560	So if your bytes disassemble as an x64 NOP, but run as a 32-bit actual instruction, it will be run.
9296560	9299500	And so, yeah, we are definitely... I can't tell from this angle.
9299500	9301660	I don't have a good view on OSU.
9301660	9303620	They're looking at the code here.
9304640	9309700	Clearly, the ducks are, I would say, in a strong...
9309700	9310960	Running your NOPs, they should have...
9310960	9313540	They know. They completely understand.
9313680	9318340	Like I said, this could be one of our faster solves, because they are absolutely...
9318340	9318940	They get it.
9318940	9324880	Now, how long will it take them to build a payload, and can our beavers catch up?
9324880	9327960	That's going to be the question we've got to figure out.
9328120	9332940	You can see that they are looking up the Capstone CSV.
9333720	9337940	So that is a good thing to do, because a lot of people, when we tested this challenge,
9337940	9341260	just assumed it was disassembling the same architecture with.
9341260	9345120	And so actually double-checking that call to Capstone, checking the parameter,
9345120	9348480	checking that information, is actually not a bad idea.
9348480	9352880	I just think we're seeing our duck over here make...
9354080	9355900	They looked at it, and they just knew.
9355900	9358760	They're like, oh, I get this. I understand exactly what this challenge is.
9358780	9363560	I mean, sometimes you're just on the same kind of frequency as the challenge author,
9363560	9366400	and like, I see where you're going with this.
9367740	9376200	So MMM, and actually, MMM is a very similar name to PPP.
9376220	9377480	Yeah, what a coincidence.
9377480	9379300	What a strange coincidence.
9379300	9383380	So we mentioned earlier we're seeing a lot of these teams kind of join together.
9383840	9385940	And certainly if we look over...
9385940	9390160	We can see an opcode reference here, which is exactly what you want here.
9390160	9396300	You want to see what's the opcodes that will disassemble into the knobs
9396300	9400820	while at the same time have a different meaning in the 32-bit context.
9401340	9407340	Now, again, though, I wouldn't say that there is sort of like once you get the right one that works,
9407340	9410060	the rest kind of flows pretty easily, I feel like.
9410900	9414060	Having seen at least a solution to this, we expect there's probably multiple,
9414060	9417420	but one of them, like once you kind of get the right mismatch,
9418120	9420800	you don't need to build this really complicated payload.
9420800	9422160	It can be relatively straightforward.
9422160	9427360	So I say that to mean that it could be, I guess, not out of reach yet.
9427360	9429460	Like while I certainly, if I, you know, we're in Vegas.
9429460	9433860	If I was going to make a bet, I might put it now on MMM.
9433860	9434220	Yeah.
9434220	9437400	But this is not out of reach.
9437400	9439100	There's no question because if it's...
9439100	9440160	Okay, right.
9440160	9443500	So they just found out, for example, floating point knobs are not considered knobs
9443500	9445240	because it actually says FNOP.
9445240	9448100	So it's FNOP or however you actually pronounce it.
9448100	9452840	And I'm also kind of wondering what the hell is FNOP in the first place.
9452880	9453440	FNOP?
9453440	9457480	It's a knob that happens in the floating point instruction space.
9457480	9457900	Right.
9457900	9459680	But, like, what?
9460440	9460880	Yeah.
9460880	9463540	Actually, if memory serves, it's even a funny opcode.
9463540	9468660	I think it's D9D0 because, you know, 90 is the regular knob.
9468660	9470720	And so I believe let's...
9470720	9471620	I'm not sure.
9471620	9472640	But, like, you know, chat.
9472680	9474020	Somebody check me out, chat.
9474300	9478720	Open up your Binary Ninja and type D9D0 and hit, you know, P, disassemble it.
9478900	9479680	Or we can look.
9479680	9480680	Yeah, we can look here.
9480780	9483360	So we're seeing working over through the knobs.
9483360	9484920	Okay, we're back in Capstone.
9485400	9487520	So have we found out the key yet?
9487520	9488680	So let's see.
9488820	9490200	Yeah, they're looking at the Capstone header.
9490200	9495600	I think they're trying to figure out exactly what the different constants mean, like the different arguments.
9497140	9504320	Which is definitely the key to understand this challenge, then, to realize, like, exactly in what way it's disassembled.
9504320	9506040	Now, you could go too far, though, right?
9506040	9514280	So, like, one of the, I think, the most important things to figure out is how much do you spend into one sinkhole before you move to another topic?
9514280	9515920	Or are you going too deep?
9515920	9521180	Especially in this one, where you know there is a solution that should be doable in 20, 30 minutes, right?
9521180	9521640	Right.
9521640	9523880	And this is a little bit like a metagaming thing.
9523880	9526020	We just saw it at FNOP over there as well, too.
9526020	9526600	Nice.
9526600	9530760	So they're looking through the different operations.
9530760	9531320	Yeah.
9531560	9534040	But a little bit like a metagaming thing in the CTF.
9534040	9541180	Like, because you know that there is a solution, like, it shapes how you approach the problem.
9541180	9546780	And, like, you start thinking about, like, okay, what could the author have been thinking about, and so on.
9546780	9553700	Well, and that's one where, again, I feel like, you know, we saw immediately a 32-64 mismatch coming out of MMM.
9553700	9559740	So that was just somebody who looked at it and instantly thought, if I was making a challenge like this, about like this, here's probably what happens.
9559740	9561740	And then it just, they tested it, and it worked.
9562640	9566060	And that's where, like, the experience really comes into play.
9566060	9572300	So, Iron, we currently have MMM, which sounds suspiciously like PPP.
9572300	9574100	They're a duck-themed team.
9574100	9578680	The full name is Maple Mallard Magistrates.
9578680	9580200	I call them the Mighty Ducks.
9580200	9584900	And they're playing against the OSU SEC, the Oklahoma State University Beavers.
9584900	9587160	So we have a duck versus beaver match.
9587180	9587940	What?
9588680	9589700	Coincidentally.
9589700	9593820	And actually, for context, the seeding for these challenges...
9593820	9596260	Oh, I do see our stream bitrate kind of going up and down.
9596260	9597720	So I apologize for the 720.
9598340	9603040	We are at the mercy of the bandwidth that we've got here.
9603040	9607380	But the good news is we have local feeds, and we will make sure that we put...
9607860	9609800	Upload the videos of this, the recordings.
9609800	9611880	Yeah, we'll do the good ones later.
9613900	9616440	There was a question here, like, they can only use NOP in shellcode.
9616440	9618260	And yes, it's like, yes, but no.
9618260	9620000	I said Oklahoma, didn't I? I meant Oregon.
9620000	9621420	Thank you, Lucas. I apologize.
9621460	9623420	Yes, this is Oregon State University.
9623960	9625120	We're not operating on much sleep.
9625120	9627780	Is this like the U.S. version of, like, Sweden, Switzerland?
9628380	9630200	Oh, there's lots of them.
9630380	9631720	It's just O universities.
9631720	9632740	There's Oklahoma, Ohio.
9633420	9634800	I know, I know.
9634800	9639000	Listen, we didn't sleep a whole lot the last few days.
9639000	9641120	Like, we've been hard at work getting this done.
9641120	9645080	So I guarantee you that's not the worst mix-up that we're going to have.
9645080	9648080	All right, so I'm starting to see...
9648620	9649860	This is interesting.
9649860	9652920	Okay, so let's go back over to the ducks.
9653380	9655440	And we've actually got, like, a payload here.
9655440	9657420	So we're writing...
9657420	9661620	We've got this 0xf and 1f.
9661720	9664480	Or no, 0xf and 1f.
9667220	9670640	Okay, so we've got a bunch of NOPs that the behavior...
9673830	9675670	Oh, I think they're just brute-forcing.
9675670	9681670	They're just trying all different combinations of, like, opcodes to see...
9682850	9684150	I don't think so.
9684150	9686970	I think this is a little different.
9686970	9690850	I think what we're doing is we know something is disassembled wrong,
9690850	9692890	and we're just trying to either, like, increment a pointer or something.
9692890	9694790	This feels further along to me.
9694790	9695450	No, no, you see that.
9695450	9699030	They loop over all the 256, like...
9699030	9700110	Oh, immediate values?
9700110	9700770	No, you're right, you're right.
9700770	9701610	I take that back.
9701610	9707050	They're trying to explore, basically building up a playbook, I guess,
9707050	9709370	of what they have to work with.
9710450	9715210	Well, AR, I will say that of all the O universities,
9715210	9717610	only one is represented at DEF CON CTF.
9717610	9721050	So by definition, I think you might be right.
9721050	9724610	I think certainly in the CTF community, right now anyway,
9725250	9729970	Oregon State does have that edge on all of their other O universities.
9733230	9735910	The other thing I think is really interesting,
9735910	9737350	I love looking at the tooling.
9737930	9742830	I love to see somebody's using BBEdit with very tight indentation limits
9742830	9744070	so you can see a lot of code.
9744130	9746410	This is sort of personal preference in how people work.
9746410	9747710	Some people are using Vim in the shell,
9747710	9750170	and some people are using actual IDEs,
9750170	9751870	or some people are just using text editors.
9753770	9757550	So I'm really curious to see more of that as well as we go.
9757550	9760090	And then, yeah, Hex Fiend as well,
9760090	9762910	just to be able to get a quick analysis.
9762910	9765750	In fact, when this challenge was being tested,
9765750	9767430	one of the things I saw done that I thought was really nifty
9767430	9769630	was open up the binary.
9770090	9772650	And I think you could do this in Gitter, or IDA, or Binja.
9773310	9774510	It works really well in Binja, though,
9774510	9776490	to be able to just type a bunch of hex bytes
9776490	9780330	and have them disassembled simultaneously in each of the widths.
9780330	9780970	Oh, nice.
9781250	9782550	Actually, no, I take that back.
9782550	9785930	You can't actually have overlapping architectures in IDA or Gitter.
9785930	9789410	But you could easily wire up objdump to do the same thing,
9789410	9791010	just disassemble them both side by side,
9791010	9794050	let me fiddle with a bunch of bytes, and work from there.
9798210	9800110	We're looking through a bunch of these.
9800230	9804190	I think once the right one is found, it'll go quickly.
9804190	9807350	Right, so is there one or two operations here that are key?
9807350	9810390	There's at least one that, when I saw it get done,
9810390	9816170	when Glenn was producing the answer for, was definitely key.
9816170	9818550	And in fact, we've got plenty of time left,
9818550	9821330	but if we hit the 30-minute mark or the 25-minute mark,
9821330	9824530	what we'll probably do is go tell them a hint,
9824530	9826330	like the mnemonic that they should be aiming for.
9826330	9829010	And that might help them get a little bit further along.
9829150	9830690	So we've talked before about what happens
9830690	9832750	if teams don't solve this in time.
9832750	9834570	Uh-oh. Oh, that's a good-looking list.
9834570	9837790	Oh, this is interesting. I see some inks and decks.
9837790	9838810	Oh, that's useful.
9838810	9842610	Yeah, what could you do interesting if you could ink or deck a pointer?
9842730	9845750	Well, now I expect we're going to go back and look at...
9845750	9848250	No, you need the actual disassembly at this point, though, right?
9848370	9850150	Or a debugger. So there we go.
9850150	9852790	We're going to see Ghidra, we're going to see a debugger.
9853050	9854510	I think we've got a gadget.
9854730	9856710	And now it's a question of what can we do with it.
9856710	9859450	Yeah. It's like incrementing...
9860590	9864490	Very useful to either do self-modifying code
9864490	9867150	or just manipulate pointers.
9867150	9869090	Just align some pointer at something else, right?
9869090	9870750	Like, what can we point it at?
9870750	9873650	Right. You have an ink ESP there, for example.
9873650	9875050	Oh, and there's a segfault, right?
9875050	9875910	So writing a bunch of those.
9875910	9878170	So we know there's something malicious happening.
9878170	9878730	Right.
9878750	9879870	But how do we ensure that?
9879870	9883090	So, Fabio, to answer your question about why they're using a hex editor,
9883470	9885330	they're usually going to be using a hex editor here
9885850	9888170	because they wanted to just enter a bunch of different bytes in
9888170	9889810	and see how they were decoded,
9889810	9893250	how they were disassembled as 64-bit and 32-bit disassembly.
9893330	9895750	Because that's, again, the sort of crux of this challenge
9895750	9900050	is that the program tells you it's only going to run your self-code
9900050	9902550	if it only contains all NOPs.
9903690	9905070	But it's not actually true
9905070	9907090	because it's going to disassemble them for one architecture
9907090	9908530	and then run them for the other.
9908530	9910270	And so that's what you're trying to exploit.
9910350	9911730	Let's double-check back on our...
9911730	9913730	Oh, man, this is tempting.
9913810	9915190	Yeah, but let's go back over to OSU.
9915190	9919730	Let's go back to OSU and let's see where we're at over here.
9920570	9923730	Yes. So they are also looking at an opcode reference.
9923730	9926350	They've started writing a script.
9926350	9928390	So they're on the same path.
9928390	9930990	If they get that ink, they're only a minute behind.
9930990	9931310	Yes.
9931510	9937010	Honestly, if you've got an ink, they've still got a shot.
9937090	9940410	Again, Batman, I still know as much as where I put it.
9940410	9942970	So let's keep our eye on back on the ducks
9943490	9945450	and see where the mighty ducks are at.
9946130	9948410	And we're already looking at memory maps.
9948410	9954150	We should keep a vote of Jeff versus Pwnbag
9954150	9956130	or all the different other options.
9956650	9957350	So here we go.
9957350	9958970	So they're using Gitter as well for the...
9958970	9961110	But I'm waiting for like...
9961110	9963030	I think they're just so much faster than me
9963030	9964690	because they flip the Gitter and they flip away immediately.
9964690	9967330	I don't remember if they just remember the disassembly so much.
9967330	9967870	Yeah.
9967890	9971370	Maybe they just wanted to double-check one small detail.
9971370	9974470	If you have one question that you want answered, just check.
9974470	9975270	Look back at it.
9975270	9976770	What was the size of that buffer?
9976770	9979110	Again, we've got the choice here between
9979110	9980790	what register do we want to increment?
9980830	9982170	And so that's the key question.
9982330	9983650	Which one is most useful?
9983650	9986630	And I will say a debugger also makes a lot of sense here too.
9988250	9989530	Yeah, AR, absolutely.
9989530	9991130	I think everybody is impressed with OSUsec.
9991130	9994210	In particular, the most impressive thing about OSUSEC
9994210	9996830	is that they're one of the few teams that didn't combo up
9996830	9998010	with a million other teams.
9998270	9999430	Because a lot of these other teams...
9999430	10003230	To our knowledge, they are actually just OSUSEC.
10003350	10005570	Yeah, and it sounds like we've got a lot of their fans in the chat.
10005570	10007470	And yeah, that's super impressive.
10007470	10009310	You definitely get an underdog vibe.
10009730	10011690	And you want them to do well because they're competing
10011690	10013910	against these CTF giants that have been around for 10 years
10013910	10015230	and they're combining four of the teams.
10015230	10019170	Going up against PPP plus friends, that's rough.
10019170	10020090	That's daunting.
10020250	10023110	I've lost a lot to PPP without friends.
10023110	10024930	We all have.
10026310	10027270	Over the years.
10027270	10030410	All right, so take a look in the debugger.
10031430	10034770	It seems like there's some kind of controlled values in there
10034770	10036890	and is that a stack they're looking at?
10036890	10039470	Yeah, let's look at the stack pointer.
10039470	10041070	Look at the memory maps.
10041310	10043310	Again, looking at disassembly.
10043310	10045490	What is RPOSX64?
10045810	10047550	I don't know that.
10048150	10049950	No, that's RP++.
10050010	10054750	That's another ROP gadgets finder.
10054750	10057970	I tend to use that one.
10058230	10062490	I think all the cool kids nowadays use ROPR.
10062490	10067310	But I think before that, RP++ was the good stuff.
10067310	10068950	I'm still kind of using that.
10069710	10071390	This is one of the things I'm actually excited about too,
10071390	10075110	is seeing the new toys and tools.
10075930	10077230	Because I don't actively...
10077230	10078230	Oh, we got a little bit of a...
10078230	10078890	Oh, there we go.
10078890	10081150	We were looking for...
10081150	10082990	It looked like God entries maybe.
10083230	10085590	I saw a bunch of a list of function pointers.
10086690	10090110	I haven't actively played CTF in several years now.
10090110	10094350	I know enough to maybe make a small challenge an easy challenge.
10094350	10096910	And I know it's going to get destroyed by really good people.
10096910	10099370	But it's fun to see what are the latest tools.
10099550	10104090	I kind of missed out on watching people do that.
10105410	10109590	To recap, we're 19 minutes in.
10110070	10114110	And we've got at least one team...
10115730	10119370	Let's go take a look back over at OSU.
10119370	10120650	Because we are in a debugger.
10120690	10122590	That might be a good sign.
10122590	10124650	You can see them stepping through a whole bunch of NOPs,
10124650	10128390	which doesn't really give them anything so far.
10128870	10132470	But it's going to say NOP, whether it is or not, in the output.
10132510	10134010	Did you see what they sent in?
10134010	10137110	No, but you see in the debugger, it's also listed as NOP.
10137110	10139850	And also in the output to the left, it's listed as NOP.
10139850	10142470	So they haven't found the key mismatched yet.
10142770	10143310	Correct.
10143310	10145790	Or they haven't exploited it yet.
10145790	10147970	Or actually taken advantage of it.
10148830	10152830	However, you can see here over at MMM,
10152830	10159530	that you have a sequence of hex values listed here in their exploit script.
10160390	10163990	So it looks like they are going somewhere, putting together...
10163990	10168130	Oh, I wonder if they're putting together a shellcode payload in these immediates.
10168130	10169950	See, it's called smuggle32, right?
10169950	10171670	Oh, nice. I like that.
10171670	10174510	Also, again, with nice naming of things.
10174810	10177070	We've gone boring now. Now it's just x32.
10177070	10180610	Yeah, so we lost the more interesting name.
10180610	10181970	Yeah, I mean smuggle32, I think.
10181970	10183590	Oh, there we go. So at ink ESP...
10183590	10185910	Oh, no, sorry, not shellcode. Pointers, right? Clearly.
10186370	10187130	Executable code.
10187130	10187430	Yes.
10187430	10192650	So they're going to have this x32, which is going to let them rot potentially.
10193130	10195730	And they're going to be able to ink the stack pointer.
10195730	10197150	This sounds like a great technique.
10197150	10197750	Yes.
10197890	10201510	Ink the stack pointer, override the return address, maybe.
10202550	10203750	And go from there.
10203750	10206570	And you've got to end in maybe either one gadget or multiple gadgets,
10206570	10209370	or you've got a sort of straightforward shot.
10210010	10211070	Oh, there's a win function.
10211070	10213510	Or maybe you could go, oh, you know what, though?
10213770	10216530	If a team doesn't actually open this thing up in a disassembler,
10216530	10218610	if they only use a debugger, they won't see win.
10218950	10220090	Well, they have the source code.
10220090	10220730	Oh, they have the source code.
10220730	10221690	They have the source code.
10221690	10222510	That's a good point.
10222810	10226010	But this is definitely the thing that you can, like, you know,
10226010	10228250	because I think it's maybe like at the top of the,
10228250	10230290	like it's a small function at the top of the file.
10230470	10233390	Like, you know, if you just scroll past that because you don't notice.
10233390	10236690	And then you build your mental model all around, like, you know,
10236790	10238410	a rough chain or something.
10238570	10241150	It's the kind of thing that happens a lot in this environment.
10241150	10243370	When you're doing a live CTF, and you're under pressure,
10243370	10245730	and you're out of the gun, or you remembered it,
10245730	10247930	but it's 20 minutes later, and now you've forgotten it.
10247930	10248370	Right.
10248370	10252490	So it's possible we see somebody get tunnel vision and miss that.
10252490	10255470	I mean, I've done that, like, in several CTFs where, like,
10255470	10258050	oh, there was actually this memory region that was, like,
10258050	10259590	writable or executable or something.
10259590	10260410	And, like, you didn't see it.
10260410	10262530	The binary is actually executable even though,
10262530	10263510	because it's running an emulator or something,
10263510	10265810	and you assumed that the permissions were, yeah, were fixed.
10265810	10269190	Yeah, it's, you know, it can lose you a lot of hours.
10269930	10272250	All right, so we've got our ink ESP pattern.
10272450	10274490	We've got our, and we are using PwnTools, right?
10274490	10275730	So we're seeing PwnTools.
10275730	10276930	I don't think we have a payload yet.
10276930	10279550	We're still got, unfortunately for OSU,
10279550	10283950	I think we don't have an understanding yet.
10284070	10284630	Right.
10284630	10286110	I think we're kind of lost in the weeds.
10286110	10288310	So this is not looking good over there.
10288310	10292270	We're going to keep it on the ducks
10292270	10296830	and see if we can, see if this will come in.
10297330	10297790	Right.
10297890	10299670	Because this is, I mean, this is looking really good, right?
10299670	10302890	We've got the ability to misalign the stack,
10302890	10304550	which gets us a return address overwrite,
10304550	10306330	which gets us an instruction pointer,
10306330	10307490	and we've got a win function.
10307590	10309790	Right, it looks like they're dumping this to a file now.
10309790	10310950	Do we have ASLR?
10310950	10313510	Do we need to know if it's randomized or is it...
10313510	10314650	Yeah, this is...
10314650	10318310	I believe if the source, if they pull up the source again,
10318310	10320070	the first line of the source was the build instruction
10320070	10321730	that was used to compile that binary.
10322010	10324810	So we would know if they flashed that again real quick.
10326530	10329510	We've got not coding that C, so we're one away.
10329510	10331650	It makes you want to touch the screen.
10331650	10334310	Yeah, we should have some kind of plug-in on the computer.
10334310	10335730	Yeah, just like, no, no, we need to look at this.
10335730	10337350	Well, really, yeah.
10337370	10339650	The later iteration of this, we're going to have more,
10339650	10340810	I think, machines here,
10340810	10344010	but we're already overloading the number of available USB ports
10344010	10345510	even with several hubs.
10345530	10345910	Yeah.
10346310	10349450	So I'm curious.
10349450	10353850	I know there's a lot of Beaver fans in the chat.
10353870	10355410	Y'all still got faith?
10355410	10357350	Are you still in hope?
10357350	10359270	Or are you...
10359270	10360550	There we go.
10360550	10361370	See, hanging.
10361370	10365610	So there are still the Oregon fans out there.
10365610	10366230	Right, Oregon?
10366230	10366870	I said it right this time?
10366870	10367750	Okay, good.
10368230	10368790	I'll get it right.
10368790	10369130	All right.
10369130	10370890	You can just keep rotating around by...
10370890	10372190	Just different O's each time?
10372190	10372890	Yeah.
10372890	10375110	Ohio, Oklahoma, Oregon.
10375110	10376470	Switch to all of them.
10376550	10376910	Yeah.
10377010	10377550	All right.
10378070	10378430	So...
10379410	10382310	You can see there, again, doing some, like...
10382310	10382810	Brute force.
10382810	10383870	Looking for something else.
10383870	10384030	Yeah.
10384030	10386930	So this, to me, is like somebody stepping back saying,
10386930	10387890	I'm not sure I have all the gadgets.
10387890	10390010	Like, I think that was all the gadgets they needed.
10390470	10392590	I think that was sufficient to win.
10392590	10394050	Glenn, is that sufficient?
10394130	10395570	Or is there more to it?
10396130	10397930	We're getting it mostly from Glenn.
10398290	10399010	Yeah.
10399150	10400190	And I can't hear him at all.
10400190	10401690	I can't hear you, unfortunately, over there.
10401690	10403930	We're just going to roll with it and say that, you know,
10403930	10405790	they might need a few instructions.
10405790	10407930	But, I mean, it should be able to...
10407930	10410030	Because, sure, you can increment the stack pointer, right?
10410030	10411710	But then you need to actually modify the value.
10411710	10413850	So you need one more thing to actually, like...
10413850	10414350	No, no.
10414430	10418390	If your buffer is on the stack, then you don't need to do any such thing.
10419230	10422130	You can just return when it points to your...
10422130	10424890	If your input that you send in is on the stack...
10424890	10425770	Oh, right. Yes.
10425770	10426750	You just need to line it up.
10426750	10426790	Yeah, yeah, yeah.
10426790	10427310	So you do...
10427310	10428130	Okay, of course.
10428130	10428630	Right.
10428630	10433890	So I think a variant of that is possible in this particular binary.
10433930	10438030	But your input is still slightly constrained, then.
10438030	10444050	Like, let's say you would put a return address or something there.
10444050	10448750	I don't remember the source code if this was string operations,
10448750	10451210	if a null terminate will break it or not.
10451270	10452730	Ah, I see. Okay, right.
10452730	10456930	Yeah, so you could potentially smuggle it behind the other stuff.
10456930	10457690	But, yeah.
10458250	10462490	But, no, you give it binary because it doesn't assemble your...
10462490	10462910	That's right, that's right.
10462910	10467150	You give it the hex and it's actually going to put that buffer as those bytes.
10467150	10467990	Yeah, yeah, yeah.
10468470	10469610	Presumably do it.
10469610	10470410	Right.
10470550	10471630	Five minutes to a fresh start.
10471630	10472450	No, no, no, no, no.
10472450	10473630	We have...
10473630	10475690	So they have plenty of time left.
10475690	10476090	Yes.
10476470	10478950	Well, so we are coming up on...
10478950	10481830	This is the point where if neither team had made progress,
10481830	10483710	we'd walk over to them and we'd say,
10483710	10487810	you need to misalign your 64, your 32,
10487810	10491850	and you need to find a gadget that's going to let you get the payload.
10493090	10495890	But because we're already seeing at least...
10495890	10498650	Once at least one team has sort of made it to that point...
10498650	10500810	Yeah, and clearly that's the case.
10500810	10502890	Which has been for several minutes now.
10503250	10504230	We're not going to do it now.
10504230	10509770	That said, if we come up on 45 minutes, we do hit sudden death mode.
10509770	10510710	And we will swatch over.
10510710	10516810	So there is 20 minutes left where if the duck doesn't successfully finish this challenge
10517210	10519870	in the next 20 minutes, there is still a chance that we go to sudden death
10520790	10522510	and our beavers could have a chance.
10522510	10522750	Yes.
10522750	10524470	So that is absolutely possible.
10527450	10527850	Let's...
10527850	10530970	All right, I'm going to just look for a second and try to get caught up here
10530970	10533750	where we're at because it's a little concerning
10533750	10537090	when I see going back to the well of trying to find more gadgets.
10537130	10537910	Right.
10537910	10540390	And I'm wondering...
10540860	10542950	We're still looking for more patterns, but as far as we know,
10542950	10545830	we think there's enough gadgets there.
10546290	10547050	Yeah.
10548150	10552210	I have actually not looked at our reference solution for this.
10552210	10556130	So I don't know exactly what instructions it contains, but...
10556130	10558830	I thought it was an ink ESP, actually.
10558830	10559750	Or ink or deck ESP.
10559750	10564870	One of the two to misalign the stack pointer into a buffer you controlled.
10564870	10566530	Right, so we've got a question about the sudden death thing.
10566530	10567930	Yeah, so we have this thing.
10567930	10570050	So there's a time limit of 45 minutes.
10570050	10572770	So if they hit that, we will stop the challenge
10572770	10574530	because then it was...
10575050	10577450	Well, we don't want to drag this on for too long.
10577450	10581450	So in particular, the whole match on every team versus team matchup
10581450	10583290	really needs to stay under an hour.
10583290	10585930	Otherwise, the schedule starts slipping and throws off all the other events.
10585930	10586470	Right.
10587910	10588690	What's that?
10589510	10591970	All right, do you want to get on the mic and do it
10591970	10593190	or do you just want to tell us from there?
10593970	10595470	You have a mic over there.
10597030	10599590	Actually, that mic is even still live.
10599910	10601290	So careful rubbing it on things.
10601290	10605490	But if you talk into that mic, it might just be easier to hold it
10605870	10607270	and try to put it on. It's up to you.
10607270	10609050	There we go. So I think we've got Glenn.
10609050	10610190	It looks like your levels are up.
10610190	10610990	All right, let's see if this is working.
10610990	10615170	So our producer Glenn and challenge author Glenn is going to come here.
10615170	10617990	We'll tell you a little bit more, Rakesh, about sudden death in a second.
10617990	10621550	Let's let Glenn talk a little bit more about what the expected solution is here.
10621690	10622470	All right, so...
10622470	10625890	This is why the competitors have those earmuffs on,
10625890	10628210	so they can't hear us as we're talking about all these details.
10628210	10630290	Yeah, let me just make sure the levels are actually working.
10631050	10631710	All right.
10631710	10634110	So generally speaking, the way that this works is
10634110	10639750	since you have the difference between x86-32 and 64 bits,
10639750	10642630	you can get what the MMM player has found,
10642630	10646670	which is like a REX-W NOP,
10646670	10651170	which basically on x86-64,
10651170	10652930	it disassembles to a NOP.
10652930	10658150	On 32-bit, it disassembles to a decrement stack pointer NOP.
10658150	10661810	From this, you can gain control over the stack pointer.
10661810	10663550	You can go either direction,
10663550	10667070	but the way that the reference solution works is
10667070	10672290	it just changes the stack pointer to point into the buffer of NOPs
10672290	10674490	that you send to the server.
10675090	10677970	And since the binary is not pi,
10677970	10679950	and so the addresses are fixed,
10679950	10681230	and there's a win function,
10681230	10683730	you should be able to just get the stack pointer
10684450	10686530	such that when the function returns,
10686530	10687950	it returns to the win function.
10687950	10689230	I think we need to give a hint.
10689230	10690330	And here's my proposal.
10690370	10691610	Here's the hint that I'm going to give.
10691850	10695690	I think MMM missed the fact that this does not have pi.
10696090	10698310	And so they're looking for a more complicated one.
10698310	10701690	But I also think that OSU has missed the 30-bit 64.
10701690	10704390	We can give them the same hint to both of them
10704390	10706130	and help them both out equally,
10706130	10707290	which is that we can tell them
10707290	10710650	they need to double-check how these binaries were compiled.
10712390	10714430	They need to check the first line of source code
10714430	10716510	that tells them how the binary was compiled.
10716610	10718610	That will tell them both something useful
10718610	10720030	to the state that they're at.
10720770	10721470	All right?
10721470	10722530	So do you want to go get one?
10722530	10723890	I'm going to go do that,
10723890	10727790	because we did not add the messaging thing.
10727790	10728290	Yeah, yeah.
10728430	10729650	I'll go tell them.
10729690	10731290	Or just write a note out,
10731290	10732130	and then just hand them each the note.
10732130	10733490	Right. Where's your notebook?
10734030	10734790	Here we go.
10735510	10736830	We'll do this now.
10736830	10738550	We'll give them each that little bit hint.
10738550	10738950	Yeah.
10739070	10740130	And to answer...
10740130	10741010	Oh, sorry.
10741290	10744830	Glenn, kill the volume level on that third...
10745570	10746290	Yeah.
10746470	10747410	Mute that.
10747690	10750530	Sorry for the ASMR there on the microphone as we set it down.
10750530	10751770	We've got to be like, yeah.
10752870	10754070	I got you, Penn.
10754190	10755390	Yeah. Okay. Awesome.
10755390	10756150	I'm tethered in,
10756150	10758730	because I wired my microphone through my vest this last time,
10758730	10759530	so I can't go anywhere.
10759530	10759950	Yeah, looking good.
10759950	10761510	But you can explain sudden death.
10761510	10761970	Right.
10761970	10765570	So the sudden death plan...
10766690	10768770	Just keeping an eye on our duck,
10768770	10770930	just to see if they've got anything else.
10770930	10772750	The sudden death plan is that if we get into a situation
10772750	10775230	where both teammates are stuck,
10775230	10776750	neither one's making more progress,
10777290	10779010	it's not looking like they're going to solve it in time,
10779010	10780470	we have a totally different challenge.
10780470	10783770	We have an easier, simpler, quicker challenge
10783770	10785270	that we will field,
10785270	10787070	that is meant to just break a tie, essentially,
10787070	10788730	because we don't want to have something in
10788730	10790050	where neither one can solve it.
10790050	10793210	So if we get to the point where we have...
10793210	10794470	So 15 more minutes.
10794590	10796110	If we get to that point,
10796110	10799450	we will deploy a sudden death challenge.
10799450	10800210	We'll change it and say,
10800210	10802850	sorry, you didn't solve it in the 45 minutes.
10803070	10804110	Here's another challenge.
10804110	10804890	Try that.
10804890	10806850	We haven't figured out if that takes too long.
10806850	10808630	We just kind of have to wait until that gets done.
10809230	10809970	So hopefully those...
10809970	10811870	But those are intended to be, like,
10811870	10814510	the easiest possible challenges that we could do.
10814510	10816050	So that's what we're doing with that.
10816050	10818170	We're writing out the same hint to both teams.
10819430	10822450	First line of source code.
10822790	10823530	So we're going to tell them
10823530	10825510	that they should each double check
10825510	10826950	how the binary was compiled.
10827530	10828590	I think that'll be nice,
10828590	10830810	both fair and yet also useful to both of them.
10830810	10832930	So we'll go ahead and do that
10833890	10835870	and get that to both the teams.
10835910	10837350	Because what's going to happen here is, again,
10837350	10839170	if the duck can finish this out,
10839170	10840490	if they can actually successfully solve this,
10840490	10841230	they have a shot at it.
10841230	10842550	But if they don't,
10842550	10844410	then they're going to basically kind of be reset.
10844410	10847170	They're both going back to zero on this new challenge.
10847170	10853630	So the new challenge will be, like,
10853630	10854950	fresh territory for both of them.
10854950	10858450	So let's switch, maybe,
10858450	10860970	to one of the other cameras
10860970	10863070	and we can see in the background
10863070	10865810	as Carl's going to go deliver our hints
10865810	10867290	to both competitors.
10867730	10870890	And we'll see if this has an impact on them.
10871990	10875010	In the meantime, thank you.
10875010	10877910	Is it down down or dawn dawn?
10877910	10879390	I forget. I feel like I should remember this
10879390	10881170	because I know I've seen the hint before.
10881670	10882470	So that's a good question.
10882470	10883870	What is osusec up to?
10884150	10886650	We're just looking at the source again, it looks like.
10887950	10891270	So we have deployed the hint to both players.
10893570	10897270	And it's hard to tell because they're just looking at the...
10897270	10899050	Yeah, that's not a bad idea, Peter.
10899050	10900630	They might need a bigger hint.
10900990	10904030	We could give them both an explicit hint
10904030	10906610	of something like the binary is not ASLRed
10906610	10909290	and this is 64 32-bit misalignment
10909690	10911730	to get them both past the next down.
10911730	10912590	Thank you, down down.
10913710	10915070	Or maybe it was down dawn.
10915070	10916390	It could be one of each.
10916890	10923070	So we do have a bigger hint we might have to give
10923070	10923830	to both of them.
10923830	10925030	We will see.
10925030	10927130	I would not be surprised.
10927410	10928850	And again, this is one of those things
10928850	10930010	where if you're playing at home,
10930010	10931750	you look at this and you think,
10931750	10934470	oh man, all you have to do is move the stack pointer.
10934470	10936730	You should totally be able to finish this out.
10937050	10938510	It is so different.
10938510	10940890	It's so different when you are on the camera,
10940890	10942610	when you've been stuck on the step for a while,
10942610	10943950	you get kind of into rabbit holes.
10943950	10945910	You're thinking, surely there's some other gadget
10945910	10946530	that I'm missing.
10946530	10948290	Surely there's some other thing that I need to find.
10948950	10953390	Or if you feel like you just don't even have a way to do it.
10953390	10954610	So let's go ahead and prepare the next hint
10955130	10956510	that we'll give them in a couple minutes.
10956510	10958250	If one of them starts to make more progress,
10958250	10959490	maybe we'll hold off
10960530	10962290	and we'll see what happens.
10965710	10967270	If we give them the opcode,
10967270	10969950	we're giving one team what the other one already has.
10971590	10973490	So I think this hint should say...
10977450	10979490	Yeah, maybe we can...
10980070	10980830	Yeah, let's think.
10981450	10982390	What's the clock at?
10982390	10983490	Yeah, I think...
10984190	10985690	Give it a few more minutes, right?
10988970	10990590	So there's a question about how long...
10990590	10992990	So the idea is that at 45 minutes,
10992990	10993910	we will switch to the...
10993910	10995830	And we start every match on the hour.
10995830	10999590	So we started for us at 4 p.m. Pacific time.
10999590	11001250	So we're 34 minutes in.
11001250	11004590	So we have 11 more minutes before we...
11006910	11007870	So we're...
11007870	11009250	Are we brute-forcing?
11009250	11010730	Maybe we're done brute-forcing.
11011190	11013110	Yeah, they've removed the for loop.
11013130	11014030	Okay, so we're not...
11014030	11016070	They're putting some address in there.
11016610	11018150	This is test.py.
11021820	11023020	Okay.
11023900	11025400	So this...
11025400	11027140	Python quit unexpectedly.
11028760	11030280	Wait a minute.
11031040	11032800	Execve launch.
11033540	11035980	Maybe we are close.
11036500	11037320	Yeah.
11037320	11038000	Okay.
11038000	11040300	This is a good sign.
11041780	11042960	Okay, yes.
11042960	11044780	Oh, look, he's looking for system.
11045140	11046860	Okay, okay.
11047000	11048780	This looks positive.
11048780	11052640	I think the realization has stuck home.
11053040	11056440	I think we're about to watch it come home stretch.
11056580	11059420	I still don't see osusec, unfortunately,
11059420	11062500	coming up with that key 3264 insight.
11063520	11066140	Even after they hinted the binary was compiled for 32-bit,
11066140	11067880	but the disassembly is 64-bit.
11069120	11071020	So we're looking for a bin as a string.
11071020	11072980	We're going to pass it as an argument to system.
11072980	11074580	Right, so they're going to skip the win function.
11074580	11076820	They're going to just put the...
11076820	11077340	But this is...
11077340	11079460	Again, there's literally a win function.
11079460	11080500	They just need the address of that.
11080500	11083180	But luckily this is 32-bit, right?
11083180	11085720	So they can just put the argument on the stack.
11085720	11088480	I mean, it's marginally more difficult.
11088640	11091700	You would need to put two addresses on the stack instead of one address.
11092100	11094520	As long as there's room, and I believe there is plenty of room.
11094520	11097840	Not a huge loss, but definitely could have cost them.
11098600	11100900	This is looking real close.
11100900	11102300	We're getting the last address in.
11102300	11103660	Let's see if this does it.
11105080	11106780	Again, we predicted this earlier.
11106780	11110560	Like I said, the win function we gave them the source, it's very easy to miss.
11110560	11116080	You 100% can get tunnel vision and totally either have forgotten about it or never seen it.
11116080	11118640	In fact, in this case, I wouldn't even be surprised to have never seen it.
11118720	11122060	Because there's not been a lot of poking around in the...
11122060	11125800	No, because they were so quick at understanding what the source code was.
11125820	11126640	And that's the thing.
11126640	11128300	Then you build this abstraction in your head.
11128300	11129860	This mental model.
11129980	11133200	This thing just doesn't exist.
11133860	11135480	There it is! Congratulations!
11135980	11137540	All right, we have a win.
11137800	11139240	Congratulations to our ducks.
11139540	11141220	I'm excited we didn't need a sudden death.
11141220	11143100	That is our third round complete.
11143220	11145400	We will see you all back here in about...
11145400	11145700	Wait, wait, wait.
11145800	11146760	Hold on.
11146760	11147820	That was just local.
11148300	11149280	No, no, it's not.
11149420	11149960	Submitter.
11149960	11150660	It ran.
11150860	11151480	Did it run?
11151480	11152500	It ran, right?
11152860	11153740	No, no, no.
11155140	11155760	Sorry.
11156280	11157280	You didn't trigger it, right?
11157280	11158260	I saw it trigger on...
11158260	11158700	Yeah, yeah.
11159100	11160140	We're done, we're done, we're done.
11160140	11161380	All right, congratulations.
11161380	11161920	Okay.
11162100	11165400	We will see everybody back here at the top of the next hour.
11166760	11168300	Very, very fun match.
11168300	11169380	Thanks to both the teams.
11169380	11171140	We'll see everybody in a few minutes.
11172140	11173060	We out.
11233970	11235370	Bye.
11235370	11236290	Bye.
11236290	11237690	Bye.
11371180	11372600	Bye.
11373080	11374480	Bye.
11374480	11376120	Bye.
11710330	11710550	Bye.
11710550	11710750	Bye.
11710750	11710970	Bye.
11862020	11863440	Bye.
11948110	12302430	Bye.
12302430	12303950	Bye.
12303950	12315930	Bye.
12782150	13122080	Bye.
13122080	13122220	Bye.
13189800	13190980	Welcome back, everybody.
13191000	13194160	We are here again, the last round of the day.
13194700	13197060	Apologies for the 10-minute delay on this one.
13197320	13198980	We're trying to hunt down a bad cable.
13199020	13203140	Somewhere in our infrastructure is a bad cable, and it's causing one of our streams to have issues.
13203400	13206460	So we might have some intermittent connectivity for one of our players.
13206860	13208240	Apologies for that.
13208400	13209880	We're going to go ahead and get a kickoff right away.
13209880	13212960	We want to get these team members back to their teams as soon as we can.
13212960	13219900	So let's go ahead and get a countdown of 5, 4, 3, 2, 1.
13219900	13220940	Go!
13221280	13223420	And now they're off.
13223900	13224500	Okay.
13224500	13227880	So we've already got the first one downloaded.
13227880	13228880	And this particular one...
13228880	13231760	Actually, can you grab me my notebook over there with our teams and whatnot?
13232500	13235700	This one, we've got the new organizers.
13236380	13240640	And I believe we've got Team Taiwan was the name that they requested.
13240640	13248500	Because it's, again, another one of these mega teams that has a conglomeration of many different teams.
13248500	13254060	So we've got Team Balsan, Team 217, Team TSJ.TW.
13254460	13259000	So there's another team that has TW in the name that's Tokyo Westerns, a Japanese team.
13259020	13261560	But this is the Taiwanese team because it's .TW.
13261980	13267120	So let's go ahead and take a look at Team Balsan.
13267120	13269420	It should be the one that I've got over here on my monitor.
13269420	13273320	And they are already off, and they're in IDA looking at our challenge.
13273320	13277760	Now, again, you'll notice all of our challenges are named Challenge, just the way that our Docker deployment kind of works.
13277760	13282300	The official name of this challenge is called Nerd Sniped.
13282340	13282980	Right.
13283540	13286280	So what are things you can get Nerd Sniped by?
13286280	13287320	A lot of things.
13287340	13287900	Yeah.
13288460	13289180	We'll see how that plays out.
13289180	13291280	I get Nerd Sniped by, like, a Rubik's Cube.
13291280	13291440	Yeah.
13291440	13292780	A good puzzle, maybe.
13292780	13293860	Yeah, a good puzzle.
13293860	13295380	Maybe something like that.
13295380	13296340	That'll do it.
13296340	13299540	So we got you 1080p back and going.
13299540	13309200	Hopefully, we'll figure out our issue with our HDMI cable, and we'll have much better consistent capture across both team members tomorrow.
13309360	13311640	Something about this cable is like it's heating up or something.
13311640	13316600	We had several hours of testing last night with no problem, and something's going on now.
13316600	13318640	So we'll give that a run.
13318940	13321820	And sure enough, I literally just saw a rename solve puzzle.
13321840	13324880	So we've renamed this function Solve the Puzzle.
13324880	13328560	So what they're looking for, they know it's a puzzle of some sort.
13328620	13335100	I'm curious if we get someone just kind of running it and interacting with the binary, or if we're going to do more static analysis.
13336480	13340020	But actually, yeah, this should be much higher quality with the full 1080.
13340420	13342980	Unfortunately, we don't have even the local recordings.
13343140	13344960	We're also not 1080.
13344960	13346380	They were only in 720 as well.
13346380	13348160	So I apologize for those first couple matches.
13348740	13355620	We're not going to have the higher quality video for those either.
13355620	13362560	But all 12 other matches from here on out are going to be in high def because we have a lot of these to go.
13362560	13365320	So you'll see your favorite players that won in the first couple rounds.
13365440	13366440	They're going to come back.
13366440	13367980	We're going to see them again.
13369580	13370480	Oh, no, that was cool.
13370560	13372080	I didn't notice that website.
13372080	13373280	Have you seen that one before?
13374200	13374560	No.
13374580	13375360	I'm curious what that was.
13375360	13377060	So now they're on the Ubuntu repo.
13377480	13380600	They're getting a particular glibc version, which makes sense.
13380820	13382100	That's often common.
13382100	13386020	Now, I think for most of these, we included a libc if we thought it was necessary.
13386200	13386520	Yes.
13386680	13388480	So it's kind of a hint to the teams.
13389260	13393700	We're trying to give out everything that we could, make it as self-contained as possible.
13393920	13398820	And so we'll see if that one ends up being useful.
13398820	13400840	But we've got our binary challenge.
13400840	13406680	This one is starting to be a little bit more difficult, though, I would say.
13406680	13409820	Our challenge difficulty is cranking up a tiny bit.
13410260	13413580	And we're going to see that kind of trend throughout the whole rest of the weekend.
13413580	13418000	I'm sure we'll have some easier ones, some that somebody finds an amazing solution to, solves it quickly.
13418000	13425420	But on the topic of difficulty, we have an idea of what's more difficult and what's easier and so on.
13425420	13427700	But, of course, we can be wrong.
13427700	13433100	People can have different specializations in their skill sets and so on.
13433100	13435260	So something that we might think is...
13435260	13436380	In both directions, right?
13436440	13437520	Exactly, yes.
13437520	13443320	So something that we might think is easy might be actually kind of tricky and then the other way around.
13443320	13445980	So it's going to be interesting to see what's going on.
13445980	13450180	There's still some reverse, like the initial reverse engineering going on of the program.
13450180	13454320	For example, this kind of step was not really needed in the previous challenge
13454320	13458120	where we just gave them the full source code with names and everything.
13461320	13463980	As an organizer, you have a lot of levers to pull.
13464500	13467160	It's ironic because we have the organizers here playing,
13467160	13470060	although, unfortunately, they're on our non-capture screen, unfortunately.
13471560	13473520	I just had to make sure that we had them lined up right.
13473520	13474900	I freaked out for a second not realizing.
13474900	13476540	They are the right halves.
13477440	13480800	But the team organizers, we're not seeing them.
13480800	13483620	But as a challenge organizer, as somebody making challenges,
13483620	13485820	you can strip a binary. You can not strip a binary.
13485820	13487160	You can include debug symbols.
13488300	13490760	Different levels of optimizations.
13490760	13495320	Because a lot of optimization also kind of acts as a slight obfuscation.
13495320	13496820	Mild obfuscation, yeah.
13497580	13502000	We have all seen these optimized mem copies and everything,
13502000	13504780	but you have all this bits magic stuff going on.
13505320	13508880	Yeah, you get vector operations in your mem copies.
13510260	13514880	And that's where, to some degree, you can make an easy challenge hard
13514880	13516400	with just tedious things.
13516480	13519200	So it is interesting that you see a lot of, I would say,
13519200	13520780	cheap challenge design where it's like,
13520780	13522620	yeah, we just made it harder by doing X.
13522700	13524720	And it didn't make it more interesting, it just made it
13525200	13528160	slightly more annoying to do the thing that you want.
13528160	13531020	So sometimes a really good easy challenge is actually
13531020	13534840	you're just really focusing on that one core thing that you want to do,
13534840	13537680	which makes a lot of fun for what we're doing here.
13537700	13538520	Right.
13539140	13542460	So still, we mentioned trying to name different things.
13542460	13544860	We've seen they name the functions, like solvePuzzle,
13544860	13547220	and you see some variables getting named, like the input.
13548500	13553800	It's all trying to get an understanding of what is this program doing.
13554000	13555820	And there are kind of two parts to it.
13555980	13560200	First of all, what's the intended functionality of the program?
13560200	13562100	And then from there, you can start to understand
13562960	13566240	in what way is it acting not as intended?
13566240	13567100	Like, where is the bug?
13567100	13571620	Or, in this case, where the author intended a bug.
13571620	13571980	Right.
13571980	13574320	But in the normal case where it's unintended vulnerabilities.
13574320	13574600	Yeah, exactly.
13574600	13577260	Or in this case, what's the surface level intended?
13577420	13579040	What's it claimed to be able to do?
13579040	13579520	Yes.
13579580	13582820	And then what does it actually do that may be different?
13582860	13583540	Right.
13584140	13586440	So let's see what we're doing.
13586440	13588140	And this is nice, too, because we're actually getting...
13588140	13590740	This is the first time we've seen a little reverse engineering workflow.
13590760	13591120	Yes.
13591120	13594120	A lot of the other ones have been, like, basically a quick glance
13594120	13598400	at the code or disassembly has kind of, like, revealed what's going on.
13598400	13601540	Here, they actually need to kind of understand what is going on.
13602080	13602440	Okay.
13602440	13606560	So we're still sort of starting our framework for our exploit here.
13606560	13610140	But I think it's just getting the menus and interacting with it, right?
13610140	13610780	And so we're looking.
13610780	13611180	Oh, okay.
13611180	13612940	So there's a current puzzle state.
13613280	13613660	All right.
13614200	13614600	So...
13614600	13614980	Puzzle.
13614980	13616100	That puzzle looked interesting.
13616100	13618740	It looked like maybe, like, a 9x9 grid of numbers.
13618740	13619180	With numbers.
13619180	13619480	Yeah.
13619480	13621320	It could be maybe, like, a Sudoku.
13621340	13623240	I think that's a great guess.
13623240	13623340	Yeah.
13623340	13626000	And, of course, you know, we're a little spoiled here, a little tainted knowledge.
13626000	13627940	But this is indeed a Sudoku.
13628300	13633160	In fact, when somebody was, like, kind of play testing and validating this challenge,
13633160	13634180	we sort of were like, wait a minute.
13634180	13636800	You just solved a Sudoku, and that's it?
13636800	13638580	And the author was like, no, no, no, no, no.
13639060	13641600	And that's not actually possible.
13642000	13643760	So it is a little bit trickier than that.
13643760	13649240	So we'll see as our teams discover it's not just a straight put it into a Sudoku solver,
13649240	13650940	get a correct answer, and win.
13651280	13652880	It is going to be a little bit more tricky.
13652880	13657120	And this is one I am almost positive we're going to need a hint on.
13657140	13657440	Right.
13657440	13662760	So I'm going to propose at, like, 15 minutes in, if we don't see...
13663840	13664800	Like, progress.
13664800	13665300	Progress.
13665300	13668040	In fact, actually, why don't you go ahead and take a look at the organizers, maybe, too.
13668040	13669140	Yes, I will do that.
13669140	13673540	And if we're looking for them to kind of have a hint as to what they're doing.
13673540	13675040	Like, indicate that they know what they're doing.
13675760	13676360	Yeah.
13676360	13676940	Yeah.
13677580	13678500	Oh, does it come on occasionally?
13678500	13679120	Okay.
13679360	13680900	So it's apparently flickering in and out.
13680900	13683320	Occasionally we're getting our video.
13683700	13685400	We swapped out the capture card.
13685400	13687560	That worked for a while until it didn't.
13687560	13689560	And then we swapped out the USB-C cable.
13689560	13691040	And that worked for a while until it didn't.
13691180	13696080	And so now we're convinced that it's just the HDMI cable itself that is causing trouble.
13696080	13699460	And I think this has been true even if we were direct wired into the laptop.
13699540	13702300	So it's not the capture on the other side.
13702680	13706600	Yes, because we also did swap out the USB-C adapter once, too.
13706620	13710040	So we swapped every component except the HDMI cable.
13711560	13714720	Partly because they're, like, taped to the floor and they're a 30-foot long cable.
13714720	13715620	So we've got to go and get some...
13715620	13716160	Oh, there we go.
13716160	13716800	I saw a...
13716800	13719200	I did see a solver pop up briefly.
13719200	13720080	I saw a Sudoku solver.
13720080	13726500	Yeah, I was just going to say, also, the player from the organizers copy-pasted the current state of the puzzle into...
13726500	13728560	And they Googled for a Sudoku solver.
13729160	13732380	So we'll see to what extent that will help them.
13734180	13739080	Again, I'm not completely familiar with the intended solution here.
13739080	13747040	But I would assume that it still involves solving the Sudoku, but not only doing that.
13747040	13748880	It is trickier than that.
13748880	13749960	Yeah, that's right.
13749960	13752900	So I have a little bit more info.
13752900	13759560	Yeah, we're still seeing that kind of solver flashing in and out occasionally on the display.
13762020	13764040	There's going to be some memory corruption here.
13764100	13764780	There is indeed.
13764780	13765400	This is not just...
13765400	13771400	Now, although I will say, it is actually a perfectly valid category of challenge in a lot of CTFs, right?
13771400	13775400	Where you would actually do have a more programming challenge or a puzzle.
13775400	13776480	That happens.
13776480	13782460	And I think, honestly, even in moderation, I think those can be fun and enjoyable mixed in amongst a traditional happy competition.
13782460	13785920	Yeah, typically they are branded as PPC.
13785920	13792440	It's the category in normal CTFs, which I think is like professional programming challenge or something like this.
13792700	13799540	People familiar with like, you know, ICPC style algorithms competitions or so might find.
13799540	13803440	Although usually they're kind of like framed slightly differently.
13803460	13807120	But it's kind of like the same general idea there.
13807120	13809720	Yeah, and there's no security flaw.
13809720	13818040	There's really just rather solving some hard mathematical problem with the right algorithm or with the right approach to kind of get it working.
13818280	13819980	But that's not the case here.
13819980	13822940	There's an aspect of that, but that's not enough.
13822940	13825060	This is truly a point of all.
13825060	13826860	There is memory corruption involved.
13827780	13834060	Although I will say, and I'm looking to see if somebody finds the sort of like win function.
13834060	13840340	When you have a correct solve Sudoku, I think we're going to see...
13840340	13852360	So this function here, they've named it check, returns whether or not we've successfully calculated a value, a valid solve.
13852780	13857840	The result of that is going to determine basically what you call a win function.
13857840	13859860	So it is going to kind of do the win for you.
13860060	13862880	So you already sort of know that you have to solve it.
13862880	13866340	Your question is, okay, what mechanic will actually get me to solve it?
13866340	13867480	And can I cheat it?
13867480	13869600	Do I have to have a combination of a solver plus a cheat?
13869600	13872080	What is that ratio going to entail?
13872080	13876580	Because at face value, it kind of looks like you just solve the Sudoku and you win.
13877100	13883200	But you know, like DEF CON finals, even being a sort of easy live CTF, I would think people would be like,
13883200	13885740	no, wait a minute, there's something here.
13885740	13887940	And I think if you can also...
13887940	13891580	There's not a lot of values here.
13891580	13893000	And so I don't know.
13893700	13898580	I think the idea is that these are just not solvable because there's not enough information.
13898620	13901600	Some Sudoku balls are very minimal, but they're designed to be solved.
13901680	13903000	They're made to be solvable.
13903000	13909800	I think I remember that if you have 13 digits, you're guaranteed to have a unique solution.
13914050	13915870	Okay, so this one definitely has more than that.
13915870	13918710	But there's going to be some other issues with it still.
13918710	13920750	I'm not sure if my trivia is correct here.
13920750	13924790	I vaguely remember, like, if you have 13 digits, you have a unique solution.
13924790	13928090	You can have a unique solution with fewer digits, but it's not guaranteed.
13928090	13931950	I don't know that that's true because I can just give you all of the ones, for example.
13932610	13933910	But that's just nine.
13934330	13935810	And all the twos.
13935970	13939070	And that doesn't give you enough information to know where all the other numbers are.
13942530	13943090	Maybe.
13943090	13947350	Maybe it's 21 or something then.
13947910	13949110	There is a number.
13949110	13953750	Where is our cracking the cryptic phone of friends?
13953790	13956510	And go to the YouTube stream.
13956750	13958430	Yeah, great channel.
13958430	13959350	So here we go.
13959350	13961810	We're seeing Sudoku solver Python.
13961810	13963450	So we're seeing people investigate that.
13963450	13966010	All right, we are now 15 minutes in.
13966050	13968070	I think we should be preparing our hint.
13968070	13970730	Because I actually think this one is a little too subtle.
13970730	13976190	And we're going to have to point them in the right direction without actually giving them the hint.
13976190	13984290	Yeah, and we should notice now that even though the time is 24, we started late because of technical difficulties.
13984290	13986570	So they are only 15 minutes into the challenge.
13986570	13987010	Correct.
13987010	13994470	So we have more time than the clock looks like compared to the other ones where we started much closer to on time.
13994550	13997210	So we're trying a solver.
13997210	14001630	Again, so trying a solver on here, which is not going to be sufficient.
14001630	14006410	So I think we need to figure out if there is an official hint from the challenge author.
14006790	14015570	So we've got Glen over in the production booth, as it were, which is otherwise known as the other side of the table that we're sitting on here.
14015570	14016310	Yeah.
14017030	14020490	It's going to reach out and see if we have an official...
14020490	14025710	We have like three times the number of computers compared to the number of crew members for this setup.
14025710	14033650	We have a lot of displays and, I mean, an order of magnitude more cables, I think, than...
14033650	14035690	Yeah, but it's...
14035690	14040490	And once we find out what is breaking our secondary capture...
14040490	14043270	Actually, speaking of which, I'm going to go ahead and take a look at the organizers.
14043270	14051030	I want to see if they're making progress while we figure out what we're doing with that hint, if we're going to give it.
14051230	14055210	And if you guys have any questions about where we're going, let us know.
14055210	14055750	Yep.
14055790	14057870	And I'll be back with an update.
14057870	14068630	Great. So while Jordan does that, we can try to see that we...
14068630	14077010	Okay, so I've just been informed that the puzzle that you were given is impossible to solve.
14077010	14078470	That's kind of the trick here.
14078470	14084050	So at face value, everything looks fine, you just need to solve this Sudoku, but actually there is no solution.
14084050	14087290	This is an invalid state for the Sudoku.
14088810	14090330	So once they...
14090330	14092490	And this is something that can really throw you off, right?
14092490	14098870	Because if you take this and you put it into a solver or something, and the solver says, like, no, there's no solution,
14098870	14106630	you might be starting to think, like, maybe the solver has a bug, or maybe the format of my input is wrong, or something like this.
14107630	14113830	And only later you might question the impossibility of the puzzle.
14113890	14124050	So this is where they have to then cheat to solve the impossible Sudoku to then get this win function.
14125010	14137510	We can see here on the Battlezone screen that they are looking still at the kind of decompilation here, thinking hard about this.
14139170	14144190	Trying to figure out, like, what is going on here? Like, why is this not working?
14145810	14149010	They have this... it's this check function, right?
14149730	14156410	So they're trying to think about, like, in what way does this function not behave correctly, maybe?
14156410	14161250	Maybe they have realized that, like, you're given an impossible puzzle.
14162470	14165110	So, let's see, they're going to try to...
14165110	14168510	Seems like they're writing, like, a small, like, formatting function.
14168510	14174150	They're looping through, like, the X and Y axes and printing something.
14175410	14176490	So, yeah.
14179370	14183790	Still unsure exactly where they're going with that, but let's see here how they run it.
14184070	14189470	So, a quick update is, both teams are taking the sort of wrong approach now, and they're still looking for solves.
14189470	14193010	So, the hint they're both going to get is, you can't win, you need to cheat.
14193690	14194410	Right.
14195570	14201250	Which is... almost feel like there's some kind of deeper philosophical thing here.
14201250	14203290	I mean, it's a true life statement, probably.
14203570	14203890	Yeah.
14205490	14206150	Yeah.
14207350	14207630	It's...
14210710	14214110	Yeah, I had a lot of thoughts about that, but let's not go too off topic.
14214110	14214870	Too deep.
14215050	14215450	Yeah.
14216130	14217070	I, you know...
14217070	14219950	So, here's the other question. Do we want to give them a little bit more of a hint?
14220710	14224050	Do we want to tell them exactly kind of how, like, more of a hint as to what they want to check?
14224050	14225090	I think we have time, right?
14225090	14227030	No, no, we have time. Let's do that.
14227410	14229230	And, yeah.
14229250	14230250	In fact...
14230250	14231650	Well, that's too late now.
14232130	14241930	I mean, I was thinking in terms of, like, since this is the last match of the day, we could have afforded, like, you know, extending the standard game time.
14241930	14242450	Yeah, but...
14242450	14244270	But I don't know if it's fair to do that once...
14244270	14248990	Well, we do it to the same two players. Either way, it's only fair relative to each other.
14249190	14252730	Because every match is different. Different challenges, different conditions, and so to some degree...
14252730	14253210	Right, right.
14253210	14254270	So, that doesn't matter.
14254270	14255170	You could argue that it's fair, but...
14255170	14258770	But let's see, you can't win, you need to cheat, you need memory corruption.
14258830	14259490	Yes.
14264030	14266590	It's dangerous to go alone, like, take this memory corruption.
14266590	14269990	Yeah, it's dangerous to go alone, take this memory corruption. I love it.
14273350	14276170	Alright, here goes the first hint.
14276190	14276970	Yes.
14277170	14281490	We'll see if this gets them on the right track again, or if we need to...
14281490	14286310	In the meantime, I'm trying to decipher what this script is doing.
14286310	14291170	They have a solve function there, which then will not really help them, since you can't solve this.
14294070	14294430	It's...
14296430	14300970	Yeah, it's still a little bit unclear where the players are in this.
14301150	14303370	Unfortunately, we can't read the minds of the players.
14303370	14306430	That would be immensely helpful when doing this type of commentary.
14306430	14309250	We can just try to guess based on what we're seeing on the screen.
14310730	14316470	Yeah, again, if you have any questions or comments from all of you watching this...
14316470	14321570	I got some smiles. I wish you all could have seen it, but there was like, oh yeah, of course, okay, okay.
14321570	14327630	So they were both going down the solver approach, so I think we're going to see a lot more IDA now.
14327630	14328050	Right.
14328150	14332610	We're going to see them actually dig into the binary and follow it that way.
14334030	14342710	So that's nice to hear, that the hint was appropriately leveled and that it was useful to the players.
14342730	14346350	Yeah, I think they both were at a spot where it's going to help both of them.
14346670	14350490	We'll see if either one starts to take advantage of that or not.
14350490	14353530	So we're looking at checksec, we're looking at the binary properties.
14353570	14358130	And that's actually a great habit to be into. I really think that a lot of people overlook that.
14358130	14367170	Again, we saw that last one with the mallard, with the ducks, where it not being randomized, I think added a little bit of extra slowdown there.
14367170	14368570	Right, yes, definitely.
14368690	14370670	Because you could have gone straight into...
14371630	14378090	I think I have this as a pretty good habit. Always run file, always run checksec.
14379730	14384030	It's kind of like when you're doing reversing engineering challenges.
14384030	14386530	Always run strings, always binwalk.
14386730	14390630	Just out of habit, it's just the things that you do.
14391350	14392930	Alright, so let's watch this.
14392930	14396150	Okay, so now we're seeing them actually where we want them.
14396150	14397950	Now they're back to reverse engineering.
14398110	14399810	They're looking for vulnerabilities.
14400750	14405410	And what they're going to do is they're going to use the vulnerability to win.
14405410	14413770	They're going to use the memory corruption to not code execution directly, but to the win state.
14413770	14418050	So what they're going to do is they're going to need to corrupt in such a way that they can create a solved board.
14418050	14419670	And they should hopefully still remember this, right?
14419670	14421830	Because they know that the point was to win.
14421830	14423950	They saw that. They saw the win state.
14423950	14426210	They saw that's why they were trying to solve the puzzle.
14426470	14427970	So I think they know that.
14428090	14435210	The question is, are they going to be able to figure out the memory corruption in time?
14435210	14436650	So that's the question that we're looking for.
14436650	14438030	And this is kind of interesting, I think.
14438030	14442330	This type of pwnable where, like a lot of pwnables, you have kind of this standard workflow
14442330	14446430	where you try to gain control of certain aspects of memory.
14446430	14448470	Yeah, yeah. It's a pointer overwrite.
14448470	14450050	Or it's something that gets you a memory write.
14450050	14451250	So you get a pointer overwrite.
14451250	14453230	To a ROP chain, to like, you know.
14454010	14458110	But here you're just doing kind of like, maybe we call it like a local memory corruption.
14458290	14463490	Or it's not quite a logic vulnerability in that it is memory corruption, but it's not useful.
14463490	14466710	It's not being used for control flow hijacking.
14466710	14471550	You're using it specifically to just change the state and change the behavior.
14471550	14474550	Yeah, the functionality through its normal legitimate means,
14474550	14477490	but by entering a memory state that it didn't intend for you to enter.
14477490	14482850	Right. So in a lot of these cases, the program wouldn't crash, for example,
14482850	14485130	if the exploit is slightly wrong.
14485130	14488250	Yeah, you just failed to get a correct puzzle. It's just not solved, right?
14488250	14488690	Yeah.
14489150	14492890	Which is not to say that they couldn't crash with this vulnerability necessarily.
14492890	14494650	It depends on how it's actually constructed.
14495010	14501050	But there are certainly use cases, or there are cases where an exploit isn't actually exploitable
14501050	14504670	in the direct code execution state.
14504670	14509470	It is rather just by exercising some other logical state of the program.
14509470	14516250	And I think, in general, everything we say here about pwnables and general ideas,
14516250	14519890	there are a lot of ifs and buts and stuff to all of these exceptions.
14520370	14525530	We're trying to make some broad strokes here about different types of challenges.
14526830	14531450	I'm a little nervous. This one feels like the first one we might have to unleash a sudden death.
14531450	14532430	I'm hoping we don't.
14532430	14532870	Right.
14532930	14538730	And I like the challenge because, like we were talking about, I think it has that good twist.
14539030	14544630	You're going to not get a pointer overwrite, but you're going to influence the state of the binary.
14544630	14549510	So I'm hoping. And we've seen great work from all the teams so far.
14549510	14553810	So we know we have high-quality people. We'll see how it's going.
14555090	14557690	This is also, I say, one of the larger binaries.
14557690	14560810	We all get very small binaries, very, very self-contained.
14560810	14563910	This one's a little bigger. It's still, I think, small on the CTF scale of things,
14563910	14566830	which in CTF is smaller than real-world binaries.
14566830	14567210	Oh, yeah.
14567210	14571670	But relative to the live CTF binaries, this is larger than some of them.
14572830	14577910	Yeah, luckily they don't have to sift through a 300 megabyte binary.
14577910	14582910	What? Who doesn't love sorting out massive binaries?
14582910	14588570	Yeah, I think I remember opening the Minecraft binary in IDA at some point.
14588870	14592970	Then I went to bed and continued the day after.
14592970	14597930	No, I think it was just barely finished, but it took eight or nine hours to analyze that.
14598530	14604910	Big binary or even obfuscated binaries can take a long time to analyze for sure.
14604910	14609690	All right, here we go. So let's look. We're seeing an int64 int.
14611410	14614910	So making sure the types are correct.
14616110	14621490	That's good. I think analyzing the types is useful.
14621490	14624990	Although what I will say is that just looking at decompiled code
14624990	14629470	is maybe not the best way to analyze any kind of type issues, right?
14629470	14635390	No, I think it's a good start to give you the big picture.
14637250	14640470	But then at some point you might have to drill down on things.
14640470	14645070	And I think this is also kind of interesting again with different types of pwnable challenges.
14645330	14650710	Some pwnable challenges like the bug is obvious and the exploitation is difficult.
14650810	14653350	And then you have these more like reversing heavy pwnables
14653350	14657010	where you have to figure out very complex data structure.
14657010	14661170	But once you have kind of sorted everything out, the bug just like appears.
14661630	14664390	And then from there it's typically not that hard.
14664430	14668230	And I think our previous examples, several of our previous challenges
14668230	14671990	were more on the side of like it's obvious where the bug was
14671990	14674470	but actually landing it was sort of the tricky part.
14674470	14678210	Like we just let you run syscalls, but which ones? That's the tricky part.
14678210	14680250	Like actually your payload, the execution.
14680390	14682890	Same thing with like not coding. Like we just ran your bytes.
14682890	14684250	Sort of you had to like do that.
14684250	14686390	I think there's those sort of like shell coding heavy
14686390	14689430	and those sort of like constrained environments are some of my favorite challenges.
14689790	14693270	Probably because I'm just bad at the more, I don't want to say tedious,
14693270	14696910	but the more in-depth long-term reversing engineering.
14697230	14697430	Right, complex.
14697930	14701890	So I mean, I'm more of a reverse engineer myself, so I like those things.
14701890	14705810	But then, for example, when you get to these complex heap exploitation things,
14705810	14708630	then I'm completely out of luck there.
14708630	14712050	Well, there's always just kind of familiarity and experience with it.
14712050	14713430	One of the things I was going to mention,
14713430	14716250	and I say this, that I don't do the reversing heavy ones
14716250	14718570	as an author of a reverse engineering tool.
14718570	14720410	Well, maybe that's why you built the tool, right?
14720410	14723130	Well, that's also why I have coworkers who are much better than I am.
14723130	14725310	That's the other, I highly recommend that approach.
14727150	14731030	But one of the things that I was going to comment on is that I like,
14731030	14733610	one of the things that Ghidra I think really does well,
14733610	14740970	that a lot of, both Ida and Binja have actually changed as a result,
14740970	14742310	is their side-by-side view.
14742310	14746050	Having the synchronized side-by-side decouplation with this assembly,
14746050	14749790	I think was a really important improvement in the standard workflow.
14750090	14753550	And so now you'll see Ida and Binja both have much better split-pane,
14753550	14755490	synchronization, those kind of workflows.
14755490	14759850	Very much inspired, I mean, I assume Ilfac also was inspired and was like,
14759850	14762270	oh yeah, I like the way that Ghidra does that too.
14762270	14766450	But certainly from Binja's perspective, we definitely did that as well.
14767170	14769090	So I do think it's good seeing difference.
14769090	14770650	Oh, here we go, we've got...
14770650	14773710	Is that the same? That's just the same screen.
14774210	14775490	But we are...
14775490	14778090	So they're looking at libc...
14779250	14783210	trying to download the appropriate libc version, right?
14783210	14788850	So they're using this web page where you can put in offsets
14788850	14793370	for different functions to like...
14793370	14794490	To match up with...
14794490	14798330	Yeah, like fingerprint the libc version and then download it.
14798330	14801170	But sometimes I think you need like two offsets
14801170	14805030	and then it will match to which version of libc is running.
14805050	14808210	So again, when we're building these challenges,
14808210	14812990	if we don't think they need libc, we're not providing it.
14812990	14814790	Now, that's not true in all competitions though.
14814790	14817890	So they may not trust us yet.
14817890	14819030	I think this is like...
14819630	14825710	It is a convention among, I would say, experienced organizers within this.
14825710	14829450	Right, because why make that an extra tedious step
14829450	14832190	that is just mechanical and you just go to the...
14832190	14833890	We all know about the website. We all know how you would do that.
14833890	14839270	However, if you come up with a solution that's different than the intended one,
14839270	14841610	you might have a solution which does require libc
14841610	14844350	and then you might go this route anyway.
14844730	14846810	Yeah, so it's not necessarily bad.
14846810	14847710	It is just...
14847710	14850510	It should be a hint that maybe you're not taking the intended route.
14850510	14852750	Right. Doesn't mean that you're wrong,
14852750	14855790	but you might be venturing into unknown territory.
14855790	14857350	All right, so let's be thinking about our next hint,
14857350	14859710	because like I said, I'm a little concerned.
14859710	14861270	We might need to do a different one.
14862330	14866850	I don't know, triple-tap control and get the spoken dictation pop-up.
14868050	14869610	I'm going to go...
14869610	14872050	Oh, nope, there's somebody else in the background excited about something.
14872050	14872390	Yeah.
14872390	14875370	I thought for a second we had a surprise win off-screen.
14875530	14878770	I'm going to go ahead and check in with...
14880650	14881330	Organizers is...
14883030	14885530	Organizers is unfortunately not being captured.
14886050	14887750	So we're kind of in the dark there.
14888070	14889570	So I'm going to see if I can get a little bit more of an insight.
14889570	14892410	Hopefully we're making good progress there and I can come back with a little bit of an update.
14892590	14893130	Yep.
14893930	14898210	And then maybe then go ahead with some hints based on current status.
14899080	14900810	So, yeah.
14900810	14909570	Again, they're looking at figuring out libc versions or downloading an Ubuntu image.
14909570	14912690	I'm not entirely sure what's going on there.
14913070	14914650	But, yeah.
14916130	14921930	We'll see if we can manage to see in what direction they're going with this.
14925290	14926490	But, yeah.
14931530	14940010	It would be very interesting to see if they have figured out where this check function is going on.
14940030	14942830	Unfortunately, I don't have the reference solution.
14942830	14948450	So I'm not super familiar with exactly where it's doing something incorrect.
14948450	14952010	But, yeah.
14952010	14958790	It's also going to be interesting to hear what the organizers are up to if they have good progress.
14958790	14962110	So we're also kind of a little bit in the dark on that.
14962190	14969510	But, hopefully, I think we are going to give them a hint.
14969510	14973370	I see Jordan and Ben are discussing a little bit.
14973370	14979310	But what's the exact hint that we want to give them here to point them in the right direction?
14984290	14994870	You can see here in the lower corner, from time to time, we have the organizers' screen flickering in and out.
14995030	14998090	Unfortunately, that's the tech situation right now.
14999710	15006570	In the meantime, I can give you a little bit of an update on the combined scoreboard for the DEFCON CTF.
15006570	15011190	We have still a fairly tight race.
15011190	15022570	We have a span of about 18,000 points for the leaders, Katsubin, down to 14,000 points for the team in 16th place.
15023870	15031690	Everyone is definitely still in the game, with top three being Katsubin, MMM and Perfect Roots.
15031690	15039490	And they are all within less than some percent or so of each other.
15039490	15043190	Or maybe like 10% of each other.
15043670	15048550	Definitely a good competition there.
15049450	15055570	So, Jordan is coming back here. So what's the status? What's the organizers doing?
15055570	15059250	We're going to need some hints. They're both still looking. I don't see any kind of progress.
15059250	15060650	So, we're going to drop a hint.
15062190	15063610	There's a couple of hints we considered.
15063610	15065250	One is, have you considered fuzzing?
15065570	15074730	Because literally just sending in a bunch of bytes will actually overwrite your game state.
15074910	15076810	So that's the key thing they need to figure out.
15076810	15081690	If they send in just too big of a solution, it will actually corrupt the state.
15081770	15083090	And they'll get weird boards.
15083250	15087010	And then it's a matter of, okay, how do I now create a board that would be solvable?
15087390	15089150	So, one that we considered.
15089190	15094830	The other one was, don't let yourself be boxed in to your solution.
15094830	15097490	It's a Sudoku puzzle. That's a little probably more obscure.
15097490	15103610	So, I think we're going to go with just, how big is your solution again?
15103750	15105150	Or how many bytes is your solution?
15105950	15107590	As our next hint.
15107590	15109990	And I think we're going to give them that, because there's still some work to be done.
15110170	15113350	And we want to give them both a shot at getting it.
15113590	15114990	Otherwise, we're going to go to our sudden death.
15114990	15116790	So, that's the hint we're going to go with.
15116990	15119710	In the meantime, we had a comment here from KigEff.
15120410	15124230	These seem interesting C challenges. I think I would try them all, but I'm sure I would take a lot longer.
15124230	15125890	I would too, so that's okay.
15125890	15134410	But it is a good idea, in general for CTFs, to try out challenges after they've been solved.
15134410	15138290	Normally, for a lot of CTFs, people publish write-ups.
15138370	15142330	So, you can try the challenges that you didn't manage to solve.
15142590	15149450	And then use a write-up or so as a reference and guide your attempt as well to learn more.
15150230	15153310	I think the idea is that we are releasing all the challenges.
15153310	15157290	It might take a few days for us to recover from this weekend.
15157290	15164550	We have 15 matches, so another 11 matches to go after this one.
15164990	15167890	But yeah, we will definitely publish them.
15168550	15178670	You can even organize your own mini-tournament in your own CTF team or hacker space.
15179310	15187730	I know that I heard from before the competition that Shellfish actually did some practice for this tournament.
15188070	15193890	By doing a small mini-competition of their own within the team, which I think is really cool.
15193890	15196630	And it paid off. At least it appears it paid off.
15196650	15198890	As one of the winning teams.
15198970	15200730	Yeah, we'll see how far they can go.
15202470	15207230	So, we have the hints prepared. Jordan is going to go and hand that off to the players.
15208170	15210210	We are... what's the clock at?
15210210	15215370	We are 5.45, so we are 35 minutes into the game.
15215370	15220910	Which means that we are running up against the sudden death clock here.
15221090	15223710	Let's see if they can manage to figure out this.
15223710	15227610	On the other hand, this is also kind of a similar situation to the previous challenge.
15227610	15233730	Where we were 35 minutes into the game and then it kind of just clicked for one of the players.
15233730	15235190	And they managed to go all the way.
15236390	15239410	It's going to be really exciting to see what's going on.
15239410	15246850	Still a bit difficult to get a read on Balson's progress or their understanding.
15246910	15249810	They're kind of looking at the code, probably thinking very hard about it.
15249810	15254590	You can see the mouse moving around, trying to build this mental model of what's going on.
15254590	15257090	You're kind of running the code in your head.
15257090	15259370	What if this has this value? How does that propagate?
15259370	15261890	It's probably the least interesting part of a live CTF, right?
15261890	15264750	That's the only downside when you have a more reverse engineering heavy challenge.
15264750	15268850	Is that you're just seeing people maybe name stuff if you're lucky or add comments.
15268850	15271130	But most of the time it's just looking at it.
15271410	15275930	You know you're getting closer when you start seeing a crash in a debugger and a payload being written.
15276250	15277330	And we don't have it yet.
15277330	15280510	I'm going to go ahead and keep an eye on the organizers just briefly.
15280710	15283690	And see if we get any kind of that similar progress.
15284290	15285750	Right, so we have...
15287390	15290690	Oh, okay. We did have a comment somebody else pointed out. Thank you for clarifying.
15291430	15294570	The reason that somebody was looking for the libc was to actually run it.
15294570	15299530	Because if you don't have the same VM handy, you can't run that libc.
15299530	15303850	So you can just grab the libc from another version of Linux to be able to run the binary.
15303850	15307390	So that is another completely valid reason that you might do that.
15307830	15308090	Yes.
15308090	15311190	Probably just easier to maybe look at a previous stream.
15311530	15316930	I don't think we told people what platform all of our challenges were created on.
15316930	15320790	That's actually a good note for future things.
15320790	15324450	Because again, normal in a CTF happens all the time.
15324450	15328370	You have to figure out the OS that it was created for, match version information and whatnot.
15328370	15330690	Not our intention to make that part of the challenge here.
15330690	15337590	No. And it's a thing. Ubuntu 22 somewhat recently went in LTS release.
15337590	15341290	And a lot of people haven't updated to that yet.
15341830	15346450	I will accept shared responsibility on this.
15346450	15349030	Because, you know, update your computers, people.
15349030	15354370	20.04, 22.04 would probably be Ubuntu's most common.
15354370	15357110	Or Debian. Certainly it's frequently.
15357110	15359830	But all right. I'm going to go take a look at the organizers. I'll be back and we'll see how it's going.
15359830	15360610	Awesome.
15360810	15368250	So I was talking about something when it comes to these challenges.
15369590	15373410	Trying to get back on my train of thought there.
15375670	15376070	With...
15378290	15379290	Oh, yes.
15379290	15385670	So, you know, with this looking at another player, looking at code, trying to figure things out.
15385930	15392690	A lot of times when I talk to people who are not experienced CTF players or don't know what CTFs are.
15392870	15394110	You often get the question.
15394110	15397370	Oh, is this some kind of esports thing?
15397370	15401190	Or could you make this into some kind of esports thing?
15401190	15404550	To an extent, this is kind of what we're trying to do here.
15404990	15415910	But, of course, it has its shortcomings that like some aspects of CTF is kind of like watching someone else take a maths exam.
15416310	15418850	It's, you know, occasionally not the most exciting.
15418850	15424070	So we're really trying to by adding this commentary and trying to understand what the players are doing.
15424070	15430210	We're trying to make this an interesting and educational experience for all of you viewers there.
15431190	15441250	So I hope you do enjoy this and, you know, have some takeaways and definitely check out the challenges afterwards.
15442230	15448450	To also kind of get a feel for that's, you know, it might some of these might seem simple.
15448450	15455350	But when you're sitting here and actually trying to do it, you have to consider and take into account all these small little details.
15456130	15462150	If you're just off by one, like a small bit somewhere, like the whole thing doesn't work.
15462150	15464410	You need to do all this troubleshooting, debugging.
15465730	15472410	And I think I mentioned it earlier, but like when you're writing exploits, you are essentially...
15472410	15476110	It's like software development, but with your like hands tied behind your back.
15476110	15483390	You don't get like all the nice tools and helps and error messages that you get like during normal software development processes.
15483390	15487090	Where, you know, you have all of these modern tools to help you.
15487090	15494330	But here you're kind of like you're trying to bend something in a way that was not like intended to be used.
15494330	15498290	You're messing with like a state of memory and so on.
15498290	15504610	So it's you really have like everything stacked against you.
15504610	15511370	And that is like a big part of the challenge when doing these Pwnables, these memory corruption challenges.
15512490	15520950	Looking here at the code here, we can see that the Bowser player is writing some small helper function here to send a number.
15521170	15527550	Maybe they're gonna try to, you know, use this to try to send different number of numbers.
15527770	15532450	And, you know, see if they get any kind of reaction out of that.
15534250	15537750	Haven't really seen yet what...
15537750	15541430	So now they're gonna send like a thousand zeros. That's interesting.
15544050	15546150	So we comment here like, yeah, it's unsolvable.
15546150	15548830	Yeah, like the Sudoku itself is unsolvable.
15548830	15554410	And that's kind of like the twist of this whole thing that, you know, at face value just sold a Sudoku and win.
15554410	15556010	But then it's unsolvable.
15556010	15560350	So, yeah, that's kind of like the recap for people just recently tuning in.
15560350	15565610	And speaking of recap, just to tell you again a little bit about what we're doing here.
15565610	15569490	So we're here in Vegas on site at DEFCON.
15569490	15575750	So organizing this live CDF as part of the official DEFCON CDF.
15575750	15583770	So this is kind of like a sub-event where all the 16 participating teams participate in this like single elimination knockout tournament.
15583770	15595630	Where in each match the teams send one player to go head-to-head against the other team to be the first one to solve a relatively simple CDF challenge.
15596090	15598090	I mean, relatively is relative.
15598110	15600870	Yes, yes. I really want to stress relatively.
15600870	15605490	And I want to be clear. I wouldn't personally solve half of the ones that we're fielding in the allotted time.
15606110	15610530	I tried some of them and, you know, I could get them but maybe take a little bit longer.
15610530	15612810	So I have a lot of respect for these people.
15612810	15614170	They're all very, very good.
15614790	15617090	And they're dealing with the pressure of being on camera.
15617270	15619950	There's a crowd standing around them watching them.
15620610	15624370	It can be pretty nerve-wracking.
15624370	15627130	So I'm predicting...
15627130	15630350	Oh, that is quite the visual effect there.
15630350	15634370	Yeah, you know, the photosensitivity warnings here.
15634650	15636830	I think it's only on our monitor. I don't see it on the screen as well.
15636830	15639870	No, no, it's on the screen as well. Yes, we have some glitching.
15639870	15644090	I'm not sure what that's about. It feels like our whole infrastructure is slowly melting.
15644230	15645950	No, no, it's fine. Stay with us.
15645950	15649170	Wow, that is unusual.
15650130	15654590	Maybe we're getting hacked by the players through the HDMI cables.
15654590	15657850	They're playing the other game, the other CTF challenge.
15657850	15665430	I mean, we would be lying if we would say that we did not have a discussion about what shenanigans could the teams try to pull off.
15665430	15668390	And how we would measure against it or what we would do.
15668390	15673130	Doing that kind of threat analysis or threat modeling.
15673630	15675130	We have three more minutes.
15676890	15679670	This has been a very fast 45 minutes.
15680010	15682970	It's looking unlikely that either one...
15682970	15685010	I did see some debugger action.
15685850	15687850	I'm going to make one last pass.
15687850	15692110	If we see somebody very close and they're making progress, we might be able to give them just a little bit extra.
15692110	15694350	But basically, we're about ready to deploy.
15696760	15698780	Or if they actually want to extend it.
15700000	15700880	That's not a bad idea.
15701360	15704800	If they both say they want to extend it, we'll let them go because they're the last one.
15705460	15709840	So the rules are, if one of them says they want to go sudden death, then we go sudden death.
15709840	15711420	If both of them want to extend it, then it's fine.
15711420	15712960	Exactly right. We'll see what they say.
15712960	15718640	But ask them one on one.
15718740	15720440	To not give any pressure.
15721420	15724600	It would be cool to see a solution on this.
15724600	15729900	Since we have been keeping up with the schedule, we do have that kind of time.
15731060	15736260	But again, it's difficult to say what the players want.
15736260	15738620	This is also a game theory thing.
15738620	15740260	Do you want to go to sudden death or not?
15740260	15743560	It's a high risk environment.
15743640	15745460	When they're going super fast.
15746340	15749780	Also, you don't know the progress of the other player.
15749780	15753880	Do you think you have better progress than the other player in this challenge right now?
15753880	15762260	And if you don't, do you think you have a better chance of beating them in the sudden death one versus catching up with them in the current challenge?
15762260	15767760	It's definitely not an easy decision to make by the players.
15768880	15771120	So what's the verdict?
15771120	15772020	What do you think?
15772460	15774160	If you're in their shoes...
15774160	15775420	Oh no, I would say extend it.
15775420	15775980	Absolutely.
15775980	15778080	So we have a game here.
15779160	15783140	I'm happy with this because I don't want to change the rules in a way that they're unhappy with.
15783140	15784800	But they both want to solve it.
15784900	15788860	Nobody wants to give up on a challenge that you've been working hard.
15788860	15790900	You have a little bit of an idea.
15791180	15791880	I'm glad.
15791880	15793560	I really want to see them see this through.
15793560	15794180	We'll let them go.
15794180	15795360	It's the last one of the day.
15795360	15797320	So we're not running over anything else.
15798280	15799460	I'm actually kind of excited.
15799720	15802680	So a story related to that.
15802680	15809520	So I was playing in the qualifiers for the DEF CON CTF with our Scandinavian team, Norse Code.
15809520	15813400	And I was basically sitting all weekend with one challenge.
15813760	15816200	I mean, I took breaks and met some friends and stuff.
15816200	15817940	But there was a lot of hours.
15817940	15818760	This is the Paris Challenge.
15818760	15820140	This was the Paris Challenge.
15820400	15822500	It was the crypto-pwnable thing.
15822920	15824780	So I don't know if I spent...
15824780	15827460	I don't remember if it was like 10, 20 or 30 hours on this.
15827460	15833480	But regardless, I solved it like two minutes after the CTF ended.
15833900	15835580	And that... yeah.
15835740	15837180	On the one hand, it's crushing.
15837180	15839680	And on the other hand, though, you still solved it.
15839680	15841020	You still solved it.
15841020	15841840	And that's the thing.
15843340	15846920	When the time ran out, I could have just stopped.
15846920	15849920	Because it doesn't matter anymore.
15849920	15851240	We're not going to get any points.
15851260	15852840	But I was so close.
15852840	15854740	I did not want to stop there.
15855760	15863020	So the only saving grace, or what you want to call it, for that was that in the end,
15863020	15866900	solving that challenge or not would not have affected whether we qualified or not.
15866900	15868440	That would have been crushing.
15868440	15869680	That's a little demoralizing.
15870640	15875780	Luckily, even with those points, we would have been just below the qualifying limit.
15875780	15878500	So at least you had clarity there either way.
15878500	15880500	Yeah, I was comfortable with that.
15880500	15888260	And also that means that I could be part of this without having to betray the team.
15888260	15890340	So yeah.
15892600	15895500	So we are...
15895500	15898340	There's a question here about whether it was MCAT.
15898340	15903260	No, this was the crypto-pwnable challenge.
15903820	15906380	It was about a function closure thing.
15906540	15907300	C++.
15907300	15908980	We could go ask Perry.
15909200	15910540	She just was in the room.
15910540	15911280	She just left.
15911280	15911940	Right.
15912100	15915060	But yeah, I've heard a number of people that worked on that.
15915060	15916160	It was a great challenge.
15916160	15918680	I enjoyed it a lot.
15919500	15920700	But it was tough.
15920700	15921000	Okay.
15921000	15924260	So we don't have a hard time with it now.
15924260	15929020	Now it's basically we're just going to let it go until either we are convinced it's going to take way too long
15929020	15932960	or we'll see at this point.
15932960	15935040	But they both want to keep going.
15935100	15936820	I would love for one of them to get it.
15936820	15939680	It not only means we get to save one of our sudden deaths,
15939680	15945460	but I think it's just way more fulfilling for them and for the audience to see the hard one solved.
15945460	15946820	So we're looking forward to it.
15948120	15950800	It is interesting that we've got ROP gadget address.
15950840	15954120	It looks like a template, I think, that this existed.
15954120	15957100	Because hopefully they have an idea that that is...
15957100	15960960	Someone is writing something very deliberate here, right?
15960960	15964860	This is like to print out the board somehow.
15964860	15967480	But let's see.
15967480	15971620	They are trying to see.
15971620	15974620	I mean, this double loop there is to print out some states.
15974620	15979200	But that part above, you see something where they're like cutting off.
15979220	15980200	They're swapping.
15983240	15984440	All right.
15985280	15989960	Oh, is this just to generate a solution?
15990180	15993900	I mean, I would just search the internet for solve Sudoku board and copy and paste it.
15993900	15996580	But if that is what they're doing, that would be valid too.
15996580	16002140	All right. So the idea is that you want to kind of overflow and stuff to basically insert...
16002140	16007280	To modify the state into something that's either solvable or already solved.
16008580	16010520	And so they need to have that.
16010520	16013800	Okay. So we're seeing interesting. We're seeing calculations.
16013840	16016580	We're seeing length calculations.
16018500	16023300	Unfortunately, I was hoping we'd get some more video from the new organizers.
16023300	16024820	Oh, it came in briefly.
16024820	16028120	Yes. With some debugger output there, right?
16028700	16031440	Yeah. We'll leave it up for a second and just kind of show them both.
16031440	16032800	And we might be able to see a little bit.
16032800	16034580	Yep. See there? It's coming on.
16035040	16037180	Man, that's tantalizing. That's so mean.
16037180	16037680	Yeah.
16037680	16040320	This cable has been...
16040320	16042620	Yeah. We might have to do some shopping.
16042620	16044340	Oh, there is definitely a shopping run tonight.
16044340	16047780	So we should be able to have this solved and out of the way.
16047880	16052620	And that way we've got a long day, eight hours tomorrow of hopefully uninterrupted stream.
16053040	16055440	We'll see. We'll see if that turns out to be the case.
16055440	16056620	I mean, given that it's only been...
16057600	16060920	We swapped out the capture card, the USB-C cable.
16061320	16062960	The HDMI is the only thing we haven't swapped out.
16062960	16067860	But it's been that same side of the table consistently that's been having these problems.
16068380	16073560	Makes me think that, yeah, we've just got an HDMI cable that is suspicious.
16074940	16076960	So we'll see if we can get that going.
16076960	16077640	All right.
16078320	16081340	Actually, I'm going to go ahead and do another in-person look.
16081340	16082760	I'm going to go ahead and take a look at new organizers.
16083380	16084780	And we'll be back with an update shortly.
16084780	16087020	Because debugger is generally a good sign.
16087020	16087680	Yes.
16088260	16089320	Oh, wait.
16089900	16090540	Uh-oh.
16090700	16094760	I saw a bin bash string in the debugger there somehow.
16096240	16098340	But that doesn't really make sense, right?
16098340	16102060	Well, I mean, with the intended solution, that doesn't mean they're not going to do...
16102060	16102800	Oh, no. Yeah.
16102920	16105200	And there also is the...
16105200	16108300	So I'm trying to remember how the win function runs.
16108300	16112040	It may be from the win function on the stack as well, too.
16112040	16112620	I don't remember.
16112620	16114820	But no, they shouldn't be getting to that.
16115300	16115460	Yes.
16115460	16115820	Let's see.
16115820	16117740	I don't see the...
16117740	16124900	In the meantime, I wanted to just ask people who are watching whether you are, like...
16124900	16128680	Is anyone here in Vegas attending DEF CON?
16128680	16132140	Or are you watching from all over the world?
16132140	16133720	Like, who do we have here?
16133720	16136140	We saw someone from Kenya even chimed in earlier.
16136140	16136480	Oh, wow.
16136480	16140220	So we know we do have some worldwide watchers.
16140220	16143940	It will be interesting to go and see those analytics afterwards to see who's watching.
16145160	16147280	But, yeah, do we have any people?
16147620	16156600	By the way, if you are here at DEF CON, feel free to come by the CTF area.
16157620	16161260	We probably won't be able to talk a ton, but hopefully we'll get some breaks.
16161260	16163140	If you come during matches, you can watch the matches.
16163140	16169120	If you come between matches, you can have a chat with us, hopefully, if we're not panicking.
16169460	16172000	Yeah, someone's watching from the CTF floor.
16172000	16173020	Okay, nice.
16173020	16176360	And also from Europe, in the hotel room, giving your feet a break.
16176360	16178840	Yeah, that's a wise decision, I think.
16178840	16183720	I'm ready for my feet, my throat, like, several parts of me need a break.
16183720	16184000	Oh, yeah, yeah.
16184020	16185680	We've been talking here for, like, several hours now.
16185680	16187460	Okay, so this is interesting.
16187680	16190600	Those ASCII values are being converted to integers.
16190600	16194860	So we're looking at debugger dump of the game state, right?
16194860	16195680	Nice, nice.
16196060	16197940	So we do see the game state.
16198280	16200720	It's really obvious to see those numbers.
16200940	16201720	Cool.
16203540	16208200	Yeah, and you can see, look at that base thing there.
16208200	16213800	You have, like, generating a list of integers from 0 to 96, which is interesting.
16215520	16222280	Yeah, we have watchers from Estonia, Brazil, people who are saying they want to go visit DEF CON in the future.
16222360	16225640	Yeah, I think DEF CON is, like, it's a cool event to visit.
16226060	16229580	I think they're trying to increase the amount of streaming and online presence as well, too.
16229580	16232540	So you probably will be able to find other streams.
16232540	16237840	I think there's even some webcam, like, 360-degree webcam, virtual cameras they're putting up in a couple of the rooms where you can watch what's going on.
16237840	16240780	So they're trying to improve, like, the accessibility.
16240780	16245890	I mean, certainly with COVID in general, most conferences have tried to adapt better for...
16246300	16250560	Oh, okay, we have somebody watching right next to our camera. Let's hope they don't bump it.
16253660	16257840	But anyway, again, checking the code here they're writing.
16258280	16261280	I'm trying to get a better feel for what they're doing.
16262000	16265360	Again, they're generating, like, a list of numbers.
16265920	16266580	Oh, okay.
16266580	16270300	Also, they need to find, like, the right offset for their overflow.
16270300	16271580	This actually looks really good.
16271580	16271920	Yes.
16271920	16273240	This actually does, like, really good.
16273240	16273680	I'm glad we let them go.
16273680	16274940	Because, like, once they finish this...
16274940	16276540	Yeah, yeah, if they get the right offsets.
16276560	16278620	Let me go look at the other one, but we might be closing in.
16278620	16279160	Yes.
16282970	16284150	So that's really cool.
16284150	16287270	Like, once they get that thing, it's going to be real quick.
16287270	16289590	Like, we are probably going to miss...
16289590	16291950	There's a big risk we're going to miss, like, the moment.
16292090	16297410	So, basically, if I'm reading this correctly, what they're trying to do is, like, find the offset in memory.
16298290	16309090	They're overflowing something, and then, like, how far into this do they want to put whatever they are placing there, which should be the solved or solvable state.
16310290	16314070	So, yeah, they might definitely be onto something.
16314070	16316610	They're switching the numbers around a little bit.
16316610	16317790	Maybe it's that they...
16317790	16324670	So they switched the zeros to a one, which seemed to have crashed the program.
16324770	16328470	And then checking why this is happening.
16329510	16331970	Yeah, we have someone from Morocco as well. Cool.
16333990	16336430	It's cool to see we have people all over.
16337550	16344590	I guess I'm trying to, like, work out, like, what time it is across the world at the moment.
16345930	16350930	But, wait, that's the people watching from Europe. It's, like, in the middle of the night there.
16351130	16354610	So, that's dedication.
16355610	16357490	I hope you're enjoying it.
16357950	16362090	I'm trying to see here. They're just quickly looking at the disassembly again.
16365050	16369190	Trying to... maybe looking for some specific offset or so.
16371750	16378070	Yes, they did get some specific offset to put a breakpoint there, right?
16378070	16380750	And then they're also looking at the base.
16381930	16384630	Oh, yeah, to make the breakpoint. Or maybe not the breakpoint.
16387310	16389550	The offset, where to inspect the memory.
16391450	16392210	Oh, yeah.
16392870	16396250	Oh, yeah, people saying they're watching from, like, yeah, definitely middle of the night.
16396250	16398710	You know...
16402530	16404990	Awesome. Netherlands represented as well.
16405170	16413010	So, I'm seeing some interesting stuff there, but what did you see from the organizers?
16413010	16419770	Yeah, so, I mean, I hate to take bets, because I've lost a lot of money at this table so far.
16420110	16425670	If this was a gambling arrangement, I would not be doing so well.
16425670	16429850	But, I also feel like I tend to favor my side of the table.
16429850	16433730	And then we've had all these surprise victories from the other ones pop up several times.
16433730	16439150	But, all that said, I do think Team Taiwan has a little bit of a lead.
16439150	16442890	So, looking at the new organizers, we've got a script.
16443370	16448710	It's a mixture of GDB, some PwnTools, and then as well as sending inputs and kind of breaking in.
16449090	16455110	I didn't get the sense that they had an overall plan for what to do.
16455110	16460210	Right. But again, definitely the one thing I've learned is that I don't know what I'm doing anyways.
16460210	16464490	It is really hard to understand exactly what's going on in their heads, and so you're not always right.
16465830	16473130	Whereas, I will say, it certainly looks like with that offset, right?
16473130	16478370	We're seeing a valid, solved Sudoku, trying to find the right offset to line it up.
16478370	16482970	Which sounds like, from what I understand of it, is the intended solution.
16484230	16486790	So, we'll see.
16488470	16489110	Yep.
16492290	16495090	Can we get some confirmation?
16495090	16500890	If it's just misaligning the correct board, the certain number of bytes, will that trigger it, essentially?
16502490	16504290	Any correct board at the right offset.
16504290	16507030	So, just put the right amount of padding bytes in, and then it will override it the right...
16516090	16516990	Say again?
16523650	16524450	Yep.
16526850	16528730	Then you mark it as solved? Yeah.
16536260	16538840	Oh, just send anything, and it will just mark it as solved?
16539200	16539880	Right.
16540700	16541500	Okay.
16541560	16548760	So, what our producer there said was that, first you send a solvable state,
16548760	16553160	you override the thing, the state, with the solvable one,
16553160	16557900	and then you just send something to trigger the recheck, and have it be solved,
16557900	16559960	and you get the win there.
16562380	16567060	We can see here, they are working out in a text editor...
16567060	16575380	Yeah, it still looks like they're trying to solve the state as it exists, not overwrite the state with their solve.
16575840	16584200	I wonder, I'm a little afraid, they got the overwrite, but if their exploit didn't try to send another round for validation,
16584200	16586940	it overwrote it, but then never...
16586940	16590580	Oh, wow, that would be terrible.
16590580	16594460	So, it is possible that they potentially had the right solution,
16594460	16598580	just didn't re-trigger it to be able to actually get to the win function.
16600080	16603840	So, we will see.
16604380	16605860	We're only a little bit late.
16605860	16609280	Actually, technically, we have two more minutes before the original length of this,
16609280	16613000	and we're letting them run long just because of the last one of the day,
16613920	16618860	and we prefer they have a chance to if they can, but our voices will give out,
16618860	16622320	and there will be some point which we say, sorry, we're cutting you off.
16622540	16626200	But none of us want that to happen, so we'll see.
16626340	16630700	Yeah, we're taking a bet here and hoping this will work.
16632200	16635000	We're also about to lose power on our chat.
16635000	16635460	Yes.
16635480	16637120	Tunisia, excellent, welcome.
16637120	16640220	Yeah, I've been to Tunisia for a CTF competition.
16640480	16643660	Have you really? I think I got invited to speak there one time at a conference.
16643660	16644080	Yeah.
16644080	16644900	There we go.
16645700	16647320	Let's see if that actually powers it.
16647320	16649060	I don't know what this is plugged into at this point.
16649660	16651840	Yeah, we have power on one of our screens here.
16651840	16652740	All right, good.
16652760	16657080	We also have a graphical glitch on the Balsam screen.
16657080	16659260	But it's just blocking the ads, so I'm okay with it.
16659260	16660080	That sounds great.
16660080	16664480	I wish all of my graphics glitches just blocked out ads as I surfed on the web.
16664480	16664880	Oh, yeah.
16665100	16669240	So as an employee of a big ad tech company, I would have to...
16669240	16673500	A large tech company whose revenue might depend heavily on ad?
16673500	16674200	Yeah.
16675060	16675500	Yeah.
16677000	16678820	Yeah, are you allowed to run ad blockers?
16679040	16680220	Nah, I'm not going to make you talk at work.
16680220	16681200	I'm not going to make you talk at work.
16681200	16682100	All right, all right.
16682100	16683000	I'm not going to do that.
16683540	16685260	All right, so here we go.
16689460	16692960	So this still feels like we're trying to solve it.
16693820	16701760	I don't see the exploit.
16701760	16704820	I don't see them actually exploiting it.
16704820	16712400	Well, I mean, this might still work if their idea is to just overwrite a couple of values,
16712400	16714400	and then make it solvable, and then put it in the solution.
16714480	16715600	It's not a fast solution.
16715600	16717640	They're going to inherently have to overwrite the whole thing, though, right?
16717640	16719500	Because they're just linearly overwriting it.
16719500	16723260	Well, I mean, it might be that they think that they can only overwrite the beginning of it,
16723260	16724380	or something like this.
16724380	16726120	You're still going to have a null at the end.
16726160	16728480	No, no, no, not necessarily, because it's going to convert in red.
16728480	16729560	Yeah, no, that's fair.
16729740	16731360	I mean, it could work.
16731360	16735700	It's not the intended play, but it could probably work.
16736640	16737600	So, yeah.
16738220	16740500	Unless there's a question mark at the very end of the puzzle.
16740500	16746260	If there's an unallocated one at the very end, that would have to be...
16746260	16747280	Well, we'll see.
16747560	16748020	Yeah.
16748020	16749000	We'll see.
16749000	16749800	All right.
16750440	16752920	A few more bits.
16753380	16754580	Thanks, everybody, for hanging with us.
16754580	16758660	This has been just utterly exhausting and super exciting.
16759400	16768940	Just as a quick recap from our earlier games, we had a nail-biter of a finish at the very beginning from Shellfish versus PTB WTL.
16768940	16769360	Oh, yeah.
16769400	16773380	They were, I think, within a few keystrokes of each other.
16773380	16774920	You can't get a tighter match.
16774920	16775340	I know.
16775340	16777840	We were looking at one screen as they were...
16777840	16778800	About to declare a winner.
16778800	16779500	Yeah, and then the other one...
16779500	16780580	When all of a sudden, it popped.
16780580	16781620	It just was so quick.
16781620	16782120	Yeah.
16782360	16783120	So that was fantastic.
16783120	16786040	Make sure you go back and check the replay on that one.
16786480	16790640	We're going to end the stream today when we're done with this particular challenge.
16791260	16792300	Oops, sorry about that.
16792300	16793160	I hit the microphone.
16793380	16799080	We're going to end the stream today once we're done with this challenge and we wrap it up.
16799760	16801480	But we'll be back tomorrow.
16801480	16802700	A long day tomorrow.
16802700	16805220	So the stream is going to run for eight hours straight.
16805220	16808460	Actually, I guess nine at least because we've got eight...
16808460	16809300	No, no, that's right.
16809300	16810180	Eight total hours.
16810180	16811520	Each one is a one-hour thing.
16811520	16811880	Yeah.
16812260	16812900	We'll see.
16812900	16814120	We may end up needing a break.
16814120	16816180	We're going to try to get breaks by trading off.
16816180	16818160	You're going to see some guest commentators.
16818160	16820580	We're going to have some other people come in and fill out different roles.
16820580	16821580	Should we...
16821580	16823100	I think it was already written on Twitter.
16823100	16825220	But the idea is to have...
16825220	16829760	We have LiveOverflow, hopefully joining in.
16829840	16832760	And Gamoso, Brandon Falk.
16832760	16833260	Yeah.
16833740	16842080	So two popular people in the security content creation space.
16842080	16842760	Yeah.
16843700	16847280	I'm excited, looking forward to chatting with both of them.
16847820	16849640	And I'm also looking forward to have a break.
16849640	16853660	And as we each get to maybe alternate every other round.
16853660	16855420	So one of us will get to take a rest.
16855420	16859580	And also make sure we give our producer, Glenn, a break as well.
16859580	16861760	So we'll be cycling through that.
16863100	16865820	We've got a variety of different challenges.
16866420	16869020	Maybe for any of the teams that happen to be listening,
16869020	16872720	we want to talk about the overall types of challenges that we have.
16872720	16876940	No super-spoilers, but I will say I think we're pretty representative.
16877040	16877420	Right.
16877420	16880960	We've seen heavy-pwned focus, a little bit of RE.
16880960	16881600	Yes.
16881700	16887100	There's certainly a little bit like shell-coding or constrained exploitation.
16890800	16893140	Just having a quick look here again.
16893140	16894560	Yeah, trying to get caught back up.
16895660	16896480	Oh, man.
16896480	16897940	So they have a solution there, right?
16897940	16901720	They have a solved solution, but...
16902240	16903000	Yeah.
16903140	16907220	There's a hashtag, FreeJordanGlenn and Kalle in the chat.
16907220	16907500	Yes.
16907500	16910760	So, yeah, just to clarify, that's my nickname.
16914480	16915840	HackHarder. Thank you.
16915840	16916460	Yes.
16916460	16920700	I mean, thank you, Negasoro, this random person who showed up in our chat.
16920800	16923380	Certainly not the author of this particular challenge
16923380	16927360	that has stymied our opponents for so long.
16927360	16928080	Right.
16928080	16930160	Yeah, but you're not wrong.
16930160	16933820	If they just would hack harder, we could take a break and we could...
16933820	16935500	Yeah, we could get some dinner.
16935600	16938140	So let us consider this.
16938140	16940300	I would say we are going to have to hit sudden death pretty soon
16940300	16943400	because we're looking at another several minutes of sudden death as well.
16944620	16944980	So...
16947140	16948160	We'll take a look.
16948160	16950280	Maybe I'll take one more pass at new organizers.
16950660	16954800	We'll talk about having a, you know, securing up a sudden death.
16954800	16956360	We'll kind of consider what we want to go.
16957440	16958160	Yeah.
16958920	16960980	I'll go ahead and give a bit of a...
16960980	16962400	Oh, just use a data glove.
16962680	16963720	What is a data glove?
16963720	16965040	That's a reference I don't get.
16965080	16969200	Isn't that the game controller thing?
16969200	16970360	No, that's a power glove.
16970360	16971180	That's a power glove.
16971180	16971500	Yeah, yeah.
16971500	16973020	The child of the 80s, of course.
16973020	16973660	Yeah, yeah.
16973660	16974040	No, no.
16974380	16976060	That's a thing from before I was born.
16976060	16977080	Sam, no trolling.
16977080	16977680	No trolling.
16977680	16978140	Please stay.
16978140	16978700	No, stay.
16978700	16979400	No, no.
16980100	16981320	We will find you.
16981320	16982100	You're in the room.
16982100	16983080	We remember this.
16983080	16984660	We don't talk like that.
16984780	16985140	That's...
16985140	16986200	Yeah.
16986200	16989040	Next you're going to be asking for network forensics or something.
16989040	16989860	Something crazy.
16989860	16990100	Yeah.
16990100	16991400	We might call the goons.
16991400	16991840	Yeah.
16991840	16992800	Have them take you out of the room.
16992800	16993080	Yeah.
16993080	16993240	All right.
16993240	16994920	I'll go check out new organizers and we'll be back.
16994920	16995180	Definitely.
16995180	16999780	I'll give an update on the DEF CON CTF scoreboard in the meantime.
17001100	17010060	So, we have like a slightly larger spread now with like spanning from just below 14,000
17010060	17018680	up to just above 18,000 points between the 16th and the 1st place with Katsubin in 1st
17018680	17022420	place, MMM in 2nd place and Perfect Root in 3rd place.
17022460	17028540	And if I'm not misremembering, I think last year we did have like a top fight between
17028540	17032040	Katsubin and PPP as well.
17032040	17036760	They have kind of pulled ahead, those two teams, and created like a slight gap down
17036760	17037680	to 3rd place.
17037680	17046000	So, I do think this like mirrors some of what we saw last year with regards to like the
17046000	17046640	standings.
17046640	17049980	But, this is only the first day of the DEF CON CTF.
17049980	17051860	A lot of stuff can happen.
17052060	17054000	This is like far from over.
17054140	17062820	So, we're going to be keeping an eye on that throughout the weekend and give you updates.
17064680	17071820	If you're here in the CTF room, you can see this really funny visualization the Nautilus
17071820	17072860	Institute have put up.
17072860	17080100	It's like some 3D animation of like a bunch of weird machines, one for each team, like
17080100	17083000	spitting random objects at the other teams, like showing...
17083540	17086320	I guess it's showing like who is attacking whom.
17086600	17090000	Possibly, there's like seashells and stuff flying around.
17090000	17094900	I guess there's some joke there about like shells and seashells and you know that.
17096120	17101680	But, again, taking a look at the screen of Balsun here.
17102700	17104720	I'm still not entirely sure.
17104720	17107880	They have this like partial solution or like a solution.
17107880	17114700	They have split up the solution into two parts and then trying to send some...
17114700	17118500	Like they're sending some data and then they're sending the other solution.
17118500	17121080	Still not exactly sure what's going on.
17123140	17124980	So, we have an explanation.
17124980	17126520	Data handler, crazy keyboards.
17126520	17129960	Yeah, I will have to look that up afterwards.
17130540	17137400	But, yeah, I'm still thinking power gloves would, you know, really help out in this situation.
17137860	17141180	Maybe you could have them like, you know, different like rock gadgets and stuff mapped
17141180	17143180	to the different buttons and stuff.
17143180	17145380	That's, you know, the way to go.
17146120	17151540	Anyway, you can see them like in the debugger here inspecting the memory there a little bit.
17151540	17153260	So, I'm looking at the global variables.
17153260	17155780	You can see you have the standard in and standard out object.
17155780	17158380	And then further down they have these objects.
17158380	17164420	And you can see the byte values there in the like the middle of the printed out block
17164420	17168060	with the different digits of the Sudoku solution.
17171060	17177220	Yeah, it feels like they are very close to getting it,
17177220	17181980	but still like a bit unsure exactly what's going on.
17183660	17187480	So, yeah, we have Jordan coming back here now.
17187480	17190040	So, we'll get an update on where we are.
17190040	17192360	We are going to give them a sudden death hint.
17192360	17196360	We're going to give them a hint that is just because here's the thing that we have missed
17196740	17197760	talking about it so far.
17197760	17200140	I was looking back over with the example solution.
17201700	17208020	And the nuance here is that there's a length check that has been kind of showing up a little bit.
17208020	17213200	Now, length check basically prevents you from even if you overwrite it with a fully solved board
17213940	17216880	from actually solving it on that throw.
17216880	17220440	So, you overwrite the state of the board all but the last one.
17220880	17221380	Right.
17221380	17222600	And the last one you leave empty.
17222600	17226660	And then you can just solve it by overwriting the correct last answer.
17226720	17227180	I see.
17227180	17230520	So, it's a little bit along the lines of what we've been talking about,
17230520	17238420	but it seems that they've done a weaker variant of that where they didn't have as good of a solution.
17238920	17242920	There's a question here about is there anywhere that explains the CTF format?
17242920	17245000	There's an AD going on as well as these one-in-ones.
17245000	17245620	Yes.
17245620	17256560	The main CTF, the DEFCON CTF, is the traditional DEFCON attack-defense that we all know and love.
17256580	17261260	Although, there have been variants and twists to it over the years.
17262220	17267260	Then, within this competition, this live CTF is like a sub-event
17267260	17272060	where it's running parallel to the attack-defense aspect of this.
17272060	17277980	Each team sends one player for each match and then we play this knockout tournament.
17277980	17282180	At the end, this will generate a ranking from the knockout tournament,
17282180	17290280	which is then fed back in and will affect the scores of the main CTF event.
17290280	17298400	So, this will be valuable and might definitely affect the final standings of the DEFCON CTF.
17298400	17308730	I'm not completely aware of what the weighting factor is, how the scoring model works for the CTF.
17310280	17317800	So, I couldn't tell you exactly how valuable it is to win the tournament versus getting second place.
17317800	17322880	But, we've been trying to find a balance where the teams can definitely...
17322880	17328500	I'll tell you in a second. But, first I'm going to deliver the hints and I'll be right back.
17328500	17331820	And we'll see if we can bring this one home.
17331820	17334080	Right. Can you just read me the hints here first?
17334080	17339760	Here we go. First attempt, overwrite almost all. Second attempt solves due to length check.
17339760	17341700	Yes. Sounds great.
17341860	17343200	And we will see if this does it.
17343240	17349900	This is almost like a straight-up solution. This could almost be like a write-up for the...
17349900	17353240	You have to understand what the program does. And that's the state that they've got.
17353240	17354260	Yeah, but they have that.
17355920	17360620	So, now we're going to give them the final, hopefully final hint here.
17360620	17366420	They will just hopefully blow this case wide open and have them solve it from there.
17366520	17371160	Did we get any reaction from the players on that?
17371160	17373240	I was too busy coming back. I should have watched.
17373240	17374580	Okay, okay. I see.
17374620	17376940	Yeah, we got some forehead touching.
17376940	17377580	Okay.
17377580	17378880	Says our producer.
17378880	17379600	Yes.
17381120	17382600	So, we'll see. Will it...
17382600	17385520	I think this was... This one, I think, is on us.
17385520	17385680	Yeah.
17385680	17389040	I think this was a little too subtle for what we're kind of aiming for.
17389040	17394140	And again, being in a high-pressure thing, this is not to say that these are not excellent exploiters.
17394140	17398800	It is just very hard. And this was a little bit of nuance, a little subtle nuance.
17398800	17399340	Oh, yeah.
17399340	17405840	Because of the way that the length check happens in the binary, you can't actually fully overwrite and expect it to do it.
17405840	17409560	It will already know that it's an invalid attempt, and so it's not solvable.
17409560	17417360	But then you have overwritten the correct state such that you can then solve it because you moved it from an insolvable state to a solvable state.
17417360	17417760	Right.
17418060	17419880	Somebody else might have got it. You don't know.
17419880	17422220	But it's definitely... This is definitely a little harder.
17422220	17425160	Certainly, it's more subtle than some of our previous challenges.
17425460	17426060	Yes.
17426260	17431780	But we'll see. We'll do our best to keep dialing in the difficulty and see how it goes.
17431780	17434380	So, let's keep an eye out for the winner.
17434380	17444680	We may see, because we're not looking at the new organizers, we might get that off screen, or we might see Team Taiwan pull it off here in the main window.
17444700	17450240	So, I keep rooting for whoever we have the capture card working on, just by the very nature of being on my side of the table.
17450240	17451340	Yeah, yeah, yeah.
17452160	17452560	But...
17452560	17461780	But, you know, like, being a Swiss, not citizen, but Swiss resident, I'm, you know, kind of like maybe rooting for organizers a little bit.
17461880	17462280	Oh?
17462420	17463160	So, yeah.
17463160	17464940	Are they a Swiss team?
17464940	17468760	So, they are a Swiss-British-American team, I think.
17468760	17469200	Okay.
17469420	17470080	Oh!
17470080	17471200	There we go!
17471200	17472200	All right.
17472200	17473320	So, there...
17473320	17474620	We have the winner.
17475340	17476220	Congratulations.
17476420	17478140	Congratulations. Awesome, awesome.
17479280	17480300	Oh, my God.
17480300	17481140	Down to the end.
17481140	17482920	It happened again. It happened again.
17482920	17483900	So, I'm going to go...
17483900	17488000	Go congratulate them. Go talk to the team. I'm going to go ahead and see you all out.
17488020	17492220	Just a quick summary. I think we've already kind of covered what's happening the rest of the day.
17492220	17493540	We're going to go recuperate.
17493560	17496420	We're going to fix our HDMI cables, so we'll come back with...
17497080	17505180	Tomorrow, we'll hopefully have the ability to see both screens more effectively instead of having the flickering that we had this time.
17505440	17508280	And we look forward to seeing eight challenges.
17508280	17509140	We're going to have eight more rounds.
17509140	17510440	We're going to finish up in the morning.
17510600	17512420	Four more rounds of round one.
17512620	17515060	And then, in the afternoon, we're going to move straight into round two.
17515060	17519020	And we're going to go all the way from eight teams all the way down to four by the end of tomorrow.
17519020	17521400	So, come back and see that long day.
17521400	17522580	Look forward to seeing you then.
17522660	17523840	Take care and have a good one.
18241080	18242500	Bye.
18242500	18242540	Bye.
18243060	18248090	Bye.