WEBVTT 05:14.630 --> 05:17.650 Hello, everyone, and welcome to live CTF. 05:17.710 --> 05:19.630 This is our audio check for our live stream. 05:19.630 --> 05:21.210 Hopefully, you guys can hear us. 05:21.330 --> 05:22.850 Let us know in the chat if you can. 05:22.970 --> 05:24.410 I'm cyphertex, or Jordan. 05:24.410 --> 05:26.350 I'm going to be one of the commentators this weekend. 05:26.350 --> 05:27.510 And with me is Carl. 05:27.510 --> 05:29.530 Hi, I'm Carl, or Zita2. 05:29.550 --> 05:31.510 We'll be commentating here with Jordan. 05:31.690 --> 05:33.490 And, yeah, glad to be here. 05:33.730 --> 05:35.630 Okay, I hope this is... 05:35.630 --> 05:37.330 Yeah, we put a lot of work in. 05:37.450 --> 05:40.970 This has been a lot of stress, but we're starting. 05:40.970 --> 05:41.870 I think everything's working. 05:41.870 --> 05:45.450 We're looking forward to seeing the teams compete. 05:45.710 --> 05:53.350 So before we kind of get into the meat of it, let's talk a little bit about the history, what this event is, what we're doing, what we're hoping to see from the teams. 05:53.610 --> 05:57.970 So , you know, live CTF as a concept has existed for quite some time. 05:57.970 --> 05:59.470 Hey, triple six, we see you in there in the chat. 05:59.470 --> 06:01.350 Yeah, definitely let us know if you're doing this. 06:01.510 --> 06:04.030 We have to bring the camera in if we get too many jokesters behind us. 06:05.210 --> 06:07.970 It is DEF CON, so we're going to get that. 06:09.290 --> 06:12.730 Live CTF has been around as a name. 06:13.030 --> 06:15.030 GeoHot started several years ago. 06:15.230 --> 06:25.070 It was streaming on Twitch and did a couple of these kind of like live, it was playing capture and flag challenges and wanted other people to see him doing it and kind of interact, sort of early live streaming stuff. 06:25.070 --> 06:28.030 There was a couple of different, I guess, experiments or attempts. 06:28.210 --> 06:34.390 I did one a couple years ago at DEF CON finals where I messed up the audio and it wasn't live and recorded it and it was a bit of a bummer. 06:34.390 --> 06:37.790 So we've had a couple examples of that. 06:37.790 --> 06:39.350 And then you also were running Pony Racing, right? 06:39.350 --> 06:40.090 Yeah, exactly. 06:40.090 --> 06:55.510 So a couple of years ago, we did for a year, we run a monthly like live CTF show on YouTube where we had four contestants trying to solve the same challenge head to head and like doing commentary on top of that. 06:55.690 --> 06:58.310 It was pretty popular, actually. 06:58.530 --> 07:00.370 A lot of people like, it's a lot of work though. 07:00.370 --> 07:04.590 I think people don't, they underestimate how hard it is to kind of get it. 07:04.590 --> 07:07.150 So let's talk a little about like the kind of what it is. 07:07.150 --> 07:12.910 So when we talk about live CTF, right, obviously Capture the Flag, we're talking about a hacking challenges. 07:13.350 --> 07:17.830 There's a variety of different, you know, CTF out there with different scoreboard and structure. 07:18.130 --> 07:23.950 And so when we say live CTF, we're specifically saying a small group of people going head to head on the exact same challenge. 07:24.030 --> 07:25.610 And in particular, we're watching them. 07:25.610 --> 07:26.610 We want to see what they're doing. 07:26.610 --> 07:28.710 That's what makes live CTF really interesting. 07:28.950 --> 07:33.750 And this is exciting because we're bringing live CTF to DEF CON CTF finals. 07:33.750 --> 07:38.570 So certainly one of the premier Capture the Flag contests is DEF CON CTF. 07:38.570 --> 07:44.370 It's one of the, I think it is the oldest, certainly continually running Capture the Flag event. 07:44.390 --> 07:45.530 This is DEF CON 30. 07:45.530 --> 07:47.770 I think, I mean, they've had DEF CON CTF. 07:48.090 --> 07:53.110 I came in DEF CON nine, 21 years ago, and there was, the CTF was already an established thing. 07:53.110 --> 07:54.910 Like it's been around for many years. 07:55.290 --> 08:01.010 And the idea is that we are going to have all the teams that are here, they're playing DEF CON CTF. 08:01.010 --> 08:04.310 So to be clear, the CTF as a whole is going on around us. 08:04.310 --> 08:07.390 Nautilus Institute is running the DEF CON CTF. 08:07.430 --> 08:10.430 We are like a little side piece, and kind of inside of that, right? 08:10.430 --> 08:13.170 And so this is a part of the whole event. 08:13.170 --> 08:16.530 If the teams do well here, it will add to their score for the final event. 08:17.210 --> 08:32.490 So we're trying to add some, like a little bit of a twist, a little bit of spice to the competition, like bring that excitement, and also to make this accessible to the viewers and see a little bit of what's going on in like the minds and computers of these participants. 08:32.490 --> 08:39.350 If you've ever been to DEF CON before and you've walked through the CTF room, nobody wants you to look what they're doing because competitors will cheat and spy on one another. 08:39.610 --> 08:43.830 And it's, you know, so they're all kind of like closed in and it's not really spectator friendly. 08:44.010 --> 08:46.210 Last several years, teams have worked on cool visualizations. 08:46.210 --> 08:47.690 And so we've got one kind of going on over here. 08:47.690 --> 08:51.270 There's a 3D visualization from Nautilus that's tracking their scoreboard. 08:51.650 --> 08:57.630 AR, if you're talking about the DEF CON CTF scoreboard, unfortunately, no, I don't actually think we've asked Nautilus. 08:57.630 --> 09:00.530 There is no public scoreboard right now for the main event. 09:00.530 --> 09:04.430 We can give you updates throughout the event right now. 09:04.430 --> 09:10.350 So actually at the end of this broadcast, before we turn over to our next one, if we had a little bit of time, we'll actually let you know what the latest scores are. 09:11.550 --> 09:14.470 Otherwise, find a friend who's at DEF CON and have them come in here and take a picture. 09:15.050 --> 09:17.470 I don't know what the plan is on their scoreboard. 09:17.570 --> 09:23.450 The live CTF portion, you'll see when we go back to like our kind of intermission screens, you'll see the brackets. 09:23.610 --> 09:28.670 So what live CTF is going to be, actually, Carl, what do you tell them about like the structure of like what that bracket is and how that's going to work? 09:28.670 --> 09:29.330 Yeah, exactly. 09:29.330 --> 09:34.750 So we're playing this as a traditional single elimination knockout tournament. 09:34.750 --> 09:38.450 So there will be, so we have 16 teams in the DEF CON CTF. 09:38.450 --> 09:42.510 So we're starting with the round of 16 today. 09:42.510 --> 09:46.270 We will have four matches and then we'll continue tomorrow. 09:46.810 --> 09:52.310 So yeah, the teams, there will be one player from each team sitting at these tables behind us. 09:52.310 --> 09:53.690 Right behind us. 09:53.910 --> 09:55.190 With one computer. 09:55.210 --> 09:58.150 They are not allowed to communicate with their teammates. 09:58.150 --> 10:03.270 They will be wearing earmuffs to block out our commentary. 10:03.670 --> 10:07.710 And they both get the same CTF challenge at the same time. 10:07.710 --> 10:09.850 And the first one to solve it wins. 10:09.850 --> 10:10.970 The other team is eliminated. 10:10.970 --> 10:12.990 The winners advance to the next round. 10:13.010 --> 10:16.170 And in the end, we will have a winner of this tournament. 10:16.190 --> 10:16.490 And then... 10:16.490 --> 10:18.830 And each round, like, gets them points, right? 10:18.830 --> 10:19.570 Yeah, exactly. 10:19.570 --> 10:28.190 So depending on how far they make it in this tournament, this will then add to their scores of the whole, like, DEFCON CTF. 10:28.610 --> 10:32.010 DEFCON, I mean, the DEFCON CTF is an attack-defense CTF. 10:32.010 --> 10:35.050 So you have, like, different aspects of the scoring. 10:35.050 --> 10:37.270 You typically have, like, for attacking and for defending and stuff. 10:37.270 --> 10:41.950 So this will be, like, another dimension to the scoring of this event. 10:41.950 --> 10:46.230 Yeah, in fact, that actually informed kind of how the points were worked as Nautilus. 10:46.230 --> 10:48.890 And we were talking about kind of the design of the game. 10:48.930 --> 10:52.650 The goal is we want this to be something teams take seriously. 10:52.650 --> 10:53.950 We want them to send their best person. 10:53.950 --> 10:56.750 We want them to really want to win and do well because it will benefit them in the game. 10:56.750 --> 11:02.830 But also not disrupt the whole game if one team does well here and another team does well. 11:02.830 --> 11:04.910 And , you know, like, we don't want to throw it off too much. 11:04.910 --> 11:05.050 Right? 11:05.050 --> 11:06.790 So kind of finding that balance is tricky. 11:07.030 --> 11:08.330 I like what Nautilus has done. 11:08.330 --> 11:10.010 I think it's going to get us that. 11:10.190 --> 11:13.510 And the other thing to point out is the teams, we're going to have a lot of work. 11:13.510 --> 11:15.150 We have a lot of work cut out for us. 11:15.150 --> 11:20.630 We're going to have 15 total matches throughout the next three days, today, tomorrow, and Sunday. 11:21.250 --> 11:24.690 But the teams have a maximum of four events that they're in, right? 11:24.690 --> 11:28.470 Because there's only four rounds to go from 16 to eight to four to two to one. 11:28.910 --> 11:33.990 And so the teams are out at most four hours for if they get first or second place. 11:33.990 --> 11:34.350 Yeah . 11:34.530 --> 11:40.090 And in fact, the teams that, like, don't get any points, they're done and gone and they can go back to focusing the other events. 11:40.090 --> 11:44.410 So we hope to not, like, disrupt too much of the normal flow of what teams are doing. 11:44.410 --> 11:54.510 Yeah , and we hope with the teams, like, we've talked a little bit to the teams and we've heard, like, some people, they find this, you know, a little bit nervous, like, being live on camera. 11:54.510 --> 11:55.630 It's stressful, it is. 11:55.630 --> 12:03.310 So, but we still, like, hope to make this, like, an enjoyable experience for both the participants and for all of you viewers as well. 12:03.310 --> 12:08.290 Yeah, one of the, again, we said earlier, you know, DEF CON is not accessible to a large extent. 12:08.290 --> 12:10.390 You have to already be in the CTF community. 12:10.410 --> 12:15.930 You have to already be very active to even compete at the qualification round to make it here. 12:16.010 --> 12:22.150 And so we're hoping by having challenges here that are a little bit more accessible, you'll be able to follow along. 12:22.150 --> 12:24.650 You'll be able to see kind of what they're doing on a smaller scale. 12:24.790 --> 12:31.510 And so speaking of that, let's talk a little about the challenges themselves and how they differ maybe from the challenges that are going to be happening for the rest of the CTF. 12:31.510 --> 12:31.930 Right. 12:31.930 --> 12:38.890 So, I mean, normally in a CTF, a challenge can, I mean, you can have varying difficulty of your challenges, right? 12:38.890 --> 12:44.990 But especially in a top tier competition, such as DEF CON, you typically have pretty difficult challenges. 12:44.990 --> 12:50.390 It can take many hours to exploit these systems. 12:50.390 --> 13:00.810 But we are aiming to have matches here of about like 30 to 45 minutes, which means that that also kind of puts some constraints on the difficulty of our challenges. 13:00.810 --> 13:02.230 They cannot be too difficult. 13:02.530 --> 13:06.850 So we have had to like try to find that balance between, you know... 13:07.390 --> 13:08.910 Not so trivial, it's like five minutes. 13:08.910 --> 13:10.350 You run one thing and you're done. 13:10.350 --> 13:10.550 Yeah. 13:10.550 --> 13:12.570 But also it can't take too long. 13:12.570 --> 13:13.770 So hopefully we got it right. 13:13.770 --> 13:15.590 We'll find out as the weekend progresses. 13:15.590 --> 13:15.870 Yeah. 13:15.870 --> 13:31.610 And if we don't, like if the matches are like, if they go too long, we have a sudden death round thing where we have prepared some very simple challenges that we will then switch out. 13:31.610 --> 13:33.070 So we will stop the normal challenge. 13:33.070 --> 13:35.190 They will get this sudden death challenge instead. 13:35.370 --> 13:37.430 And then it's really about being quick. 13:37.430 --> 13:38.290 Those are five minute challenges. 13:38.290 --> 13:38.650 Yeah. 13:38.650 --> 13:41.050 They're meant to be like very, very straightforward and easy. 13:41.050 --> 13:41.410 Yeah. 13:41.410 --> 13:42.550 Hopefully we don't have to use them. 13:42.550 --> 13:44.610 But if we do, they're there and they're ready. 13:44.690 --> 13:48.530 With the idea that whether it's those or the normal ones, the fastest team wins. 13:48.530 --> 13:54.170 First person to solve it ends that particular round and we set up for the next round and start all over. 13:54.170 --> 14:02.450 So in terms of the type of challenges, now like the DEF CON qualification rounds, you often have a mixture of web and forensics and all these different other things. 14:02.590 --> 14:04.610 Finals though tends to be focused more on pwning, right? 14:04.610 --> 14:04.890 Yeah. 14:05.030 --> 14:09.150 Pwning, reversing, like that low level stuff. 14:09.150 --> 14:09.670 Yeah. 14:09.730 --> 14:11.430 And so we've mirrored that as well. 14:11.490 --> 14:14.910 So if the teams were a little nervous about like, well, wait a minute, I don't do a lot of web app stack. 14:14.910 --> 14:15.790 Don't worry. 14:16.010 --> 14:21.870 We are keeping things in line in part because we want this to be representative of what the teams are doing now. 14:21.870 --> 14:27.810 Like if a little baby challenge is very similar to the style of challenge, if not the same difficulty, that they're doing in the final event. 14:27.810 --> 14:31.070 So you can get a sense of kind of what's going on at home as we follow along. 14:31.390 --> 14:35.530 And speaking of following along, if you are in chat, we are watching it, we're keeping an eye on it. 14:35.530 --> 14:38.550 We're happy to answer questions as we progress throughout the day. 14:38.790 --> 14:43.710 Thanks earlier for the question about the scoreboard. 14:43.810 --> 14:45.030 So just a quick update. 14:45.030 --> 14:46.910 I'm looking at the scoreboard right now. 14:46.910 --> 14:51.350 Currently, there's only a couple hundred points separating first from last. 14:51.350 --> 14:54.090 So they all started around 1600 points. 14:54.470 --> 14:56.790 It looks like this is going to be a zero-sum game. 14:56.790 --> 15:03.150 And so actually, one of the later streams, we might bring on one of the Nautilus folks and talk more about it if we have time. 15:03.510 --> 15:05.830 And so we'll learn more about how they're doing it. 15:05.830 --> 15:09.570 But zero-sum game where teams lose points and then they go to other teams that gain it. 15:09.570 --> 15:19.350 So in other words, if I get exploited by another team, I lose some points in the form of my SLA because I didn't have a secure service and they gain some points that they've sort of taken from me. 15:19.410 --> 15:23.030 Yeah , on the topic of bringing in other people as well. 15:23.030 --> 15:25.890 So we will be on commentary throughout the weekend. 15:26.130 --> 15:32.510 But we're also hoping to bring in some other commentators, some remote commentators as well. 15:33.150 --> 15:37.250 So yeah, hopefully, there will be a little bit of a mix here as well on the commentator table. 15:37.250 --> 15:46.550 Assuming we can figure out the logistics and the streaming and everything as the connectivity gods are working for us, we are going to, yeah, we will bring in a couple of folks that you will probably recognize if you do any online. 15:46.550 --> 15:49.250 We don't want to like promise yet until it works out. 15:49.250 --> 15:51.790 But we have some folks that I think you'll be excited to hear from. 15:51.790 --> 15:54.430 And we're looking forward to having joined the commentary. 15:54.970 --> 15:56.490 And so keep an eye on that. 15:56.490 --> 15:58.570 But that will probably be in tomorrow. 15:58.570 --> 16:03.370 Yeah, we have a question in chat here about whether each round will have the same challenge or each match will be unique. 16:03.370 --> 16:06.570 So each match will have a unique challenge. 16:06.570 --> 16:09.470 And this is because, of course, we are broadcasting this. 16:09.470 --> 16:12.950 So all the teams can watch the other matches. 16:12.950 --> 16:18.830 And in fact, that might be like a good idea to get like a feel for the type of challenges we are going for. 16:19.490 --> 16:24.890 So definitely we couldn't have the same challenges for each match because then you could just copy the solution of the previous match. 16:24.890 --> 16:30.930 Yeah , the only way to do that would have been to sort of sequester and take all the people in any given round into a room, not let them out and let them one at a time. 16:30.930 --> 16:32.810 And that just was we were going to waste people's time. 16:32.950 --> 16:35.590 So instead we wasted our time and we made a lot more challenges. 16:35.590 --> 16:37.910 It would have been a lot easier if we only had to make four challenges. 16:38.150 --> 16:42.390 But by making 15 challenges, yes, different teams will get different challenges. 16:42.390 --> 16:52.190 We have actually told each team, though, the name of the challenge, which is sometimes actually a pretty good hint as to what kind of challenge it is, the category, whether it's reversing or a pwnable. 16:52.230 --> 16:53.710 Today we have all pwnables. 16:53.710 --> 16:56.630 And we have a mix of x86 and x64 binaries. 16:56.630 --> 16:58.470 I think it was one x86 32-bit. 16:58.590 --> 17:01.370 The rest are all 64-bit. 17:01.590 --> 17:03.450 So that's the challenge we've got. 17:03.450 --> 17:06.490 I love seeing the team hype keep up, you know, cheering on your favorite teams. 17:06.490 --> 17:08.370 That's exactly what we want to see. 17:09.070 --> 17:17.930 Speaking of favorite teams, maybe we should just mention a little bit about how they ended up here as well. 17:17.930 --> 17:21.350 Because as I said, we're here at the DEF CON Finals with the 16 teams. 17:21.350 --> 17:30.870 They had to qualify early this year, I think it was back in May or April, in really tough qualifiers. 17:31.130 --> 17:31.850 Yeah , absolutely. 17:32.330 --> 17:34.030 So, yeah, the top 16... 17:34.030 --> 17:39.950 Well, actually, you have the winner of last year are pre-qualified for the DEF CON. 17:39.950 --> 17:43.450 So in this case, it really was just the top 16, because it happened to be... 17:43.450 --> 17:45.310 Yes, because that team was also playing the qualifiers. 17:45.370 --> 17:48.850 I think officially the previous team didn't this year, as it was a clean break. 17:48.850 --> 17:50.610 When I talked to Nautilus, they said, actually, it turned... 17:50.610 --> 17:53.890 Normally, the team who won the previous year automatically gets a buy. 17:54.050 --> 17:55.050 They weren't sure about that. 17:55.050 --> 17:55.950 In the end, it didn't matter. 17:55.950 --> 17:56.250 Oh, OK. 17:56.570 --> 17:58.890 Because the previous team qualified anyways. 17:59.090 --> 18:01.170 But they were kind of treating it as a sort of fresh break. 18:01.170 --> 18:07.390 So actually, what you're going to see in our bracket, which... Actually, we can pull up the bracket now, and we can take a look at it. 18:07.390 --> 18:17.210 You'll see the way the seeding has worked, is the team who scored first place in the qualification event is battling against the 16th place team from the qualification event, right? 18:17.210 --> 18:20.770 And so throughout these events, that's just kind of how we split things up. 18:20.770 --> 18:24.630 We chose a random order for which match happens when. 18:24.870 --> 18:28.250 And we're going to be putting, again, these kind of random challenges out. 18:28.330 --> 18:35.430 So you'll see where your favorite teams are and kind of who they're battling as they make it through the rounds here this weekend. 18:35.430 --> 18:36.550 Again, we're going to do four. 18:36.550 --> 18:40.250 So round one will take us down from the field of 16 to a field of eight. 18:40.410 --> 18:41.970 And we're going to do half of that round today. 18:41.970 --> 18:43.410 So we've got four rounds today. 18:43.570 --> 18:48.910 Tomorrow morning, Pacific time at 10 a.m., we're going to do the next four rounds. 18:49.110 --> 18:50.950 And at that point, we'll be into round two. 18:50.950 --> 18:51.810 Sorry, matches. 18:52.150 --> 18:53.110 I've got to be careful. 18:53.110 --> 18:57.730 So just to be clear, we have four rounds, and each round will have the number of competitors. 18:58.270 --> 18:59.810 And then we're going to have 15 matches. 19:00.370 --> 19:01.050 We have the language. 19:01.050 --> 19:01.770 I'll probably get it wrong. 19:01.770 --> 19:04.010 We'll correct each other if we do it. 19:04.470 --> 19:08.210 But that's the plan for this whole event. 19:08.210 --> 19:10.430 So scoreboard update, maybe? 19:10.430 --> 19:11.930 Or we get everything else? 19:11.930 --> 19:12.930 What do we need? 19:13.810 --> 19:19.610 Yeah, I think that's where we're at right now. 19:19.650 --> 19:22.150 As I said, pretty tight. 19:22.150 --> 19:26.870 I mean, the DEF CON CTF just kicked off a few hours ago. 19:27.170 --> 19:28.650 Almost four hours ago, yeah. 19:28.650 --> 19:31.750 So it's still early days. 19:31.750 --> 19:32.330 Three hours ago, rather. 19:32.330 --> 19:36.490 Yeah, the teams are within percentages of each other. 19:37.070 --> 19:39.890 But if you want to root on your favorite team, we'll do the top three. 19:39.890 --> 19:44.010 So we have Water Paddler in first with 16,282 points. 19:44.170 --> 19:50.170 Maple Mallard Magistrates, or as I plan to call them, the Mighty Ducks, because that name is really long. 19:50.170 --> 19:52.290 We're going to have to come up with names for a lot of these teams. 19:52.410 --> 19:54.270 And in third place is Straw Hat. 19:54.270 --> 20:02.210 Tied with MMM and Straw Hat, there's a lot of history in all these teams. 20:02.210 --> 20:03.310 We're going to talk more later. 20:03.310 --> 20:05.110 We're going to talk about the split of them. 20:05.250 --> 20:08.730 Many of these teams, actually, I think almost all of them are actually conglomerate teams. 20:08.730 --> 20:10.010 There are several teams that have come together. 20:10.010 --> 20:17.790 Again, speaks to the nature, this is like the hardest, biggest competition that several kind of elite teams come together to form a team to compete here. 20:17.810 --> 20:19.970 Multiple different collaboration teams here. 20:19.970 --> 20:29.750 Just to give an example, you have Sour Cloud, which is like a collection of all the German CTF teams, which they already have, like, really good CTF teams. 20:29.750 --> 20:30.670 Individual teams, absolutely. 20:30.710 --> 20:32.390 But then they, you know, bond together. 20:32.390 --> 20:37.550 This tells a little bit about just how fierce the competition is at this event. 20:37.630 --> 20:39.830 Yeah, so we're going to look forward to those. 20:39.830 --> 20:41.450 We've got nine minutes until our first round. 20:41.530 --> 20:43.210 Let's go ahead and go back to our intermission. 20:43.210 --> 20:46.330 We're going to bring up our next two teams, get them set. 20:46.470 --> 20:47.730 Cross your fingers for the challenge. 20:47.730 --> 20:49.770 I'm really looking forward to seeing what the teams do. 20:49.770 --> 20:51.690 And we'll see you all in about nine minutes. 24:48.030 --> 24:49.230 And we'll see you all in about nine minutes. 24:49.230 --> 24:50.630 And we'll see you all in about nine minutes. 30:28.410 --> 30:31.030 All right, we are back, I hope. 30:31.030 --> 30:32.130 We'll find out. 30:32.710 --> 30:34.610 We are going to count us in. 30:34.610 --> 30:41.430 We have our first two teams, PTBWTL and Shellfish, battling in our first round of live CTF. 30:41.450 --> 30:42.470 We've got the screens up. 30:42.470 --> 30:43.230 They're here behind us. 30:43.230 --> 30:49.570 We're going to count them in, in five, four, three, two, one. 30:50.290 --> 30:51.730 It's live. 30:51.910 --> 30:53.190 They're refreshing the page. 30:53.190 --> 30:55.090 Round of applause for live CTF. 30:56.970 --> 31:00.830 Okay, so now we'll watch and we'll see. 31:00.830 --> 31:01.690 And make sure this is working. 31:01.690 --> 31:12.270 We're going to go ahead and bring up both their screens, and you can get a little sense of the layout that we're going to be using for the event, where you can actually see what they're doing, all right? 31:12.570 --> 31:16.070 So, I see, I love the full-screen terminals, right? 31:16.070 --> 31:17.150 Right, first thing we see. 31:17.150 --> 31:17.510 Yes. 31:17.590 --> 31:18.490 They've got a binary. 31:18.490 --> 31:19.950 We told them it's a pwnable binary. 31:19.950 --> 31:21.950 What was the name of this particular challenge? 31:22.830 --> 31:24.190 It's a SysCallMeMaybe, right? 31:24.570 --> 31:24.950 SysCallMeMaybe. 31:24.950 --> 31:28.090 So, we've got like a little meme reference, CallMeMaybe. 31:28.610 --> 31:32.990 We've also got a competitor webcam, which has just got the laptop, so you can't really see a whole lot of that. 31:32.990 --> 31:35.690 We'll probably not use that particular view. 31:36.010 --> 31:36.310 Yeah. 31:36.350 --> 31:39.570 But we can see we've got IDA up and going. 31:39.570 --> 31:40.850 We've got terminals. 31:40.850 --> 31:42.850 Okay, so let's take a deep breath. 31:42.850 --> 31:45.390 We can already see pretty straightforward. 31:45.390 --> 31:48.230 In fact, we've even got some symbols here, right, on this particular binaries. 31:48.230 --> 31:48.910 Yes. 31:48.910 --> 31:52.470 And let's, we've got on the left, we've got... 31:54.570 --> 32:01.410 We have Pwnabytes, the PTB, PTL here, and we have Shellfish on this side. 32:01.410 --> 32:01.770 On the right, okay. 32:01.770 --> 32:05.510 They're both using IDA for their disassembly. 32:05.510 --> 32:07.230 I was hoping for, I did see Binger running. 32:07.230 --> 32:08.570 I noticed Binger was actually running. 32:08.570 --> 32:09.010 Yeah. 32:09.010 --> 32:15.970 I think they're prepared, knowing a Binger developer was one of the organizers, like , in case there's something terrible that Binger does better at, we should leave it up. 32:15.970 --> 32:16.610 Yes. 32:16.650 --> 32:18.210 You see, it's a pretty small program here. 32:18.210 --> 32:33.010 You can see on the Shellfish there, you could get a glance of the code where it's a program, reading in some commands, sorry, some arguments to whatever syscall you want to make. 32:33.630 --> 32:37.470 And yeah, you can do this how many times you want, and then from there you want to get code execution. 32:37.470 --> 32:39.910 So, the vulnerability is there. 32:39.910 --> 32:47.710 This is actually more of a Shell coding exercise than a, like, you don't have to find the vulnerability. 32:47.710 --> 32:53.950 It literally will just run whatever syscall you want, and it's up to you to provide a series of syscalls. 32:53.950 --> 32:57.310 So, like, can't I just, like, execve and run bash? 32:57.310 --> 32:57.770 Immediately? 32:57.770 --> 32:59.530 Like, you know, is that not a valid solution? 32:59.770 --> 33:06.070 Yeah, I mean, almost, except that, you know, to call an exec, you need a string of the program you're executing. 33:06.070 --> 33:11.870 So, they first need to get that string into memory somehow, but then it should be just smooth sailing from there. 33:11.870 --> 33:17.530 Yeah, and it's kind of ironic that, like, we give them full syscalls, but they don't have the ability to just run Shell code, right? 33:17.530 --> 33:26.550 So, because they don't have actual Shell code, little things like just put some bytes directly into a piece of memory is maybe a little bit trickier, and so they're not going to be able to do that. 33:27.410 --> 33:29.730 Let's talk about what's their goal. 33:29.730 --> 33:31.810 What are they trying to do here to show that they've won? 33:31.810 --> 33:32.330 Right. 33:32.330 --> 33:38.530 So, the goal of this challenge, and most of the challenges, actually, is to gain code execution on the remote system. 33:38.670 --> 33:44.350 And once you have that, there is a small program sitting there that you can run to... 33:44.350 --> 33:47.370 Let's go ahead and pick up Shellfish there, because I saw them running the challenge. 33:47.370 --> 33:47.590 Right. 33:47.590 --> 33:59.910 So, they've created kind of like a template in their exploitation script where they're just, like, setting up the interaction with the program, like, inputting the different parameters, just making sure that that works. 33:59.990 --> 34:05.550 And then once they have that in place, they can kind of, like, make an abstraction on top of that and just make all the syscalls that they want. 34:05.550 --> 34:15.070 So, they're just going to use, like, Epone tools or something like that to be able to interact with the service, but then they're going to wrap that so that it's this syscall, this parameters, and it will handle the text formatting and the new lines and all that kind of stuff. 34:15.070 --> 34:15.490 Right. 34:15.490 --> 34:16.770 Just let them build their primitives. 34:16.770 --> 34:19.290 And this is very common when you do this type of exploitation. 34:19.290 --> 34:26.170 You kind of, like, transform functions in the program to, like, more abstracted operations. 34:27.210 --> 34:30.390 And we had a question here in chat, if they have internet and they can Google and stuff. 34:30.390 --> 34:31.530 Yes, they do have access to internet. 34:31.530 --> 34:32.690 Actually, we can see it just now. 34:32.690 --> 34:36.110 So, PDB just pulled up a reference here. 34:36.490 --> 34:42.010 So, I think we're looking, if we switched over in time, you're going to see them looking up syscall tables, which makes a lot of sense. 34:42.010 --> 34:44.130 That was actually what we did when we were testing this as well, right? 34:44.130 --> 34:44.690 Yes. 34:45.690 --> 34:55.610 In fact, the first thing they're looking for is execv-e, exactly as we said, oh, I want to just run execv-e, I'm going to run binbash, and that's where you're going to first run into this, well, wait a minute, how do I actually get the string? 34:55.890 --> 35:06.450 As we, like, had some of the Nautilus members, and as we talked about this with some folks, everyone's first reaction is, oh, that's immediately trivial, and then you're like, yeah, but where do you get your string from? 35:06.450 --> 35:10.990 You've got to have a pointer to a string, and so you've got to think a little bit about that. 35:11.050 --> 35:17.550 It's not super hard, but you have to figure out how to get something into memory first that's going to be the string that you're going to call. 35:17.550 --> 35:17.910 Yeah. 35:17.910 --> 35:21.650 We can see here for Shellfish some debugging going on. 35:21.650 --> 35:25.030 There was some GDB with the Jeff extension. 35:25.050 --> 35:26.110 I'm a big fan. 35:26.670 --> 35:28.710 It makes life a lot easier. 35:29.470 --> 35:31.510 I'm trying to see exactly what's going on. 35:31.510 --> 35:34.630 They're trying to put some breakpoints somewhere, looking at the memory mapping. 35:34.630 --> 35:35.930 Yeah, okay. 35:36.190 --> 35:42.510 So they needed the base address there to put the breakpoint in the right place, although there is a function in Jeff to automate that. 35:42.510 --> 35:44.730 But , however, you know, they're getting there. 35:44.730 --> 35:45.650 What's the function? 35:45.770 --> 35:48.930 It's called, like, pybreak, so they will, like, do relative to the... 35:48.930 --> 35:49.990 Oh, that's kind of handy. 35:49.990 --> 35:50.530 Yeah. 35:50.710 --> 35:52.250 Does the math for you with the offset. 35:52.250 --> 35:52.350 Yes. 35:52.350 --> 35:52.990 That's cool. 35:54.130 --> 35:59.990 There's a lot of different nice tricks with that extension framework. 36:00.690 --> 36:02.990 So I want to talk a little bit just about the teams, too, right? 36:02.990 --> 36:06.110 Because we've got, again, we've got a lot of, like, these conglomeration teams. 36:06.310 --> 36:13.350 And so, briefly, and we'll try not to miss, so , yeah, you keep an eye on the teams to make sure I'm not missing somebody, like, you know, getting close. 36:13.530 --> 36:15.930 But we've got Team Shellfish that has been around. 36:15.930 --> 36:23.370 It's one of the longest-running CTF teams, originally out of UCSB, but they've got, kind of, I think, connections now a lot of different places. 36:24.650 --> 36:28.630 So Team Shellfish is currently one of our battling teams. 36:28.750 --> 36:32.910 And PTBWTL has pwned the bytes and... 36:32.910 --> 36:33.590 Wrecked the line. 36:33.610 --> 36:34.390 Wrecked the line. 36:34.630 --> 36:35.930 I don't remember that one exactly. 36:35.930 --> 36:37.590 Both Romanian teams, right? 36:37.590 --> 36:38.630 I believe so. 36:38.630 --> 36:39.150 I believe so. 36:39.150 --> 36:44.190 I think they have other members as well, but I think they're, like, primarily Romanian-based, at least. 36:44.190 --> 36:48.430 And I think we do see that, especially in the DEF CON, where the teams are, like, these megagroups are coming. 36:48.530 --> 36:51.330 Sometimes they're just colleges or friends or online communities. 36:51.330 --> 36:56.810 And sometimes they are just local, regional, or, you know, country CTF teams that normally compete against each other. 36:56.830 --> 36:59.150 And then they come together to form, like, a megagroup. 36:59.150 --> 37:02.510 And so you've got, like, this sort of country-based representation. 37:02.850 --> 37:03.430 Yes. 37:03.810 --> 37:09.350 Which also says something about, like, kind of, like, the, you know, CTF community aspect of the whole thing. 37:09.350 --> 37:13.810 I think it's really nice to see these, like, different, like, regional communities, like, gathered together. 37:13.810 --> 37:17.210 You're both competing against and also participating with. 37:17.330 --> 37:19.510 We're losing video on one of our capsules. 37:19.510 --> 37:19.850 We're not sure. 37:19.850 --> 37:21.750 Is it losing on the stream as well, or are we... 37:21.750 --> 37:21.990 OK. 37:21.990 --> 37:24.410 So I apologize for the flicker. 37:24.410 --> 37:26.910 We've got some probably loose cable somewhere. 37:26.910 --> 37:27.430 Yeah. 37:27.890 --> 37:29.050 This is the joys. 37:29.050 --> 37:32.010 But technically, you know, it could be a lot worse. 37:32.010 --> 37:34.110 Like , it is... it appears to be working. 37:34.110 --> 37:35.710 And so that's our big stress here. 37:35.710 --> 37:42.110 So I saw some... was it, like, S-trace output or something from the P2B screen there? 37:43.050 --> 37:43.890 Not sure. 37:43.970 --> 37:44.150 OK . 37:44.150 --> 37:44.650 So, OK. 37:44.650 --> 37:45.190 I like that. 37:45.190 --> 37:45.590 So look at it. 37:45.590 --> 37:46.990 I love that we're seeing the highlights, right? 37:46.990 --> 37:47.790 So, mmap. 37:47.790 --> 37:49.070 We started with execve. 37:49.090 --> 37:52.910 Yes, that's going to be your ultimate goal, is you're probably going to want to trigger execve. 37:53.170 --> 37:54.950 But, like, you've got to get your memory first. 37:54.950 --> 37:58.170 And so we're seeing, like, someone's looking... 37:58.170 --> 38:03.890 we're going to look for mmap to try to get something into memory, get a piece of memory that we control. 38:04.430 --> 38:06.850 But they're going to have to still get something into that region, right? 38:06.850 --> 38:09.070 They're still going to have to actually get bytes at that address. 38:09.690 --> 38:13.590 I'm seeing some very interesting thing here on the Shellfish side. 38:13.590 --> 38:22.110 They're grabbing the address of the vsyscall memory region, which was not involved in any of the proposed solutions when we were testing this. 38:22.110 --> 38:22.990 I love it. 38:22.990 --> 38:26.930 So I really would like to see what they're going for there. 38:27.870 --> 38:30.630 And to be clear, we expect that there will be lots... 38:30.630 --> 38:33.470 that this one in particular has an infinite number of solutions, right? 38:33.470 --> 38:36.390 There's going to be all sorts of ways that we didn't think about. 38:36.390 --> 38:38.390 So we have one in mind that we expected. 38:39.210 --> 38:46.490 One of the things that I think is the most fun as an organizer is when somebody solves your challenge in a way that you completely did not expect. 38:46.490 --> 38:47.330 Yeah , yeah. 38:47.690 --> 38:49.450 As long as it's not like... 38:49.450 --> 38:54.650 So in this particular case, we're okay if they solve it quickly, because that's the point, is to be as fast as possible. 38:54.710 --> 39:01.950 Sometimes if you build a really difficult, hard CTF challenge and somebody finds a trivial thing that you forgot, that's a little soul-crushing. 39:01.950 --> 39:02.370 Yeah , yeah, yeah. 39:02.370 --> 39:07.170 But as long as it's a cool solution or anything, then you just love to see it. 39:07.170 --> 39:12.230 Yeah, although sometimes I love how CTF organizers will re-release a challenge, right? 39:12.230 --> 39:17.490 Patch the easy bug you didn't intend, give them points still, but then make them solve it the harder way as well, too. 39:17.490 --> 39:22.190 So I think that's a decent trend and one good way to just get both out of it. 39:22.190 --> 39:24.670 To reward them for what they did, but also keep doing that. 39:25.630 --> 39:26.810 So we have... 39:26.810 --> 39:28.730 Uh-oh, so we've got something happening here. 39:28.810 --> 39:29.970 So we've got an mmap syscall. 39:29.970 --> 39:34.270 Okay, so we're looking at PTB, and we've got mmap. 39:34.430 --> 39:35.850 So we've got our syscall wrapper. 39:35.850 --> 39:38.230 We're going to call the syscall by name. 39:39.810 --> 39:42.490 So, the mmap syscall, what are we doing with that? 39:42.490 --> 39:46.790 We know execve is going to run something, but what's mmap going to do that's going to help us? 39:47.070 --> 39:50.950 Yes, so we need to put the string somewhere in memory. 39:50.970 --> 39:56.290 We don't know anything about what memory is mapped and so on, so we'll just map, we'll use the mmap thing. 39:56.290 --> 40:02.730 Okay, and we do, we didn't mention this earlier, I don't think, but the output of the syscall you ran is returned to the user. 40:02.730 --> 40:03.750 Like the return value. 40:04.210 --> 40:08.550 Yeah, so if there is a return from that syscall, they're going to get that information back. 40:08.550 --> 40:12.150 So any of these syscalls that that's useful, we're going to see that. 40:12.450 --> 40:16.390 So we had a comment, sorry, question here about what happens if they don't solve the challenge in one hour. 40:16.390 --> 40:19.110 So even before that, I think it's like 45 minutes or so. 40:19.110 --> 40:20.170 Sometime around 45 minutes. 40:20.170 --> 40:28.890 Yes, if they don't, we will switch to a sudden death challenge, which is a very simple challenge that they will try to solve instead. 40:28.890 --> 40:33.650 So we will just like discard all the stuff they did so far, and we will switch to like a super, super simple challenge. 40:33.650 --> 40:45.010 And mainly the reason that we're going to do that is just because we've got so many matches that we have to run, that if they each start taking longer and longer, and we're off schedule, we'll be keeping people overnight, and it would just be kind of a logistical headache. 40:45.010 --> 40:47.090 So we hope we don't have to. 40:47.130 --> 40:53.210 If we don't have any bugs in our challenges, and they're all the appropriate difficulty, and the teams all do well, you'll never see them. 40:53.210 --> 40:54.470 We'll save them for next year. 40:55.450 --> 41:00.570 But those are going to be like really, really simple ones that we hope they can solve within less than five or ten minutes. 41:00.750 --> 41:02.390 So that's kind of the backup plan. 41:02.510 --> 41:03.490 We'll find out if we need it. 41:03.490 --> 41:07.230 I have to say, so far, right on pace, super happy with this. 41:07.230 --> 41:09.970 This is, I think, about what I would have hoped and expected. 41:10.830 --> 41:13.090 We're seeing they've already got their frameworks up. 41:13.090 --> 41:14.750 They know exactly what they have to do. 41:14.770 --> 41:17.650 They're just building the right building blocks to kind of see it. 41:17.790 --> 41:23.230 And this is also, I think, something that's always kind of a challenge for me when solving these kind of challenges. 41:24.070 --> 41:29.710 How much do you want to take the time and build the proper abstractions and make your nice functions? 41:29.850 --> 41:38.130 And how much do you kind of just want to take that leap of faith and just throw together some really crappy code that might solve the thing? 41:38.190 --> 41:42.410 That might work, but if it doesn't, then you have to backtrack, and it's a whole mess. 41:42.410 --> 41:54.890 I feel like there's a lot of game theory to it, almost, in terms of risk-reward, explore-exploit kind of analysis, where you have to figure out, is it worth it? 41:54.890 --> 41:55.610 And you don't really know. 41:55.610 --> 41:57.750 You do develop, I think, a bit of an intuition. 41:58.210 --> 42:05.190 You can kind of look at it, and you sort of have a sense of, okay, no, I just need to bang this out and just hard-code a bunch of bytes in, and that'll be fine. 42:05.310 --> 42:07.330 In this particular case, oh, here we go. 42:07.330 --> 42:08.290 This is interesting. 42:08.490 --> 42:10.350 So now we've got a read syscall. 42:10.370 --> 42:13.170 This is... oh, we also saw the syscall list on the other side with shellfish. 42:13.170 --> 42:17.070 But ptb, I think we have all the syscalls we need. 42:17.310 --> 42:17.930 I think... 42:17.930 --> 42:19.930 Read, mmap, yeah, exactly. 42:19.930 --> 42:21.050 I think this is it. 42:21.070 --> 42:22.810 These are the right ingredients. 42:22.850 --> 42:25.070 They just got to assemble them correctly. 42:25.090 --> 42:26.190 Yeah, make that cake. 42:26.190 --> 42:27.350 Yeah, yeah. 42:27.350 --> 42:37.410 And then we should be... we may be looking at a winner, but we'll also keep an eye on shellfish and see what's happening there as well, and make sure that... 42:37.410 --> 42:38.370 Yeah. 42:38.370 --> 42:44.490 So they're using the fxv function, which I... that variant, I'm not... 42:44.490 --> 42:45.070 I don't know. 42:45.070 --> 42:47.170 I'd have to look at the main page myself, yeah. 42:47.170 --> 42:51.410 I mean, because these functions, they come in a bunch of different flavors, right? 42:51.770 --> 42:52.770 So that's interesting. 42:52.770 --> 42:59.130 And again, there is... I think one of the things the teams are going to realize is that we didn't go for tricks. 42:59.610 --> 43:02.630 We didn't... we tried not to go for tricky, gimmicky things. 43:02.630 --> 43:04.170 It's tried to be pretty straightforward. 43:04.170 --> 43:10.230 We want them to be fast and quick, and sort of the obvious thing you would think of is at least our intended solution oftentimes. 43:10.450 --> 43:11.730 That's not always the case. 43:11.730 --> 43:13.350 Lots of CTFs, right? 43:13.690 --> 43:17.270 You've got to find the very tricky thing, and that makes it fun. 43:17.270 --> 43:18.610 It actually is super entertaining. 43:18.610 --> 43:19.050 Yeah. 43:19.310 --> 43:25.350 Something you can also learn stuff from, like it sends you down this rabbit hole of research and stuff, but you don't really have time for that. 43:25.350 --> 43:25.670 Right. 43:25.670 --> 43:31.750 So like Punnable.kr or those websites have amazing, really cool things you can learn. 43:31.990 --> 43:34.870 But here, we're not trying to trick them. 43:35.710 --> 43:36.010 Yeah. 43:36.190 --> 43:37.730 No Gidra users yet. 43:37.730 --> 43:40.970 I have seen a couple of the participants in the room using Gidra. 43:41.170 --> 43:43.950 Maybe we should keep a tally for the tournament. 43:44.190 --> 43:45.650 It might be too depressing for me. 43:45.650 --> 43:47.550 That might hurt my Binja soul. 43:47.550 --> 43:49.850 Might be too hurt by that. 43:49.850 --> 43:50.390 Yeah. 43:50.390 --> 43:57.370 So for those not aware, Jordan, one of the founders of Vector35, making Binary Ninja, which is not used in this match. 43:57.370 --> 43:58.770 But we hopefully will see it. 43:58.770 --> 43:59.590 I hope we see it. 43:59.590 --> 44:04.570 And if all I want is one Binja user to win one round, then that'll make my heart happy. 44:04.570 --> 44:06.430 Go straight into the marketing material. 44:06.430 --> 44:07.610 I mean, yeah, exactly. 44:07.610 --> 44:08.050 Exactly. 44:08.110 --> 44:13.150 I will say, you know, the funny thing is, Binary Ninja was actually designed for CTFs originally. 44:13.150 --> 44:15.110 It was meant to be very, very fast and quick. 44:15.110 --> 44:18.630 And like common things like patching things out were meant to be quick. 44:18.630 --> 44:20.310 So that's probably kind of some of the things it does well. 44:20.310 --> 44:24.530 So it is actually well-suited towards a very, very fast-paced environment. 44:24.530 --> 44:26.770 But more important than that is knowing what you're doing. 44:26.770 --> 44:27.490 All right, so back to Shellfish. 44:27.490 --> 44:28.230 What are you seeing? 44:28.230 --> 44:37.470 So Shellfish, they are writing a small C program here, calling mmap. 44:37.470 --> 44:39.490 Yeah, I think they're testing out, they're maybe like... 44:39.490 --> 44:40.370 I like that idea. 44:40.370 --> 44:44.930 ...not completely sure about the arguments or so for the mmap. 44:44.930 --> 44:49.350 So they're writing a small little test program to just verify that they have the correct understanding of the situation. 44:49.350 --> 44:50.490 That's actually a really, really good idea. 44:50.490 --> 44:51.170 Very good idea. 44:51.170 --> 44:52.750 Yeah, because, you know, you don't want to like... 44:52.750 --> 44:57.670 You have the added complication of a network service and the text protocol and your throwing script and your wrapper. 44:57.830 --> 44:59.370 No, no, just get rid of that abstraction. 44:59.630 --> 45:04.830 Test the syscalls in a row directly, and then once you've got it working, then you can sort of port it to your throwing framework. 45:04.830 --> 45:07.150 I think that's a great idea, so I'm happy to see that. 45:07.930 --> 45:08.890 But we are seeing... 45:08.890 --> 45:13.250 So we're seeing just the straight-up approach over here on WTL. 45:15.330 --> 45:17.350 Let's watch them as they've got it. 45:19.870 --> 45:20.570 Yeah. 45:20.570 --> 45:21.690 Looking through... 45:21.690 --> 45:22.170 Yes. 45:22.170 --> 45:23.830 Is it buffered? 45:23.830 --> 45:25.170 Is input buffered or not? 45:25.170 --> 45:26.410 They're checking that. 45:26.670 --> 45:28.610 Maybe they're looking for another piece of memory. 45:28.730 --> 45:33.530 They're looking over here in the data segment, so I wonder if they're looking for a place to reuse. 45:33.530 --> 45:35.130 But this is ASLR, right? 45:35.130 --> 45:44.390 I don't think we gave them information about where the binary is executing here, because it is kind of up to them to sort of like make their own memory with the syscalls that they've got. 45:44.390 --> 45:57.710 Yeah, we can see here, going over to Shellfish again, they are putting this together as the mmap syscall now. 45:59.410 --> 46:01.170 And yeah, I think... 46:01.170 --> 46:05.550 Are they like slightly behind the P2P at the moment? 46:05.550 --> 46:07.650 You know, it's so hard to say, though. 46:07.650 --> 46:08.250 Having done... 46:08.250 --> 46:11.850 You know, we've both done, I think, several versions of these kind of events, and it can be really tough. 46:11.850 --> 46:15.790 Sometimes you think somebody's like not even close, and all of a sudden, before you notice, they've solved it. 46:15.790 --> 46:16.110 Yeah . 46:16.110 --> 46:19.030 And sometimes you can see them kind of bringing it home. 46:19.030 --> 46:19.530 Yeah. 46:19.710 --> 46:22.790 Yes, Nick, I'm Jordan. 46:22.790 --> 46:26.750 Hi, cyphertext on Twitter, the Vector35 BinaryNinja guy. 46:26.910 --> 46:29.830 And David, we have thousands of BinaryNinja users. 46:29.830 --> 46:32.290 There are many thousands of BinaryNinja users. 46:32.690 --> 46:37.930 We'll see how many are here besides the one that we have from PTB, even though they're not using it. 46:37.930 --> 46:41.810 Maybe they just ran it just to like as a show of solidarity for me, to make me feel better. 46:41.810 --> 46:42.810 I'm a BinaryNinja user. 46:42.810 --> 46:43.350 There we go. 46:43.350 --> 46:45.570 There are, yes, there are BinaryNinja users. 46:45.570 --> 46:54.950 Yeah , but anyway, looking at the PTB screen here, I think you can see that they're debugging the read, the calls here, right? 46:54.950 --> 46:57.630 No, sorry, that's the input reading routine. 46:57.970 --> 47:04.070 And they are doing the syscall zero, which is, is that the read? 47:05.690 --> 47:12.630 And yeah, checking out some documentation about mmap. 47:12.810 --> 47:14.270 Stack overflow, always check it. 47:14.270 --> 47:17.190 But we have Shellfish. 47:20.090 --> 47:23.950 Again, yeah, fixing the mmap. 47:24.930 --> 47:27.770 Okay, so PTB just found map fixed. 47:27.910 --> 47:35.450 So what they were looking for is they wanted to get the right flag to be able to pass to mmap to request a fixed address. 47:35.450 --> 47:37.070 So you can, there's different modes of mmap. 47:37.070 --> 47:39.130 You can request memory and just take whatever you can get. 47:39.130 --> 47:41.230 Or you can just say, no, no, I want this address. 47:41.230 --> 47:42.370 Please give me this address. 47:42.370 --> 47:45.910 And so they're just going to hard code some address that they hope nothing runs against. 47:45.910 --> 47:47.630 And this is kind of like a key to the challenge, right? 47:47.630 --> 47:52.890 Where since, well, not necessarily, since you do get the return address. 47:52.890 --> 47:54.790 They get the return address, so they could, but... 47:54.790 --> 47:58.590 Slightly simpler variant is just to tell mmap, like, no, we're going to allocate at this address. 47:58.590 --> 48:01.030 It's one less moving part to worry about. 48:01.390 --> 48:04.210 So yeah, I think you can go kind of either way. 48:04.390 --> 48:06.130 And this is, so this is, we're about 20 minutes in. 48:06.130 --> 48:09.630 This is where I think we'd be evaluating, are we going to give a hint? 48:09.630 --> 48:11.210 And I don't think they need any hints. 48:11.210 --> 48:14.710 They both really know, I think, generally what the shape of the problem is. 48:14.910 --> 48:16.550 They're both working on it. 48:16.570 --> 48:21.690 I have every confidence that they're going to, I think they're going to finish it out in the next 20, you know, 10, 20 minutes. 48:21.690 --> 48:22.250 Yes. 48:22.290 --> 48:23.450 We hope, we hope. 48:23.450 --> 48:25.830 We're looking forward to seeing them do that. 48:28.310 --> 48:29.290 All right. 48:29.490 --> 48:34.630 We forgot to bring our water bottles over here to make sure we could stay hydrated, but we'll do that. 48:34.850 --> 48:46.390 We're having to, not only are we yelling over the house audio, but we have our masks on, and there have been easier streaming environments, but I'm super excited to be here. 48:46.730 --> 48:47.010 Yeah . 48:47.810 --> 48:51.290 So, going over to P2P again. 48:52.250 --> 48:56.810 Well, and so, yeah, I think we mentioned this before, but right, like this solid script they're running, they're running locally. 48:56.810 --> 49:00.810 They got the binary locally, they're running it in debugger, so they can analyze both halves of it. 49:00.810 --> 49:09.190 And then once they have it working, then they're going to go ahead and throw it against the real server remotely, which is like standard operating procedure, I feel like, for these kind of challenges, right? 49:09.190 --> 49:10.690 Standard pwnable challenge. 49:10.690 --> 49:11.210 Exactly. 49:11.210 --> 49:18.530 And that's also why it's nice to have, it's nice to actually have an environment where you can run it directly, right? 49:18.530 --> 49:22.230 Whether it's the architecture you've got or the operating system. 49:23.610 --> 49:24.190 Yes. 49:24.190 --> 49:27.890 Teams were a little worried about having internet, and we're like, no, no, no, we want to see you in internet. 49:27.890 --> 49:31.390 And remember, these are some of the best teams in the world, and they're still looking this stuff up. 49:31.390 --> 49:32.710 We all are doing that. 49:32.710 --> 49:36.630 Let's take a look over here at Shellfish again and see where we're at. 49:36.630 --> 49:37.170 Yes. 49:37.450 --> 49:41.390 So, they have another syscall that they're setting up. 49:41.390 --> 49:45.350 You see them, like, well, retrying that. 49:45.350 --> 49:49.850 So , they're really making sure that the interaction here is working. 49:49.850 --> 49:52.790 You have this, like, question from the programmer, like, do you want to make another syscall? 49:52.790 --> 49:55.450 So, they're just setting that up to answer yes on that. 49:55.450 --> 49:57.810 And then you'll see they're about to set up another syscall. 49:57.850 --> 49:58.510 Oh, there we go. 49:58.510 --> 50:00.730 So, we're looking at memory maps over on PTB. 50:00.730 --> 50:03.430 So, they briefly, they tried to allocate the memory. 50:03.430 --> 50:06.350 They went to look in the debugger and to see if the memory was allocated. 50:06.350 --> 50:15.470 So, the only thing, I mean, if they're past that step, the only thing left to do then is going to be to actually put binbash there, right? 50:15.470 --> 50:21.610 Like, once they have the string binbash into that location, they should be able to win. 50:21.610 --> 50:23.030 They should be able to, yeah. 50:23.350 --> 50:28.070 We have a question in chat about if the challenges are going to be released to everyone after the finals. 50:28.070 --> 50:31.450 I mean, we haven't really talked about that, but, I mean, impossible... 50:31.450 --> 50:32.150 I assume so, yes. 50:32.170 --> 50:34.410 Should the DA, is anything stopping us from doing that? 50:34.410 --> 50:37.630 So, I'm going to say yes on that. 50:38.070 --> 50:38.790 Provisionally, yes. 50:38.790 --> 50:39.990 Yeah, we'll double check with... 50:39.990 --> 50:45.870 So, now's actually a good time to talk about, if you keep an eye and make sure, we're getting a little close over here on PTB. 50:45.910 --> 50:47.250 So, Carl, if you watch that. 50:47.570 --> 50:50.890 But we do have a lot of people who've been helping out so far. 50:50.890 --> 50:56.050 So, there are three of us in person here at Vegas that are doing all like this kind of stuff. 50:56.130 --> 51:02.070 But we've had several other people contribute challenges remotely, test challenges, do a lot of stuff. 51:02.070 --> 51:03.830 We're looking real close over here. 51:03.830 --> 51:09.870 Okay, so again, we've got our read, we've got an exec, we've got our mmap, this might actually be it. 51:09.870 --> 51:15.430 So, let's take a look and follow on PTB, because I'm smelling blood in the water. 51:15.430 --> 51:17.030 I think if there was... 51:18.810 --> 51:23.010 Yeah, so they, like, maybe they need to fix some small thing here. 51:23.610 --> 51:26.070 Oh, yeah, is that, they have some helper function there. 51:26.070 --> 51:28.010 Unfortunately, I don't know really what it is. 51:28.050 --> 51:29.230 It was like interactive. 51:29.270 --> 51:30.710 Is it, oh, is it dead? 51:30.950 --> 51:31.610 Is it? 51:32.770 --> 51:34.090 Oh, they're solving it. 51:34.090 --> 51:34.870 That's it. 51:36.270 --> 51:36.950 That's it. 51:36.950 --> 51:37.570 Is that it? 51:37.570 --> 51:38.090 Is that it? 51:38.090 --> 51:38.670 Is that it? 51:38.670 --> 51:39.370 Is it going? 51:41.630 --> 51:42.230 What? 51:42.230 --> 51:42.690 What? 51:42.690 --> 51:43.310 We already had it. 51:43.310 --> 51:44.250 Oh, my God. 51:44.250 --> 51:45.490 We were even looking at the right screen. 51:45.750 --> 51:46.470 Congratulations. 51:47.790 --> 51:50.390 Wow, that was so close. 51:50.430 --> 51:52.370 That was so close. 51:52.370 --> 51:52.930 Okay. 51:53.270 --> 51:54.510 Well done. 51:54.650 --> 51:56.870 I can't believe how close that was. 51:57.430 --> 51:57.830 All right. 51:57.830 --> 51:58.330 Oh, my God. 51:58.330 --> 51:59.170 Okay, so... 51:59.170 --> 52:00.710 That was outrageous. 52:00.770 --> 52:00.810 Yes . 52:01.490 --> 52:03.970 Give me, so I will go over to the players. 52:03.970 --> 52:04.590 You talk to the players. 52:04.590 --> 52:05.690 You take it over here. 52:06.030 --> 52:06.330 All right . 52:06.330 --> 52:06.910 Yes. 52:06.910 --> 52:08.330 That was unbelievable. 52:08.570 --> 52:09.650 We even predicted. 52:09.650 --> 52:10.930 We said we're going to miss one. 52:10.930 --> 52:11.290 Yeah. 52:11.290 --> 52:12.430 We're looking the wrong way. 52:12.590 --> 52:14.890 All right, so let's do a real quick recap. 52:15.130 --> 52:19.410 So we were between the screen kind of turning on and off a little bit on the shelf of Shy. 52:19.410 --> 52:20.370 We were a little behind. 52:20.370 --> 52:22.530 I mean, that was like seconds. 52:22.530 --> 52:24.390 They were seconds away. 52:24.610 --> 52:26.070 That was unbelievable. 52:26.070 --> 52:27.190 What a great finish. 52:28.050 --> 52:31.270 So just as a quick recap, perfect timing. 52:31.810 --> 52:32.710 Super exciting. 52:32.710 --> 52:34.770 Very well done to both of those teams. 52:34.990 --> 52:37.030 That was so close. 52:37.030 --> 52:38.310 So close. 52:39.310 --> 52:47.810 So, again, once they were able to get their shell, all they had to do was run their script, put their team number in from the page that told them what they had done. 52:47.970 --> 52:52.510 I'm happy we saw all of our infrastructure working, the overlay when we got a winner. 52:53.170 --> 52:54.690 Congratulations to Team Shellfish. 52:54.690 --> 52:56.350 But, man, well played, PTB. 52:56.350 --> 52:57.970 That was so close. 52:58.430 --> 52:59.650 Really, really well done. 52:59.690 --> 53:04.770 We're going to let them go back to their teams and keep working on the rest of the challenges here. 53:04.790 --> 53:11.170 We'll see if we can figure out how to turn off the winner script and get back to the stream. 53:12.290 --> 53:15.090 We're going to leave the stream going, so keep watching here. 53:15.090 --> 53:19.590 But remember, just on the hour, every hour, our goal, we're going to have a new round. 53:19.590 --> 53:20.650 And so we're going to get set up. 53:20.650 --> 53:21.830 We're going to get the next team. 53:22.190 --> 53:23.910 And then we'll update our bracket now. 53:23.910 --> 53:25.090 We have our first winner. 53:25.090 --> 53:26.990 Congratulations to Team Shellfish. 53:27.330 --> 53:28.170 Well done. 53:28.170 --> 53:29.070 Very well done. 53:29.070 --> 53:29.890 Oh, my God. 53:29.890 --> 53:30.450 That was so good. 53:30.450 --> 53:30.930 Oh, my God. 53:30.930 --> 53:31.770 That was so good. 53:31.770 --> 53:32.230 Yeah. 53:32.230 --> 53:35.910 All right, that set a high bar for, I think, the competition for the rest of the event. 53:35.910 --> 53:37.650 But what a way to kick it off. 53:38.010 --> 53:39.550 We're going to leave you at the intermission. 53:39.650 --> 53:40.710 You can check out the scoreboard. 53:40.710 --> 53:45.090 And then we'll be back in about 35 minutes with the next round. 53:45.130 --> 53:45.790 Yep. 53:45.850 --> 53:46.550 See you later. 53:46.550 --> 53:47.170 Take care. 55:08.010 --> 55:08.110 See you later. 01:34:15.060 --> 01:34:16.760 All right, and we're back. 01:34:16.760 --> 01:34:24.020 Welcome, everybody, to round two of, excuse me, round one, match two of live CTF here at DEF CON CTF. 01:34:24.020 --> 01:34:26.780 You can see Carl behind me instructing the competitors. 01:34:26.780 --> 01:34:38.700 Our next two teams up are team, I'm just going to call them slashers, slash, slash, slash, because their official name is slash V, slash home, slash R, slash .bin, slash TW. 01:34:39.100 --> 01:34:48.880 I believe it's a combination of team Binja, team Tokyo Westerns, a bunch of teams, and they've combined themselves with, like, a path. 01:34:49.140 --> 01:34:53.520 So they're getting the instructions now on exactly what's going to happen. 01:34:54.420 --> 01:34:57.280 They're hopefully about ready to go. 01:34:58.000 --> 01:34:59.200 You count it out. 01:34:59.200 --> 01:35:00.660 Count it out and make it live. 01:35:00.660 --> 01:35:03.880 And let's go ahead and actually pull up both of their screens. 01:35:03.880 --> 01:35:05.440 We'll watch them start here. 01:35:05.920 --> 01:35:12.360 And we'll, as soon as we give them the word that the server's live, they'll be able to refresh and start going on challenge number two. 01:35:13.360 --> 01:35:15.520 You go ahead and count it, count it in, count it in. 01:35:17.560 --> 01:35:18.780 All right, here we go. 01:35:19.040 --> 01:35:20.120 So we're going to go. 01:35:21.080 --> 01:35:24.140 All right, go, go, make it go. 01:35:24.160 --> 01:35:24.920 All right, we'll just do that. 01:35:24.920 --> 01:35:25.560 No countdown. 01:35:25.560 --> 01:35:26.880 No countdown this time. 01:35:27.960 --> 01:35:29.260 So we're going. 01:35:29.260 --> 01:35:30.360 Refresh the pages. 01:35:30.380 --> 01:35:31.620 We should be able to see them. 01:35:31.800 --> 01:35:32.300 There we go. 01:35:32.300 --> 01:35:32.980 Download challenge. 01:35:32.980 --> 01:35:33.860 Download challenge. 01:35:33.860 --> 01:35:34.360 Okay. 01:35:34.620 --> 01:35:38.340 So not a little, little less fanfare than last time. 01:35:38.800 --> 01:35:40.220 But hopefully we are going to be live. 01:35:40.220 --> 01:35:45.120 This challenge is specifically called open to interpretation. 01:35:46.140 --> 01:35:48.780 We're not sure if all of our challenges are the right difficulty. 01:35:48.820 --> 01:35:50.660 What we are sure is they all have great names. 01:35:50.660 --> 01:35:51.300 No, you didn't. 01:35:51.300 --> 01:35:51.780 Sorry. 01:35:51.900 --> 01:35:52.820 This is the wrong one. 01:35:52.820 --> 01:35:54.260 You didn't replace the handouts. 01:35:54.260 --> 01:35:54.920 Oh, okay. 01:35:55.040 --> 01:35:55.740 Go tell them. 01:35:55.740 --> 01:35:56.080 Go tell them. 01:35:56.080 --> 01:35:56.520 Go to them. 01:35:56.520 --> 01:35:57.120 Sorry. 01:35:57.180 --> 01:35:58.040 Technical glitch. 01:35:58.700 --> 01:35:59.000 All right. 01:35:59.000 --> 01:36:01.260 So we got to warn them this is not the right challenge. 01:36:01.260 --> 01:36:02.460 One second. 01:36:02.540 --> 01:36:03.160 Okay. 01:36:03.160 --> 01:36:05.160 So this was still the old challenge. 01:36:05.160 --> 01:36:06.860 There's a couple of management scripts. 01:36:06.860 --> 01:36:09.360 This is our first time transitioning from an earlier round. 01:36:09.620 --> 01:36:11.820 So real short intermission. 01:36:12.240 --> 01:36:14.480 And we should be back. 01:36:14.680 --> 01:36:20.560 Unfortunately, we're still seeing some... I think we've done terrible things to the USB inputs on one of our laptops. 01:36:21.140 --> 01:36:24.660 And so we keep restarting that capture card. 01:36:24.840 --> 01:36:28.160 We do actually have a spare capture card that's arriving shortly as well. 01:36:28.160 --> 01:36:33.520 So we can switch to if this ends up not working. 01:36:33.760 --> 01:36:35.760 So okay. 01:36:35.760 --> 01:36:36.960 We told them to try again. 01:36:36.960 --> 01:36:38.260 They're going to download a new challenge. 01:36:38.260 --> 01:36:42.480 And let's take a look at a new binary. 01:36:44.360 --> 01:36:44.800 All right. 01:36:44.800 --> 01:36:45.960 Let's take a look at that. 01:36:46.960 --> 01:36:47.460 Challenge. 01:36:47.460 --> 01:36:48.640 It's just called challenge. 01:36:49.400 --> 01:36:52.980 We should have named the challenge the actual challenge name in hindsight. 01:36:52.980 --> 01:36:54.620 You learn all the lessons learned. 01:36:55.140 --> 01:36:55.540 All right. 01:36:55.540 --> 01:36:56.840 So we've got an IDA. 01:36:56.840 --> 01:37:00.900 Is this... give me a program. 01:37:00.900 --> 01:37:01.240 Okay. 01:37:01.240 --> 01:37:01.580 All right. 01:37:01.580 --> 01:37:03.600 So we are on the right challenge now. 01:37:04.060 --> 01:37:07.700 It looks like we're having some difficulty with our one capture card, unfortunately. 01:37:08.300 --> 01:37:09.340 This one is problematic. 01:37:09.340 --> 01:37:12.340 We swapped out adapters, cards. 01:37:12.400 --> 01:37:13.200 We'll figure it out. 01:37:13.200 --> 01:37:14.540 We have backups for everything. 01:37:14.540 --> 01:37:14.760 Yeah. 01:37:14.760 --> 01:37:20.100 We'll have our production look into that while we continue the commentary. 01:37:20.100 --> 01:37:21.520 And when we say production, we mean Glenn. 01:37:21.520 --> 01:37:21.860 Yes. 01:37:22.240 --> 01:37:25.400 But you know, it sounds more professional when you say production. 01:37:25.400 --> 01:37:26.780 We'll have backup house. 01:37:26.780 --> 01:37:30.020 The production crew look into it and let us know how it's going. 01:37:30.380 --> 01:37:30.780 Yeah. 01:37:31.400 --> 01:37:33.920 So we've got our second challenge. 01:37:33.920 --> 01:37:35.060 They're at least going. 01:37:36.660 --> 01:37:41.640 Let's go ahead and look at just team slash V slash whatever. 01:37:41.640 --> 01:37:43.800 Look at their desktop while we've got that working. 01:37:43.800 --> 01:37:44.320 Yeah. 01:37:44.320 --> 01:37:48.000 And then we'll keep an eye on the other one so it comes back up. 01:37:48.000 --> 01:37:52.620 We will see if, worst case, if we're not looking at one of the screens, we'll still see winner. 01:37:52.620 --> 01:37:55.440 So if we see winner and we didn't, just like last time, we were looking at the wrong one. 01:37:55.440 --> 01:37:55.900 Yes. 01:37:55.900 --> 01:37:57.000 Shouldn't be a problem . 01:37:57.200 --> 01:38:00.120 We should still be able to see that that's happened. 01:38:00.360 --> 01:38:02.400 All the challenges will be available to download . 01:38:02.400 --> 01:38:02.600 Yeah. 01:38:02.600 --> 01:38:03.960 We're going to release them. 01:38:04.140 --> 01:38:05.340 We don't have a specific plan. 01:38:05.340 --> 01:38:10.000 So we'll probably wait till just after we've recuperated a little bit after we get back from DEF CON. 01:38:10.360 --> 01:38:12.420 But we do plan to release them. 01:38:12.740 --> 01:38:17.700 I like that you're guessing about what type of challenge it might be. 01:38:17.700 --> 01:38:19.380 So open to interpretation. 01:38:19.380 --> 01:38:20.540 Is it a polyglot? 01:38:21.100 --> 01:38:24.080 I think it's more of a play on words of interpreter. 01:38:24.440 --> 01:38:24.700 Yes . 01:38:24.700 --> 01:38:25.040 Yes. 01:38:25.040 --> 01:38:25.180 Right. 01:38:25.220 --> 01:38:33.080 I think we're not that clever with, you know, we're only moderately clever with the naming here. 01:38:33.080 --> 01:38:33.260 Right. 01:38:33.260 --> 01:38:35.180 So, yeah, I think that's something like this. 01:38:35.180 --> 01:38:35.780 Yes. 01:38:35.920 --> 01:38:48.500 So we can see here looking at the program in the item and starting to build up a simple phone tools script. 01:38:48.880 --> 01:38:49.980 So PTRlib. 01:38:49.980 --> 01:38:52.120 Actually, I saw PTRlib. 01:38:52.240 --> 01:38:53.300 That's a good question. 01:38:53.300 --> 01:38:56.440 I'm not actually sure the name of the individual players that we've got. 01:38:56.440 --> 01:38:58.040 If you all saw like home. 01:38:58.440 --> 01:38:58.740 Yeah. 01:38:58.740 --> 01:38:59.240 PTR. 01:38:59.240 --> 01:39:00.680 It is PTR. 01:39:01.140 --> 01:39:02.820 And that makes sense that PTRlib. 01:39:02.820 --> 01:39:05.560 So this is their throwing script library. 01:39:05.560 --> 01:39:08.580 So I think we're not looking at a PwnTools. 01:39:08.580 --> 01:39:10.560 I think we're looking at an actual like custom. 01:39:10.560 --> 01:39:11.140 Oh, nice. 01:39:11.140 --> 01:39:11.320 Yeah. 01:39:11.700 --> 01:39:12.500 Yeah. 01:39:12.500 --> 01:39:14.060 From PTRlib import star. 01:39:14.060 --> 01:39:14.580 I see. 01:39:14.580 --> 01:39:14.800 Yeah. 01:39:14.800 --> 01:39:18.660 Some of my players prefer to like build their own little thing. 01:39:18.840 --> 01:39:22.100 I mean, PwnTools has a million things, but also it has a million things. 01:39:22.140 --> 01:39:22.140 Yeah. 01:39:22.140 --> 01:39:22.140 Yeah. 01:39:22.140 --> 01:39:27.240 And so it's like getting that whole box of stuff when you only need like the screwdriver. 01:39:27.240 --> 01:39:27.800 Yeah. 01:39:28.100 --> 01:39:29.740 So there's certainly an argument. 01:39:29.740 --> 01:39:32.140 There's also Mpwn, which is another nice one. 01:39:32.340 --> 01:39:34.800 It's meant to be a little simpler, kind of more standalone. 01:39:35.080 --> 01:39:35.320 Yeah. 01:39:35.720 --> 01:39:38.260 But so let's talk about the problem. 01:39:38.260 --> 01:39:43.560 We can see this is explicitly, I believe, a custom situation. 01:39:43.680 --> 01:39:45.740 We've got a question mark and A. 01:39:45.740 --> 01:39:46.420 So we saw that. 01:39:46.420 --> 01:39:46.660 Yeah. 01:39:46.660 --> 01:39:51.560 That little switch statement there again with the name open to interpretation. 01:39:51.560 --> 01:39:53.660 And we think it's kind of like an interpreter. 01:39:53.660 --> 01:39:54.240 Yeah. 01:39:54.240 --> 01:39:58.500 Some sort of little virtual machine or some sort of interpreter that's going to make some simple changes. 01:39:59.080 --> 01:40:00.300 I do love people. 01:40:00.300 --> 01:40:05.820 People know this is like a live CTF because they start their throwing script like immediately, right? 01:40:05.820 --> 01:40:09.320 Like they just immediately start building that up. 01:40:10.120 --> 01:40:18.720 And I think that's also kind of a good way to, in a sense, document your understanding of the problem so far, like writing down like the interactions, like the different things. 01:40:18.720 --> 01:40:19.660 And so you don't forget things. 01:40:19.660 --> 01:40:25.500 And you kind of like, as you like, you'll often, as you put to do's, like, you know, you do this part, but like, I need to do this later, but at least I'll remember it because that's my... 01:40:26.300 --> 01:40:27.340 Yeah, I think you're right. 01:40:27.340 --> 01:40:34.880 I think people use their little throwing script almost as a stand-in for like a, you know... Like a notes. 01:40:34.880 --> 01:40:35.480 Yeah, exactly. 01:40:35.480 --> 01:40:36.980 Notes or task tracking or like... 01:40:36.980 --> 01:40:39.740 We can see some debugging going on now as well. 01:40:41.320 --> 01:40:45.000 Yeah, we're not going to interrupt his throwing. 01:40:45.000 --> 01:40:54.100 You know, in the interest of fairness, we're not sure why we're having glitches on our one capture, unfortunately, so we'll resolve it before the next round. 01:40:54.100 --> 01:40:57.640 But we're not going to... Once we've started, we need to let him go until the first person solves it. 01:40:57.640 --> 01:41:04.660 Yeah, because this is so hectic, like, the margins, like, as we saw in the previous match, for those who watched, like, the, yeah, the seconds matter. 01:41:05.180 --> 01:41:05.820 Absolutely. 01:41:05.860 --> 01:41:13.520 Like, literally, there was, like, seven keystrokes, but, like, between the... I don't think we will see a tighter match. 01:41:13.520 --> 01:41:14.580 I will be surprised. 01:41:14.600 --> 01:41:15.340 I mean, we basically can't see a tighter match. 01:41:15.360 --> 01:41:16.820 I would be really surprised. 01:41:16.820 --> 01:41:20.380 Yeah, we would have to go down to, like, you know, recording. 01:41:21.580 --> 01:41:28.440 Yeah, and so, exactly, we're seeing PwnDBG instead of... Yeah, these... What is your preference on debugging libraries? 01:41:28.440 --> 01:41:37.080 Have you, like, Geph versus... So, I used to be a PwnDBG user, but I have switched to Jeff. 01:41:37.080 --> 01:41:37.720 Yeah. 01:41:37.860 --> 01:41:42.260 I mean, a long time ago, I was a Peta user. 01:41:42.260 --> 01:41:42.580 Yeah, yeah. 01:41:42.740 --> 01:41:47.800 But then that kind of just stopped developing for a bit or something. 01:41:47.800 --> 01:41:50.300 Anyway, I switched to PwnDBG, then I went to Jeff. 01:41:51.420 --> 01:41:53.280 Yeah, that's my current preference. 01:41:53.280 --> 01:41:59.160 So, you can see, I think, just over the shoulder here, some of the players. 01:41:59.160 --> 01:42:04.820 So, the people in chat that are wondering, kind of depends on where we lean if we're, like, yeah, if we're letting him in. 01:42:04.820 --> 01:42:09.760 But we're also trying to kind of... We have to block off their opponent's screen here, right? 01:42:09.760 --> 01:42:15.760 So, because we have, well, at least one of the teams now visible on our little monitors that are in front of us. 01:42:16.440 --> 01:42:23.460 And we've intentionally kind of, like, laid it out so that you can't see your opponent's, you know, monitor over here that we're using to see them. 01:42:23.460 --> 01:42:26.020 So, we've kind of got them angled down a little bit lower. 01:42:27.640 --> 01:42:30.060 Yeah, honestly, they're all better than, like, stock GDB. 01:42:30.060 --> 01:42:33.320 Although, like, you know, TUI is not the worst thing. 01:42:33.420 --> 01:42:39.440 It's at least better, I feel like, than, like, you know, stock command line. 01:42:40.400 --> 01:42:41.060 Yeah. 01:42:41.060 --> 01:42:46.280 I mean, I used to roll with, like, you know, display slash whatever and, like, build up my own little kind of custom prompt. 01:42:46.280 --> 01:42:48.360 But it is... I think I never really learned that. 01:42:48.360 --> 01:42:50.460 I went, like, directly from the vanilla. 01:42:50.460 --> 01:42:53.200 Honestly, yeah, to a real tool. 01:42:53.240 --> 01:42:54.640 Yeah, one of those. 01:42:54.640 --> 01:42:55.120 Okay. 01:42:55.300 --> 01:42:56.700 So, we're back in IDA. 01:42:56.700 --> 01:43:00.160 And it's interesting, too, because we started in hex arrays in the decompiler. 01:43:00.440 --> 01:43:02.920 And now we're just looking at actual offsets here, right? 01:43:02.920 --> 01:43:07.900 So, we've got... So, some kind of overflow situation here going on? 01:43:07.900 --> 01:43:08.240 Oh, okay. 01:43:08.240 --> 01:43:08.500 Yeah. 01:43:08.680 --> 01:43:13.560 So, we already see somebody writing Ds, which were, if we go back to that... 01:43:16.540 --> 01:43:17.660 Oh, man. 01:43:18.140 --> 01:43:18.360 All right. 01:43:18.360 --> 01:43:19.320 You know what we might do? 01:43:19.320 --> 01:43:27.680 I might actually have... If you go look over the shoulder and just to give us an update, come back and give us an update and see how... On the Starbuck side. 01:43:27.920 --> 01:43:27.980 Yes. 01:43:27.980 --> 01:43:30.640 And let us... If I'm doing this right. 01:43:30.640 --> 01:43:30.880 Yeah. 01:43:30.880 --> 01:43:31.760 So, yeah. 01:43:32.720 --> 01:43:32.960 We'll... 01:43:33.700 --> 01:43:34.340 We'll go... Yeah. 01:43:34.340 --> 01:43:34.880 You go check it out. 01:43:34.880 --> 01:43:35.000 Yeah. 01:43:35.000 --> 01:43:35.580 I'll go check it out. 01:43:35.580 --> 01:43:38.960 And then you can go back and give us a report and let us know what kind of looks like where we're at. 01:43:38.980 --> 01:43:40.640 So, apologies for this. 01:43:42.080 --> 01:43:43.980 This is going to be a wild and crazy weekend. 01:43:43.980 --> 01:43:46.720 We're going to have a lot of stuff. 01:43:46.720 --> 01:43:53.200 So, this is the only real issue is we've got to figure out why our capture card is freaking out. 01:43:53.200 --> 01:43:58.180 We actually do have another capture card we'll bring in and we'll get working in the break. 01:43:58.180 --> 01:44:03.080 So, especially if this is a really fast match, that'll be really easy. 01:44:03.740 --> 01:44:05.120 We will bring this in. 01:44:05.120 --> 01:44:05.280 Okay. 01:44:05.280 --> 01:44:05.540 So, yeah. 01:44:05.540 --> 01:44:05.900 There we go. 01:44:05.900 --> 01:44:09.520 We can see the switch statement with the different options. 01:44:09.520 --> 01:44:12.080 Question A, D, S, W. 01:44:12.720 --> 01:44:13.890 And we notice that there's some... 01:44:14.730 --> 01:44:15.330 Yep. 01:44:15.330 --> 01:44:15.910 Exactly. 01:44:15.910 --> 01:44:18.930 So, there's that comparison there, right? 01:44:18.930 --> 01:44:19.750 It was checking to zero. 01:44:19.750 --> 01:44:20.730 It was checking 128. 01:44:21.050 --> 01:44:32.670 But you'll notice, I think this is actually why earlier we saw PTR looking at the disassembly is because in hex arrays, you don't always see the signs. 01:44:32.670 --> 01:44:34.470 Is the comparison signed or unsigned? 01:44:34.530 --> 01:44:34.770 Right? 01:44:34.770 --> 01:44:44.010 And so, I suspect that's what we were seeing before is the switch over to disassembly was saying, well, wait a minute, is this comparison signed or unsigned? 01:44:44.250 --> 01:44:53.350 I think you can mouse over the comparison operator and it will say if I don't misremember. 01:44:53.750 --> 01:44:58.350 But yes, it's still like to get the exact details, you might have to go down to the disassembly. 01:44:58.350 --> 01:45:05.490 I mean , you could use binary ninja in high level IL where it tells you signed or unsigned comparison, but I promise... Okay. 01:45:05.490 --> 01:45:05.670 Okay. 01:45:05.670 --> 01:45:06.510 I'll be good. 01:45:06.510 --> 01:45:07.450 I'll be good. 01:45:07.450 --> 01:45:08.770 I won't do that. 01:45:08.770 --> 01:45:13.590 And I will say, me with binary ninja would not beat these folks with IDA, right? 01:45:13.590 --> 01:45:17.650 So, I'm not claiming that it would make me infinitely better. 01:45:17.850 --> 01:45:26.290 So, to give a bit of an update on Starbucks, it's actually very similar to the situation for... How do you choose to pronounce it? 01:45:26.570 --> 01:45:27.330 Homer. 01:45:27.330 --> 01:45:27.910 Like, yeah. 01:45:27.910 --> 01:45:28.770 Homer bin. 01:45:29.150 --> 01:45:30.950 That's now what we call these. 01:45:31.290 --> 01:45:32.570 I've been saying slash. 01:45:32.570 --> 01:45:33.110 Okay. 01:45:33.110 --> 01:45:33.410 Slash. 01:45:33.410 --> 01:45:33.770 Slash. 01:45:33.770 --> 01:45:33.810 Slash. 01:45:33.810 --> 01:45:33.890 Slash. 01:45:33.890 --> 01:45:33.990 Slash. 01:45:33.990 --> 01:45:34.390 Okay. 01:45:34.390 --> 01:45:34.730 Yes. 01:45:34.830 --> 01:45:36.070 However we do it. 01:45:36.070 --> 01:45:36.790 Yes. 01:45:36.810 --> 01:45:41.030 Anyway, Starbucks, they were in a similar situation. 01:45:41.210 --> 01:45:43.510 They have done some analysis. 01:45:43.510 --> 01:45:56.570 They started out the small Xbox screen, not quite as fleshed out yet as the one... A bit shorter, doing some debugging, looking at the registry values, just making sure that they're completely understanding what's going on. 01:45:56.570 --> 01:46:01.570 So, I would say at this point, it seemed like they're fairly similar progress between the players. 01:46:01.870 --> 01:46:07.890 I will say, at least looking... So, I actually have not seen an official solution for this one yet. 01:46:07.890 --> 01:46:15.210 So, some of the challenges we wrote, some of them other of our teammates wrote, some of them we know the exploits and we tested them and some of them we don't. 01:46:15.310 --> 01:46:24.750 Just knowing kind of generally what's going on here and looking at those comparisons, I'm wondering... I mean, we're already... This looks like intention, right? 01:46:24.750 --> 01:46:27.470 It looks like we're seeing... I have an idea of what we're doing. 01:46:27.550 --> 01:46:29.130 We've already contacted... Yeah. 01:46:29.130 --> 01:46:33.110 This looks like really good progress only several minutes in. 01:46:33.250 --> 01:46:34.890 If you had asked me now, do we need a hint? 01:46:35.830 --> 01:46:38.190 I'm like, you never really know. 01:46:38.190 --> 01:46:38.470 Yeah. 01:46:38.470 --> 01:46:41.410 But you can see here they're doing a leak. 01:46:41.410 --> 01:46:45.910 You see this line starting with like libc base, if it's readable. 01:46:45.910 --> 01:46:52.610 So, they are reading eight bytes out from the program and then they're subtracting the offset of the putchar address. 01:46:52.610 --> 01:46:54.790 And then, I like a bit more as well. 01:46:54.790 --> 01:47:11.010 So, from this, they're calculating the base address of the libc library, which then can be used to calculate the addresses of other functions you might want, such as system, which is maybe like the go-to choice. 01:47:11.010 --> 01:47:12.450 Usually the choice, right? 01:47:12.450 --> 01:47:20.930 And so, before we were talking about execve for the syscall challenge, the last one, and that's just going to be the raw syscall, system's even better though, right? 01:47:21.230 --> 01:47:23.310 What's the advantage of system over an execve? 01:47:23.490 --> 01:47:24.110 I mean, yes. 01:47:24.110 --> 01:47:30.010 So, for the system, you just give it one string argument, which is the thing you want to execute, and that's it. 01:47:30.010 --> 01:47:36.250 You don't need to care about splitting up the command line arguments into an array or all that stuff. 01:47:36.250 --> 01:47:42.830 It's just like... I wonder if we'll see somebody's system straight to the payload or if they're going to get a shell first and then run to the payload. 01:47:42.830 --> 01:47:43.990 They could kind of go either way on that, right? 01:47:43.990 --> 01:47:44.250 Yeah. 01:47:44.250 --> 01:47:49.170 I mean, personally, even though this is, again , do you take it slow and methodically? 01:47:49.170 --> 01:47:51.110 Yeah, and be able to debug it along the way? 01:47:51.110 --> 01:47:51.590 Yeah. 01:47:51.650 --> 01:47:58.230 So, I would just go for the shell because then the same solution also works out of the box locally as well as remotely. 01:47:58.230 --> 01:47:59.170 Otherwise, they would need to... That's true. 01:47:59.170 --> 01:48:03.190 Well, if you get an error message that would say, follow my pattern, you would see some sort of bug there. 01:48:03.190 --> 01:48:08.110 I would still feel more comfortable doing, like, launching a shell and then going with that. 01:48:08.110 --> 01:48:12.430 You know, I think that's interesting because, again, though, last round, literally seconds mattered. 01:48:12.430 --> 01:48:20.510 If one team went one way and one went the other and they were that close, the team that threw the straight to the submitter would win. 01:48:20.510 --> 01:48:22.990 So, we will see. 01:48:23.250 --> 01:48:23.870 We'll see. 01:48:23.870 --> 01:48:25.770 I don't expect it to match. 01:48:25.770 --> 01:48:28.270 I don't expect it to be that close this time. 01:48:28.450 --> 01:48:37.570 There is, like, a small catch to that, though, because they don't know, like, you need an absolute address for exec, right? 01:48:39.290 --> 01:48:41.310 Execve does have to have the full path. 01:48:41.310 --> 01:48:44.750 Exactly, and they don't know the current working directory. 01:48:44.750 --> 01:48:47.050 So, they don't know the full path of the submitter. 01:48:47.050 --> 01:48:52.450 Right, but if they're calling system, in this case, if they're just finding system... Right, exactly, but I'm just... Oh, no, no, yeah, true, true, you're correct. 01:48:52.450 --> 01:48:55.530 Like, on this one, you're right, last round... Yeah, they could not have done that. 01:48:55.530 --> 01:48:58.950 They could not have done that nearly as easily, right, but whereas this one... Yes. 01:48:58.990 --> 01:49:05.750 Yeah, because the relative pathing only works because of your shell, essentially, which, if you're going to call system, it's going to run the shell for you. 01:49:05.750 --> 01:49:08.910 Okay, and thank you for the kind words. 01:49:08.910 --> 01:49:10.110 We appreciate it, Grandma Bullet. 01:49:10.290 --> 01:49:20.850 You guys in chat, we're definitely keeping an eye on it, and happy if you guys have questions, and I expect y'all will be seeing stuff that we miss, because we're kind of trying to, like, juggle around and look at a lot of different things. 01:49:21.070 --> 01:49:28.950 In fact, I even talked to one of the competitors in the room watching the stream in the last round, and he was like, why didn't they use the breaks this call? 01:49:28.950 --> 01:49:29.330 Why didn't they? 01:49:29.330 --> 01:49:41.530 They were all watching, like, you know, they're doing the regular CTF, but they were also, you know, checking out the competition, seeing what the challenges are looking like, wisely preparing for future rounds, and they were, you know, commenting on better approaches. 01:49:41.530 --> 01:49:47.790 So I imagine we'll have people in chat here that have feedback and have ideas on things that they can do. 01:49:47.850 --> 01:49:54.050 I mean, you also should keep in mind that, like, this is not your average CTF environment. 01:49:54.050 --> 01:49:55.050 Do we have it back? 01:49:55.050 --> 01:49:56.370 Oh, it's teasing us. 01:49:56.370 --> 01:49:57.830 No, yeah, it's teasing us. 01:49:57.830 --> 01:50:00.570 Unfortunately, this is not your average CTF environment, right? 01:50:00.570 --> 01:50:02.950 This is much more stressful for the players. 01:50:03.870 --> 01:50:12.270 Like, most of them are not used to, like, you know, live stream when they're... And even if you are, even if you've done a lot of streaming, it still is harder. 01:50:12.270 --> 01:50:14.330 It's just 100% always harder. 01:50:14.530 --> 01:50:17.170 There's people watching, thinking, oh, did I clean up my desktop? 01:50:17.210 --> 01:50:19.470 Do I need to, like, is this my VM set up? 01:50:19.470 --> 01:50:21.210 You know, there's just a lot more on your mind. 01:50:21.210 --> 01:50:23.170 And it's also kind of like an all-or-nothing situation, right? 01:50:23.170 --> 01:50:29.890 And a normal CTF, usually, because we kind of moved away from the tradition of first blood points. 01:50:29.890 --> 01:50:30.410 This is true. 01:50:30.410 --> 01:50:32.450 Nowadays, it's all about total score. 01:50:32.450 --> 01:50:34.110 It doesn't matter when. 01:50:34.110 --> 01:50:39.150 It doesn't matter if you solve the challenge, like, five minutes into the competition or when it's five minutes left of the competition. 01:50:39.630 --> 01:50:41.570 Here, it's everything. 01:50:41.570 --> 01:50:44.770 Like, either you win or you don't. 01:50:44.790 --> 01:50:54.290 We might be getting pretty close here, because I am seeing... I did see... It looked like we had maybe had a system leak or we're close to a system leak. 01:50:55.030 --> 01:50:55.910 So, let's watch. 01:50:55.910 --> 01:50:58.250 So, we're looking at system provider. 01:50:59.670 --> 01:51:01.990 So, we've already got a convenient call. 01:51:01.990 --> 01:51:04.950 Again, there's a call to system already in the binary. 01:51:04.950 --> 01:51:08.490 Oh, and Starbuck is... Yeah, yeah, yeah. 01:51:08.490 --> 01:51:10.970 Why don't we go ahead and do another check, Carl, on Starbuck. 01:51:10.970 --> 01:51:12.810 Yeah, I'm gonna go play with him. 01:51:14.430 --> 01:51:21.230 No, we don't actually worry about past people learning things for new ones, because again, the challenges are totally different. 01:51:21.230 --> 01:51:23.550 Every match is a different challenge. 01:51:23.810 --> 01:51:24.430 Exactly. 01:51:24.430 --> 01:51:26.370 So, we don't have to worry about that. 01:51:26.530 --> 01:51:39.570 The general setup, well, the way that we would compensate by that is, I will say, we specifically put all the easiest things that we knew were easiest first, just because we wanted to be guaranteed that they would get solved in time. 01:51:39.810 --> 01:51:42.430 So, the teams that go first had less information. 01:51:42.430 --> 01:51:44.910 They knew less about the environment and what was going to happen and maybe... 01:51:45.850 --> 01:51:46.890 but I don't know. 01:51:46.890 --> 01:51:47.990 It depends on the player. 01:51:47.990 --> 01:51:51.430 I think for some people, going first is actually significantly better. 01:51:51.430 --> 01:51:53.990 You just get it out of the way and your nerves are over. 01:51:54.150 --> 01:51:56.830 And some people, though, they really want to see what's happening and know. 01:51:56.830 --> 01:51:58.310 So, it's hard to say. 01:51:58.310 --> 01:52:01.670 It was totally random selection in terms of which round happened when. 01:52:02.410 --> 01:52:03.510 So, we'll see what it is. 01:52:03.510 --> 01:52:06.070 And yes, everyone not only has to use a laptop. 01:52:06.070 --> 01:52:16.750 So, one of the differences is that they're not only using a laptop , but we plug in our video capture cards and those cards force a specific aspect ratio, so their font size can be a little bit off. 01:52:16.750 --> 01:52:21.730 So, we are handicapping them unintentionally a little bit that way as well, too. 01:52:21.730 --> 01:52:23.230 So, how's it going with Starbug? 01:52:23.230 --> 01:52:23.590 Yeah. 01:52:23.670 --> 01:52:26.250 So, they have some good progress. 01:52:26.250 --> 01:52:27.910 I saw them looking at the debugger. 01:52:27.930 --> 01:52:30.730 I think they were looking at the got. 01:52:31.890 --> 01:52:37.430 So, maybe a similar approach there with overwriting or leaking addresses. 01:52:39.950 --> 01:52:41.890 I mean, very fast to find a bug. 01:52:41.890 --> 01:52:43.350 I think both teams, right? 01:52:43.410 --> 01:52:46.690 I mean, again, this is meant to be an easy bug to find. 01:52:46.850 --> 01:52:50.410 It's even just wiring it all up, putting it all together, building the payload. 01:52:50.410 --> 01:52:50.650 Yes. 01:52:50.650 --> 01:52:52.050 Avoiding all the mistakes. 01:52:52.050 --> 01:52:56.170 When you do these things, it's very unforgiving. 01:52:56.170 --> 01:53:00.930 The smallest, you're off by one somewhere and things just don't work. 01:53:00.990 --> 01:53:09.350 It won't give you any meaningful error messages or something like that, as you would get when you're developing normal software. 01:53:09.350 --> 01:53:11.150 I love that we're getting debug information. 01:53:11.150 --> 01:53:12.470 So, we've got a logger info. 01:53:12.470 --> 01:53:15.070 They're actually printing out their variables and stuff. 01:53:15.090 --> 01:53:19.250 Thank you, as a caster and as a commentator. 01:53:19.250 --> 01:53:24.690 It does make it easy when we can see what your intentions are and kind of what you're doing. 01:53:24.690 --> 01:53:32.290 When I write my exploit scripts, I'm definitely more on the cautious and structured side. 01:53:32.290 --> 01:53:34.390 I name all my variables properly. 01:53:34.390 --> 01:53:36.170 I have logging statements. 01:53:36.190 --> 01:53:37.430 Do you put type hints? 01:53:37.430 --> 01:53:39.170 Do you actually put Python 3 type hinting? 01:53:39.170 --> 01:53:42.230 Is that that level of... No, it has happened. 01:53:42.410 --> 01:53:44.450 That's a bridge too far for CTF. 01:53:44.450 --> 01:53:46.290 It has happened, but no, no. 01:53:46.410 --> 01:53:47.310 Generally not. 01:53:47.310 --> 01:53:49.610 Well, I am the opposite, I think, by nature. 01:53:49.610 --> 01:53:51.270 I was always quick and dirty. 01:53:51.270 --> 01:53:53.230 I mean, I wrote a lot of exploits with Bash. 01:53:53.230 --> 01:53:55.210 I would literally just shove raw bytes in with Bash. 01:53:55.970 --> 01:53:59.350 If it works, it's faster, but when it fails, it fails miserably. 01:53:59.350 --> 01:54:06.490 Yes, because when it fails, it fails and you have not gained any ground. 01:54:06.750 --> 01:54:13.450 It fails and you're kind of still at zero, while the slow and methodical, it can fail, but it's a very local fail. 01:54:13.450 --> 01:54:14.810 And it's easier to measure progress. 01:54:14.810 --> 01:54:17.490 Potentially, you can instrument a little bit better and see kind of where you're at. 01:54:17.490 --> 01:54:20.450 But then it comes at this additional cost. 01:54:21.170 --> 01:54:24.970 So I'm trying to see what they're doing. 01:54:24.970 --> 01:54:26.050 So there's a question here. 01:54:26.050 --> 01:54:27.350 Every team sends only one player. 01:54:27.350 --> 01:54:28.110 Yes, correct. 01:54:28.110 --> 01:54:33.810 So for each match, the team chooses, so they will get to know what type of challenge it is. 01:54:33.810 --> 01:54:41.130 So we might say like this is an x86, 64 -bit Pwnable challenge, and they choose a player to send. 01:54:41.330 --> 01:54:43.650 They do not have to pick the same player. 01:54:43.650 --> 01:54:47.430 If they win the match and advance to the next round, they can swap out for another player. 01:54:47.590 --> 01:54:56.430 But if we, for example, switched up the architecture or made a reverse engineering versus Pwnable or whatever other things we did, they have a chance to swap it out. 01:54:56.430 --> 01:55:04.470 So it's supposed to be the best person from that team for that style of challenge and for the stress of being on camera. 01:55:04.470 --> 01:55:11.670 Because some people are maybe better exploiters, but really nervous about sitting in the room, which is a totally different experience. 01:55:11.670 --> 01:55:12.230 Yeah. 01:55:12.970 --> 01:55:17.170 And they are not allowed to get help from their teammates. 01:55:17.870 --> 01:55:18.130 Yep. 01:55:18.190 --> 01:55:19.650 But they can look on the internet. 01:55:19.650 --> 01:55:21.830 They can have all these resources. 01:55:21.830 --> 01:55:23.690 Although I don't think we've seen either one of these. 01:55:23.830 --> 01:55:24.990 They knew what they were doing. 01:55:24.990 --> 01:55:29.030 They went straight in, they found the bug, they reverse engineered it, and they're writing their exploits. 01:55:29.290 --> 01:55:32.990 But for example, the last one was a little bit different where they were building syscall payloads. 01:55:33.070 --> 01:55:36.970 And so we did see both of them looking up a list of syscalls and the parameters. 01:55:37.050 --> 01:55:37.410 Yeah. 01:55:37.410 --> 01:55:44.050 So if we have another look here and see what they're doing, we can see they're trying their exploit script, doing some debugging here. 01:55:44.050 --> 01:55:46.490 They're checking the output of the script. 01:55:46.490 --> 01:55:48.950 Comparing it to the debugger itself to see if the addresses line up. 01:55:48.950 --> 01:55:52.410 Making sure you have your offsets and your lengths correct. 01:55:54.310 --> 01:55:55.230 So it's all good. 01:55:55.230 --> 01:55:57.270 Again, I'm not super familiar. 01:55:57.370 --> 01:56:04.390 I think there's some kind of integer over underflow business going on in this challenge. 01:56:05.610 --> 01:56:10.890 Actually, I'm curious if the challenge author who was in chat last time is in now. 01:56:11.210 --> 01:56:22.210 Feel free to drop hints just for our YouTube chat and we'll see if Negasora is still around. 01:56:23.650 --> 01:56:30.010 Okay, so it looks like a write primitive because we've got a target for an overwrite. 01:56:30.870 --> 01:56:33.250 Oh, they're looking for one gadget. 01:56:33.250 --> 01:56:35.170 They want to figure out is there one now. 01:56:35.170 --> 01:56:41.230 So to explain a little bit here, one gadget is both like a concept and a tool. 01:56:41.230 --> 01:56:50.610 So it turns out that in various places in libc, if you jump to that address, you will execute the shell. 01:56:50.610 --> 01:56:51.350 Just get a shell. 01:56:51.350 --> 01:56:54.210 Like it's going to call a system with binsh or binbash or whatever. 01:56:54.570 --> 01:57:02.170 Some person or people have created this tool which will take a libc version and list what these addresses are. 01:57:02.170 --> 01:57:11.950 Some of them have like conditions like, oh, this register cannot be zero or... You know, several years ago, 1804, Ubuntu, standard installs, that was less common. 01:57:11.950 --> 01:57:14.450 It would just tend to just work unconditionally. 01:57:14.450 --> 01:57:19.050 There was just addresses that were... that's why it was called one gadget because it was literally one place you go. 01:57:19.050 --> 01:57:23.810 You jump there, all you needed was control of instruction pointer and that would be all you got. 01:57:23.810 --> 01:57:25.330 Now we're actually looking for ROPers. 01:57:25.330 --> 01:57:30.030 So we're actually looking for ROP gadgets to see how those work. 01:57:30.030 --> 01:57:31.410 I'm actually going to go starbug. 01:57:31.410 --> 01:57:33.190 I want to get a hit there. 01:57:33.190 --> 01:57:33.350 Yes. 01:57:33.350 --> 01:57:35.750 So I'll leave you on the stream and I'll be right back with an update. 01:57:35.790 --> 01:57:36.410 Definitely. 01:57:36.410 --> 01:57:39.210 I hope Jordan comes back with some nice updates there. 01:57:39.410 --> 01:57:42.670 I'm going to lean over a little bit to see better this. 01:57:42.970 --> 01:57:49.410 So ROPER, one of several tools to find ROP gadgets in a program. 01:57:49.410 --> 01:57:56.810 So they're running this on the program to find what gadgets are available to you then use them to build up the ROP chain. 01:57:57.490 --> 01:57:59.250 So return oriented programming. 01:58:01.590 --> 01:58:03.410 And it can be a bit tricky. 01:58:03.410 --> 01:58:06.730 As we see here, it didn't look that they had a lot of things to choose. 01:58:06.730 --> 01:58:25.090 I didn't see if there was like any filter or anything going on there, but regardless, so they were looking for specific gadgets with specific properties, like a call instruction, I think there, to be able to put this into the ROP chain and then use that to develop their exploits. 01:58:27.030 --> 01:58:36.230 Yeah, so again, we see them looking at... I did a little bit double checking what they're doing. 01:58:37.990 --> 01:58:40.390 We can see that they're rewriting a part of their exploit. 01:58:40.390 --> 01:58:44.690 There's some kind of address that they're going to trying to figure out what's the appropriate address. 01:58:44.690 --> 01:58:48.190 So here, they're going for libc base plus an offset. 01:58:48.190 --> 01:58:51.970 So they're trying to go into one of these one gadgets, I think. 01:58:53.010 --> 01:58:54.670 And we'll see. 01:58:54.670 --> 01:59:04.970 So they're just trying them one by one to just see if any of them works and if they have the constraints satisfied for them to be able to do this. 01:59:05.110 --> 01:59:08.470 But doesn't seem like it's working quite yet. 01:59:08.750 --> 01:59:09.710 Yeah. 01:59:09.870 --> 01:59:11.430 So what do you have, Jordan? 01:59:11.430 --> 01:59:11.810 All right. 01:59:11.810 --> 01:59:18.210 So the update on Starbucks, I would just say Starbucks looks like they're still kind of like thinking about the problem. 01:59:18.210 --> 01:59:26.710 I kind of get the impression that slash v slash home has more of a sense of where they're going. 01:59:26.710 --> 01:59:27.010 Yeah. 01:59:27.010 --> 01:59:28.690 And they'll kind of get the building blocks there. 01:59:28.890 --> 01:59:29.810 Could be wrong though. 01:59:29.810 --> 01:59:33.370 Again, it can be really hard to kind of get a sense of where people are at in their head. 01:59:33.370 --> 01:59:35.950 We're just trying to kind of watch and gain understanding. 01:59:35.950 --> 01:59:39.250 But I definitely saw some more just kind of poking around. 01:59:39.370 --> 01:59:51.350 It is interesting, we did see a true PwnTools user, so it was PwnTools coming in from Starbucks versus the custom PTR lib that we're seeing here. 01:59:52.370 --> 01:59:58.490 And Jeff, I don't know, is there like a canonical pronunciation? 01:59:58.490 --> 02:00:04.370 I just kind of guessed because GDB, but yeah, I mean, I've heard both. 02:00:04.950 --> 02:00:11.010 I agree with the GDB being a GIF, but I think it's funny. 02:00:11.010 --> 02:00:12.670 I think it's canonical. 02:00:13.150 --> 02:00:14.390 I think it's Jeff. 02:00:14.390 --> 02:00:15.430 It could very well be. 02:00:15.510 --> 02:00:17.370 It's like in the name Jeff. 02:00:18.170 --> 02:00:18.710 Yeah. 02:00:19.750 --> 02:00:22.810 So we've definitely got some fans. 02:00:22.810 --> 02:00:25.690 People are excited to see both their favorite players. 02:00:26.690 --> 02:00:29.290 And yeah, Fabio, it depends. 02:00:29.290 --> 02:00:33.070 Some of these challenges, there are absolutely things that you want to look up. 02:00:33.130 --> 02:00:36.470 You might be looking up a bug in the tool or something you're doing. 02:00:36.490 --> 02:00:40.110 This particular one is kind of very classic. 02:00:40.390 --> 02:00:43.870 I feel like they know their tools. 02:00:43.870 --> 02:00:45.590 They know what they're doing. 02:00:45.730 --> 02:00:50.190 They're not looking up the help for PwnTools because they're using features that they've used a lot. 02:00:50.270 --> 02:00:54.810 They're not looking up the help for these things just because they're more familiar with it. 02:00:55.390 --> 02:00:56.070 All right. 02:00:56.130 --> 02:01:00.870 So it seems like we've got code execution, right? 02:01:00.870 --> 02:01:03.370 If they're already looking for gadgets, they've got code execution. 02:01:03.370 --> 02:01:04.970 They're really just trying to redirect. 02:01:05.250 --> 02:01:05.850 Exactly. 02:01:05.850 --> 02:01:07.350 GIF or GIF, Jeff or GIF. 02:01:07.350 --> 02:01:08.330 I love it. 02:01:08.710 --> 02:01:09.650 Exactly. 02:01:09.850 --> 02:01:10.310 Yes. 02:01:10.310 --> 02:01:18.250 So we're trying to kind of pivot, get us a gadget that gets us closer to our one gadget, right? 02:01:18.250 --> 02:01:22.390 So they need to... See that they were looking for a move RSP gadget. 02:01:22.390 --> 02:01:31.350 So they want to pivot the stack and potentially to use that to have like a longer ROP chain, potentially. 02:01:33.350 --> 02:01:40.070 Another technique they might have used to get a longer ROP chain, too, is sometimes you can just actually pivot back into the same program, right? 02:01:40.070 --> 02:01:43.090 Into like another read or another receive depending on the program. 02:01:43.550 --> 02:01:44.310 So let's see. 02:01:44.310 --> 02:01:47.110 We're looking at some padding going down in here into the payload. 02:01:48.650 --> 02:01:50.610 So they're just increasing it. 02:01:57.020 --> 02:02:01.220 And it is fun, too, because the speed at which people operated at this tier... 02:02:02.320 --> 02:02:02.760 We're done! 02:02:02.760 --> 02:02:03.460 We have a winner! 02:02:03.460 --> 02:02:04.040 Oh, I'm so sorry. 02:02:04.040 --> 02:02:06.360 We didn't see it on screen, but congratulations! 02:02:06.980 --> 02:02:08.340 Round two winner! 02:02:08.780 --> 02:02:09.620 Very good. 02:02:09.620 --> 02:02:11.240 I wish we had that one on stream. 02:02:11.240 --> 02:02:12.960 I'm very sorry for the capture problems. 02:02:12.960 --> 02:02:21.300 We're going to make sure we take this time and we're going to swap out our capture card so that we don't have that happen again. 02:02:21.640 --> 02:02:22.840 But thanks again for hanging with us. 02:02:22.840 --> 02:02:25.940 We'll be back with a better view of both team screens this time. 02:02:26.100 --> 02:02:28.780 And we'll see you just in a few minutes. 02:02:28.780 --> 02:02:30.220 Thanks, everybody. 02:06:17.310 --> 02:06:18.710 So 02:21:59.330 --> 02:22:02.130 A little pause... 02:22:02.130 --> 02:22:02.130 and we are back. 02:29:10.380 --> 02:29:12.320 All righty, everybody, we are back. 02:29:12.400 --> 02:29:14.160 We've swapped out a capture card. 02:29:14.240 --> 02:29:15.840 I think we're going to be good. 02:29:16.000 --> 02:29:19.200 So let's go ahead and get everybody to help count me in. 02:29:19.200 --> 02:29:19.460 You ready? 02:29:19.460 --> 02:29:20.480 We're going to do a countdown. 02:29:20.480 --> 02:29:26.820 Five, four, three, two, one, go. 02:29:27.640 --> 02:29:28.580 And refresh. 02:29:28.580 --> 02:29:30.480 Let's bring up the team screens. 02:29:31.800 --> 02:29:33.400 Production, bring up our team screens. 02:29:33.400 --> 02:29:34.140 They are live. 02:29:34.140 --> 02:29:36.320 They've already got the binary, and they are going. 02:29:36.680 --> 02:29:37.400 There we go. 02:29:37.400 --> 02:29:40.680 Okay, so let's get up our team views, and we're off. 02:29:40.680 --> 02:29:47.600 We're back this round with Maple Mallard Magistrates, which, I mean, that's the Mighty Ducks, right? 02:29:48.000 --> 02:29:49.380 I've decided that's what we're going to call them. 02:29:49.380 --> 02:29:50.560 We're going to call them the Mighty Ducks. 02:29:50.860 --> 02:29:53.680 And they're competing against OSUSEC, or OSUSEC. 02:29:53.680 --> 02:29:54.040 Yep . 02:29:54.580 --> 02:29:55.940 Do you know who they are? 02:29:56.260 --> 02:30:01.640 I believe they're from OSU, either Oklahoma State, or I assume it's a state university. 02:30:01.640 --> 02:30:03.420 Yeah, I mean, I would guess, but... 02:30:03.420 --> 02:30:04.560 But I don't know for certain. 02:30:04.560 --> 02:30:07.640 Yeah, I'm also not super familiar with, like, all the universities in the U.S. 02:30:07.640 --> 02:30:08.720 and stuff, so, yeah. 02:30:09.600 --> 02:30:11.940 Yes, but that sounds very plausible. 02:30:12.200 --> 02:30:15.140 What do we have here on the competitors' screens? 02:30:15.140 --> 02:30:16.820 So we're looking at source code. 02:30:16.820 --> 02:30:24.340 So I guess we gave source code on this particular challenge, because nobody's got Ida or Binja open. 02:30:24.740 --> 02:30:26.960 They're just going straight to... 02:30:26.960 --> 02:30:29.100 So let's see, we've got the handouts. 02:30:30.260 --> 02:30:33.500 Right, that's some Capstone library calls, right? 02:30:33.500 --> 02:30:34.360 Oh , this is interesting. 02:30:34.360 --> 02:30:34.620 We've got... 02:30:34.620 --> 02:30:36.280 Okay, so we've got Capstone. 02:30:38.320 --> 02:30:39.860 And they're going to run. 02:30:39.860 --> 02:30:41.800 They're going to try it locally, and they're going to see how it works. 02:30:41.800 --> 02:30:45.540 Now, this program, this challenge, is called Knop Coding. 02:30:45.540 --> 02:30:48.980 Okay, so it's not showing... 02:30:48.980 --> 02:30:49.600 Oh, did we lose... 02:30:49.600 --> 02:30:50.320 Oh, no. 02:30:51.860 --> 02:30:52.800 We lost this. 02:30:52.800 --> 02:30:53.780 Did you lose that? 02:30:53.780 --> 02:30:54.620 No, it's back. 02:30:54.620 --> 02:30:55.260 It's back. 02:30:55.260 --> 02:30:57.060 But, like, did you lose it on the capture? 02:30:57.060 --> 02:30:58.560 Because I think it's just our power. 02:30:58.980 --> 02:30:59.680 Yeah, okay, cool. 02:30:59.680 --> 02:31:00.160 We're fine. 02:31:00.160 --> 02:31:00.960 So I think we're losing... 02:31:00.960 --> 02:31:01.720 There's power... 02:31:01.720 --> 02:31:03.940 Something power with this is causing trouble. 02:31:04.540 --> 02:31:05.440 You know what? 02:31:05.460 --> 02:31:07.020 Bring the brightness way down. 02:31:07.800 --> 02:31:08.480 Yes. 02:31:09.300 --> 02:31:10.940 Let's see if we can do this. 02:31:11.640 --> 02:31:12.260 Yes. 02:31:12.260 --> 02:31:14.880 So someone's saying Oregon State University. 02:31:14.880 --> 02:31:17.020 Someone's saying Ohio State University. 02:31:17.380 --> 02:31:17.620 So... 02:31:17.620 --> 02:31:20.640 I mean, they're all good guesses, but I don't know which it is. 02:31:20.640 --> 02:31:21.480 Yes. 02:31:21.860 --> 02:31:27.080 Anyway, while that's, you know, sorted out, we do have... 02:31:27.080 --> 02:31:31.260 Let's see if we decrease our power draw on our monitor here, if that'll... 02:31:31.740 --> 02:31:32.520 Yeah. 02:31:32.820 --> 02:31:34.220 Let's hope that's better. 02:31:34.220 --> 02:31:35.300 Let's hope that works. 02:31:35.420 --> 02:31:36.020 Okay. 02:31:36.020 --> 02:31:42.000 Anyway, off to a bit of a rocky start again, but hopefully we'll recover. 02:31:42.000 --> 02:31:44.180 New challenges each time. 02:31:44.180 --> 02:31:44.660 There we go. 02:31:44.660 --> 02:31:45.040 Go beavers. 02:31:45.040 --> 02:31:46.100 So is this actually... 02:31:46.100 --> 02:31:48.260 The beavers would be... 02:31:48.660 --> 02:31:49.420 Beavers versus ducks. 02:31:49.420 --> 02:31:51.840 Well, the ducks are Oregon, but Ohio State... 02:31:51.840 --> 02:31:53.420 No, Ohio State's the Buckeyes. 02:31:53.420 --> 02:31:54.320 It is Oregon State. 02:31:54.320 --> 02:31:54.860 Okay. 02:31:54.860 --> 02:31:55.240 All right. 02:31:55.240 --> 02:31:55.400 All right. 02:31:55.400 --> 02:31:56.140 Thank you. 02:31:57.300 --> 02:31:59.140 Thank you, chat, for filling us in. 02:31:59.340 --> 02:32:00.320 Can confirm. 02:32:00.320 --> 02:32:01.140 So I apologize. 02:32:01.140 --> 02:32:02.240 We should have... 02:32:02.240 --> 02:32:03.180 We're bad casters. 02:32:03.180 --> 02:32:07.760 We should have had better, you know, intel on our teams. 02:32:07.760 --> 02:32:10.960 But you know how they say, like, the best way to get an answer... 02:32:10.960 --> 02:32:11.760 Is to say a wrong one? 02:32:11.760 --> 02:32:12.360 Yeah, yeah. 02:32:12.360 --> 02:32:13.900 Oh, that's how I, like, run a business. 02:32:13.900 --> 02:32:14.640 That works great. 02:32:14.680 --> 02:32:17.140 I just, you know, I say something, and then my coworkers are like, no, you're wrong. 02:32:17.140 --> 02:32:18.720 I'm like, okay, but now I know the right answer, so... 02:32:18.720 --> 02:32:19.260 Yeah , yeah. 02:32:19.460 --> 02:32:20.880 So we can see here that... 02:32:20.880 --> 02:32:22.180 We should be streaming it. 02:32:22.180 --> 02:32:27.800 If we're not streaming at 720p, it is either YouTube or it's just our bandwidth. 02:32:27.800 --> 02:32:29.900 Because we should be streaming at 1080. 02:32:30.380 --> 02:32:33.080 And the VOD that we're recording is also going to be 1080. 02:32:33.080 --> 02:32:37.080 So if we need to upload a higher quality afterwards, we will get that. 02:32:37.080 --> 02:32:37.560 All right. 02:32:37.560 --> 02:32:38.980 Oh, this is interesting. 02:32:39.260 --> 02:32:39.880 Okay, okay. 02:32:39.880 --> 02:32:40.260 So wait a minute. 02:32:40.260 --> 02:32:42.340 I'm seeing indecisive over here on... 02:32:42.340 --> 02:32:42.900 So remind me. 02:32:42.900 --> 02:32:44.040 I've got... 02:32:44.040 --> 02:32:44.960 Maple Mount. 02:32:44.960 --> 02:32:45.280 Okay. 02:32:45.280 --> 02:32:46.520 So I've got... 02:32:46.520 --> 02:32:47.360 Mighty Ducks. 02:32:47.600 --> 02:32:51.900 I've got the Mighty Ducks over here, and I'm already seeing something really interesting. 02:32:52.740 --> 02:32:53.940 Start your clocks. 02:32:53.940 --> 02:32:57.140 This could actually be fastest solve from what I'm seeing over here, okay? 02:32:57.140 --> 02:32:59.500 So this challenge was called Knop Coding. 02:32:59.600 --> 02:33:08.200 And what they're doing is they're told you must get a shell, but everything that you run must be a knop. 02:33:08.200 --> 02:33:10.620 Which kind of doesn't really make sense. 02:33:10.620 --> 02:33:11.180 Sounds impossible? 02:33:11.180 --> 02:33:11.720 Yeah. 02:33:11.780 --> 02:33:12.900 Knop doesn't do anything. 02:33:12.900 --> 02:33:15.700 But we did give them a hint, actually, right? 02:33:15.820 --> 02:33:17.300 So if it's locked at 720... 02:33:17.300 --> 02:33:18.360 Yeah, we apologize. 02:33:18.360 --> 02:33:24.640 It is probably just our stream bandwidth, because I believe we're streaming at 1080p. 02:33:25.500 --> 02:33:30.700 And actually, let's go ahead and go full screen to one of the teams, and we'll try to keep the full screen ones. 02:33:30.740 --> 02:33:32.100 Let's do the one without the... 02:33:32.100 --> 02:33:34.540 If we're at 720, we want it to be real full screen. 02:33:34.540 --> 02:33:38.420 So we'll get rid of all the pretty artwork, and we'll just do... 02:33:38.420 --> 02:33:40.740 Let's do the bigger one that's clear without even that. 02:33:40.740 --> 02:33:44.580 Yeah, so this will get us looking at Oregon State. 02:33:45.620 --> 02:33:47.520 So we're seeing the preload. 02:33:47.520 --> 02:33:50.180 Right, so what they're trying to do now is they're going to run it with their capstone. 02:33:51.560 --> 02:33:55.100 Yeah, they're just trying to make the binary work so that they can debug the stuff. 02:33:55.100 --> 02:34:00.100 You see, they do some LD preloads to get the proper libraries running. 02:34:00.480 --> 02:34:02.660 No, these are not two local teams, as far as I know. 02:34:02.660 --> 02:34:04.320 I don't believe... 02:34:04.320 --> 02:34:05.980 It's funny that they're duck-themed, right? 02:34:05.980 --> 02:34:07.420 So the duck theme is... 02:34:07.420 --> 02:34:09.920 Yeah, we are making progress, right? 02:34:09.920 --> 02:34:16.460 Okay, so what we're looking at here is we've got a text file on the right that is a NOP, right? 02:34:16.460 --> 02:34:20.800 And we're assembling it, so it's test.s, and this is being created as a NOP. 02:34:20.800 --> 02:34:24.280 But when we disassemble it, now it's not a NOP, right? 02:34:24.280 --> 02:34:33.260 So the reason why we're doing that, and we gave them a hint, we told them that the binary they're given is a 32-bit binary on this particular... I believe? 02:34:33.260 --> 02:34:35.660 The point is that there's a mismatch here. 02:34:35.740 --> 02:34:41.420 It's being disassembled as 32-bits, but it's executed as 64-bits. 02:34:41.420 --> 02:34:42.460 So it's going to be run as 64. 02:34:42.460 --> 02:34:44.260 The other way around. 02:34:44.600 --> 02:34:47.540 It's disassembled as 64-bit, but executed as 32-bit. 02:34:47.540 --> 02:34:56.560 So if your bytes disassemble as an x64 NOP, but run as a 32-bit actual instruction, it will be run. 02:34:56.560 --> 02:34:59.500 And so, yeah, we are definitely... I can't tell from this angle. 02:34:59.500 --> 02:35:01.660 I don't have a good view on OSU. 02:35:01.660 --> 02:35:03.620 They're looking at the code here. 02:35:04.640 --> 02:35:09.700 Clearly, the ducks are, I would say, in a strong... 02:35:09.700 --> 02:35:10.960 Running your NOPs, they should have... 02:35:10.960 --> 02:35:12.060 They know. 02:35:12.060 --> 02:35:13.540 They completely understand. 02:35:13.680 --> 02:35:18.340 Like I said, this could be one of our faster solves, because they are absolutely... 02:35:18.340 --> 02:35:18.940 They get it. 02:35:18.940 --> 02:35:24.880 Now, how long will it take them to build a payload, and can our beavers catch up? 02:35:24.880 --> 02:35:27.960 That's going to be the question we've got to figure out. 02:35:28.120 --> 02:35:32.940 You can see that they are looking up the Capstone CSV. 02:35:33.720 --> 02:35:41.260 So that is a good thing to do, because a lot of people, when we tested this challenge, just assumed it was disassembling the same architecture with. 02:35:41.260 --> 02:35:48.480 And so actually double-checking that call to Capstone, checking the parameter, checking that information, is actually not a bad idea. 02:35:48.480 --> 02:35:52.880 I just think we're seeing our duck over here make... 02:35:54.080 --> 02:35:55.900 They looked at it, and they just knew. 02:35:55.900 --> 02:35:57.000 They're like, oh, I get this. 02:35:57.000 --> 02:35:58.760 I understand exactly what this challenge is. 02:35:58.780 --> 02:36:06.400 I mean, sometimes you're just on the same kind of frequency as the challenge author, and like, I see where you're going with this. 02:36:07.740 --> 02:36:16.200 So MMM, and actually, MMM is a very similar name to PPP. 02:36:16.220 --> 02:36:17.480 Yeah, what a coincidence. 02:36:17.480 --> 02:36:19.300 What a strange coincidence. 02:36:19.300 --> 02:36:23.380 So we mentioned earlier we're seeing a lot of these teams kind of join together. 02:36:23.840 --> 02:36:25.940 And certainly if we look over... 02:36:25.940 --> 02:36:30.160 We can see an opcode reference here, which is exactly what you want here. 02:36:30.160 --> 02:36:40.820 You want to see what's the opcodes that will disassemble into the knobs while at the same time have a different meaning in the 32-bit context. 02:36:41.340 --> 02:36:50.060 Now, again, though, I wouldn't say that there is sort of like once you get the right one that works, the rest kind of flows pretty easily, I feel like. 02:36:50.900 --> 02:37:00.800 Having seen at least a solution to this, we expect there's probably multiple, but one of them, like once you kind of get the right mismatch, you don't need to build this really complicated payload. 02:37:00.800 --> 02:37:02.160 It can be relatively straightforward. 02:37:02.160 --> 02:37:07.360 So I say that to mean that it could be, I guess, not out of reach yet. 02:37:07.360 --> 02:37:09.460 Like while I certainly, if I, you know, we're in Vegas. 02:37:09.460 --> 02:37:13.860 If I was going to make a bet, I might put it now on MMM. 02:37:13.860 --> 02:37:14.220 Yeah. 02:37:14.220 --> 02:37:17.400 But this is not out of reach. 02:37:17.400 --> 02:37:19.100 There's no question because if it's... 02:37:19.100 --> 02:37:20.160 Okay, right. 02:37:20.160 --> 02:37:25.240 So they just found out, for example, floating point knobs are not considered knobs because it actually says FNOP. 02:37:25.240 --> 02:37:28.100 So it's FNOP or however you actually pronounce it. 02:37:28.100 --> 02:37:32.840 And I'm also kind of wondering what the hell is FNOP in the first place. 02:37:32.880 --> 02:37:33.440 FNOP? 02:37:33.440 --> 02:37:37.480 It's a knob that happens in the floating point instruction space. 02:37:37.480 --> 02:37:37.900 Right. 02:37:37.900 --> 02:37:39.680 But, like, what? 02:37:40.440 --> 02:37:40.880 Yeah. 02:37:40.880 --> 02:37:43.540 Actually, if memory serves, it's even a funny opcode. 02:37:43.540 --> 02:37:48.660 I think it's D9D0 because, you know, 90 is the regular knob. 02:37:48.660 --> 02:37:50.720 And so I believe let's... 02:37:50.720 --> 02:37:51.620 I'm not sure. 02:37:51.620 --> 02:37:52.640 But , like, you know, chat. 02:37:52.680 --> 02:37:54.020 Somebody check me out, chat. 02:37:54.300 --> 02:37:58.720 Open up your Binary Ninja and type D9D0 and hit, you know, P, disassemble it. 02:37:58.900 --> 02:37:59.680 Or we can look. 02:37:59.680 --> 02:38:00.680 Yeah, we can look here. 02:38:00.780 --> 02:38:03.360 So we're seeing working over through the knobs. 02:38:03.360 --> 02:38:04.920 Okay, we're back in Capstone. 02:38:05.400 --> 02:38:07.520 So have we found out the key yet? 02:38:07.520 --> 02:38:08.680 So let's see. 02:38:08.820 --> 02:38:10.200 Yeah, they're looking at the Capstone header. 02:38:10.200 --> 02:38:15.600 I think they're trying to figure out exactly what the different constants mean, like the different arguments. 02:38:17.140 --> 02:38:24.320 Which is definitely the key to understand this challenge, then, to realize, like, exactly in what way it's disassembled. 02:38:24.320 --> 02:38:26.040 Now, you could go too far, though, right? 02:38:26.040 --> 02:38:34.280 So, like, one of the, I think, the most important things to figure out is how much do you spend into one sinkhole before you move to another topic? 02:38:34.280 --> 02:38:35.920 Or are you going too deep? 02:38:35.920 --> 02:38:41.180 Especially in this one, where you know there is a solution that should be doable in 20, 30 minutes, right? 02:38:41.180 --> 02:38:41.640 Right. 02:38:41.640 --> 02:38:43.880 And this is a little bit like a metagaming thing. 02:38:43.880 --> 02:38:46.020 We just saw it at FNOP over there as well, too. 02:38:46.020 --> 02:38:46.600 Nice. 02:38:46.600 --> 02:38:50.760 So they're looking through the different operations. 02:38:50.760 --> 02:38:51.320 Yeah. 02:38:51.560 --> 02:38:54.040 But a little bit like a metagaming thing in the CTF. 02:38:54.040 --> 02:39:01.180 Like , because you know that there is a solution, like, it shapes how you approach the problem. 02:39:01.180 --> 02:39:06.780 And, like, you start thinking about, like, okay, what could the author have been thinking about, and so on. 02:39:06.780 --> 02:39:13.700 Well, and that's one where, again, I feel like, you know, we saw immediately a 32-64 mismatch coming out of MMM. 02:39:13.700 --> 02:39:19.740 So that was just somebody who looked at it and instantly thought, if I was making a challenge like this, about like this, here's probably what happens. 02:39:19.740 --> 02:39:21.740 And then it just, they tested it, and it worked. 02:39:22.640 --> 02:39:26.060 And that's where, like, the experience really comes into play. 02:39:26.060 --> 02:39:32.300 So, Iron, we currently have MMM, which sounds suspiciously like PPP. 02:39:32.300 --> 02:39:34.100 They're a duck-themed team. 02:39:34.100 --> 02:39:38.680 The full name is Maple Mallard Magistrates. 02:39:38.680 --> 02:39:40.200 I call them the Mighty Ducks. 02:39:40.200 --> 02:39:44.900 And they're playing against the OSU SEC, the Oklahoma State University Beavers. 02:39:44.900 --> 02:39:47.160 So we have a duck versus beaver match. 02:39:47.180 --> 02:39:47.940 What? 02:39:48.680 --> 02:39:49.700 Coincidentally. 02:39:49.700 --> 02:39:53.820 And actually, for context, the seeding for these challenges... 02:39:53.820 --> 02:39:56.260 Oh, I do see our stream bitrate kind of going up and down. 02:39:56.260 --> 02:39:57.720 So I apologize for the 720. 02:39:58.340 --> 02:40:03.040 We are at the mercy of the bandwidth that we've got here. 02:40:03.040 --> 02:40:07.380 But the good news is we have local feeds, and we will make sure that we put... 02:40:07.860 --> 02:40:09.800 Upload the videos of this, the recordings. 02:40:09.800 --> 02:40:11.880 Yeah , we'll do the good ones later. 02:40:13.900 --> 02:40:16.440 There was a question here, like, they can only use NOP in shellcode. 02:40:16.440 --> 02:40:18.260 And yes, it's like, yes, but no. 02:40:18.260 --> 02:40:19.460 I said Oklahoma, didn't I? 02:40:19.460 --> 02:40:20.000 I meant Oregon. 02:40:20.000 --> 02:40:20.640 Thank you, Lucas. 02:40:20.640 --> 02:40:21.420 I apologize. 02:40:21.460 --> 02:40:23.420 Yes, this is Oregon State University. 02:40:23.960 --> 02:40:25.120 We're not operating on much sleep. 02:40:25.120 --> 02:40:26.140 Is this like the U.S. 02:40:26.140 --> 02:40:27.780 version of, like, Sweden, Switzerland? 02:40:28.380 --> 02:40:30.200 Oh, there's lots of them. 02:40:30.380 --> 02:40:31.720 It's just O universities. 02:40:31.720 --> 02:40:32.740 There's Oklahoma, Ohio. 02:40:33.420 --> 02:40:34.800 I know, I know. 02:40:34.800 --> 02:40:39.000 Listen, we didn't sleep a whole lot the last few days. 02:40:39.000 --> 02:40:41.120 Like, we've been hard at work getting this done. 02:40:41.120 --> 02:40:45.080 So I guarantee you that's not the worst mix-up that we're going to have. 02:40:45.080 --> 02:40:48.080 All right, so I'm starting to see... 02:40:48.620 --> 02:40:49.860 This is interesting. 02:40:49.860 --> 02:40:52.920 Okay, so let's go back over to the ducks. 02:40:53.380 --> 02:40:55.440 And we've actually got, like, a payload here. 02:40:55.440 --> 02:40:57.420 So we're writing... 02:40:57.420 --> 02:41:01.620 We've got this 0xf and 1f. 02:41:01.720 --> 02:41:04.480 Or no, 0xf and 1f. 02:41:07.220 --> 02:41:10.640 Okay, so we've got a bunch of NOPs that the behavior... 02:41:13.830 --> 02:41:15.670 Oh, I think they're just brute-forcing. 02:41:15.670 --> 02:41:21.670 They're just trying all different combinations of, like, opcodes to see... 02:41:22.850 --> 02:41:24.150 I don't think so. 02:41:24.150 --> 02:41:26.970 I think this is a little different. 02:41:26.970 --> 02:41:32.890 I think what we're doing is we know something is disassembled wrong, and we're just trying to either, like, increment a pointer or something. 02:41:32.890 --> 02:41:34.790 This feels further along to me. 02:41:34.790 --> 02:41:35.450 No, no, you see that. 02:41:35.450 --> 02:41:39.030 They loop over all the 256, like... 02:41:39.030 --> 02:41:40.110 Oh, immediate values? 02:41:40.110 --> 02:41:40.770 No, you're right, you're right. 02:41:40.770 --> 02:41:41.610 I take that back. 02:41:41.610 --> 02:41:49.370 They're trying to explore, basically building up a playbook, I guess, of what they have to work with. 02:41:50.450 --> 02:41:57.610 Well, AR, I will say that of all the O universities, only one is represented at DEF CON CTF. 02:41:57.610 --> 02:42:01.050 So by definition, I think you might be right. 02:42:01.050 --> 02:42:09.970 I think certainly in the CTF community, right now anyway, Oregon State does have that edge on all of their other O universities. 02:42:13.230 --> 02:42:17.350 The other thing I think is really interesting, I love looking at the tooling. 02:42:17.930 --> 02:42:24.070 I love to see somebody's using BBEdit with very tight indentation limits so you can see a lot of code. 02:42:24.130 --> 02:42:26.410 This is sort of personal preference in how people work. 02:42:26.410 --> 02:42:31.870 Some people are using Vim in the shell, and some people are using actual IDEs, or some people are just using text editors. 02:42:33.770 --> 02:42:37.550 So I'm really curious to see more of that as well as we go. 02:42:37.550 --> 02:42:42.910 And then, yeah, Hex Fiend as well, just to be able to get a quick analysis. 02:42:42.910 --> 02:42:49.630 In fact, when this challenge was being tested, one of the things I saw done that I thought was really nifty was open up the binary. 02:42:50.090 --> 02:42:52.650 And I think you could do this in Gitter, or IDA, or Binja. 02:42:53.310 --> 02:43:00.330 It works really well in Binja, though, to be able to just type a bunch of hex bytes and have them disassembled simultaneously in each of the widths. 02:43:00.330 --> 02:43:00.970 Oh, nice. 02:43:01.250 --> 02:43:02.550 Actually, no, I take that back. 02:43:02.550 --> 02:43:05.930 You can't actually have overlapping architectures in IDA or Gitter. 02:43:05.930 --> 02:43:14.050 But you could easily wire up objdump to do the same thing, just disassemble them both side by side, let me fiddle with a bunch of bytes, and work from there. 02:43:18.210 --> 02:43:20.110 We're looking through a bunch of these. 02:43:20.230 --> 02:43:24.190 I think once the right one is found, it'll go quickly. 02:43:24.190 --> 02:43:27.350 Right, so is there one or two operations here that are key? 02:43:27.350 --> 02:43:36.170 There's at least one that, when I saw it get done, when Glenn was producing the answer for, was definitely key. 02:43:36.170 --> 02:43:46.330 And in fact, we've got plenty of time left, but if we hit the 30-minute mark or the 25-minute mark, what we'll probably do is go tell them a hint, like the mnemonic that they should be aiming for. 02:43:46.330 --> 02:43:49.010 And that might help them get a little bit further along. 02:43:49.150 --> 02:43:52.750 So we've talked before about what happens if teams don't solve this in time. 02:43:52.750 --> 02:43:53.330 Uh-oh. 02:43:53.410 --> 02:43:54.570 Oh, that's a good-looking list. 02:43:54.570 --> 02:43:55.910 Oh, this is interesting. 02:43:56.210 --> 02:43:57.790 I see some inks and decks. 02:43:57.790 --> 02:43:58.810 Oh, that's useful. 02:43:58.810 --> 02:44:02.610 Yeah, what could you do interesting if you could ink or deck a pointer? 02:44:02.730 --> 02:44:05.750 Well, now I expect we're going to go back and look at... 02:44:05.750 --> 02:44:08.250 No, you need the actual disassembly at this point, though, right? 02:44:08.370 --> 02:44:09.450 Or a debugger. 02:44:09.550 --> 02:44:10.150 So there we go. 02:44:10.150 --> 02:44:12.790 We're going to see Ghidra, we're going to see a debugger. 02:44:13.050 --> 02:44:14.510 I think we've got a gadget. 02:44:14.730 --> 02:44:16.710 And now it's a question of what can we do with it. 02:44:16.710 --> 02:44:17.150 Yeah. 02:44:17.850 --> 02:44:19.450 It's like incrementing... 02:44:20.590 --> 02:44:27.150 Very useful to either do self-modifying code or just manipulate pointers. 02:44:27.150 --> 02:44:29.090 Just align some pointer at something else, right? 02:44:29.090 --> 02:44:30.750 Like, what can we point it at? 02:44:30.750 --> 02:44:31.350 Right. 02:44:31.510 --> 02:44:33.650 You have an ink ESP there, for example. 02:44:33.650 --> 02:44:35.050 Oh , and there's a segfault, right? 02:44:35.050 --> 02:44:35.910 So writing a bunch of those. 02:44:35.910 --> 02:44:38.170 So we know there's something malicious happening. 02:44:38.170 --> 02:44:38.730 Right. 02:44:38.750 --> 02:44:39.870 But how do we ensure that? 02:44:39.870 --> 02:44:53.250 So, Fabio, to answer your question about why they're using a hex editor, they're usually going to be using a hex editor here because they wanted to just enter a bunch of different bytes in and see how they were decoded, how they were disassembled as 64-bit and 32-bit disassembly. 02:44:53.330 --> 02:45:02.550 Because that's, again, the sort of crux of this challenge is that the program tells you it's only going to run your self-code if it only contains all NOPs. 02:45:03.690 --> 02:45:08.530 But it's not actually true because it's going to disassemble them for one architecture and then run them for the other. 02:45:08.530 --> 02:45:10.270 And so that's what you're trying to exploit. 02:45:10.350 --> 02:45:11.730 Let's double-check back on our... 02:45:11.730 --> 02:45:13.730 Oh, man, this is tempting. 02:45:13.810 --> 02:45:15.190 Yeah, but let's go back over to OSU. 02:45:15.190 --> 02:45:19.730 Let's go back to OSU and let's see where we're at over here. 02:45:20.570 --> 02:45:21.070 Yes. 02:45:21.070 --> 02:45:23.730 So they are also looking at an opcode reference. 02:45:23.730 --> 02:45:26.350 They've started writing a script. 02:45:26.350 --> 02:45:28.390 So they're on the same path. 02:45:28.390 --> 02:45:30.990 If they get that ink, they're only a minute behind. 02:45:30.990 --> 02:45:31.310 Yes. 02:45:31.510 --> 02:45:37.010 Honestly, if you've got an ink, they've still got a shot. 02:45:37.090 --> 02:45:40.410 Again, Batman, I still know as much as where I put it. 02:45:40.410 --> 02:45:45.450 So let's keep our eye on back on the ducks and see where the mighty ducks are at. 02:45:46.130 --> 02:45:48.410 And we're already looking at memory maps. 02:45:48.410 --> 02:45:56.130 We should keep a vote of Jeff versus Pwnbag or all the different other options. 02:45:56.650 --> 02:45:57.350 So here we go. 02:45:57.350 --> 02:45:58.970 So they're using Gitter as well for the... 02:45:58.970 --> 02:46:01.110 But I'm waiting for like... 02:46:01.110 --> 02:46:04.690 I think they're just so much faster than me because they flip the Gitter and they flip away immediately. 02:46:04.690 --> 02:46:07.330 I don't remember if they just remember the disassembly so much. 02:46:07.330 --> 02:46:07.870 Yeah. 02:46:07.890 --> 02:46:11.370 Maybe they just wanted to double-check one small detail. 02:46:11.370 --> 02:46:14.470 If you have one question that you want answered, just check. 02:46:14.470 --> 02:46:15.270 Look back at it. 02:46:15.270 --> 02:46:16.770 What was the size of that buffer? 02:46:16.770 --> 02:46:20.790 Again, we've got the choice here between what register do we want to increment? 02:46:20.830 --> 02:46:22.170 And so that's the key question. 02:46:22.330 --> 02:46:23.650 Which one is most useful? 02:46:23.650 --> 02:46:26.630 And I will say a debugger also makes a lot of sense here too. 02:46:28.250 --> 02:46:29.530 Yeah, AR, absolutely. 02:46:29.530 --> 02:46:31.130 I think everybody is impressed with OSUsec. 02:46:31.130 --> 02:46:38.010 In particular, the most impressive thing about OSUSEC is that they're one of the few teams that didn't combo up with a million other teams. 02:46:38.270 --> 02:46:39.430 Because a lot of these other teams... 02:46:39.430 --> 02:46:43.230 To our knowledge, they are actually just OSUSEC. 02:46:43.350 --> 02:46:45.570 Yeah, and it sounds like we've got a lot of their fans in the chat. 02:46:45.570 --> 02:46:47.470 And yeah, that's super impressive. 02:46:47.470 --> 02:46:49.310 You definitely get an underdog vibe. 02:46:49.730 --> 02:46:55.230 And you want them to do well because they're competing against these CTF giants that have been around for 10 years and they're combining four of the teams. 02:46:55.230 --> 02:46:59.170 Going up against PPP plus friends, that's rough. 02:46:59.170 --> 02:47:00.090 That's daunting. 02:47:00.250 --> 02:47:03.110 I've lost a lot to PPP without friends. 02:47:03.110 --> 02:47:04.930 We all have. 02:47:06.310 --> 02:47:07.270 Over the years. 02:47:07.270 --> 02:47:10.410 All right, so take a look in the debugger. 02:47:11.430 --> 02:47:16.890 It seems like there's some kind of controlled values in there and is that a stack they're looking at? 02:47:16.890 --> 02:47:19.470 Yeah, let's look at the stack pointer. 02:47:19.470 --> 02:47:21.070 Look at the memory maps. 02:47:21.310 --> 02:47:23.310 Again, looking at disassembly. 02:47:23.310 --> 02:47:25.490 What is RPOSX64? 02:47:25.810 --> 02:47:27.550 I don't know that. 02:47:28.150 --> 02:47:29.950 No, that's RP++. 02:47:30.010 --> 02:47:34.750 That's another ROP gadgets finder. 02:47:34.750 --> 02:47:37.970 I tend to use that one. 02:47:38.230 --> 02:47:42.490 I think all the cool kids nowadays use ROPR. 02:47:42.490 --> 02:47:47.310 But I think before that, RP++ was the good stuff. 02:47:47.310 --> 02:47:48.950 I'm still kind of using that. 02:47:49.710 --> 02:47:55.110 This is one of the things I'm actually excited about too, is seeing the new toys and tools. 02:47:55.930 --> 02:47:57.230 Because I don't actively... 02:47:57.230 --> 02:47:58.230 Oh, we got a little bit of a... 02:47:58.230 --> 02:47:58.890 Oh, there we go. 02:47:58.890 --> 02:48:01.150 We were looking for... 02:48:01.150 --> 02:48:02.990 It looked like God entries maybe. 02:48:03.230 --> 02:48:05.590 I saw a bunch of a list of function pointers. 02:48:06.690 --> 02:48:10.110 I haven't actively played CTF in several years now. 02:48:10.110 --> 02:48:14.350 I know enough to maybe make a small challenge an easy challenge. 02:48:14.350 --> 02:48:16.910 And I know it's going to get destroyed by really good people. 02:48:16.910 --> 02:48:19.370 But it's fun to see what are the latest tools. 02:48:19.550 --> 02:48:24.090 I kind of missed out on watching people do that. 02:48:25.410 --> 02:48:29.590 To recap, we're 19 minutes in. 02:48:30.070 --> 02:48:34.110 And we've got at least one team... 02:48:35.730 --> 02:48:39.370 Let's go take a look back over at OSU. 02:48:39.370 --> 02:48:40.650 Because we are in a debugger. 02:48:40.690 --> 02:48:42.590 That might be a good sign. 02:48:42.590 --> 02:48:48.390 You can see them stepping through a whole bunch of NOPs, which doesn't really give them anything so far. 02:48:48.870 --> 02:48:52.470 But it's going to say NOP, whether it is or not, in the output. 02:48:52.510 --> 02:48:54.010 Did you see what they sent in? 02:48:54.010 --> 02:48:57.110 No, but you see in the debugger, it's also listed as NOP. 02:48:57.110 --> 02:48:59.850 And also in the output to the left, it's listed as NOP. 02:48:59.850 --> 02:49:02.470 So they haven't found the key mismatched yet. 02:49:02.770 --> 02:49:03.310 Correct. 02:49:03.310 --> 02:49:05.790 Or they haven't exploited it yet. 02:49:05.790 --> 02:49:07.970 Or actually taken advantage of it. 02:49:08.830 --> 02:49:19.530 However, you can see here over at MMM, that you have a sequence of hex values listed here in their exploit script. 02:49:20.390 --> 02:49:23.990 So it looks like they are going somewhere, putting together... 02:49:23.990 --> 02:49:28.130 Oh, I wonder if they're putting together a shellcode payload in these immediates. 02:49:28.130 --> 02:49:29.950 See, it's called smuggle32, right? 02:49:29.950 --> 02:49:30.870 Oh, nice. 02:49:30.870 --> 02:49:31.670 I like that. 02:49:31.670 --> 02:49:34.510 Also, again, with nice naming of things. 02:49:34.810 --> 02:49:35.790 We've gone boring now. 02:49:35.790 --> 02:49:37.070 Now it's just x32. 02:49:37.070 --> 02:49:40.610 Yeah , so we lost the more interesting name. 02:49:40.610 --> 02:49:41.970 Yeah , I mean smuggle32, I think. 02:49:41.970 --> 02:49:42.470 Oh, there we go. 02:49:42.470 --> 02:49:43.590 So at ink ESP... 02:49:43.590 --> 02:49:45.030 Oh, no, sorry, not shellcode. 02:49:45.030 --> 02:49:45.570 Pointers, right? 02:49:45.570 --> 02:49:45.910 Clearly. 02:49:46.370 --> 02:49:47.130 Executable code. 02:49:47.130 --> 02:49:47.430 Yes. 02:49:47.430 --> 02:49:52.650 So they're going to have this x32, which is going to let them rot potentially. 02:49:53.130 --> 02:49:55.730 And they're going to be able to ink the stack pointer. 02:49:55.730 --> 02:49:57.150 This sounds like a great technique. 02:49:57.150 --> 02:49:57.750 Yes. 02:49:57.890 --> 02:50:01.510 Ink the stack pointer, override the return address, maybe. 02:50:02.550 --> 02:50:03.750 And go from there. 02:50:03.750 --> 02:50:09.370 And you've got to end in maybe either one gadget or multiple gadgets, or you've got a sort of straightforward shot. 02:50:10.010 --> 02:50:11.070 Oh, there's a win function. 02:50:11.070 --> 02:50:13.510 Or maybe you could go, oh, you know what, though? 02:50:13.770 --> 02:50:18.610 If a team doesn't actually open this thing up in a disassembler, if they only use a debugger, they won't see win. 02:50:18.950 --> 02:50:20.090 Well, they have the source code. 02:50:20.090 --> 02:50:20.730 Oh, they have the source code. 02:50:20.730 --> 02:50:21.690 They have the source code. 02:50:21.690 --> 02:50:22.510 That's a good point. 02:50:22.810 --> 02:50:30.290 But this is definitely the thing that you can, like, you know, because I think it's maybe like at the top of the, like it's a small function at the top of the file. 02:50:30.470 --> 02:50:33.390 Like, you know, if you just scroll past that because you don't notice. 02:50:33.390 --> 02:50:38.410 And then you build your mental model all around, like, you know, a rough chain or something. 02:50:38.570 --> 02:50:41.150 It's the kind of thing that happens a lot in this environment. 02:50:41.150 --> 02:50:47.930 When you're doing a live CTF, and you're under pressure, and you're out of the gun, or you remembered it, but it's 20 minutes later, and now you've forgotten it. 02:50:47.930 --> 02:50:48.370 Right. 02:50:48.370 --> 02:50:52.490 So it's possible we see somebody get tunnel vision and miss that. 02:50:52.490 --> 02:50:59.590 I mean, I've done that, like, in several CTFs where, like, oh, there was actually this memory region that was, like, writable or executable or something. 02:50:59.590 --> 02:51:00.410 And , like, you didn't see it. 02:51:00.410 --> 02:51:05.810 The binary is actually executable even though, because it's running an emulator or something, and you assumed that the permissions were, yeah, were fixed. 02:51:05.810 --> 02:51:09.190 Yeah , it's, you know, it can lose you a lot of hours. 02:51:09.930 --> 02:51:12.250 All right, so we've got our ink ESP pattern. 02:51:12.450 --> 02:51:14.490 We've got our, and we are using PwnTools, right? 02:51:14.490 --> 02:51:15.730 So we're seeing PwnTools. 02:51:15.730 --> 02:51:16.930 I don't think we have a payload yet. 02:51:16.930 --> 02:51:23.950 We're still got, unfortunately for OSU, I think we don't have an understanding yet. 02:51:24.070 --> 02:51:24.630 Right. 02:51:24.630 --> 02:51:26.110 I think we're kind of lost in the weeds. 02:51:26.110 --> 02:51:28.310 So this is not looking good over there. 02:51:28.310 --> 02:51:36.830 We're going to keep it on the ducks and see if we can, see if this will come in. 02:51:37.330 --> 02:51:37.790 Right. 02:51:37.890 --> 02:51:39.670 Because this is, I mean, this is looking really good, right? 02:51:39.670 --> 02:51:47.490 We've got the ability to misalign the stack, which gets us a return address overwrite, which gets us an instruction pointer, and we've got a win function. 02:51:47.590 --> 02:51:49.790 Right, it looks like they're dumping this to a file now. 02:51:49.790 --> 02:51:50.950 Do we have ASLR? 02:51:50.950 --> 02:51:53.510 Do we need to know if it's randomized or is it... 02:51:53.510 --> 02:51:54.650 Yeah, this is... 02:51:54.650 --> 02:52:01.730 I believe if the source, if they pull up the source again, the first line of the source was the build instruction that was used to compile that binary. 02:52:02.010 --> 02:52:04.810 So we would know if they flashed that again real quick. 02:52:06.530 --> 02:52:09.510 We've got not coding that C, so we're one away. 02:52:09.510 --> 02:52:11.650 It makes you want to touch the screen. 02:52:11.650 --> 02:52:14.310 Yeah , we should have some kind of plug-in on the computer. 02:52:14.310 --> 02:52:15.730 Yeah, just like, no, no, we need to look at this. 02:52:15.730 --> 02:52:17.350 Well, really, yeah. 02:52:17.370 --> 02:52:25.510 The later iteration of this, we're going to have more, I think, machines here, but we're already overloading the number of available USB ports even with several hubs. 02:52:25.530 --> 02:52:25.910 Yeah . 02:52:26.310 --> 02:52:29.450 So I'm curious. 02:52:29.450 --> 02:52:33.850 I know there's a lot of Beaver fans in the chat. 02:52:33.870 --> 02:52:35.410 Y'all still got faith? 02:52:35.410 --> 02:52:37.350 Are you still in hope? 02:52:37.350 --> 02:52:39.270 Or are you... 02:52:39.270 --> 02:52:40.550 There we go. 02:52:40.550 --> 02:52:41.370 See, hanging. 02:52:41.370 --> 02:52:45.610 So there are still the Oregon fans out there. 02:52:45.610 --> 02:52:46.230 Right, Oregon? 02:52:46.230 --> 02:52:46.870 I said it right this time? 02:52:46.870 --> 02:52:47.750 Okay, good. 02:52:48.230 --> 02:52:48.790 I'll get it right. 02:52:48.790 --> 02:52:49.130 All right. 02:52:49.130 --> 02:52:50.890 You can just keep rotating around by... 02:52:50.890 --> 02:52:52.190 Just different O's each time? 02:52:52.190 --> 02:52:52.890 Yeah. 02:52:52.890 --> 02:52:55.110 Ohio, Oklahoma, Oregon. 02:52:55.110 --> 02:52:56.470 Switch to all of them. 02:52:56.550 --> 02:52:56.910 Yeah . 02:52:57.010 --> 02:52:57.550 All right. 02:52:58.070 --> 02:52:58.430 So... 02:52:59.410 --> 02:53:02.310 You can see there, again, doing some, like... 02:53:02.310 --> 02:53:02.810 Brute force. 02:53:02.810 --> 02:53:03.870 Looking for something else. 02:53:03.870 --> 02:53:04.030 Yeah. 02:53:04.030 --> 02:53:07.890 So this, to me, is like somebody stepping back saying, I'm not sure I have all the gadgets. 02:53:07.890 --> 02:53:10.010 Like, I think that was all the gadgets they needed. 02:53:10.470 --> 02:53:12.590 I think that was sufficient to win. 02:53:12.590 --> 02:53:14.050 Glenn, is that sufficient? 02:53:14.130 --> 02:53:15.570 Or is there more to it? 02:53:16.130 --> 02:53:17.930 We're getting it mostly from Glenn. 02:53:18.290 --> 02:53:19.010 Yeah. 02:53:19.150 --> 02:53:20.190 And I can't hear him at all. 02:53:20.190 --> 02:53:21.690 I can't hear you, unfortunately, over there. 02:53:21.690 --> 02:53:25.790 We're just going to roll with it and say that, you know, they might need a few instructions. 02:53:25.790 --> 02:53:27.930 But , I mean, it should be able to... 02:53:27.930 --> 02:53:30.030 Because, sure, you can increment the stack pointer, right? 02:53:30.030 --> 02:53:31.710 But then you need to actually modify the value. 02:53:31.710 --> 02:53:33.850 So you need one more thing to actually, like... 02:53:33.850 --> 02:53:34.350 No, no. 02:53:34.430 --> 02:53:38.390 If your buffer is on the stack, then you don't need to do any such thing. 02:53:39.230 --> 02:53:42.130 You can just return when it points to your... 02:53:42.130 --> 02:53:44.890 If your input that you send in is on the stack... 02:53:44.890 --> 02:53:45.450 Oh, right. 02:53:45.450 --> 02:53:45.770 Yes. 02:53:45.770 --> 02:53:46.750 You just need to line it up. 02:53:46.750 --> 02:53:46.790 Yeah , yeah , yeah. 02:53:46.790 --> 02:53:47.310 So you do... 02:53:47.310 --> 02:53:48.130 Okay, of course. 02:53:48.130 --> 02:53:48.630 Right. 02:53:48.630 --> 02:53:53.890 So I think a variant of that is possible in this particular binary. 02:53:53.930 --> 02:53:58.030 But your input is still slightly constrained, then. 02:53:58.030 --> 02:54:04.050 Like, let's say you would put a return address or something there. 02:54:04.050 --> 02:54:11.210 I don't remember the source code if this was string operations, if a null terminate will break it or not. 02:54:11.270 --> 02:54:12.070 Ah, I see. 02:54:12.070 --> 02:54:12.730 Okay, right. 02:54:12.730 --> 02:54:16.930 Yeah, so you could potentially smuggle it behind the other stuff. 02:54:16.930 --> 02:54:17.690 But, yeah. 02:54:18.250 --> 02:54:22.490 But, no, you give it binary because it doesn't assemble your... 02:54:22.490 --> 02:54:22.910 That's right, that's right. 02:54:22.910 --> 02:54:27.150 You give it the hex and it's actually going to put that buffer as those bytes. 02:54:27.150 --> 02:54:27.990 Yeah, yeah, yeah. 02:54:28.470 --> 02:54:29.610 Presumably do it. 02:54:29.610 --> 02:54:30.410 Right. 02:54:30.550 --> 02:54:31.630 Five minutes to a fresh start. 02:54:31.630 --> 02:54:32.450 No, no, no, no, no. 02:54:32.450 --> 02:54:33.630 We have... 02:54:33.630 --> 02:54:35.690 So they have plenty of time left. 02:54:35.690 --> 02:54:36.090 Yes . 02:54:36.470 --> 02:54:38.950 Well, so we are coming up on... 02:54:38.950 --> 02:54:51.850 This is the point where if neither team had made progress, we'd walk over to them and we'd say, you need to misalign your 64, your 32, and you need to find a gadget that's going to let you get the payload. 02:54:53.090 --> 02:54:55.890 But because we're already seeing at least... 02:54:55.890 --> 02:54:58.650 Once at least one team has sort of made it to that point... 02:54:58.650 --> 02:55:00.810 Yeah, and clearly that's the case. 02:55:00.810 --> 02:55:02.890 Which has been for several minutes now. 02:55:03.250 --> 02:55:04.230 We're not going to do it now. 02:55:04.230 --> 02:55:09.770 That said, if we come up on 45 minutes, we do hit sudden death mode. 02:55:09.770 --> 02:55:10.710 And we will swatch over. 02:55:10.710 --> 02:55:22.510 So there is 20 minutes left where if the duck doesn't successfully finish this challenge in the next 20 minutes, there is still a chance that we go to sudden death and our beavers could have a chance. 02:55:22.510 --> 02:55:22.750 Yes . 02:55:22.750 --> 02:55:24.470 So that is absolutely possible. 02:55:27.450 --> 02:55:27.850 Let's... 02:55:27.850 --> 02:55:37.090 All right, I'm going to just look for a second and try to get caught up here where we're at because it's a little concerning when I see going back to the well of trying to find more gadgets. 02:55:37.130 --> 02:55:37.910 Right. 02:55:37.910 --> 02:55:40.390 And I'm wondering... 02:55:40.860 --> 02:55:45.830 We're still looking for more patterns, but as far as we know, we think there's enough gadgets there. 02:55:46.290 --> 02:55:47.050 Yeah. 02:55:48.150 --> 02:55:52.210 I have actually not looked at our reference solution for this. 02:55:52.210 --> 02:55:56.130 So I don't know exactly what instructions it contains, but... 02:55:56.130 --> 02:55:58.830 I thought it was an ink ESP, actually. 02:55:58.830 --> 02:55:59.750 Or ink or deck ESP. 02:55:59.750 --> 02:56:04.870 One of the two to misalign the stack pointer into a buffer you controlled. 02:56:04.870 --> 02:56:06.530 Right, so we've got a question about the sudden death thing. 02:56:06.530 --> 02:56:07.930 Yeah, so we have this thing. 02:56:07.930 --> 02:56:10.050 So there's a time limit of 45 minutes. 02:56:10.050 --> 02:56:14.530 So if they hit that, we will stop the challenge because then it was... 02:56:15.050 --> 02:56:17.450 Well, we don't want to drag this on for too long. 02:56:17.450 --> 02:56:23.290 So in particular, the whole match on every team versus team matchup really needs to stay under an hour. 02:56:23.290 --> 02:56:25.930 Otherwise, the schedule starts slipping and throws off all the other events. 02:56:25.930 --> 02:56:26.470 Right. 02:56:27.910 --> 02:56:28.690 What's that? 02:56:29.510 --> 02:56:33.190 All right, do you want to get on the mic and do it or do you just want to tell us from there? 02:56:33.970 --> 02:56:35.470 You have a mic over there. 02:56:37.030 --> 02:56:39.590 Actually, that mic is even still live. 02:56:39.910 --> 02:56:41.290 So careful rubbing it on things. 02:56:41.290 --> 02:56:46.790 But if you talk into that mic, it might just be easier to hold it and try to put it on. 02:56:46.790 --> 02:56:47.270 It's up to you. 02:56:47.270 --> 02:56:47.710 There we go. 02:56:47.710 --> 02:56:49.050 So I think we've got Glenn. 02:56:49.050 --> 02:56:50.190 It looks like your levels are up. 02:56:50.190 --> 02:56:50.990 All right, let's see if this is working. 02:56:50.990 --> 02:56:55.170 So our producer Glenn and challenge author Glenn is going to come here. 02:56:55.170 --> 02:56:57.990 We'll tell you a little bit more, Rakesh, about sudden death in a second. 02:56:57.990 --> 02:57:01.550 Let's let Glenn talk a little bit more about what the expected solution is here. 02:57:01.690 --> 02:57:02.470 All right, so... 02:57:02.470 --> 02:57:08.210 This is why the competitors have those earmuffs on, so they can't hear us as we're talking about all these details. 02:57:08.210 --> 02:57:10.290 Yeah , let me just make sure the levels are actually working. 02:57:11.050 --> 02:57:11.710 All right. 02:57:11.710 --> 02:57:32.930 So generally speaking, the way that this works is since you have the difference between x86-32 and 64 bits, you can get what the MMM player has found, which is like a REX-W NOP, which basically on x86-64, it disassembles to a NOP. 02:57:32.930 --> 02:57:38.150 On 32-bit, it disassembles to a decrement stack pointer NOP. 02:57:38.150 --> 02:57:41.810 From this, you can gain control over the stack pointer. 02:57:41.810 --> 02:57:54.490 You can go either direction, but the way that the reference solution works is it just changes the stack pointer to point into the buffer of NOPs that you send to the server. 02:57:55.090 --> 02:58:07.950 And since the binary is not pi, and so the addresses are fixed, and there's a win function, you should be able to just get the stack pointer such that when the function returns, it returns to the win function. 02:58:07.950 --> 02:58:09.230 I think we need to give a hint. 02:58:09.230 --> 02:58:10.330 And here's my proposal. 02:58:10.370 --> 02:58:11.610 Here's the hint that I'm going to give. 02:58:11.850 --> 02:58:15.690 I think MMM missed the fact that this does not have pi. 02:58:16.090 --> 02:58:18.310 And so they're looking for a more complicated one. 02:58:18.310 --> 02:58:21.690 But I also think that OSU has missed the 30-bit 64. 02:58:21.690 --> 02:58:30.650 We can give them the same hint to both of them and help them both out equally, which is that we can tell them they need to double-check how these binaries were compiled. 02:58:32.390 --> 02:58:36.510 They need to check the first line of source code that tells them how the binary was compiled. 02:58:36.610 --> 02:58:40.030 That will tell them both something useful to the state that they're at. 02:58:40.770 --> 02:58:41.470 All right? 02:58:41.470 --> 02:58:42.530 So do you want to go get one? 02:58:42.530 --> 02:58:47.790 I'm going to go do that, because we did not add the messaging thing. 02:58:47.790 --> 02:58:48.290 Yeah, yeah. 02:58:48.430 --> 02:58:49.650 I'll go tell them. 02:58:49.690 --> 02:58:52.130 Or just write a note out, and then just hand them each the note. 02:58:52.130 --> 02:58:52.450 Right. 02:58:52.450 --> 02:58:53.490 Where's your notebook? 02:58:54.030 --> 02:58:54.790 Here we go. 02:58:55.510 --> 02:58:56.830 We'll do this now. 02:58:56.830 --> 02:58:58.550 We'll give them each that little bit hint. 02:58:58.550 --> 02:58:58.950 Yeah . 02:58:59.070 --> 02:59:00.130 And to answer... 02:59:00.130 --> 02:59:01.010 Oh, sorry. 02:59:01.290 --> 02:59:04.830 Glenn, kill the volume level on that third... 02:59:05.570 --> 02:59:06.290 Yeah. 02:59:06.470 --> 02:59:07.410 Mute that. 02:59:07.690 --> 02:59:10.530 Sorry for the ASMR there on the microphone as we set it down. 02:59:10.530 --> 02:59:11.770 We've got to be like, yeah. 02:59:12.870 --> 02:59:14.070 I got you, Penn. 02:59:14.190 --> 02:59:14.530 Yeah. 02:59:14.530 --> 02:59:14.870 Okay. 02:59:14.870 --> 02:59:15.390 Awesome. 02:59:15.390 --> 02:59:19.530 I'm tethered in, because I wired my microphone through my vest this last time, so I can't go anywhere. 02:59:19.530 --> 02:59:19.950 Yeah , looking good. 02:59:19.950 --> 02:59:21.510 But you can explain sudden death. 02:59:21.510 --> 02:59:21.970 Right. 02:59:21.970 --> 02:59:25.570 So the sudden death plan... 02:59:26.690 --> 02:59:30.930 Just keeping an eye on our duck, just to see if they've got anything else. 02:59:30.930 --> 02:59:40.470 The sudden death plan is that if we get into a situation where both teammates are stuck, neither one's making more progress, it's not looking like they're going to solve it in time, we have a totally different challenge. 02:59:40.470 --> 02:59:50.050 We have an easier, simpler, quicker challenge that we will field, that is meant to just break a tie, essentially, because we don't want to have something in where neither one can solve it. 02:59:50.050 --> 02:59:53.210 So if we get to the point where we have... 02:59:53.210 --> 02:59:54.470 So 15 more minutes. 02:59:54.590 --> 02:59:59.450 If we get to that point, we will deploy a sudden death challenge. 02:59:59.450 --> 03:00:02.850 We'll change it and say, sorry, you didn't solve it in the 45 minutes. 03:00:03.070 --> 03:00:04.110 Here's another challenge. 03:00:04.110 --> 03:00:04.890 Try that. 03:00:04.890 --> 03:00:06.850 We haven't figured out if that takes too long. 03:00:06.850 --> 03:00:08.630 We just kind of have to wait until that gets done. 03:00:09.230 --> 03:00:09.970 So hopefully those... 03:00:09.970 --> 03:00:14.510 But those are intended to be, like, the easiest possible challenges that we could do. 03:00:14.510 --> 03:00:16.050 So that's what we're doing with that. 03:00:16.050 --> 03:00:18.170 We're writing out the same hint to both teams. 03:00:19.430 --> 03:00:22.450 First line of source code. 03:00:22.790 --> 03:00:26.950 So we're going to tell them that they should each double check how the binary was compiled. 03:00:27.530 --> 03:00:30.810 I think that'll be nice, both fair and yet also useful to both of them. 03:00:30.810 --> 03:00:35.870 So we'll go ahead and do that and get that to both the teams. 03:00:35.910 --> 03:00:41.230 Because what's going to happen here is, again, if the duck can finish this out, if they can actually successfully solve this, they have a shot at it. 03:00:41.230 --> 03:00:44.410 But if they don't, then they're going to basically kind of be reset. 03:00:44.410 --> 03:00:47.170 They're both going back to zero on this new challenge. 03:00:47.170 --> 03:00:54.950 So the new challenge will be, like, fresh territory for both of them. 03:00:54.950 --> 03:01:07.290 So let's switch, maybe, to one of the other cameras and we can see in the background as Carl's going to go deliver our hints to both competitors. 03:01:07.730 --> 03:01:10.890 And we'll see if this has an impact on them. 03:01:11.990 --> 03:01:15.010 In the meantime, thank you. 03:01:15.010 --> 03:01:17.910 Is it down down or dawn dawn? 03:01:17.910 --> 03:01:18.410 I forget. 03:01:18.410 --> 03:01:21.170 I feel like I should remember this because I know I've seen the hint before. 03:01:21.670 --> 03:01:22.470 So that's a good question. 03:01:22.470 --> 03:01:23.870 What is osusec up to? 03:01:24.150 --> 03:01:26.650 We're just looking at the source again, it looks like. 03:01:27.950 --> 03:01:31.270 So we have deployed the hint to both players. 03:01:33.570 --> 03:01:37.270 And it's hard to tell because they're just looking at the... 03:01:37.270 --> 03:01:39.050 Yeah, that's not a bad idea, Peter. 03:01:39.050 --> 03:01:40.630 They might need a bigger hint. 03:01:40.990 --> 03:01:51.730 We could give them both an explicit hint of something like the binary is not ASLRed and this is 64 32-bit misalignment to get them both past the next down. 03:01:51.730 --> 03:01:52.590 Thank you, down down. 03:01:53.710 --> 03:01:55.070 Or maybe it was down dawn. 03:01:55.070 --> 03:01:56.390 It could be one of each. 03:01:56.890 --> 03:01:58.170 So we do have 03:02:01.530 --> 03:02:03.830 a bigger hint we might have to give to both of them. 03:02:03.830 --> 03:02:05.030 We will see. 03:02:05.030 --> 03:02:07.130 I would not be surprised. 03:02:07.410 --> 03:02:14.470 And again, this is one of those things where if you're playing at home, you look at this and you think, oh man, all you have to do is move the stack pointer. 03:02:14.470 --> 03:02:16.730 You should totally be able to finish this out. 03:02:17.050 --> 03:02:18.510 It is so different. 03:02:18.510 --> 03:02:23.950 It's so different when you are on the camera, when you've been stuck on the step for a while, you get kind of into rabbit holes. 03:02:23.950 --> 03:02:26.530 You're thinking, surely there's some other gadget that I'm missing. 03:02:26.530 --> 03:02:28.290 Surely there's some other thing that I need to find. 03:02:28.950 --> 03:02:33.390 Or if you feel like you just don't even have a way to do it. 03:02:33.390 --> 03:02:36.510 So let's go ahead and prepare the next hint that we'll give them in a couple minutes. 03:02:36.510 --> 03:02:42.290 If one of them starts to make more progress, maybe we'll hold off and we'll see what happens. 03:02:45.710 --> 03:02:49.950 If we give them the opcode, we're giving one team what the other one already has. 03:02:51.590 --> 03:02:53.490 So I think this hint should say... 03:02:57.450 --> 03:02:59.490 Yeah, maybe we can... 03:03:00.070 --> 03:03:00.830 Yeah, let's think. 03:03:01.450 --> 03:03:02.390 What's the clock at? 03:03:02.390 --> 03:03:03.490 Yeah, I think... 03:03:04.190 --> 03:03:05.690 Give it a few more minutes, right? 03:03:08.970 --> 03:03:10.590 So there's a question about how long... 03:03:10.590 --> 03:03:13.910 So the idea is that at 45 minutes, we will switch to the... 03:03:13.910 --> 03:03:15.830 And we start every match on the hour. 03:03:15.830 --> 03:03:18.390 So we started for us at 4 p.m. 03:03:18.510 --> 03:03:19.590 Pacific time. 03:03:19.590 --> 03:03:21.250 So we're 34 minutes in. 03:03:21.250 --> 03:03:24.590 So we have 11 more minutes before we... 03:03:26.910 --> 03:03:27.870 So we're... 03:03:27.870 --> 03:03:29.250 Are we brute-forcing? 03:03:29.250 --> 03:03:30.730 Maybe we're done brute-forcing. 03:03:31.190 --> 03:03:33.110 Yeah, they've removed the for loop. 03:03:33.130 --> 03:03:34.030 Okay, so we're not... 03:03:34.030 --> 03:03:36.070 They're putting some address in there. 03:03:36.610 --> 03:03:38.150 This is test.py. 03:03:41.820 --> 03:03:43.020 Okay. 03:03:43.900 --> 03:03:45.400 So this... 03:03:45.400 --> 03:03:47.140 Python quit unexpectedly. 03:03:48.760 --> 03:03:50.280 Wait a minute. 03:03:51.040 --> 03:03:52.800 Execve launch. 03:03:53.540 --> 03:03:55.980 Maybe we are close. 03:03:56.500 --> 03:03:57.320 Yeah. 03:03:57.320 --> 03:03:58.000 Okay. 03:03:58.000 --> 03:04:00.300 This is a good sign. 03:04:01.780 --> 03:04:02.960 Okay, yes. 03:04:02.960 --> 03:04:04.780 Oh, look, he's looking for system. 03:04:05.140 --> 03:04:06.860 Okay, okay. 03:04:07.000 --> 03:04:08.780 This looks positive. 03:04:08.780 --> 03:04:12.640 I think the realization has stuck home. 03:04:13.040 --> 03:04:16.440 I think we're about to watch it come home stretch. 03:04:16.580 --> 03:04:22.500 I still don't see osusec, unfortunately, coming up with that key 3264 insight. 03:04:23.520 --> 03:04:27.880 Even after they hinted the binary was compiled for 32-bit, but the disassembly is 64-bit. 03:04:29.120 --> 03:04:31.020 So we're looking for a bin as a string. 03:04:31.020 --> 03:04:32.980 We're going to pass it as an argument to system. 03:04:32.980 --> 03:04:34.580 Right , so they're going to skip the win function. 03:04:34.580 --> 03:04:36.820 They're going to just put the... 03:04:36.820 --> 03:04:37.340 But this is... 03:04:37.340 --> 03:04:39.460 Again, there's literally a win function. 03:04:39.460 --> 03:04:40.500 They just need the address of that. 03:04:40.500 --> 03:04:43.180 But luckily this is 32-bit, right? 03:04:43.180 --> 03:04:45.720 So they can just put the argument on the stack. 03:04:45.720 --> 03:04:48.480 I mean, it's marginally more difficult. 03:04:48.640 --> 03:04:51.700 You would need to put two addresses on the stack instead of one address. 03:04:52.100 --> 03:04:54.520 As long as there's room, and I believe there is plenty of room. 03:04:54.520 --> 03:04:57.840 Not a huge loss, but definitely could have cost them. 03:04:58.600 --> 03:05:00.900 This is looking real close. 03:05:00.900 --> 03:05:02.300 We're getting the last address in. 03:05:02.300 --> 03:05:03.660 Let's see if this does it. 03:05:05.080 --> 03:05:06.780 Again, we predicted this earlier. 03:05:06.780 --> 03:05:10.560 Like I said, the win function we gave them the source, it's very easy to miss. 03:05:10.560 --> 03:05:16.080 You 100% can get tunnel vision and totally either have forgotten about it or never seen it. 03:05:16.080 --> 03:05:18.640 In fact, in this case, I wouldn't even be surprised to have never seen it. 03:05:18.720 --> 03:05:22.060 Because there's not been a lot of poking around in the... 03:05:22.060 --> 03:05:25.800 No, because they were so quick at understanding what the source code was. 03:05:25.820 --> 03:05:26.640 And that's the thing. 03:05:26.640 --> 03:05:28.300 Then you build this abstraction in your head. 03:05:28.300 --> 03:05:29.860 This mental model. 03:05:29.980 --> 03:05:33.200 This thing just doesn't exist. 03:05:33.860 --> 03:05:34.640 There it is! 03:05:34.720 --> 03:05:35.480 Congratulations! 03:05:35.980 --> 03:05:37.540 All right, we have a win. 03:05:37.800 --> 03:05:39.240 Congratulations to our ducks. 03:05:39.540 --> 03:05:41.220 I'm excited we didn't need a sudden death. 03:05:41.220 --> 03:05:43.100 That is our third round complete. 03:05:43.220 --> 03:05:45.400 We will see you all back here in about... 03:05:45.400 --> 03:05:45.700 Wait , wait, wait. 03:05:45.800 --> 03:05:46.760 Hold on. 03:05:46.760 --> 03:05:47.820 That was just local. 03:05:48.300 --> 03:05:49.280 No, no, it's not. 03:05:49.420 --> 03:05:49.960 Submitter. 03:05:49.960 --> 03:05:50.660 It ran. 03:05:50.860 --> 03:05:51.480 Did it run? 03:05:51.480 --> 03:05:52.500 It ran, right? 03:05:52.860 --> 03:05:53.740 No, no, no. 03:05:55.140 --> 03:05:55.760 Sorry. 03:05:56.280 --> 03:05:57.280 You didn't trigger it, right? 03:05:57.280 --> 03:05:58.260 I saw it trigger on... 03:05:58.260 --> 03:05:58.700 Yeah, yeah. 03:05:59.100 --> 03:06:00.140 We're done, we're done, we're done. 03:06:00.140 --> 03:06:01.380 All right, congratulations. 03:06:01.380 --> 03:06:01.920 Okay. 03:06:02.100 --> 03:06:05.400 We will see everybody back here at the top of the next hour. 03:06:06.760 --> 03:06:08.300 Very, very fun match. 03:06:08.300 --> 03:06:09.380 Thanks to both the teams. 03:06:09.380 --> 03:06:11.140 We'll see everybody in a few minutes. 03:06:12.140 --> 03:06:13.060 We out. 03:07:13.970 --> 03:07:15.370 Bye. 03:07:15.370 --> 03:07:16.290 Bye. 03:07:16.290 --> 03:07:17.690 Bye . 03:09:31.180 --> 03:09:32.600 Bye. 03:09:33.080 --> 03:09:34.480 Bye. 03:09:34.480 --> 03:09:36.120 Bye. 03:15:10.330 --> 03:15:10.550 Bye. 03:15:10.550 --> 03:15:10.750 Bye. 03:15:10.750 --> 03:15:10.970 Bye. 03:17:42.020 --> 03:17:43.440 Bye. 03:19:08.110 --> 03:19:09.510 Bye 03:25:02.430 --> 03:25:02.430 . 03:25:02.430 --> 03:25:03.950 Bye. 03:25:03.950 --> 03:25:03.950 Bye 03:25:14.530 --> 03:25:15.930 . 03:33:02.150 --> 03:38:42.080 Bye. 03:38:42.080 --> 03:38:42.220 Bye . 03:39:49.800 --> 03:39:50.980 Welcome back, everybody. 03:39:51.000 --> 03:39:54.160 We are here again, the last round of the day. 03:39:54.700 --> 03:39:57.060 Apologies for the 10-minute delay on this one. 03:39:57.320 --> 03:39:58.980 We're trying to hunt down a bad cable. 03:39:59.020 --> 03:40:03.140 Somewhere in our infrastructure is a bad cable, and it's causing one of our streams to have issues. 03:40:03.400 --> 03:40:06.460 So we might have some intermittent connectivity for one of our players. 03:40:06.860 --> 03:40:08.240 Apologies for that. 03:40:08.400 --> 03:40:09.880 We're going to go ahead and get a kickoff right away. 03:40:09.880 --> 03:40:12.960 We want to get these team members back to their teams as soon as we can. 03:40:12.960 --> 03:40:19.900 So let's go ahead and get a countdown of 5, 4, 3, 2, 1. 03:40:19.900 --> 03:40:20.940 Go! 03:40:21.280 --> 03:40:23.420 And now they're off. 03:40:23.900 --> 03:40:24.500 Okay. 03:40:24.500 --> 03:40:27.880 So we've already got the first one downloaded. 03:40:27.880 --> 03:40:28.880 And this particular one... 03:40:28.880 --> 03:40:31.760 Actually, can you grab me my notebook over there with our teams and whatnot? 03:40:32.500 --> 03:40:35.700 This one, we've got the new organizers. 03:40:36.380 --> 03:40:40.640 And I believe we've got Team Taiwan was the name that they requested. 03:40:40.640 --> 03:40:48.500 Because it's, again, another one of these mega teams that has a conglomeration of many different teams. 03:40:48.500 --> 03:40:54.060 So we've got Team Balsan, Team 217, Team TSJ.TW. 03:40:54.460 --> 03:40:59.000 So there's another team that has TW in the name that's Tokyo Westerns, a Japanese team. 03:40:59.020 --> 03:41:01.560 But this is the Taiwanese team because it's .TW. 03:41:01.980 --> 03:41:07.120 So let's go ahead and take a look at Team Balsan. 03:41:07.120 --> 03:41:09.420 It should be the one that I've got over here on my monitor. 03:41:09.420 --> 03:41:13.320 And they are already off, and they're in IDA looking at our challenge. 03:41:13.320 --> 03:41:17.760 Now, again, you'll notice all of our challenges are named Challenge, just the way that our Docker deployment kind of works. 03:41:17.760 --> 03:41:22.300 The official name of this challenge is called Nerd Sniped. 03:41:22.340 --> 03:41:22.980 Right. 03:41:23.540 --> 03:41:26.280 So what are things you can get Nerd Sniped by? 03:41:26.280 --> 03:41:27.320 A lot of things. 03:41:27.340 --> 03:41:27.900 Yeah. 03:41:28.460 --> 03:41:29.180 We'll see how that plays out. 03:41:29.180 --> 03:41:31.280 I get Nerd Sniped by, like, a Rubik's Cube. 03:41:31.280 --> 03:41:31.440 Yeah. 03:41:31.440 --> 03:41:32.780 A good puzzle, maybe. 03:41:32.780 --> 03:41:33.860 Yeah, a good puzzle. 03:41:33.860 --> 03:41:35.380 Maybe something like that. 03:41:35.380 --> 03:41:36.340 That'll do it. 03:41:36.340 --> 03:41:39.540 So we got you 1080p back and going. 03:41:39.540 --> 03:41:49.200 Hopefully, we'll figure out our issue with our HDMI cable, and we'll have much better consistent capture across both team members tomorrow. 03:41:49.360 --> 03:41:51.640 Something about this cable is like it's heating up or something. 03:41:51.640 --> 03:41:56.600 We had several hours of testing last night with no problem, and something's going on now. 03:41:56.600 --> 03:41:58.640 So we'll give that a run. 03:41:58.940 --> 03:42:01.820 And sure enough, I literally just saw a rename solve puzzle. 03:42:01.840 --> 03:42:04.880 So we've renamed this function Solve the Puzzle. 03:42:04.880 --> 03:42:08.560 So what they're looking for, they know it's a puzzle of some sort. 03:42:08.620 --> 03:42:15.100 I'm curious if we get someone just kind of running it and interacting with the binary, or if we're going to do more static analysis. 03:42:16.480 --> 03:42:20.020 But actually, yeah, this should be much higher quality with the full 1080. 03:42:20.420 --> 03:42:22.980 Unfortunately, we don't have even the local recordings. 03:42:23.140 --> 03:42:24.960 We're also not 1080. 03:42:24.960 --> 03:42:26.380 They were only in 720 as well. 03:42:26.380 --> 03:42:28.160 So I apologize for those first couple matches. 03:42:28.740 --> 03:42:35.620 We're not going to have the higher quality video for those either. 03:42:35.620 --> 03:42:42.560 But all 12 other matches from here on out are going to be in high def because we have a lot of these to go. 03:42:42.560 --> 03:42:45.320 So you'll see your favorite players that won in the first couple rounds. 03:42:45.440 --> 03:42:46.440 They're going to come back. 03:42:46.440 --> 03:42:47.980 We're going to see them again. 03:42:49.580 --> 03:42:50.480 Oh, no, that was cool. 03:42:50.560 --> 03:42:52.080 I didn't notice that website. 03:42:52.080 --> 03:42:53.280 Have you seen that one before? 03:42:54.200 --> 03:42:54.560 No. 03:42:54.580 --> 03:42:55.360 I'm curious what that was. 03:42:55.360 --> 03:42:57.060 So now they're on the Ubuntu repo. 03:42:57.480 --> 03:43:00.600 They're getting a particular glibc version, which makes sense. 03:43:00.820 --> 03:43:02.100 That's often common. 03:43:02.100 --> 03:43:06.020 Now, I think for most of these, we included a libc if we thought it was necessary. 03:43:06.200 --> 03:43:06.520 Yes . 03:43:06.680 --> 03:43:08.480 So it's kind of a hint to the teams. 03:43:09.260 --> 03:43:13.700 We're trying to give out everything that we could, make it as self-contained as possible. 03:43:13.920 --> 03:43:18.820 And so we'll see if that one ends up being useful. 03:43:18.820 --> 03:43:20.840 But we've got our binary challenge. 03:43:20.840 --> 03:43:26.680 This one is starting to be a little bit more difficult, though, I would say. 03:43:26.680 --> 03:43:29.820 Our challenge difficulty is cranking up a tiny bit. 03:43:30.260 --> 03:43:33.580 And we're going to see that kind of trend throughout the whole rest of the weekend. 03:43:33.580 --> 03:43:38.000 I'm sure we'll have some easier ones, some that somebody finds an amazing solution to, solves it quickly. 03:43:38.000 --> 03:43:45.420 But on the topic of difficulty, we have an idea of what's more difficult and what's easier and so on. 03:43:45.420 --> 03:43:47.700 But, of course, we can be wrong. 03:43:47.700 --> 03:43:53.100 People can have different specializations in their skill sets and so on. 03:43:53.100 --> 03:43:55.260 So something that we might think is... 03:43:55.260 --> 03:43:56.380 In both directions, right? 03:43:56.440 --> 03:43:57.520 Exactly, yes. 03:43:57.520 --> 03:44:03.320 So something that we might think is easy might be actually kind of tricky and then the other way around. 03:44:03.320 --> 03:44:05.980 So it's going to be interesting to see what's going on. 03:44:05.980 --> 03:44:10.180 There's still some reverse, like the initial reverse engineering going on of the program. 03:44:10.180 --> 03:44:18.120 For example, this kind of step was not really needed in the previous challenge where we just gave them the full source code with names and everything. 03:44:21.320 --> 03:44:23.980 As an organizer, you have a lot of levers to pull. 03:44:24.500 --> 03:44:30.060 It's ironic because we have the organizers here playing, although, unfortunately, they're on our non-capture screen, unfortunately. 03:44:31.560 --> 03:44:33.520 I just had to make sure that we had them lined up right. 03:44:33.520 --> 03:44:34.900 I freaked out for a second not realizing. 03:44:34.900 --> 03:44:36.540 They are the right halves. 03:44:37.440 --> 03:44:40.800 But the team organizers, we're not seeing them. 03:44:40.800 --> 03:44:45.000 But as a challenge organizer, as somebody making challenges, you can strip a binary. 03:44:45.000 --> 03:44:45.820 You can not strip a binary. 03:44:45.820 --> 03:44:47.160 You can include debug symbols. 03:44:48.300 --> 03:44:50.760 Different levels of optimizations. 03:44:50.760 --> 03:44:55.320 Because a lot of optimization also kind of acts as a slight obfuscation. 03:44:55.320 --> 03:44:56.820 Mild obfuscation, yeah. 03:44:57.580 --> 03:45:04.780 We have all seen these optimized mem copies and everything, but you have all this bits magic stuff going on. 03:45:05.320 --> 03:45:08.880 Yeah, you get vector operations in your mem copies. 03:45:10.260 --> 03:45:16.400 And that's where, to some degree, you can make an easy challenge hard with just tedious things. 03:45:16.480 --> 03:45:22.620 So it is interesting that you see a lot of, I would say, cheap challenge design where it's like, yeah, we just made it harder by doing X. 03:45:22.700 --> 03:45:28.160 And it didn't make it more interesting, it just made it slightly more annoying to do the thing that you want. 03:45:28.160 --> 03:45:37.680 So sometimes a really good easy challenge is actually you're just really focusing on that one core thing that you want to do, which makes a lot of fun for what we're doing here. 03:45:37.700 --> 03:45:38.520 Right. 03:45:39.140 --> 03:45:42.460 So still, we mentioned trying to name different things. 03:45:42.460 --> 03:45:47.220 We've seen they name the functions, like solvePuzzle, and you see some variables getting named, like the input. 03:45:48.500 --> 03:45:53.800 It's all trying to get an understanding of what is this program doing. 03:45:54.000 --> 03:45:55.820 And there are kind of two parts to it. 03:45:55.980 --> 03:46:00.200 First of all, what's the intended functionality of the program? 03:46:00.200 --> 03:46:06.240 And then from there, you can start to understand in what way is it acting not as intended? 03:46:06.240 --> 03:46:07.100 Like, where is the bug? 03:46:07.100 --> 03:46:11.620 Or , in this case, where the author intended a bug. 03:46:11.620 --> 03:46:11.980 Right. 03:46:11.980 --> 03:46:14.320 But in the normal case where it's unintended vulnerabilities. 03:46:14.320 --> 03:46:14.600 Yeah, exactly. 03:46:14.600 --> 03:46:17.260 Or in this case, what's the surface level intended? 03:46:17.420 --> 03:46:19.040 What's it claimed to be able to do? 03:46:19.040 --> 03:46:19.520 Yes. 03:46:19.580 --> 03:46:22.820 And then what does it actually do that may be different? 03:46:22.860 --> 03:46:23.540 Right. 03:46:24.140 --> 03:46:26.440 So let's see what we're doing. 03:46:26.440 --> 03:46:28.140 And this is nice, too, because we're actually getting... 03:46:28.140 --> 03:46:30.740 This is the first time we've seen a little reverse engineering workflow. 03:46:30.760 --> 03:46:31.120 Yes. 03:46:31.120 --> 03:46:38.400 A lot of the other ones have been, like, basically a quick glance at the code or disassembly has kind of, like, revealed what's going on. 03:46:38.400 --> 03:46:41.540 Here, they actually need to kind of understand what is going on. 03:46:42.080 --> 03:46:42.440 Okay. 03:46:42.440 --> 03:46:46.560 So we're still sort of starting our framework for our exploit here. 03:46:46.560 --> 03:46:50.140 But I think it's just getting the menus and interacting with it, right? 03:46:50.140 --> 03:46:50.780 And so we're looking. 03:46:50.780 --> 03:46:51.180 Oh, okay. 03:46:51.180 --> 03:46:52.940 So there's a current puzzle state. 03:46:53.280 --> 03:46:53.660 All right. 03:46:54.200 --> 03:46:54.600 So... 03:46:54.600 --> 03:46:54.980 Puzzle. 03:46:54.980 --> 03:46:56.100 That puzzle looked interesting. 03:46:56.100 --> 03:46:58.740 It looked like maybe, like, a 9x9 grid of numbers. 03:46:58.740 --> 03:46:59.180 With numbers. 03:46:59.180 --> 03:46:59.480 Yeah. 03:46:59.480 --> 03:47:01.320 It could be maybe, like, a Sudoku. 03:47:01.340 --> 03:47:03.240 I think that's a great guess. 03:47:03.240 --> 03:47:03.340 Yeah. 03:47:03.340 --> 03:47:06.000 And , of course, you know, we're a little spoiled here, a little tainted knowledge. 03:47:06.000 --> 03:47:07.940 But this is indeed a Sudoku. 03:47:08.300 --> 03:47:14.180 In fact, when somebody was, like, kind of play testing and validating this challenge, we sort of were like, wait a minute. 03:47:14.180 --> 03:47:16.800 You just solved a Sudoku, and that's it? 03:47:16.800 --> 03:47:18.580 And the author was like, no, no, no, no, no. 03:47:19.060 --> 03:47:21.600 And that's not actually possible. 03:47:22.000 --> 03:47:23.760 So it is a little bit trickier than that. 03:47:23.760 --> 03:47:30.940 So we'll see as our teams discover it's not just a straight put it into a Sudoku solver, get a correct answer, and win. 03:47:31.280 --> 03:47:32.880 It is going to be a little bit more tricky. 03:47:32.880 --> 03:47:37.120 And this is one I am almost positive we're going to need a hint on. 03:47:37.140 --> 03:47:37.440 Right. 03:47:37.440 --> 03:47:42.760 So I'm going to propose at, like, 15 minutes in, if we don't see... 03:47:43.840 --> 03:47:44.800 Like, progress. 03:47:44.800 --> 03:47:45.300 Progress. 03:47:45.300 --> 03:47:48.040 In fact, actually, why don't you go ahead and take a look at the organizers, maybe, too. 03:47:48.040 --> 03:47:49.140 Yes, I will do that. 03:47:49.140 --> 03:47:53.540 And if we're looking for them to kind of have a hint as to what they're doing. 03:47:53.540 --> 03:47:55.040 Like, indicate that they know what they're doing. 03:47:55.760 --> 03:47:56.360 Yeah. 03:47:56.360 --> 03:47:56.940 Yeah. 03:47:57.580 --> 03:47:58.500 Oh, does it come on occasionally? 03:47:58.500 --> 03:47:59.120 Okay. 03:47:59.360 --> 03:48:00.900 So it's apparently flickering in and out. 03:48:00.900 --> 03:48:03.320 Occasionally we're getting our video. 03:48:03.700 --> 03:48:05.400 We swapped out the capture card. 03:48:05.400 --> 03:48:07.560 That worked for a while until it didn't. 03:48:07.560 --> 03:48:09.560 And then we swapped out the USB-C cable. 03:48:09.560 --> 03:48:11.040 And that worked for a while until it didn't. 03:48:11.180 --> 03:48:16.080 And so now we're convinced that it's just the HDMI cable itself that is causing trouble. 03:48:16.080 --> 03:48:19.460 And I think this has been true even if we were direct wired into the laptop. 03:48:19.540 --> 03:48:22.300 So it's not the capture on the other side. 03:48:22.680 --> 03:48:26.600 Yes, because we also did swap out the USB-C adapter once, too. 03:48:26.620 --> 03:48:30.040 So we swapped every component except the HDMI cable. 03:48:31.560 --> 03:48:34.720 Partly because they're, like, taped to the floor and they're a 30-foot long cable. 03:48:34.720 --> 03:48:35.620 So we've got to go and get some... 03:48:35.620 --> 03:48:36.160 Oh, there we go. 03:48:36.160 --> 03:48:36.800 I saw a... 03:48:36.800 --> 03:48:39.200 I did see a solver pop up briefly. 03:48:39.200 --> 03:48:40.080 I saw a Sudoku solver. 03:48:40.080 --> 03:48:46.500 Yeah , I was just going to say, also, the player from the organizers copy-pasted the current state of the puzzle into... 03:48:46.500 --> 03:48:48.560 And they Googled for a Sudoku solver. 03:48:49.160 --> 03:48:52.380 So we'll see to what extent that will help them. 03:48:54.180 --> 03:48:59.080 Again, I'm not completely familiar with the intended solution here. 03:48:59.080 --> 03:49:07.040 But I would assume that it still involves solving the Sudoku, but not only doing that. 03:49:07.040 --> 03:49:08.880 It is trickier than that. 03:49:08.880 --> 03:49:09.960 Yeah, that's right. 03:49:09.960 --> 03:49:12.900 So I have a little bit more info. 03:49:12.900 --> 03:49:19.560 Yeah, we're still seeing that kind of solver flashing in and out occasionally on the display. 03:49:22.020 --> 03:49:24.040 There's going to be some memory corruption here. 03:49:24.100 --> 03:49:24.780 There is indeed. 03:49:24.780 --> 03:49:25.400 This is not just... 03:49:25.400 --> 03:49:31.400 Now, although I will say, it is actually a perfectly valid category of challenge in a lot of CTFs, right? 03:49:31.400 --> 03:49:35.400 Where you would actually do have a more programming challenge or a puzzle. 03:49:35.400 --> 03:49:36.480 That happens. 03:49:36.480 --> 03:49:42.460 And I think, honestly, even in moderation, I think those can be fun and enjoyable mixed in amongst a traditional happy competition. 03:49:42.460 --> 03:49:45.920 Yeah, typically they are branded as PPC. 03:49:45.920 --> 03:49:52.440 It's the category in normal CTFs, which I think is like professional programming challenge or something like this. 03:49:52.700 --> 03:49:59.540 People familiar with like, you know, ICPC style algorithms competitions or so might find. 03:49:59.540 --> 03:50:03.440 Although usually they're kind of like framed slightly differently. 03:50:03.460 --> 03:50:07.120 But it's kind of like the same general idea there. 03:50:07.120 --> 03:50:09.720 Yeah, and there's no security flaw. 03:50:09.720 --> 03:50:18.040 There's really just rather solving some hard mathematical problem with the right algorithm or with the right approach to kind of get it working. 03:50:18.280 --> 03:50:19.980 But that's not the case here. 03:50:19.980 --> 03:50:22.940 There's an aspect of that, but that's not enough. 03:50:22.940 --> 03:50:25.060 This is truly a point of all. 03:50:25.060 --> 03:50:26.860 There is memory corruption involved. 03:50:27.780 --> 03:50:34.060 Although I will say, and I'm looking to see if somebody finds the sort of like win function. 03:50:34.060 --> 03:50:40.340 When you have a correct solve Sudoku, I think we're going to see... 03:50:40.340 --> 03:50:52.360 So this function here, they've named it check, returns whether or not we've successfully calculated a value, a valid solve. 03:50:52.780 --> 03:50:57.840 The result of that is going to determine basically what you call a win function. 03:50:57.840 --> 03:50:59.860 So it is going to kind of do the win for you. 03:51:00.060 --> 03:51:02.880 So you already sort of know that you have to solve it. 03:51:02.880 --> 03:51:06.340 Your question is, okay, what mechanic will actually get me to solve it? 03:51:06.340 --> 03:51:07.480 And can I cheat it? 03:51:07.480 --> 03:51:09.600 Do I have to have a combination of a solver plus a cheat? 03:51:09.600 --> 03:51:12.080 What is that ratio going to entail? 03:51:12.080 --> 03:51:16.580 Because at face value, it kind of looks like you just solve the Sudoku and you win. 03:51:17.100 --> 03:51:25.740 But you know, like DEF CON finals, even being a sort of easy live CTF, I would think people would be like, no, wait a minute, there's something here. 03:51:25.740 --> 03:51:27.940 And I think if you can also... 03:51:27.940 --> 03:51:31.580 There's not a lot of values here. 03:51:31.580 --> 03:51:33.000 And so I don't know. 03:51:33.700 --> 03:51:38.580 I think the idea is that these are just not solvable because there's not enough information. 03:51:38.620 --> 03:51:41.600 Some Sudoku balls are very minimal, but they're designed to be solved. 03:51:41.680 --> 03:51:43.000 They're made to be solvable. 03:51:43.000 --> 03:51:49.800 I think I remember that if you have 13 digits, you're guaranteed to have a unique solution. 03:51:54.050 --> 03:51:55.870 Okay, so this one definitely has more than that. 03:51:55.870 --> 03:51:58.710 But there's going to be some other issues with it still. 03:51:58.710 --> 03:52:00.750 I'm not sure if my trivia is correct here. 03:52:00.750 --> 03:52:04.790 I vaguely remember, like, if you have 13 digits, you have a unique solution. 03:52:04.790 --> 03:52:08.090 You can have a unique solution with fewer digits, but it's not guaranteed. 03:52:08.090 --> 03:52:11.950 I don't know that that's true because I can just give you all of the ones, for example. 03:52:12.610 --> 03:52:13.910 But that's just nine. 03:52:14.330 --> 03:52:15.810 And all the twos. 03:52:15.970 --> 03:52:19.070 And that doesn't give you enough information to know where all the other numbers are. 03:52:22.530 --> 03:52:23.090 Maybe. 03:52:23.090 --> 03:52:27.350 Maybe it's 21 or something then. 03:52:27.910 --> 03:52:29.110 There is a number. 03:52:29.110 --> 03:52:33.750 Where is our cracking the cryptic phone of friends? 03:52:33.790 --> 03:52:36.510 And go to the YouTube stream. 03:52:36.750 --> 03:52:38.430 Yeah, great channel. 03:52:38.430 --> 03:52:39.350 So here we go. 03:52:39.350 --> 03:52:41.810 We're seeing Sudoku solver Python. 03:52:41.810 --> 03:52:43.450 So we're seeing people investigate that. 03:52:43.450 --> 03:52:46.010 All right, we are now 15 minutes in. 03:52:46.050 --> 03:52:48.070 I think we should be preparing our hint. 03:52:48.070 --> 03:52:50.730 Because I actually think this one is a little too subtle. 03:52:50.730 --> 03:52:56.190 And we're going to have to point them in the right direction without actually giving them the hint. 03:52:56.190 --> 03:53:04.290 Yeah, and we should notice now that even though the time is 24, we started late because of technical difficulties. 03:53:04.290 --> 03:53:06.570 So they are only 15 minutes into the challenge. 03:53:06.570 --> 03:53:07.010 Correct. 03:53:07.010 --> 03:53:14.470 So we have more time than the clock looks like compared to the other ones where we started much closer to on time. 03:53:14.550 --> 03:53:17.210 So we're trying a solver. 03:53:17.210 --> 03:53:21.630 Again, so trying a solver on here, which is not going to be sufficient. 03:53:21.630 --> 03:53:26.410 So I think we need to figure out if there is an official hint from the challenge author. 03:53:26.790 --> 03:53:35.570 So we've got Glen over in the production booth, as it were, which is otherwise known as the other side of the table that we're sitting on here. 03:53:35.570 --> 03:53:36.310 Yeah. 03:53:37.030 --> 03:53:40.490 It's going to reach out and see if we have an official... 03:53:40.490 --> 03:53:45.710 We have like three times the number of computers compared to the number of crew members for this setup. 03:53:45.710 --> 03:53:53.650 We have a lot of displays and, I mean, an order of magnitude more cables, I think, than... 03:53:53.650 --> 03:53:55.690 Yeah, but it's... 03:53:55.690 --> 03:54:00.490 And once we find out what is breaking our secondary capture... 03:54:00.490 --> 03:54:03.270 Actually, speaking of which, I'm going to go ahead and take a look at the organizers. 03:54:03.270 --> 03:54:11.030 I want to see if they're making progress while we figure out what we're doing with that hint, if we're going to give it. 03:54:11.230 --> 03:54:15.210 And if you guys have any questions about where we're going, let us know. 03:54:15.210 --> 03:54:15.750 Yep. 03:54:15.790 --> 03:54:17.870 And I'll be back with an update. 03:54:17.870 --> 03:54:18.790 Great. 03:54:18.810 --> 03:54:28.630 So while Jordan does that, we can try to see that we... 03:54:28.630 --> 03:54:37.010 Okay, so I've just been informed that the puzzle that you were given is impossible to solve. 03:54:37.010 --> 03:54:38.470 That's kind of the trick here. 03:54:38.470 --> 03:54:44.050 So at face value, everything looks fine, you just need to solve this Sudoku, but actually there is no solution. 03:54:44.050 --> 03:54:47.290 This is an invalid state for the Sudoku. 03:54:48.810 --> 03:54:50.330 So once they... 03:54:50.330 --> 03:54:52.490 And this is something that can really throw you off, right? 03:54:52.490 --> 03:55:06.630 Because if you take this and you put it into a solver or something, and the solver says, like, no, there's no solution, you might be starting to think, like, maybe the solver has a bug, or maybe the format of my input is wrong, or something like this. 03:55:07.630 --> 03:55:13.830 And only later you might question the impossibility of the puzzle. 03:55:13.890 --> 03:55:24.050 So this is where they have to then cheat to solve the impossible Sudoku to then get this win function. 03:55:25.010 --> 03:55:37.510 We can see here on the Battlezone screen that they are looking still at the kind of decompilation here, thinking hard about this. 03:55:39.170 --> 03:55:42.490 Trying to figure out, like, what is going on here? 03:55:42.490 --> 03:55:44.190 Like, why is this not working? 03:55:45.810 --> 03:55:49.010 They have this... it's this check function, right? 03:55:49.730 --> 03:55:56.410 So they're trying to think about, like, in what way does this function not behave correctly, maybe? 03:55:56.410 --> 03:56:01.250 Maybe they have realized that, like, you're given an impossible puzzle. 03:56:02.470 --> 03:56:05.110 So, let's see, they're going to try to... 03:56:05.110 --> 03:56:08.510 Seems like they're writing, like, a small, like, formatting function. 03:56:08.510 --> 03:56:14.150 They're looping through, like, the X and Y axes and printing something. 03:56:15.410 --> 03:56:16.490 So, yeah. 03:56:19.370 --> 03:56:23.790 Still unsure exactly where they're going with that, but let's see here how they run it. 03:56:24.070 --> 03:56:29.470 So , a quick update is, both teams are taking the sort of wrong approach now, and they're still looking for solves. 03:56:29.470 --> 03:56:33.010 So, the hint they're both going to get is, you can't win, you need to cheat. 03:56:33.690 --> 03:56:34.410 Right. 03:56:35.570 --> 03:56:41.250 Which is... almost feel like there's some kind of deeper philosophical thing here. 03:56:41.250 --> 03:56:43.290 I mean, it's a true life statement, probably. 03:56:43.570 --> 03:56:43.890 Yeah. 03:56:45.490 --> 03:56:46.150 Yeah. 03:56:47.350 --> 03:56:47.630 It's... 03:56:50.710 --> 03:56:54.110 Yeah, I had a lot of thoughts about that, but let's not go too off topic. 03:56:54.110 --> 03:56:54.870 Too deep. 03:56:55.050 --> 03:56:55.450 Yeah. 03:56:56.130 --> 03:56:57.070 I, you know... 03:56:57.070 --> 03:56:57.910 So, here's the other question. 03:56:57.910 --> 03:56:59.950 Do we want to give them a little bit more of a hint? 03:57:00.710 --> 03:57:04.050 Do we want to tell them exactly kind of how, like, more of a hint as to what they want to check? 03:57:04.050 --> 03:57:05.090 I think we have time, right? 03:57:05.090 --> 03:57:06.010 No , no, we have time. 03:57:06.090 --> 03:57:07.030 Let's do that. 03:57:07.410 --> 03:57:09.230 And, yeah. 03:57:09.250 --> 03:57:10.250 In fact... 03:57:10.250 --> 03:57:11.650 Well, that's too late now. 03:57:12.130 --> 03:57:21.930 I mean, I was thinking in terms of, like, since this is the last match of the day, we could have afforded, like, you know, extending the standard game time. 03:57:21.930 --> 03:57:22.450 Yeah, but... 03:57:22.450 --> 03:57:24.270 But I don't know if it's fair to do that once... 03:57:24.270 --> 03:57:26.350 Well, we do it to the same two players. 03:57:26.350 --> 03:57:28.990 Either way, it's only fair relative to each other. 03:57:29.190 --> 03:57:30.250 Because every match is different. 03:57:30.250 --> 03:57:32.730 Different challenges, different conditions, and so to some degree... 03:57:32.730 --> 03:57:33.210 Right , right. 03:57:33.210 --> 03:57:34.270 So, that doesn't matter. 03:57:34.270 --> 03:57:35.170 You could argue that it's fair, but... 03:57:35.170 --> 03:57:38.770 But let's see, you can't win, you need to cheat, you need memory corruption. 03:57:38.830 --> 03:57:39.490 Yes. 03:57:44.030 --> 03:57:46.590 It's dangerous to go alone, like, take this memory corruption. 03:57:46.590 --> 03:57:49.130 Yeah , it's dangerous to go alone, take this memory corruption. 03:57:49.130 --> 03:57:49.990 I love it. 03:57:53.350 --> 03:57:56.170 Alright, here goes the first hint. 03:57:56.190 --> 03:57:56.970 Yes. 03:57:57.170 --> 03:58:01.490 We'll see if this gets them on the right track again, or if we need to... 03:58:01.490 --> 03:58:06.310 In the meantime, I'm trying to decipher what this script is doing. 03:58:06.310 --> 03:58:11.170 They have a solve function there, which then will not really help them, since you can't solve this. 03:58:14.070 --> 03:58:14.430 It's... 03:58:16.430 --> 03:58:20.970 Yeah, it's still a little bit unclear where the players are in this. 03:58:21.150 --> 03:58:23.370 Unfortunately, we can't read the minds of the players. 03:58:23.370 --> 03:58:26.430 That would be immensely helpful when doing this type of commentary. 03:58:26.430 --> 03:58:29.250 We can just try to guess based on what we're seeing on the screen. 03:58:30.730 --> 03:58:36.470 Yeah, again, if you have any questions or comments from all of you watching this... 03:58:36.470 --> 03:58:37.230 I got some smiles. 03:58:37.230 --> 03:58:41.570 I wish you all could have seen it, but there was like, oh yeah, of course, okay, okay. 03:58:41.570 --> 03:58:47.630 So they were both going down the solver approach, so I think we're going to see a lot more IDA now. 03:58:47.630 --> 03:58:48.050 Right. 03:58:48.150 --> 03:58:52.610 We're going to see them actually dig into the binary and follow it that way. 03:58:54.030 --> 03:59:02.710 So that's nice to hear, that the hint was appropriately leveled and that it was useful to the players. 03:59:02.730 --> 03:59:06.350 Yeah, I think they both were at a spot where it's going to help both of them. 03:59:06.670 --> 03:59:10.490 We'll see if either one starts to take advantage of that or not. 03:59:10.490 --> 03:59:13.530 So we're looking at checksec, we're looking at the binary properties. 03:59:13.570 --> 03:59:16.410 And that's actually a great habit to be into. 03:59:16.410 --> 03:59:18.130 I really think that a lot of people overlook that. 03:59:18.130 --> 03:59:27.170 Again , we saw that last one with the mallard, with the ducks, where it not being randomized, I think added a little bit of extra slowdown there. 03:59:27.170 --> 03:59:28.570 Right, yes, definitely. 03:59:28.690 --> 03:59:30.670 Because you could have gone straight into... 03:59:31.630 --> 03:59:35.070 I think I have this as a pretty good habit. 03:59:35.170 --> 03:59:38.090 Always run file, always run checksec. 03:59:39.730 --> 03:59:44.030 It's kind of like when you're doing reversing engineering challenges. 03:59:44.030 --> 03:59:46.530 Always run strings, always binwalk. 03:59:46.730 --> 03:59:50.630 Just out of habit, it's just the things that you do. 03:59:51.350 --> 03:59:52.930 Alright, so let's watch this. 03:59:52.930 --> 03:59:56.150 Okay, so now we're seeing them actually where we want them. 03:59:56.150 --> 03:59:57.950 Now they're back to reverse engineering. 03:59:58.110 --> 03:59:59.810 They're looking for vulnerabilities. 04:00:00.750 --> 04:00:05.410 And what they're going to do is they're going to use the vulnerability to win. 04:00:05.410 --> 04:00:13.770 They're going to use the memory corruption to not code execution directly, but to the win state. 04:00:13.770 --> 04:00:18.050 So what they're going to do is they're going to need to corrupt in such a way that they can create a solved board. 04:00:18.050 --> 04:00:19.670 And they should hopefully still remember this, right? 04:00:19.670 --> 04:00:21.830 Because they know that the point was to win. 04:00:21.830 --> 04:00:22.470 They saw that. 04:00:22.470 --> 04:00:23.950 They saw the win state. 04:00:23.950 --> 04:00:26.210 They saw that's why they were trying to solve the puzzle. 04:00:26.470 --> 04:00:27.970 So I think they know that. 04:00:28.090 --> 04:00:35.210 The question is, are they going to be able to figure out the memory corruption in time? 04:00:35.210 --> 04:00:36.650 So that's the question that we're looking for. 04:00:36.650 --> 04:00:38.030 And this is kind of interesting, I think. 04:00:38.030 --> 04:00:46.430 This type of pwnable where, like a lot of pwnables, you have kind of this standard workflow where you try to gain control of certain aspects of memory. 04:00:46.430 --> 04:00:46.610 Yeah , yeah. 04:00:47.090 --> 04:00:48.470 It's a pointer overwrite. 04:00:48.470 --> 04:00:50.050 Or it's something that gets you a memory write. 04:00:50.050 --> 04:00:51.250 So you get a pointer overwrite. 04:00:51.250 --> 04:00:53.230 To a ROP chain, to like, you know. 04:00:54.010 --> 04:00:58.110 But here you're just doing kind of like, maybe we call it like a local memory corruption. 04:00:58.290 --> 04:01:03.490 Or it's not quite a logic vulnerability in that it is memory corruption, but it's not useful. 04:01:03.490 --> 04:01:06.710 It's not being used for control flow hijacking. 04:01:06.710 --> 04:01:11.550 You're using it specifically to just change the state and change the behavior. 04:01:11.550 --> 04:01:17.490 Yeah, the functionality through its normal legitimate means, but by entering a memory state that it didn't intend for you to enter. 04:01:17.490 --> 04:01:17.830 Right. 04:01:17.830 --> 04:01:25.130 So in a lot of these cases, the program wouldn't crash, for example, if the exploit is slightly wrong. 04:01:25.130 --> 04:01:27.190 Yeah, you just failed to get a correct puzzle. 04:01:27.190 --> 04:01:28.250 It's just not solved, right? 04:01:28.250 --> 04:01:28.690 Yeah . 04:01:29.150 --> 04:01:32.890 Which is not to say that they couldn't crash with this vulnerability necessarily. 04:01:32.890 --> 04:01:34.650 It depends on how it's actually constructed. 04:01:35.010 --> 04:01:44.670 But there are certainly use cases, or there are cases where an exploit isn't actually exploitable in the direct code execution state. 04:01:44.670 --> 04:01:49.470 It is rather just by exercising some other logical state of the program. 04:01:49.470 --> 04:01:59.890 And I think, in general, everything we say here about pwnables and general ideas, there are a lot of ifs and buts and stuff to all of these exceptions. 04:02:00.370 --> 04:02:05.530 We're trying to make some broad strokes here about different types of challenges. 04:02:06.830 --> 04:02:07.950 I'm a little nervous. 04:02:07.950 --> 04:02:11.450 This one feels like the first one we might have to unleash a sudden death. 04:02:11.450 --> 04:02:12.430 I'm hoping we don't. 04:02:12.430 --> 04:02:12.870 Right . 04:02:12.930 --> 04:02:18.730 And I like the challenge because, like we were talking about, I think it has that good twist. 04:02:19.030 --> 04:02:24.630 You're going to not get a pointer overwrite, but you're going to influence the state of the binary. 04:02:24.630 --> 04:02:25.890 So I'm hoping. 04:02:25.890 --> 04:02:29.510 And we've seen great work from all the teams so far. 04:02:29.510 --> 04:02:31.290 So we know we have high-quality people. 04:02:32.110 --> 04:02:33.810 We'll see how it's going. 04:02:35.090 --> 04:02:37.690 This is also, I say, one of the larger binaries. 04:02:37.690 --> 04:02:40.810 We all get very small binaries, very, very self-contained. 04:02:40.810 --> 04:02:41.750 This one's a little bigger. 04:02:41.750 --> 04:02:46.830 It's still, I think, small on the CTF scale of things, which in CTF is smaller than real-world binaries. 04:02:46.830 --> 04:02:47.210 Oh, yeah. 04:02:47.210 --> 04:02:51.670 But relative to the live CTF binaries, this is larger than some of them. 04:02:52.830 --> 04:02:57.910 Yeah, luckily they don't have to sift through a 300 megabyte binary. 04:02:57.910 --> 04:02:58.470 What ? 04:02:58.510 --> 04:03:02.910 Who doesn't love sorting out massive binaries? 04:03:02.910 --> 04:03:08.570 Yeah , I think I remember opening the Minecraft binary in IDA at some point. 04:03:08.870 --> 04:03:12.970 Then I went to bed and continued the day after. 04:03:12.970 --> 04:03:17.930 No, I think it was just barely finished, but it took eight or nine hours to analyze that. 04:03:18.530 --> 04:03:24.910 Big binary or even obfuscated binaries can take a long time to analyze for sure. 04:03:24.910 --> 04:03:26.970 All right, here we go. 04:03:26.970 --> 04:03:27.630 So let's look. 04:03:27.630 --> 04:03:29.690 We're seeing an int64 int. 04:03:31.410 --> 04:03:34.910 So making sure the types are correct. 04:03:36.110 --> 04:03:37.570 That's good. 04:03:37.570 --> 04:03:41.490 I think analyzing the types is useful. 04:03:41.490 --> 04:03:49.470 Although what I will say is that just looking at decompiled code is maybe not the best way to analyze any kind of type issues, right? 04:03:49.470 --> 04:03:55.390 No, I think it's a good start to give you the big picture. 04:03:57.250 --> 04:04:00.470 But then at some point you might have to drill down on things. 04:04:00.470 --> 04:04:05.070 And I think this is also kind of interesting again with different types of pwnable challenges. 04:04:05.330 --> 04:04:10.710 Some pwnable challenges like the bug is obvious and the exploitation is difficult. 04:04:10.810 --> 04:04:17.010 And then you have these more like reversing heavy pwnables where you have to figure out very complex data structure. 04:04:17.010 --> 04:04:21.170 But once you have kind of sorted everything out, the bug just like appears. 04:04:21.630 --> 04:04:24.390 And then from there it's typically not that hard. 04:04:24.430 --> 04:04:34.470 And I think our previous examples, several of our previous challenges were more on the side of like it's obvious where the bug was but actually landing it was sort of the tricky part. 04:04:34.470 --> 04:04:37.370 Like we just let you run syscalls, but which ones? 04:04:37.370 --> 04:04:38.210 That's the tricky part. 04:04:38.210 --> 04:04:40.250 Like actually your payload, the execution. 04:04:40.390 --> 04:04:41.750 Same thing with like not coding. 04:04:41.750 --> 04:04:42.890 Like we just ran your bytes. 04:04:42.890 --> 04:04:44.250 Sort of you had to like do that. 04:04:44.250 --> 04:04:49.430 I think there's those sort of like shell coding heavy and those sort of like constrained environments are some of my favorite challenges. 04:04:49.790 --> 04:04:56.910 Probably because I'm just bad at the more, I don't want to say tedious, but the more in-depth long-term reversing engineering. 04:04:57.230 --> 04:04:57.430 Right , complex . 04:04:57.930 --> 04:05:01.890 So I mean, I'm more of a reverse engineer myself, so I like those things. 04:05:01.890 --> 04:05:08.630 But then, for example, when you get to these complex heap exploitation things, then I'm completely out of luck there. 04:05:08.630 --> 04:05:12.050 Well, there's always just kind of familiarity and experience with it. 04:05:12.050 --> 04:05:18.570 One of the things I was going to mention, and I say this, that I don't do the reversing heavy ones as an author of a reverse engineering tool. 04:05:18.570 --> 04:05:20.410 Well, maybe that's why you built the tool, right? 04:05:20.410 --> 04:05:23.130 Well, that's also why I have coworkers who are much better than I am. 04:05:23.130 --> 04:05:25.310 That's the other, I highly recommend that approach. 04:05:27.150 --> 04:05:42.310 But one of the things that I was going to comment on is that I like, one of the things that Ghidra I think really does well, that a lot of, both Ida and Binja have actually changed as a result, is their side-by-side view. 04:05:42.310 --> 04:05:49.790 Having the synchronized side-by-side decouplation with this assembly, I think was a really important improvement in the standard workflow. 04:05:50.090 --> 04:05:55.490 And so now you'll see Ida and Binja both have much better split-pane, synchronization, those kind of workflows. 04:05:55.490 --> 04:06:02.270 Very much inspired, I mean, I assume Ilfac also was inspired and was like, oh yeah, I like the way that Ghidra does that too. 04:06:02.270 --> 04:06:06.450 But certainly from Binja's perspective, we definitely did that as well. 04:06:07.170 --> 04:06:09.090 So I do think it's good seeing difference. 04:06:09.090 --> 04:06:10.650 Oh, here we go, we've got... 04:06:10.650 --> 04:06:12.250 Is that the same? 04:06:12.250 --> 04:06:13.710 That's just the same screen. 04:06:14.210 --> 04:06:15.490 But we are... 04:06:15.490 --> 04:06:18.090 So they're looking at libc... 04:06:19.250 --> 04:06:23.210 trying to download the appropriate libc version, right? 04:06:23.210 --> 04:06:33.370 So they're using this web page where you can put in offsets for different functions to like... 04:06:33.370 --> 04:06:34.490 To match up with... 04:06:34.490 --> 04:06:38.330 Yeah, like fingerprint the libc version and then download it. 04:06:38.330 --> 04:06:45.030 But sometimes I think you need like two offsets and then it will match to which version of libc is running. 04:06:45.050 --> 04:06:52.990 So again, when we're building these challenges, if we don't think they need libc, we're not providing it. 04:06:52.990 --> 04:06:54.790 Now, that's not true in all competitions though. 04:06:54.790 --> 04:06:57.890 So they may not trust us yet. 04:06:57.890 --> 04:06:59.030 I think this is like... 04:06:59.630 --> 04:07:05.710 It is a convention among, I would say, experienced organizers within this. 04:07:05.710 --> 04:07:12.190 Right, because why make that an extra tedious step that is just mechanical and you just go to the... 04:07:12.190 --> 04:07:13.150 We all know about the website. 04:07:13.150 --> 04:07:13.890 We all know how you would do that. 04:07:13.890 --> 04:07:24.350 However, if you come up with a solution that's different than the intended one, you might have a solution which does require libc and then you might go this route anyway. 04:07:24.730 --> 04:07:26.810 Yeah, so it's not necessarily bad. 04:07:26.810 --> 04:07:27.710 It is just... 04:07:27.710 --> 04:07:30.510 It should be a hint that maybe you're not taking the intended route. 04:07:30.510 --> 04:07:30.890 Right. 04:07:31.010 --> 04:07:35.790 Doesn't mean that you're wrong, but you might be venturing into unknown territory. 04:07:35.790 --> 04:07:39.710 All right, so let's be thinking about our next hint, because like I said, I'm a little concerned. 04:07:39.710 --> 04:07:41.270 We might need to do a different one. 04:07:42.330 --> 04:07:46.850 I don't know, triple-tap control and get the spoken dictation pop-up. 04:07:48.050 --> 04:07:49.610 I'm going to go... 04:07:49.610 --> 04:07:52.050 Oh, nope, there's somebody else in the background excited about something. 04:07:52.050 --> 04:07:52.390 Yeah. 04:07:52.390 --> 04:07:55.370 I thought for a second we had a surprise win off-screen. 04:07:55.530 --> 04:07:58.770 I'm going to go ahead and check in with... 04:08:00.650 --> 04:08:01.330 Organizers is... 04:08:03.030 --> 04:08:05.530 Organizers is unfortunately not being captured. 04:08:06.050 --> 04:08:07.750 So we're kind of in the dark there. 04:08:08.070 --> 04:08:09.570 So I'm going to see if I can get a little bit more of an insight. 04:08:09.570 --> 04:08:12.410 Hopefully we're making good progress there and I can come back with a little bit of an update. 04:08:12.590 --> 04:08:13.130 Yep. 04:08:13.930 --> 04:08:18.210 And then maybe then go ahead with some hints based on current status. 04:08:19.080 --> 04:08:20.810 So, yeah. 04:08:20.810 --> 04:08:29.570 Again, they're looking at figuring out libc versions or downloading an Ubuntu image. 04:08:29.570 --> 04:08:32.690 I'm not entirely sure what's going on there. 04:08:33.070 --> 04:08:34.650 But, yeah. 04:08:36.130 --> 04:08:41.930 We'll see if we can manage to see in what direction they're going with this. 04:08:45.290 --> 04:08:46.490 But, yeah. 04:08:51.530 --> 04:09:00.010 It would be very interesting to see if they have figured out where this check function is going on. 04:09:00.030 --> 04:09:02.830 Unfortunately, I don't have the reference solution. 04:09:02.830 --> 04:09:08.450 So I'm not super familiar with exactly where it's doing something incorrect. 04:09:08.450 --> 04:09:12.010 But, yeah. 04:09:12.010 --> 04:09:18.790 It's also going to be interesting to hear what the organizers are up to if they have good progress. 04:09:18.790 --> 04:09:22.110 So we're also kind of a little bit in the dark on that. 04:09:22.190 --> 04:09:29.510 But, hopefully, I think we are going to give them a hint. 04:09:29.510 --> 04:09:33.370 I see Jordan and Ben are discussing a little bit. 04:09:33.370 --> 04:09:39.310 But what's the exact hint that we want to give them here to point them in the right direction? 04:09:44.290 --> 04:09:54.870 You can see here in the lower corner, from time to time, we have the organizers' screen flickering in and out. 04:09:55.030 --> 04:09:58.090 Unfortunately, that's the tech situation right now. 04:09:59.710 --> 04:10:06.570 In the meantime, I can give you a little bit of an update on the combined scoreboard for the DEFCON CTF. 04:10:06.570 --> 04:10:11.190 We have still a fairly tight race. 04:10:11.190 --> 04:10:22.570 We have a span of about 18,000 points for the leaders, Katsubin, down to 14,000 points for the team in 16th place. 04:10:23.870 --> 04:10:31.690 Everyone is definitely still in the game, with top three being Katsubin, MMM and Perfect Roots. 04:10:31.690 --> 04:10:39.490 And they are all within less than some percent or so of each other. 04:10:39.490 --> 04:10:43.190 Or maybe like 10% of each other. 04:10:43.670 --> 04:10:48.550 Definitely a good competition there. 04:10:49.450 --> 04:10:53.210 So, Jordan is coming back here. 04:10:53.210 --> 04:10:54.150 So what's the status? 04:10:54.150 --> 04:10:55.570 What's the organizers doing? 04:10:55.570 --> 04:10:56.710 We're going to need some hints. 04:10:56.710 --> 04:10:58.010 They're both still looking. 04:10:58.010 --> 04:10:59.250 I don't see any kind of progress. 04:10:59.250 --> 04:11:00.650 So , we're going to drop a hint. 04:11:02.190 --> 04:11:03.610 There's a couple of hints we considered. 04:11:03.610 --> 04:11:05.250 One is, have you considered fuzzing? 04:11:05.570 --> 04:11:14.730 Because literally just sending in a bunch of bytes will actually overwrite your game state. 04:11:14.910 --> 04:11:16.810 So that's the key thing they need to figure out. 04:11:16.810 --> 04:11:21.690 If they send in just too big of a solution, it will actually corrupt the state. 04:11:21.770 --> 04:11:23.090 And they'll get weird boards. 04:11:23.250 --> 04:11:27.010 And then it's a matter of, okay, how do I now create a board that would be solvable? 04:11:27.390 --> 04:11:29.150 So, one that we considered. 04:11:29.190 --> 04:11:34.830 The other one was, don't let yourself be boxed in to your solution. 04:11:34.830 --> 04:11:35.690 It's a Sudoku puzzle. 04:11:35.690 --> 04:11:37.490 That's a little probably more obscure. 04:11:37.490 --> 04:11:43.610 So , I think we're going to go with just, how big is your solution again? 04:11:43.750 --> 04:11:45.150 Or how many bytes is your solution? 04:11:45.950 --> 04:11:47.590 As our next hint. 04:11:47.590 --> 04:11:49.990 And I think we're going to give them that, because there's still some work to be done. 04:11:50.170 --> 04:11:53.350 And we want to give them both a shot at getting it. 04:11:53.590 --> 04:11:54.990 Otherwise, we're going to go to our sudden death. 04:11:54.990 --> 04:11:56.790 So, that's the hint we're going to go with. 04:11:56.990 --> 04:11:59.710 In the meantime, we had a comment here from KigEff. 04:12:00.410 --> 04:12:01.930 These seem interesting C challenges. 04:12:01.930 --> 04:12:04.230 I think I would try them all, but I'm sure I would take a lot longer. 04:12:04.230 --> 04:12:05.890 I would too, so that's okay. 04:12:05.890 --> 04:12:14.410 But it is a good idea, in general for CTFs, to try out challenges after they've been solved. 04:12:14.410 --> 04:12:18.290 Normally, for a lot of CTFs, people publish write-ups. 04:12:18.370 --> 04:12:22.330 So, you can try the challenges that you didn't manage to solve. 04:12:22.590 --> 04:12:29.450 And then use a write-up or so as a reference and guide your attempt as well to learn more. 04:12:30.230 --> 04:12:33.310 I think the idea is that we are releasing all the challenges. 04:12:33.310 --> 04:12:37.290 It might take a few days for us to recover from this weekend. 04:12:37.290 --> 04:12:44.550 We have 15 matches, so another 11 matches to go after this one. 04:12:44.990 --> 04:12:47.890 But yeah, we will definitely publish them. 04:12:48.550 --> 04:12:58.670 You can even organize your own mini-tournament in your own CTF team or hacker space. 04:12:59.310 --> 04:13:07.730 I know that I heard from before the competition that Shellfish actually did some practice for this tournament. 04:13:08.070 --> 04:13:13.890 By doing a small mini-competition of their own within the team, which I think is really cool. 04:13:13.890 --> 04:13:14.970 And it paid off. 04:13:14.970 --> 04:13:16.630 At least it appears it paid off. 04:13:16.650 --> 04:13:18.890 As one of the winning teams. 04:13:18.970 --> 04:13:20.730 Yeah, we'll see how far they can go. 04:13:22.470 --> 04:13:24.530 So, we have the hints prepared. 04:13:24.530 --> 04:13:27.230 Jordan is going to go and hand that off to the players. 04:13:28.170 --> 04:13:30.210 We are... what's the clock at? 04:13:30.210 --> 04:13:35.370 We are 5.45, so we are 35 minutes into the game. 04:13:35.370 --> 04:13:40.910 Which means that we are running up against the sudden death clock here. 04:13:41.090 --> 04:13:43.710 Let's see if they can manage to figure out this. 04:13:43.710 --> 04:13:47.610 On the other hand, this is also kind of a similar situation to the previous challenge. 04:13:47.610 --> 04:13:53.730 Where we were 35 minutes into the game and then it kind of just clicked for one of the players. 04:13:53.730 --> 04:13:55.190 And they managed to go all the way. 04:13:56.390 --> 04:13:59.410 It's going to be really exciting to see what's going on. 04:13:59.410 --> 04:14:06.850 Still a bit difficult to get a read on Balson's progress or their understanding. 04:14:06.910 --> 04:14:09.810 They're kind of looking at the code, probably thinking very hard about it. 04:14:09.810 --> 04:14:14.590 You can see the mouse moving around, trying to build this mental model of what's going on. 04:14:14.590 --> 04:14:17.090 You're kind of running the code in your head. 04:14:17.090 --> 04:14:18.910 What if this has this value? 04:14:18.910 --> 04:14:19.370 How does that propagate? 04:14:19.370 --> 04:14:21.890 It's probably the least interesting part of a live CTF, right? 04:14:21.890 --> 04:14:24.750 That's the only downside when you have a more reverse engineering heavy challenge. 04:14:24.750 --> 04:14:28.850 Is that you're just seeing people maybe name stuff if you're lucky or add comments. 04:14:28.850 --> 04:14:31.130 But most of the time it's just looking at it. 04:14:31.410 --> 04:14:35.930 You know you're getting closer when you start seeing a crash in a debugger and a payload being written. 04:14:36.250 --> 04:14:37.330 And we don't have it yet. 04:14:37.330 --> 04:14:40.510 I'm going to go ahead and keep an eye on the organizers just briefly. 04:14:40.710 --> 04:14:43.690 And see if we get any kind of that similar progress. 04:14:44.290 --> 04:14:45.750 Right, so we have... 04:14:47.390 --> 04:14:48.110 Oh, okay. 04:14:48.110 --> 04:14:49.470 We did have a comment somebody else pointed out. 04:14:49.470 --> 04:14:50.690 Thank you for clarifying. 04:14:51.430 --> 04:14:54.570 The reason that somebody was looking for the libc was to actually run it. 04:14:54.570 --> 04:14:59.530 Because if you don't have the same VM handy, you can't run that libc. 04:14:59.530 --> 04:15:03.850 So you can just grab the libc from another version of Linux to be able to run the binary. 04:15:03.850 --> 04:15:07.390 So that is another completely valid reason that you might do that. 04:15:07.830 --> 04:15:08.090 Yes . 04:15:08.090 --> 04:15:11.190 Probably just easier to maybe look at a previous stream. 04:15:11.530 --> 04:15:16.930 I don't think we told people what platform all of our challenges were created on. 04:15:16.930 --> 04:15:20.790 That's actually a good note for future things. 04:15:20.790 --> 04:15:24.450 Because again, normal in a CTF happens all the time. 04:15:24.450 --> 04:15:28.370 You have to figure out the OS that it was created for, match version information and whatnot. 04:15:28.370 --> 04:15:30.690 Not our intention to make that part of the challenge here. 04:15:30.690 --> 04:15:30.690 No . 04:15:30.690 --> 04:15:31.810 And it's a thing. 04:15:31.950 --> 04:15:37.590 Ubuntu 22 somewhat recently went in LTS release. 04:15:37.590 --> 04:15:41.290 And a lot of people haven't updated to that yet. 04:15:41.830 --> 04:15:46.450 I will accept shared responsibility on this. 04:15:46.450 --> 04:15:49.030 Because, you know, update your computers, people. 04:15:49.030 --> 04:15:54.370 20.04, 22.04 would probably be Ubuntu's most common. 04:15:54.370 --> 04:15:55.310 Or Debian. 04:15:55.630 --> 04:15:57.110 Certainly it's frequently. 04:15:57.110 --> 04:15:57.310 But all right. 04:15:57.310 --> 04:15:58.370 I'm going to go take a look at the organizers. 04:15:58.370 --> 04:15:59.830 I'll be back and we'll see how it's going. 04:15:59.830 --> 04:16:00.610 Awesome. 04:16:00.810 --> 04:16:08.250 So I was talking about something when it comes to these challenges. 04:16:09.590 --> 04:16:13.410 Trying to get back on my train of thought there. 04:16:15.670 --> 04:16:16.070 With... 04:16:18.290 --> 04:16:19.290 Oh, yes. 04:16:19.290 --> 04:16:25.670 So, you know, with this looking at another player, looking at code, trying to figure things out. 04:16:25.930 --> 04:16:32.690 A lot of times when I talk to people who are not experienced CTF players or don't know what CTFs are. 04:16:32.870 --> 04:16:34.110 You often get the question. 04:16:34.110 --> 04:16:37.370 Oh, is this some kind of esports thing? 04:16:37.370 --> 04:16:41.190 Or could you make this into some kind of esports thing? 04:16:41.190 --> 04:16:44.550 To an extent, this is kind of what we're trying to do here. 04:16:44.990 --> 04:16:55.910 But, of course, it has its shortcomings that like some aspects of CTF is kind of like watching someone else take a maths exam. 04:16:56.310 --> 04:16:58.850 It's, you know, occasionally not the most exciting. 04:16:58.850 --> 04:17:04.070 So we're really trying to by adding this commentary and trying to understand what the players are doing. 04:17:04.070 --> 04:17:10.210 We're trying to make this an interesting and educational experience for all of you viewers there. 04:17:11.190 --> 04:17:21.250 So I hope you do enjoy this and, you know, have some takeaways and definitely check out the challenges afterwards. 04:17:22.230 --> 04:17:28.450 To also kind of get a feel for that's, you know, it might some of these might seem simple. 04:17:28.450 --> 04:17:35.350 But when you're sitting here and actually trying to do it, you have to consider and take into account all these small little details. 04:17:36.130 --> 04:17:42.150 If you're just off by one, like a small bit somewhere, like the whole thing doesn't work. 04:17:42.150 --> 04:17:44.410 You need to do all this troubleshooting, debugging. 04:17:45.730 --> 04:17:52.410 And I think I mentioned it earlier, but like when you're writing exploits, you are essentially... 04:17:52.410 --> 04:17:56.110 It's like software development, but with your like hands tied behind your back. 04:17:56.110 --> 04:18:03.390 You don't get like all the nice tools and helps and error messages that you get like during normal software development processes. 04:18:03.390 --> 04:18:07.090 Where, you know, you have all of these modern tools to help you. 04:18:07.090 --> 04:18:14.330 But here you're kind of like you're trying to bend something in a way that was not like intended to be used. 04:18:14.330 --> 04:18:18.290 You're messing with like a state of memory and so on. 04:18:18.290 --> 04:18:24.610 So it's you really have like everything stacked against you. 04:18:24.610 --> 04:18:31.370 And that is like a big part of the challenge when doing these Pwnables, these memory corruption challenges. 04:18:32.490 --> 04:18:40.950 Looking here at the code here, we can see that the Bowser player is writing some small helper function here to send a number. 04:18:41.170 --> 04:18:47.550 Maybe they're gonna try to, you know, use this to try to send different number of numbers. 04:18:47.770 --> 04:18:52.450 And, you know, see if they get any kind of reaction out of that. 04:18:54.250 --> 04:18:57.750 Haven't really seen yet what... 04:18:57.750 --> 04:19:00.070 So now they're gonna send like a thousand zeros. 04:19:00.070 --> 04:19:01.430 That's interesting. 04:19:04.050 --> 04:19:06.150 So we comment here like, yeah, it's unsolvable. 04:19:06.150 --> 04:19:08.830 Yeah, like the Sudoku itself is unsolvable. 04:19:08.830 --> 04:19:14.410 And that's kind of like the twist of this whole thing that, you know, at face value just sold a Sudoku and win. 04:19:14.410 --> 04:19:16.010 But then it's unsolvable. 04:19:16.010 --> 04:19:20.350 So, yeah, that's kind of like the recap for people just recently tuning in. 04:19:20.350 --> 04:19:25.610 And speaking of recap, just to tell you again a little bit about what we're doing here. 04:19:25.610 --> 04:19:29.490 So we're here in Vegas on site at DEFCON. 04:19:29.490 --> 04:19:35.750 So organizing this live CDF as part of the official DEFCON CDF. 04:19:35.750 --> 04:19:43.770 So this is kind of like a sub-event where all the 16 participating teams participate in this like single elimination knockout tournament. 04:19:43.770 --> 04:19:55.630 Where in each match the teams send one player to go head-to-head against the other team to be the first one to solve a relatively simple CDF challenge. 04:19:56.090 --> 04:19:58.090 I mean, relatively is relative. 04:19:58.110 --> 04:19:58.710 Yes , yes. 04:19:58.890 --> 04:20:00.870 I really want to stress relatively. 04:20:00.870 --> 04:20:01.790 And I want to be clear. 04:20:01.790 --> 04:20:05.490 I wouldn't personally solve half of the ones that we're fielding in the allotted time. 04:20:06.110 --> 04:20:10.530 I tried some of them and, you know, I could get them but maybe take a little bit longer. 04:20:10.530 --> 04:20:12.810 So I have a lot of respect for these people. 04:20:12.810 --> 04:20:14.170 They're all very, very good. 04:20:14.790 --> 04:20:17.090 And they're dealing with the pressure of being on camera. 04:20:17.270 --> 04:20:19.950 There's a crowd standing around them watching them. 04:20:20.610 --> 04:20:24.370 It can be pretty nerve-wracking. 04:20:24.370 --> 04:20:27.130 So I'm predicting... 04:20:27.130 --> 04:20:30.350 Oh, that is quite the visual effect there. 04:20:30.350 --> 04:20:34.370 Yeah, you know, the photosensitivity warnings here. 04:20:34.650 --> 04:20:35.870 I think it's only on our monitor. 04:20:35.870 --> 04:20:36.830 I don't see it on the screen as well. 04:20:36.830 --> 04:20:38.090 No , no , it's on the screen as well. 04:20:38.090 --> 04:20:39.870 Yes, we have some glitching. 04:20:39.870 --> 04:20:41.230 I'm not sure what that's about. 04:20:41.370 --> 04:20:44.090 It feels like our whole infrastructure is slowly melting. 04:20:44.230 --> 04:20:45.450 No, no, it's fine. 04:20:45.450 --> 04:20:45.950 Stay with us. 04:20:45.950 --> 04:20:49.170 Wow, that is unusual. 04:20:50.130 --> 04:20:54.590 Maybe we're getting hacked by the players through the HDMI cables. 04:20:54.590 --> 04:20:57.850 They're playing the other game, the other CTF challenge. 04:20:57.850 --> 04:21:05.430 I mean, we would be lying if we would say that we did not have a discussion about what shenanigans could the teams try to pull off. 04:21:05.430 --> 04:21:08.390 And how we would measure against it or what we would do. 04:21:08.390 --> 04:21:13.130 Doing that kind of threat analysis or threat modeling. 04:21:13.630 --> 04:21:15.130 We have three more minutes. 04:21:16.890 --> 04:21:19.670 This has been a very fast 45 minutes. 04:21:20.010 --> 04:21:22.970 It's looking unlikely that either one... 04:21:22.970 --> 04:21:25.010 I did see some debugger action. 04:21:25.850 --> 04:21:27.850 I'm going to make one last pass. 04:21:27.850 --> 04:21:32.110 If we see somebody very close and they're making progress, we might be able to give them just a little bit extra. 04:21:32.110 --> 04:21:34.350 But basically, we're about ready to deploy. 04:21:36.760 --> 04:21:38.780 Or if they actually want to extend it. 04:21:40.000 --> 04:21:40.880 That's not a bad idea. 04:21:41.360 --> 04:21:44.800 If they both say they want to extend it, we'll let them go because they're the last one. 04:21:45.460 --> 04:21:49.840 So the rules are, if one of them says they want to go sudden death, then we go sudden death. 04:21:49.840 --> 04:21:51.420 If both of them want to extend it, then it's fine. 04:21:51.420 --> 04:21:52.120 Exactly right. 04:21:52.120 --> 04:21:52.960 We'll see what they say. 04:21:52.960 --> 04:21:58.640 But ask them one on one. 04:21:58.740 --> 04:22:00.440 To not give any pressure. 04:22:01.420 --> 04:22:04.600 It would be cool to see a solution on this. 04:22:04.600 --> 04:22:09.900 Since we have been keeping up with the schedule, we do have that kind of time. 04:22:11.060 --> 04:22:16.260 But again, it's difficult to say what the players want. 04:22:16.260 --> 04:22:18.620 This is also a game theory thing. 04:22:18.620 --> 04:22:20.260 Do you want to go to sudden death or not? 04:22:20.260 --> 04:22:23.560 It's a high risk environment. 04:22:23.640 --> 04:22:25.460 When they're going super fast. 04:22:26.340 --> 04:22:29.780 Also, you don't know the progress of the other player. 04:22:29.780 --> 04:22:33.880 Do you think you have better progress than the other player in this challenge right now? 04:22:33.880 --> 04:22:42.260 And if you don't, do you think you have a better chance of beating them in the sudden death one versus catching up with them in the current challenge? 04:22:42.260 --> 04:22:47.760 It's definitely not an easy decision to make by the players. 04:22:48.880 --> 04:22:51.120 So what's the verdict? 04:22:51.120 --> 04:22:52.020 What do you think? 04:22:52.460 --> 04:22:54.160 If you're in their shoes... 04:22:54.160 --> 04:22:55.420 Oh no, I would say extend it. 04:22:55.420 --> 04:22:55.980 Absolutely. 04:22:55.980 --> 04:22:58.080 So we have a game here. 04:22:59.160 --> 04:23:03.140 I'm happy with this because I don't want to change the rules in a way that they're unhappy with. 04:23:03.140 --> 04:23:04.800 But they both want to solve it. 04:23:04.900 --> 04:23:08.860 Nobody wants to give up on a challenge that you've been working hard. 04:23:08.860 --> 04:23:10.900 You have a little bit of an idea. 04:23:11.180 --> 04:23:11.880 I'm glad. 04:23:11.880 --> 04:23:13.560 I really want to see them see this through. 04:23:13.560 --> 04:23:14.180 We'll let them go. 04:23:14.180 --> 04:23:15.360 It's the last one of the day. 04:23:15.360 --> 04:23:17.320 So we're not running over anything else. 04:23:18.280 --> 04:23:19.460 I'm actually kind of excited. 04:23:19.720 --> 04:23:22.680 So a story related to that. 04:23:22.680 --> 04:23:29.520 So I was playing in the qualifiers for the DEF CON CTF with our Scandinavian team, Norse Code. 04:23:29.520 --> 04:23:33.400 And I was basically sitting all weekend with one challenge. 04:23:33.760 --> 04:23:36.200 I mean, I took breaks and met some friends and stuff. 04:23:36.200 --> 04:23:37.940 But there was a lot of hours. 04:23:37.940 --> 04:23:38.760 This is the Paris Challenge. 04:23:38.760 --> 04:23:40.140 This was the Paris Challenge. 04:23:40.400 --> 04:23:42.500 It was the crypto-pwnable thing. 04:23:42.920 --> 04:23:44.780 So I don't know if I spent... 04:23:44.780 --> 04:23:47.460 I don't remember if it was like 10, 20 or 30 hours on this. 04:23:47.460 --> 04:23:53.480 But regardless, I solved it like two minutes after the CTF ended. 04:23:53.900 --> 04:23:55.580 And that... yeah. 04:23:55.740 --> 04:23:57.180 On the one hand, it's crushing. 04:23:57.180 --> 04:23:59.680 And on the other hand, though, you still solved it. 04:23:59.680 --> 04:24:01.020 You still solved it. 04:24:01.020 --> 04:24:01.840 And that's the thing. 04:24:03.340 --> 04:24:06.920 When the time ran out, I could have just stopped. 04:24:06.920 --> 04:24:09.920 Because it doesn't matter anymore. 04:24:09.920 --> 04:24:11.240 We're not going to get any points. 04:24:11.260 --> 04:24:12.840 But I was so close. 04:24:12.840 --> 04:24:14.740 I did not want to stop there. 04:24:15.760 --> 04:24:26.900 So the only saving grace, or what you want to call it, for that was that in the end, solving that challenge or not would not have affected whether we qualified or not. 04:24:26.900 --> 04:24:28.440 That would have been crushing. 04:24:28.440 --> 04:24:29.680 That's a little demoralizing. 04:24:30.640 --> 04:24:35.780 Luckily, even with those points, we would have been just below the qualifying limit. 04:24:35.780 --> 04:24:38.500 So at least you had clarity there either way. 04:24:38.500 --> 04:24:40.500 Yeah, I was comfortable with that. 04:24:40.500 --> 04:24:48.260 And also that means that I could be part of this without having to betray the team. 04:24:48.260 --> 04:24:50.340 So yeah. 04:24:52.600 --> 04:24:55.500 So we are... 04:24:55.500 --> 04:24:58.340 There's a question here about whether it was MCAT. 04:24:58.340 --> 04:25:03.260 No, this was the crypto-pwnable challenge. 04:25:03.820 --> 04:25:06.380 It was about a function closure thing. 04:25:06.540 --> 04:25:07.300 C++. 04:25:07.300 --> 04:25:08.980 We could go ask Perry. 04:25:09.200 --> 04:25:10.540 She just was in the room. 04:25:10.540 --> 04:25:11.280 She just left. 04:25:11.280 --> 04:25:11.940 Right. 04:25:12.100 --> 04:25:15.060 But yeah, I've heard a number of people that worked on that. 04:25:15.060 --> 04:25:16.160 It was a great challenge. 04:25:16.160 --> 04:25:18.680 I enjoyed it a lot. 04:25:19.500 --> 04:25:20.700 But it was tough. 04:25:20.700 --> 04:25:21.000 Okay. 04:25:21.000 --> 04:25:24.260 So we don't have a hard time with it now. 04:25:24.260 --> 04:25:32.960 Now it's basically we're just going to let it go until either we are convinced it's going to take way too long or we'll see at this point. 04:25:32.960 --> 04:25:35.040 But they both want to keep going. 04:25:35.100 --> 04:25:36.820 I would love for one of them to get it. 04:25:36.820 --> 04:25:45.460 It not only means we get to save one of our sudden deaths, but I think it's just way more fulfilling for them and for the audience to see the hard one solved. 04:25:45.460 --> 04:25:46.820 So we're looking forward to it. 04:25:48.120 --> 04:25:50.800 It is interesting that we've got ROP gadget address. 04:25:50.840 --> 04:25:54.120 It looks like a template, I think, that this existed. 04:25:54.120 --> 04:25:57.100 Because hopefully they have an idea that that is... 04:25:57.100 --> 04:26:00.960 Someone is writing something very deliberate here, right? 04:26:00.960 --> 04:26:04.860 This is like to print out the board somehow. 04:26:04.860 --> 04:26:07.480 But let's see. 04:26:07.480 --> 04:26:11.620 They are trying to see. 04:26:11.620 --> 04:26:14.620 I mean, this double loop there is to print out some states. 04:26:14.620 --> 04:26:19.200 But that part above, you see something where they're like cutting off. 04:26:19.220 --> 04:26:20.200 They're swapping. 04:26:23.240 --> 04:26:24.440 All right. 04:26:25.280 --> 04:26:29.960 Oh, is this just to generate a solution? 04:26:30.180 --> 04:26:33.900 I mean, I would just search the internet for solve Sudoku board and copy and paste it. 04:26:33.900 --> 04:26:36.580 But if that is what they're doing, that would be valid too. 04:26:36.580 --> 04:26:36.780 All right. 04:26:36.780 --> 04:26:42.140 So the idea is that you want to kind of overflow and stuff to basically insert... 04:26:42.140 --> 04:26:47.280 To modify the state into something that's either solvable or already solved. 04:26:48.580 --> 04:26:50.520 And so they need to have that. 04:26:50.520 --> 04:26:51.020 Okay. 04:26:51.020 --> 04:26:52.540 So we're seeing interesting. 04:26:52.540 --> 04:26:53.800 We're seeing calculations. 04:26:53.840 --> 04:26:56.580 We're seeing length calculations. 04:26:58.500 --> 04:27:03.300 Unfortunately, I was hoping we'd get some more video from the new organizers. 04:27:03.300 --> 04:27:04.820 Oh, it came in briefly. 04:27:04.820 --> 04:27:05.380 Yes. 04:27:06.000 --> 04:27:08.120 With some debugger output there, right? 04:27:08.700 --> 04:27:09.240 Yeah. 04:27:09.480 --> 04:27:11.440 We'll leave it up for a second and just kind of show them both. 04:27:11.440 --> 04:27:12.800 And we might be able to see a little bit. 04:27:12.800 --> 04:27:13.000 Yep. 04:27:13.000 --> 04:27:13.560 See there? 04:27:13.560 --> 04:27:14.580 It's coming on. 04:27:15.040 --> 04:27:16.160 Man, that's tantalizing. 04:27:16.160 --> 04:27:17.180 That's so mean. 04:27:17.180 --> 04:27:17.680 Yeah. 04:27:17.680 --> 04:27:20.320 This cable has been... 04:27:20.320 --> 04:27:20.680 Yeah. 04:27:20.680 --> 04:27:22.620 We might have to do some shopping. 04:27:22.620 --> 04:27:24.340 Oh, there is definitely a shopping run tonight. 04:27:24.340 --> 04:27:27.780 So we should be able to have this solved and out of the way. 04:27:27.880 --> 04:27:32.620 And that way we've got a long day, eight hours tomorrow of hopefully uninterrupted stream. 04:27:33.040 --> 04:27:33.700 We'll see. 04:27:33.700 --> 04:27:35.440 We'll see if that turns out to be the case. 04:27:35.440 --> 04:27:36.620 I mean, given that it's only been... 04:27:37.600 --> 04:27:40.920 We swapped out the capture card, the USB-C cable. 04:27:41.320 --> 04:27:42.960 The HDMI is the only thing we haven't swapped out. 04:27:42.960 --> 04:27:47.860 But it's been that same side of the table consistently that's been having these problems. 04:27:48.380 --> 04:27:53.560 Makes me think that, yeah, we've just got an HDMI cable that is suspicious. 04:27:54.940 --> 04:27:56.960 So we'll see if we can get that going. 04:27:56.960 --> 04:27:57.640 All right. 04:27:58.320 --> 04:28:01.340 Actually, I'm going to go ahead and do another in-person look. 04:28:01.340 --> 04:28:02.760 I'm going to go ahead and take a look at new organizers. 04:28:03.380 --> 04:28:04.780 And we'll be back with an update shortly. 04:28:04.780 --> 04:28:07.020 Because debugger is generally a good sign. 04:28:07.020 --> 04:28:07.680 Yes. 04:28:08.260 --> 04:28:09.320 Oh, wait. 04:28:09.900 --> 04:28:10.540 Uh-oh. 04:28:10.700 --> 04:28:14.760 I saw a bin bash string in the debugger there somehow. 04:28:16.240 --> 04:28:18.340 But that doesn't really make sense, right? 04:28:18.340 --> 04:28:22.060 Well, I mean, with the intended solution, that doesn't mean they're not going to do... 04:28:22.060 --> 04:28:22.300 Oh , no. 04:28:22.300 --> 04:28:22.800 Yeah. 04:28:22.920 --> 04:28:25.200 And there also is the... 04:28:25.200 --> 04:28:28.300 So I'm trying to remember how the win function runs. 04:28:28.300 --> 04:28:32.040 It may be from the win function on the stack as well, too. 04:28:32.040 --> 04:28:32.620 I don't remember. 04:28:32.620 --> 04:28:34.820 But no, they shouldn't be getting to that. 04:28:35.300 --> 04:28:35.460 Yes . 04:28:35.460 --> 04:28:35.820 Let's see. 04:28:35.820 --> 04:28:37.740 I don't see the... 04:28:37.740 --> 04:28:44.900 In the meantime, I wanted to just ask people who are watching whether you are, like... 04:28:44.900 --> 04:28:48.680 Is anyone here in Vegas attending DEF CON? 04:28:48.680 --> 04:28:52.140 Or are you watching from all over the world? 04:28:52.140 --> 04:28:53.720 Like, who do we have here? 04:28:53.720 --> 04:28:56.140 We saw someone from Kenya even chimed in earlier. 04:28:56.140 --> 04:28:56.480 Oh, wow. 04:28:56.480 --> 04:29:00.220 So we know we do have some worldwide watchers. 04:29:00.220 --> 04:29:03.940 It will be interesting to go and see those analytics afterwards to see who's watching. 04:29:05.160 --> 04:29:07.280 But, yeah, do we have any people? 04:29:07.620 --> 04:29:16.600 By the way, if you are here at DEF CON, feel free to come by the CTF area. 04:29:17.620 --> 04:29:21.260 We probably won't be able to talk a ton, but hopefully we'll get some breaks. 04:29:21.260 --> 04:29:23.140 If you come during matches, you can watch the matches. 04:29:23.140 --> 04:29:29.120 If you come between matches, you can have a chat with us, hopefully, if we're not panicking. 04:29:29.460 --> 04:29:32.000 Yeah, someone's watching from the CTF floor. 04:29:32.000 --> 04:29:33.020 Okay, nice. 04:29:33.020 --> 04:29:36.360 And also from Europe, in the hotel room, giving your feet a break. 04:29:36.360 --> 04:29:38.840 Yeah, that's a wise decision, I think. 04:29:38.840 --> 04:29:43.720 I'm ready for my feet, my throat, like, several parts of me need a break. 04:29:43.720 --> 04:29:44.000 Oh , yeah , yeah. 04:29:44.020 --> 04:29:45.680 We've been talking here for, like, several hours now. 04:29:45.680 --> 04:29:47.460 Okay, so this is interesting. 04:29:47.680 --> 04:29:50.600 Those ASCII values are being converted to integers. 04:29:50.600 --> 04:29:54.860 So we're looking at debugger dump of the game state, right? 04:29:54.860 --> 04:29:55.680 Nice, nice. 04:29:56.060 --> 04:29:57.940 So we do see the game state. 04:29:58.280 --> 04:30:00.720 It's really obvious to see those numbers. 04:30:00.940 --> 04:30:01.720 Cool. 04:30:03.540 --> 04:30:08.200 Yeah, and you can see, look at that base thing there. 04:30:08.200 --> 04:30:13.800 You have, like, generating a list of integers from 0 to 96, which is interesting. 04:30:15.520 --> 04:30:22.280 Yeah, we have watchers from Estonia, Brazil, people who are saying they want to go visit DEF CON in the future. 04:30:22.360 --> 04:30:25.640 Yeah, I think DEF CON is, like, it's a cool event to visit. 04:30:26.060 --> 04:30:29.580 I think they're trying to increase the amount of streaming and online presence as well, too. 04:30:29.580 --> 04:30:32.540 So you probably will be able to find other streams. 04:30:32.540 --> 04:30:37.840 I think there's even some webcam, like, 360-degree webcam, virtual cameras they're putting up in a couple of the rooms where you can watch what's going on. 04:30:37.840 --> 04:30:40.780 So they're trying to improve, like, the accessibility. 04:30:40.780 --> 04:30:45.890 I mean, certainly with COVID in general, most conferences have tried to adapt better for... 04:30:46.300 --> 04:30:49.260 Oh, okay, we have somebody watching right next to our camera. 04:30:49.260 --> 04:30:50.560 Let's hope they don't bump it. 04:30:53.660 --> 04:30:57.840 But anyway, again, checking the code here they're writing. 04:30:58.280 --> 04:31:01.280 I'm trying to get a better feel for what they're doing. 04:31:02.000 --> 04:31:05.360 Again, they're generating, like, a list of numbers. 04:31:05.920 --> 04:31:06.580 Oh, okay. 04:31:06.580 --> 04:31:10.300 Also, they need to find, like, the right offset for their overflow. 04:31:10.300 --> 04:31:11.580 This actually looks really good. 04:31:11.580 --> 04:31:11.920 Yes. 04:31:11.920 --> 04:31:13.240 This actually does, like, really good. 04:31:13.240 --> 04:31:13.680 I'm glad we let them go. 04:31:13.680 --> 04:31:14.940 Because , like , once they finish this... 04:31:14.940 --> 04:31:16.540 Yeah, yeah, if they get the right offsets. 04:31:16.560 --> 04:31:18.620 Let me go look at the other one, but we might be closing in. 04:31:18.620 --> 04:31:19.160 Yes. 04:31:22.970 --> 04:31:24.150 So that's really cool. 04:31:24.150 --> 04:31:27.270 Like, once they get that thing, it's going to be real quick. 04:31:27.270 --> 04:31:29.590 Like, we are probably going to miss... 04:31:29.590 --> 04:31:31.950 There's a big risk we're going to miss, like, the moment. 04:31:32.090 --> 04:31:37.410 So, basically, if I'm reading this correctly, what they're trying to do is, like, find the offset in memory. 04:31:38.290 --> 04:31:49.090 They're overflowing something, and then, like, how far into this do they want to put whatever they are placing there, which should be the solved or solvable state. 04:31:50.290 --> 04:31:54.070 So, yeah, they might definitely be onto something. 04:31:54.070 --> 04:31:56.610 They're switching the numbers around a little bit. 04:31:56.610 --> 04:31:57.790 Maybe it's that they... 04:31:57.790 --> 04:32:04.670 So they switched the zeros to a one, which seemed to have crashed the program. 04:32:04.770 --> 04:32:08.470 And then checking why this is happening. 04:32:09.510 --> 04:32:11.250 Yeah, we have someone from Morocco as well. 04:32:11.250 --> 04:32:11.970 Cool. 04:32:13.990 --> 04:32:16.430 It's cool to see we have people all over. 04:32:17.550 --> 04:32:24.590 I guess I'm trying to, like, work out, like, what time it is across the world at the moment. 04:32:25.930 --> 04:32:28.810 But, wait, that's the people watching from Europe. 04:32:28.810 --> 04:32:30.930 It's, like, in the middle of the night there. 04:32:31.130 --> 04:32:34.610 So, that's dedication. 04:32:35.610 --> 04:32:37.490 I hope you're enjoying it. 04:32:37.950 --> 04:32:39.210 I'm trying to see here. 04:32:39.210 --> 04:32:42.090 They're just quickly looking at the disassembly again. 04:32:45.050 --> 04:32:49.190 Trying to... maybe looking for some specific offset or so. 04:32:51.750 --> 04:32:58.070 Yes, they did get some specific offset to put a breakpoint there, right? 04:32:58.070 --> 04:33:00.750 And then they're also looking at the base. 04:33:01.930 --> 04:33:03.130 Oh, yeah, to make the breakpoint. 04:33:03.130 --> 04:33:04.630 Or maybe not the breakpoint. 04:33:07.310 --> 04:33:09.550 The offset, where to inspect the memory. 04:33:11.450 --> 04:33:12.210 Oh, yeah. 04:33:12.870 --> 04:33:16.250 Oh, yeah, people saying they're watching from, like, yeah, definitely middle of the night. 04:33:16.250 --> 04:33:18.710 You know... 04:33:22.530 --> 04:33:23.270 Awesome. 04:33:23.270 --> 04:33:24.990 Netherlands represented as well. 04:33:25.170 --> 04:33:33.010 So, I'm seeing some interesting stuff there, but what did you see from the organizers? 04:33:33.010 --> 04:33:39.770 Yeah, so, I mean, I hate to take bets, because I've lost a lot of money at this table so far. 04:33:40.110 --> 04:33:45.670 If this was a gambling arrangement, I would not be doing so well. 04:33:45.670 --> 04:33:49.850 But, I also feel like I tend to favor my side of the table. 04:33:49.850 --> 04:33:53.730 And then we've had all these surprise victories from the other ones pop up several times. 04:33:53.730 --> 04:33:59.150 But, all that said, I do think Team Taiwan has a little bit of a lead. 04:33:59.150 --> 04:34:02.890 So, looking at the new organizers, we've got a script. 04:34:03.370 --> 04:34:08.710 It's a mixture of GDB, some PwnTools, and then as well as sending inputs and kind of breaking in. 04:34:09.090 --> 04:34:15.110 I didn't get the sense that they had an overall plan for what to do. 04:34:15.110 --> 04:34:15.690 Right. 04:34:15.690 --> 04:34:20.210 But again, definitely the one thing I've learned is that I don't know what I'm doing anyways. 04:34:20.210 --> 04:34:24.490 It is really hard to understand exactly what's going on in their heads, and so you're not always right. 04:34:25.830 --> 04:34:33.130 Whereas, I will say, it certainly looks like with that offset, right? 04:34:33.130 --> 04:34:38.370 We're seeing a valid, solved Sudoku, trying to find the right offset to line it up. 04:34:38.370 --> 04:34:42.970 Which sounds like, from what I understand of it, is the intended solution. 04:34:44.230 --> 04:34:46.790 So, we'll see. 04:34:48.470 --> 04:34:49.110 Yep. 04:34:52.290 --> 04:34:55.090 Can we get some confirmation? 04:34:55.090 --> 04:35:00.890 If it's just misaligning the correct board, the certain number of bytes, will that trigger it, essentially? 04:35:02.490 --> 04:35:04.290 Any correct board at the right offset. 04:35:04.290 --> 04:35:07.030 So, just put the right amount of padding bytes in, and then it will override it the right... 04:35:16.090 --> 04:35:16.990 Say again? 04:35:23.650 --> 04:35:24.450 Yep. 04:35:26.850 --> 04:35:28.210 Then you mark it as solved? 04:35:28.210 --> 04:35:28.730 Yeah. 04:35:36.260 --> 04:35:38.840 Oh, just send anything, and it will just mark it as solved? 04:35:39.200 --> 04:35:39.880 Right. 04:35:40.700 --> 04:35:41.500 Okay. 04:35:41.560 --> 04:35:59.960 So, what our producer there said was that, first you send a solvable state, you override the thing, the state, with the solvable one, and then you just send something to trigger the recheck, and have it be solved, and you get the win there. 04:36:02.380 --> 04:36:07.060 We can see here, they are working out in a text editor... 04:36:07.060 --> 04:36:15.380 Yeah, it still looks like they're trying to solve the state as it exists, not overwrite the state with their solve. 04:36:15.840 --> 04:36:26.940 I wonder, I'm a little afraid, they got the overwrite, but if their exploit didn't try to send another round for validation, it overwrote it, but then never... 04:36:26.940 --> 04:36:30.580 Oh, wow, that would be terrible. 04:36:30.580 --> 04:36:38.580 So, it is possible that they potentially had the right solution, just didn't re-trigger it to be able to actually get to the win function. 04:36:40.080 --> 04:36:43.840 So, we will see. 04:36:44.380 --> 04:36:45.860 We're only a little bit late. 04:36:45.860 --> 04:37:00.960 Actually, technically, we have two more minutes before the original length of this, and we're letting them run long just because of the last one of the day, and we prefer they have a chance to if they can, but our voices will give out, and there will be some point which we say, 04:37:00.960 --> 04:37:02.320 sorry, we're cutting you off. 04:37:02.540 --> 04:37:06.200 But none of us want that to happen, so we'll see. 04:37:06.340 --> 04:37:10.700 Yeah, we're taking a bet here and hoping this will work. 04:37:12.200 --> 04:37:15.000 We're also about to lose power on our chat. 04:37:15.000 --> 04:37:15.460 Yes. 04:37:15.480 --> 04:37:17.120 Tunisia, excellent, welcome. 04:37:17.120 --> 04:37:20.220 Yeah, I've been to Tunisia for a CTF competition. 04:37:20.480 --> 04:37:20.980 Have you really? 04:37:20.980 --> 04:37:23.660 I think I got invited to speak there one time at a conference. 04:37:23.660 --> 04:37:24.080 Yeah. 04:37:24.080 --> 04:37:24.900 There we go. 04:37:25.700 --> 04:37:27.320 Let's see if that actually powers it. 04:37:27.320 --> 04:37:29.060 I don't know what this is plugged into at this point. 04:37:29.660 --> 04:37:31.840 Yeah, we have power on one of our screens here. 04:37:31.840 --> 04:37:32.740 All right, good. 04:37:32.760 --> 04:37:37.080 We also have a graphical glitch on the Balsam screen. 04:37:37.080 --> 04:37:39.260 But it's just blocking the ads, so I'm okay with it. 04:37:39.260 --> 04:37:40.080 That sounds great. 04:37:40.080 --> 04:37:44.480 I wish all of my graphics glitches just blocked out ads as I surfed on the web. 04:37:44.480 --> 04:37:44.880 Oh , yeah . 04:37:45.100 --> 04:37:49.240 So as an employee of a big ad tech company, I would have to... 04:37:49.240 --> 04:37:53.500 A large tech company whose revenue might depend heavily on ad? 04:37:53.500 --> 04:37:54.200 Yeah. 04:37:55.060 --> 04:37:55.500 Yeah. 04:37:57.000 --> 04:37:58.820 Yeah, are you allowed to run ad blockers? 04:37:59.040 --> 04:38:00.220 Nah, I'm not going to make you talk at work. 04:38:00.220 --> 04:38:01.200 I'm not going to make you talk at work. 04:38:01.200 --> 04:38:02.100 All right, all right. 04:38:02.100 --> 04:38:03.000 I'm not going to do that. 04:38:03.540 --> 04:38:05.260 All right, so here we go. 04:38:09.460 --> 04:38:12.960 So this still feels like we're trying to solve it. 04:38:13.820 --> 04:38:21.760 I don't see the exploit. 04:38:21.760 --> 04:38:24.820 I don't see them actually exploiting it. 04:38:24.820 --> 04:38:34.400 Well, I mean, this might still work if their idea is to just overwrite a couple of values, and then make it solvable, and then put it in the solution. 04:38:34.480 --> 04:38:35.600 It's not a fast solution. 04:38:35.600 --> 04:38:37.640 They're going to inherently have to overwrite the whole thing, though, right? 04:38:37.640 --> 04:38:39.500 Because they're just linearly overwriting it. 04:38:39.500 --> 04:38:44.380 Well, I mean, it might be that they think that they can only overwrite the beginning of it, or something like this. 04:38:44.380 --> 04:38:46.120 You're still going to have a null at the end. 04:38:46.160 --> 04:38:48.480 No, no, no, not necessarily, because it's going to convert in red. 04:38:48.480 --> 04:38:49.560 Yeah, no, that's fair. 04:38:49.740 --> 04:38:51.360 I mean, it could work. 04:38:51.360 --> 04:38:55.700 It's not the intended play, but it could probably work. 04:38:56.640 --> 04:38:57.600 So, yeah. 04:38:58.220 --> 04:39:00.500 Unless there's a question mark at the very end of the puzzle. 04:39:00.500 --> 04:39:06.260 If there's an unallocated one at the very end, that would have to be... 04:39:06.260 --> 04:39:07.280 Well, we'll see. 04:39:07.560 --> 04:39:08.020 Yeah. 04:39:08.020 --> 04:39:09.000 We'll see. 04:39:09.000 --> 04:39:09.800 All right. 04:39:10.440 --> 04:39:12.920 A few more bits. 04:39:13.380 --> 04:39:14.580 Thanks, everybody, for hanging with us. 04:39:14.580 --> 04:39:18.660 This has been just utterly exhausting and super exciting. 04:39:19.400 --> 04:39:28.940 Just as a quick recap from our earlier games, we had a nail-biter of a finish at the very beginning from Shellfish versus PTB WTL. 04:39:28.940 --> 04:39:29.360 Oh, yeah. 04:39:29.400 --> 04:39:33.380 They were, I think, within a few keystrokes of each other. 04:39:33.380 --> 04:39:34.920 You can't get a tighter match. 04:39:34.920 --> 04:39:35.340 I know. 04:39:35.340 --> 04:39:37.840 We were looking at one screen as they were... 04:39:37.840 --> 04:39:38.800 About to declare a winner. 04:39:38.800 --> 04:39:39.500 Yeah, and then the other one... 04:39:39.500 --> 04:39:40.580 When all of a sudden, it popped. 04:39:40.580 --> 04:39:41.620 It just was so quick. 04:39:41.620 --> 04:39:42.120 Yeah. 04:39:42.360 --> 04:39:43.120 So that was fantastic. 04:39:43.120 --> 04:39:46.040 Make sure you go back and check the replay on that one. 04:39:46.480 --> 04:39:50.640 We're going to end the stream today when we're done with this particular challenge. 04:39:51.260 --> 04:39:52.300 Oops, sorry about that. 04:39:52.300 --> 04:39:53.160 I hit the microphone. 04:39:53.380 --> 04:39:59.080 We're going to end the stream today once we're done with this challenge and we wrap it up. 04:39:59.760 --> 04:40:01.480 But we'll be back tomorrow. 04:40:01.480 --> 04:40:02.700 A long day tomorrow. 04:40:02.700 --> 04:40:05.220 So the stream is going to run for eight hours straight. 04:40:05.220 --> 04:40:08.460 Actually, I guess nine at least because we've got eight... 04:40:08.460 --> 04:40:09.300 No, no, that's right. 04:40:09.300 --> 04:40:10.180 Eight total hours. 04:40:10.180 --> 04:40:11.520 Each one is a one-hour thing. 04:40:11.520 --> 04:40:11.880 Yeah . 04:40:12.260 --> 04:40:12.900 We'll see. 04:40:12.900 --> 04:40:14.120 We may end up needing a break. 04:40:14.120 --> 04:40:16.180 We're going to try to get breaks by trading off. 04:40:16.180 --> 04:40:18.160 You're going to see some guest commentators. 04:40:18.160 --> 04:40:20.580 We're going to have some other people come in and fill out different roles. 04:40:20.580 --> 04:40:21.580 Should we... 04:40:21.580 --> 04:40:23.100 I think it was already written on Twitter. 04:40:23.100 --> 04:40:25.220 But the idea is to have... 04:40:25.220 --> 04:40:29.760 We have LiveOverflow, hopefully joining in. 04:40:29.840 --> 04:40:32.760 And Gamoso, Brandon Falk. 04:40:32.760 --> 04:40:33.260 Yeah. 04:40:33.740 --> 04:40:42.080 So two popular people in the security content creation space. 04:40:42.080 --> 04:40:42.760 Yeah. 04:40:43.700 --> 04:40:47.280 I'm excited, looking forward to chatting with both of them. 04:40:47.820 --> 04:40:49.640 And I'm also looking forward to have a break. 04:40:49.640 --> 04:40:53.660 And as we each get to maybe alternate every other round. 04:40:53.660 --> 04:40:55.420 So one of us will get to take a rest. 04:40:55.420 --> 04:40:59.580 And also make sure we give our producer, Glenn, a break as well. 04:40:59.580 --> 04:41:01.760 So we'll be cycling through that. 04:41:03.100 --> 04:41:05.820 We've got a variety of different challenges. 04:41:06.420 --> 04:41:12.720 Maybe for any of the teams that happen to be listening, we want to talk about the overall types of challenges that we have. 04:41:12.720 --> 04:41:16.940 No super-spoilers, but I will say I think we're pretty representative. 04:41:17.040 --> 04:41:17.420 Right. 04:41:17.420 --> 04:41:20.960 We've seen heavy-pwned focus, a little bit of RE. 04:41:20.960 --> 04:41:21.600 Yes. 04:41:21.700 --> 04:41:27.100 There's certainly a little bit like shell-coding or constrained exploitation. 04:41:30.800 --> 04:41:33.140 Just having a quick look here again. 04:41:33.140 --> 04:41:34.560 Yeah , trying to get caught back up. 04:41:35.660 --> 04:41:36.480 Oh, man. 04:41:36.480 --> 04:41:37.940 So they have a solution there, right? 04:41:37.940 --> 04:41:41.720 They have a solved solution, but... 04:41:42.240 --> 04:41:43.000 Yeah. 04:41:43.140 --> 04:41:47.220 There's a hashtag, FreeJordanGlenn and Kalle in the chat. 04:41:47.220 --> 04:41:47.500 Yes . 04:41:47.500 --> 04:41:50.760 So, yeah, just to clarify, that's my nickname. 04:41:54.480 --> 04:41:55.200 HackHarder. 04:41:55.200 --> 04:41:55.840 Thank you. 04:41:55.840 --> 04:41:56.460 Yes. 04:41:56.460 --> 04:42:00.700 I mean, thank you, Negasoro, this random person who showed up in our chat. 04:42:00.800 --> 04:42:07.360 Certainly not the author of this particular challenge that has stymied our opponents for so long. 04:42:07.360 --> 04:42:08.080 Right. 04:42:08.080 --> 04:42:10.160 Yeah, but you're not wrong. 04:42:10.160 --> 04:42:13.820 If they just would hack harder, we could take a break and we could... 04:42:13.820 --> 04:42:15.500 Yeah, we could get some dinner. 04:42:15.600 --> 04:42:18.140 So let us consider this. 04:42:18.140 --> 04:42:23.400 I would say we are going to have to hit sudden death pretty soon because we're looking at another several minutes of sudden death as well. 04:42:24.620 --> 04:42:24.980 So... 04:42:27.140 --> 04:42:28.160 We'll take a look. 04:42:28.160 --> 04:42:30.280 Maybe I'll take one more pass at new organizers. 04:42:30.660 --> 04:42:34.800 We'll talk about having a, you know, securing up a sudden death. 04:42:34.800 --> 04:42:36.360 We'll kind of consider what we want to go. 04:42:37.440 --> 04:42:38.160 Yeah. 04:42:38.920 --> 04:42:40.980 I'll go ahead and give a bit of a... 04:42:40.980 --> 04:42:42.400 Oh, just use a data glove. 04:42:42.680 --> 04:42:43.720 What is a data glove? 04:42:43.720 --> 04:42:45.040 That's a reference I don't get. 04:42:45.080 --> 04:42:49.200 Isn't that the game controller thing? 04:42:49.200 --> 04:42:50.360 No, that's a power glove. 04:42:50.360 --> 04:42:51.180 That's a power glove. 04:42:51.180 --> 04:42:51.500 Yeah, yeah. 04:42:51.500 --> 04:42:53.020 The child of the 80s, of course. 04:42:53.020 --> 04:42:53.660 Yeah, yeah. 04:42:53.660 --> 04:42:54.040 No, no. 04:42:54.380 --> 04:42:56.060 That's a thing from before I was born. 04:42:56.060 --> 04:42:57.080 Sam, no trolling. 04:42:57.080 --> 04:42:57.680 No trolling. 04:42:57.680 --> 04:42:58.140 Please stay. 04:42:58.140 --> 04:42:58.700 No, stay. 04:42:58.700 --> 04:42:59.400 No, no. 04:43:00.100 --> 04:43:01.320 We will find you. 04:43:01.320 --> 04:43:02.100 You're in the room. 04:43:02.100 --> 04:43:03.080 We remember this. 04:43:03.080 --> 04:43:04.660 We don't talk like that. 04:43:04.780 --> 04:43:05.140 That's... 04:43:05.140 --> 04:43:06.200 Yeah. 04:43:06.200 --> 04:43:09.040 Next you're going to be asking for network forensics or something. 04:43:09.040 --> 04:43:09.860 Something crazy. 04:43:09.860 --> 04:43:10.100 Yeah. 04:43:10.100 --> 04:43:11.400 We might call the goons. 04:43:11.400 --> 04:43:11.840 Yeah. 04:43:11.840 --> 04:43:12.800 Have them take you out of the room. 04:43:12.800 --> 04:43:13.080 Yeah. 04:43:13.080 --> 04:43:13.240 All right. 04:43:13.240 --> 04:43:14.920 I'll go check out new organizers and we'll be back. 04:43:14.920 --> 04:43:15.180 Definitely. 04:43:15.180 --> 04:43:19.780 I'll give an update on the DEF CON CTF scoreboard in the meantime. 04:43:21.100 --> 04:43:42.420 So, we have like a slightly larger spread now with like spanning from just below 14,000 up to just above 18,000 points between the 16th and the 1st place with Katsubin in 1st place, MMM in 2nd place and Perfect Root in 3rd place. 04:43:42.460 --> 04:43:52.040 And if I'm not misremembering, I think last year we did have like a top fight between Katsubin and PPP as well. 04:43:52.040 --> 04:43:57.680 They have kind of pulled ahead, those two teams, and created like a slight gap down to 3rd place. 04:43:57.680 --> 04:44:06.640 So, I do think this like mirrors some of what we saw last year with regards to like the standings. 04:44:06.640 --> 04:44:09.980 But, this is only the first day of the DEF CON CTF. 04:44:09.980 --> 04:44:11.860 A lot of stuff can happen. 04:44:12.060 --> 04:44:14.000 This is like far from over. 04:44:14.140 --> 04:44:22.820 So, we're going to be keeping an eye on that throughout the weekend and give you updates. 04:44:24.680 --> 04:44:32.860 If you're here in the CTF room, you can see this really funny visualization the Nautilus Institute have put up. 04:44:32.860 --> 04:44:43.000 It's like some 3D animation of like a bunch of weird machines, one for each team, like spitting random objects at the other teams, like showing... 04:44:43.540 --> 04:44:46.320 I guess it's showing like who is attacking whom. 04:44:46.600 --> 04:44:50.000 Possibly, there's like seashells and stuff flying around. 04:44:50.000 --> 04:44:54.900 I guess there's some joke there about like shells and seashells and you know that. 04:44:56.120 --> 04:45:01.680 But, again, taking a look at the screen of Balsun here. 04:45:02.700 --> 04:45:04.720 I'm still not entirely sure. 04:45:04.720 --> 04:45:07.880 They have this like partial solution or like a solution. 04:45:07.880 --> 04:45:14.700 They have split up the solution into two parts and then trying to send some... 04:45:14.700 --> 04:45:18.500 Like they're sending some data and then they're sending the other solution. 04:45:18.500 --> 04:45:21.080 Still not exactly sure what's going on. 04:45:23.140 --> 04:45:24.980 So, we have an explanation. 04:45:24.980 --> 04:45:26.520 Data handler, crazy keyboards. 04:45:26.520 --> 04:45:29.960 Yeah, I will have to look that up afterwards. 04:45:30.540 --> 04:45:37.400 But, yeah, I'm still thinking power gloves would, you know, really help out in this situation. 04:45:37.860 --> 04:45:43.180 Maybe you could have them like, you know, different like rock gadgets and stuff mapped to the different buttons and stuff. 04:45:43.180 --> 04:45:45.380 That's, you know, the way to go. 04:45:46.120 --> 04:45:51.540 Anyway, you can see them like in the debugger here inspecting the memory there a little bit. 04:45:51.540 --> 04:45:53.260 So, I'm looking at the global variables. 04:45:53.260 --> 04:45:55.780 You can see you have the standard in and standard out object. 04:45:55.780 --> 04:45:58.380 And then further down they have these objects. 04:45:58.380 --> 04:46:08.060 And you can see the byte values there in the like the middle of the printed out block with the different digits of the Sudoku solution. 04:46:11.060 --> 04:46:21.980 Yeah, it feels like they are very close to getting it, but still like a bit unsure exactly what's going on. 04:46:23.660 --> 04:46:27.480 So, yeah, we have Jordan coming back here now. 04:46:27.480 --> 04:46:30.040 So, we'll get an update on where we are. 04:46:30.040 --> 04:46:32.360 We are going to give them a sudden death hint. 04:46:32.360 --> 04:46:37.760 We're going to give them a hint that is just because here's the thing that we have missed talking about it so far. 04:46:37.760 --> 04:46:40.140 I was looking back over with the example solution. 04:46:41.700 --> 04:46:48.020 And the nuance here is that there's a length check that has been kind of showing up a little bit. 04:46:48.020 --> 04:46:56.880 Now, length check basically prevents you from even if you overwrite it with a fully solved board from actually solving it on that throw. 04:46:56.880 --> 04:47:00.440 So, you overwrite the state of the board all but the last one. 04:47:00.880 --> 04:47:01.380 Right. 04:47:01.380 --> 04:47:02.600 And the last one you leave empty. 04:47:02.600 --> 04:47:06.660 And then you can just solve it by overwriting the correct last answer. 04:47:06.720 --> 04:47:07.180 I see. 04:47:07.180 --> 04:47:18.420 So, it's a little bit along the lines of what we've been talking about, but it seems that they've done a weaker variant of that where they didn't have as good of a solution. 04:47:18.920 --> 04:47:22.920 There's a question here about is there anywhere that explains the CTF format? 04:47:22.920 --> 04:47:25.000 There's an AD going on as well as these one-in-ones. 04:47:25.000 --> 04:47:25.620 Yes. 04:47:25.620 --> 04:47:36.560 The main CTF, the DEFCON CTF, is the traditional DEFCON attack-defense that we all know and love. 04:47:36.580 --> 04:47:41.260 Although, there have been variants and twists to it over the years. 04:47:42.220 --> 04:47:52.060 Then, within this competition, this live CTF is like a sub-event where it's running parallel to the attack-defense aspect of this. 04:47:52.060 --> 04:47:57.980 Each team sends one player for each match and then we play this knockout tournament. 04:47:57.980 --> 04:48:10.280 At the end, this will generate a ranking from the knockout tournament, which is then fed back in and will affect the scores of the main CTF event. 04:48:10.280 --> 04:48:18.400 So, this will be valuable and might definitely affect the final standings of the DEFCON CTF. 04:48:18.400 --> 04:48:28.730 I'm not completely aware of what the weighting factor is, how the scoring model works for the CTF. 04:48:30.280 --> 04:48:37.800 So, I couldn't tell you exactly how valuable it is to win the tournament versus getting second place. 04:48:37.800 --> 04:48:42.880 But, we've been trying to find a balance where the teams can definitely... 04:48:42.880 --> 04:48:44.000 I'll tell you in a second. 04:48:44.000 --> 04:48:48.500 But, first I'm going to deliver the hints and I'll be right back. 04:48:48.500 --> 04:48:51.820 And we'll see if we can bring this one home. 04:48:51.820 --> 04:48:52.040 Right. 04:48:52.040 --> 04:48:54.080 Can you just read me the hints here first? 04:48:54.080 --> 04:48:55.020 Here we go. 04:48:55.140 --> 04:48:57.460 First attempt, overwrite almost all. 04:48:57.460 --> 04:48:59.760 Second attempt solves due to length check. 04:48:59.760 --> 04:49:00.500 Yes. 04:49:00.640 --> 04:49:01.700 Sounds great. 04:49:01.860 --> 04:49:03.200 And we will see if this does it. 04:49:03.240 --> 04:49:06.800 This is almost like a straight-up solution. 04:49:06.900 --> 04:49:09.900 This could almost be like a write-up for the... 04:49:09.900 --> 04:49:11.540 You have to understand what the program does. 04:49:11.540 --> 04:49:13.240 And that's the state that they've got. 04:49:13.240 --> 04:49:14.260 Yeah , but they have that. 04:49:15.920 --> 04:49:20.620 So, now we're going to give them the final, hopefully final hint here. 04:49:20.620 --> 04:49:26.420 They will just hopefully blow this case wide open and have them solve it from there. 04:49:26.520 --> 04:49:31.160 Did we get any reaction from the players on that? 04:49:31.160 --> 04:49:32.220 I was too busy coming back. 04:49:32.220 --> 04:49:33.240 I should have watched. 04:49:33.240 --> 04:49:33.880 Okay, okay. 04:49:33.880 --> 04:49:34.580 I see. 04:49:34.620 --> 04:49:36.940 Yeah, we got some forehead touching. 04:49:36.940 --> 04:49:37.580 Okay. 04:49:37.580 --> 04:49:38.880 Says our producer. 04:49:38.880 --> 04:49:39.600 Yes. 04:49:41.120 --> 04:49:41.980 So, we'll see. 04:49:41.980 --> 04:49:42.600 Will it... 04:49:42.600 --> 04:49:45.520 I think this was... This one, I think, is on us. 04:49:45.520 --> 04:49:45.680 Yeah. 04:49:45.680 --> 04:49:49.040 I think this was a little too subtle for what we're kind of aiming for. 04:49:49.040 --> 04:49:54.140 And again, being in a high-pressure thing, this is not to say that these are not excellent exploiters. 04:49:54.140 --> 04:49:55.340 It is just very hard. 04:49:55.340 --> 04:49:58.800 And this was a little bit of nuance, a little subtle nuance. 04:49:58.800 --> 04:49:59.340 Oh, yeah. 04:49:59.340 --> 04:50:05.840 Because of the way that the length check happens in the binary, you can't actually fully overwrite and expect it to do it. 04:50:05.840 --> 04:50:09.560 It will already know that it's an invalid attempt, and so it's not solvable. 04:50:09.560 --> 04:50:17.360 But then you have overwritten the correct state such that you can then solve it because you moved it from an insolvable state to a solvable state. 04:50:17.360 --> 04:50:17.760 Right . 04:50:18.060 --> 04:50:19.240 Somebody else might have got it. 04:50:19.240 --> 04:50:19.880 You don't know. 04:50:19.880 --> 04:50:22.220 But it's definitely... This is definitely a little harder. 04:50:22.220 --> 04:50:25.160 Certainly, it's more subtle than some of our previous challenges. 04:50:25.460 --> 04:50:26.060 Yes. 04:50:26.260 --> 04:50:27.320 But we'll see. 04:50:27.320 --> 04:50:31.780 We'll do our best to keep dialing in the difficulty and see how it goes. 04:50:31.780 --> 04:50:34.380 So, let's keep an eye out for the winner. 04:50:34.380 --> 04:50:44.680 We may see, because we're not looking at the new organizers, we might get that off screen, or we might see Team Taiwan pull it off here in the main window. 04:50:44.700 --> 04:50:50.240 So , I keep rooting for whoever we have the capture card working on, just by the very nature of being on my side of the table. 04:50:50.240 --> 04:50:51.340 Yeah , yeah, yeah. 04:50:52.160 --> 04:50:52.560 But... 04:50:52.560 --> 04:51:01.780 But, you know, like, being a Swiss, not citizen, but Swiss resident, I'm, you know, kind of like maybe rooting for organizers a little bit. 04:51:01.880 --> 04:51:02.280 Oh ? 04:51:02.420 --> 04:51:03.160 So, yeah. 04:51:03.160 --> 04:51:04.940 Are they a Swiss team? 04:51:04.940 --> 04:51:08.760 So, they are a Swiss-British-American team, I think. 04:51:08.760 --> 04:51:09.200 Okay . 04:51:09.420 --> 04:51:10.080 Oh! 04:51:10.080 --> 04:51:11.200 There we go! 04:51:11.200 --> 04:51:12.200 All right. 04:51:12.200 --> 04:51:13.320 So, there... 04:51:13.320 --> 04:51:14.620 We have the winner. 04:51:15.340 --> 04:51:16.220 Congratulations. 04:51:16.420 --> 04:51:16.700 Congratulations . 04:51:16.720 --> 04:51:18.140 Awesome, awesome. 04:51:19.280 --> 04:51:20.300 Oh, my God. 04:51:20.300 --> 04:51:21.140 Down to the end. 04:51:21.140 --> 04:51:22.220 It happened again. 04:51:22.220 --> 04:51:22.920 It happened again. 04:51:22.920 --> 04:51:23.900 So, I'm going to go... 04:51:23.900 --> 04:51:24.980 Go congratulate them. 04:51:24.980 --> 04:51:26.040 Go talk to the team. 04:51:26.040 --> 04:51:28.000 I'm going to go ahead and see you all out. 04:51:28.020 --> 04:51:29.060 Just a quick summary. 04:51:29.060 --> 04:51:32.220 I think we've already kind of covered what's happening the rest of the day. 04:51:32.220 --> 04:51:33.540 We're going to go recuperate. 04:51:33.560 --> 04:51:36.420 We're going to fix our HDMI cables, so we'll come back with... 04:51:37.080 --> 04:51:45.180 Tomorrow, we'll hopefully have the ability to see both screens more effectively instead of having the flickering that we had this time. 04:51:45.440 --> 04:51:48.280 And we look forward to seeing eight challenges. 04:51:48.280 --> 04:51:49.140 We're going to have eight more rounds. 04:51:49.140 --> 04:51:50.440 We're going to finish up in the morning. 04:51:50.600 --> 04:51:52.420 Four more rounds of round one. 04:51:52.620 --> 04:51:55.060 And then, in the afternoon, we're going to move straight into round two. 04:51:55.060 --> 04:51:59.020 And we're going to go all the way from eight teams all the way down to four by the end of tomorrow. 04:51:59.020 --> 04:52:01.400 So, come back and see that long day. 04:52:01.400 --> 04:52:02.580 Look forward to seeing you then. 04:52:02.660 --> 04:52:03.840 Take care and have a good one. 05:04:01.080 --> 05:04:02.500 Bye. 05:04:02.500 --> 05:04:02.540 Bye. 05:04:03.060 --> 05:04:08.090 Bye.