start	end	text
256230	289530	A little pause... and we are back.
289530	290190	A little pause... and we are back.
319410	319550	A little pause... and we are back.
681220	684380	A little pause... and we are back.
1204780	1210240	Good morning and welcome back to day three of HackASAT here at DEF CON CTF30.
1210280	1211800	Let's get ready to do it.
1211840	1212460	Not HackASAT.
1212460	1213640	I did it!
1213640	1214720	I did it!
1214720	1216140	I was so afraid I was going to do it.
1216140	1217360	Welcome back to live CTF.
1217360	1219820	Listen, we're going to edit that on the VOD.
1219940	1221400	We're going to change it.
1221720	1227840	Welcome back to live CTF here at DEF CON CTF finals DEF CON 30.
1227920	1228800	Let's get ready to do it.
1228800	1231780	Let's let the teams get going for the semi-final round.
1232020	1237080	5, 4, 3, 2, 1, go!
1238240	1245840	Alright, so as you can see, we are starting to get a little bit tired here as we get towards the end of the competition.
1245840	1247980	But we are down to the semi-finals.
1248020	1251100	So we're going to have two semi-finals today and then the grand finals.
1251400	1253860	And these are important matches.
1253860	1259580	Looking at the current scoreboard of the DEF CON CTF, these points will affect the final standings.
1259580	1260780	Yes, absolutely.
1260780	1264040	We're at the point where both the point totals are going up,
1264040	1267560	the amount that teams are getting for making it further into live CTF,
1267560	1271660	and the teams that are here are all teams in the top half of the scoreboard.
1271660	1273740	And so this can change things.
1273740	1274700	It really can.
1274700	1278760	Let's just take a quick look at each of the teams and see what they're doing.
1278780	1281940	Starting over here with MMM.
1282780	1284760	Pulling up Gidra.
1284760	1288900	Is that what they were using in the previous matches?
1288900	1289660	I don't remember.
1289660	1292680	So they've changed their players before.
1292820	1295120	I think Jimmo was using Ida, but...
1295120	1296500	Yeah, Ida on Windows.
1296500	1297180	Yes, yes.
1297180	1302780	But we may have had Gidra before from Robert, so I'm not sure.
1305580	1307820	Let's check with Starbucks.
1307820	1311880	We can see a bit of Terminal, starting with Python.
1311900	1314140	Let's go ahead and tell everybody the name of the challenge,
1314140	1315180	the information on this one.
1315180	1317840	This is called AES of Spades.
1319400	1321440	Because really that's what it's all about, right?
1321460	1324500	It's very important that you get the good name, the good pun,
1324960	1326580	and then you figure out how to make a challenge out of it.
1326580	1331000	And I originally made this challenge, or I started making this challenge,
1331000	1334020	and it was in a messy state.
1334020	1338200	And then Josh came in and kind of salvaged it
1338200	1340420	and turned it into something that we see here today.
1340420	1344660	So I don't really know what the challenge is about,
1344660	1345720	except that as the name...
1345720	1346920	You know what it was about originally.
1346920	1347300	Yes, yes.
1347300	1349420	And it's changed, and so we're going to find out too.
1349420	1352320	Right. I mean, it does involve AES encryption.
1354020	1355420	That's definitely still there.
1355420	1360740	We can see, if we switch over to MMM's decouplation here,
1360740	1365580	you can see that AES-128 init and AES-128 encrypt.
1365580	1370460	So there is some kind of AES encryption thing going on here.
1370900	1379220	They are doing a little bit of decouplation,
1379220	1382920	trying to name the variables, making sense of what the program is doing.
1382940	1389360	So we've been told that basically it's an arbitrary write
1389360	1391780	dressed up with some AES encryption.
1391780	1394860	That's basically what the challenge is about.
1396000	1401520	If we switch over to Starbucks again,
1401520	1405760	we can see that they are using an online disassembler.
1405760	1407240	I thought that was a little unusual.
1407420	1407680	Yes.
1407680	1409600	I was a little surprised by that too.
1409720	1412120	So they are... I'm not entirely sure.
1412120	1414580	They are verifying a couple of...
1414580	1416380	Oh, they're doing some calculation with some offsets.
1416380	1418140	Trying to look at maybe some opcodes.
1419020	1423560	Or they are writing a little piece of shellcode.
1424320	1426560	You can see...
1427440	1430040	So they are putting together a small piece of shellcode.
1431340	1433120	They really need to learn Binja.
1433380	1435380	This is what Binja is really good at.
1435380	1438120	I'm trying not to do it too much, but I have to.
1438540	1440820	This is exactly the kind of thing it works really well for.
1440820	1443160	You can stay right in the one app.
1444360	1447020	So building up their payload using an online disassembler.
1447020	1448540	Online assembler, rather.
1449400	1451720	And there we go. We get a brief little glance at the source code.
1451720	1452420	And they're off again.
1452420	1457280	So this is interesting, because we can see that in contrast to MMM,
1457280	1460340	who started more analyzing the code,
1460340	1464120	they went straight into putting together some kind of payload.
1464900	1468580	You can see here their exploit scripts being put together.
1468580	1471060	There's some shellcode there that has been assembled.
1471060	1473580	I'm not entirely sure what the shellcode was doing.
1473580	1475160	I saw that it was...
1475160	1476640	It looked like a pointer address.
1476640	1479380	It was using some kind of pointer within the program.
1479380	1481120	And there was a syscall in there.
1481720	1483640	Maybe changing memory protections?
1484640	1488200	Well, it says it's code, and it looks like they're dropping...
1488200	1491340	Right, so it could be an mprotect plus shellcode, right?
1491340	1492100	Yeah.
1492520	1495520	Yeah, but the thing that had labeled code looked like it had a...
1495520	1496780	Is that a pointer?
1497520	1498780	No, we'll see.
1498780	1499280	I think it is.
1499280	1501660	If we do switch over to MMM,
1501660	1508860	we see that they've also started putting together an exploit script here.
1508860	1512880	You can see they have this calculateKey function.
1513620	1518920	I guess that in this program,
1518920	1525360	your resulting payload could be the result of the encryption.
1526540	1529360	I mean, I will say, watching Starbugs,
1529360	1532320	it looks like they know what they're doing.
1532320	1537620	They certainly are making an attempt to...
1538800	1543840	They're XORing the IV with their shellcode.
1543840	1544740	Oh, okay.
1544740	1548900	So that sure sounds like a thing that would be useful.
1549200	1549960	Yeah.
1550060	1550880	Yeah, so here...
1550880	1553460	Okay, so the payload is the IV.
1553460	1554260	Oh, interesting.
1554260	1559220	The IV that's used for the encryption is part of the payload.
1559220	1560580	So actually that makes a lot of sense.
1560580	1562240	We're seeing them XOR that in.
1562840	1563420	Yeah.
1563420	1565140	Yeah, they saw that very, very quickly.
1565140	1568600	Certainly faster than we could follow along as they looked at it.
1568600	1569540	It makes sense, though.
1569700	1574520	These are our top teams.
1574520	1575360	Oh, so actually that...
1575360	1575940	Where did that...
1575940	1576560	Oh, okay.
1576560	1577700	So that was memory.
1577920	1580420	That was a piece of memory that they pulled out of the binary.
1580700	1583520	And they're XORing that with the code, which is the IV.
1583520	1584120	Oh, okay.
1584120	1585120	That's interesting.
1585120	1587000	But it's actually interesting to see now.
1587000	1588600	So they are looking now in the debugger.
1588600	1594060	I guess they are now testing out their payload to see if it is working.
1594460	1597140	So this could be a quick one.
1597480	1598560	Yeah, could really be.
1598560	1601040	I mean, I'm not sure exactly how many steps there are to this.
1601040	1604440	But if we are already seeing some shellcode being thrown in there,
1604440	1608580	there might not be too many steps involved here at all.
1608800	1612000	If we switch over back to MMM,
1612000	1615140	we can see that they also have this calculation function.
1615140	1617080	They put a bunch of A's and B's in there.
1617080	1619560	And from that, they're calculating a key and an IV.
1620600	1624420	And we can see they're starting to put together the interaction to send this key,
1624420	1627280	send the IV, receiving an address.
1627280	1629680	Maybe it's like a leak, like an intentional thing.
1629680	1630940	We would just give them something there.
1631060	1634920	Yeah, and I don't see them yet creating that key.
1634920	1637080	So if I'm looking at this now, it looks like Starbucks is a little bit ahead
1637080	1640600	just based on how they've already got the memory address pulled out.
1640600	1642720	They're XORing the IV, which is their code.
1642720	1644440	So I'm seeing that.
1645500	1647740	That looks certainly further along.
1647960	1651960	And we did see Starbucks show up earlier into that payload and start it.
1651960	1655100	That said, I would say that the first person to start writing their payload script
1655100	1656980	has not been an indicator of success.
1656980	1659540	It's been sometimes slow and steady wins the race,
1659540	1662020	and sometimes quick to get your script out does.
1662020	1663480	And so it's not made consistent.
1663480	1666500	We saw MMM here testing their payload.
1666500	1672200	I saw them connecting to a local setup of the challenge.
1674600	1677320	It was not a successful exploit, at least.
1677320	1677920	That's all I know.
1677920	1683360	It was hard to tell to what extent it was successful or not.
1683360	1686080	The further along we get in this competition, the more we need pause
1686480	1688960	because these players are so fast.
1689320	1691260	Just trying to kind of keep up with them.
1691260	1696340	We did see some of the classic AAAs being put in on Starbucks just a second ago off camera.
1696340	1700140	Right. They're also checking memory mappings there, was it?
1700500	1704900	Yeah, I don't know if they're searching for their values that they sent in.
1706600	1707560	Right.
1708960	1713900	So just to do quickly a little bit recap of where we are in the tournament.
1713900	1716960	This is one of the first semifinals between Starbucks and MMM.
1716960	1721760	And then right after we will have the second semifinals between Perfect Root and Wreck-a-Pig.
1721760	1726360	And the winners of those respective matches go to the finals.
1726360	1726960	Yep.
1728700	1736220	And these teams, I'm trying to look over a little bit at the scoreboard of the main event.
1736560	1744300	And yeah, these are all in the top half, at least, of the scoreboard.
1744300	1746780	Actually, Wreck-a-Pig might not be.
1747840	1753480	So in order relative to one another on the top scoreboard, MMM isn't in number one.
1753580	1757420	But Perfect Root is in number four.
1757420	1760380	And I would say they're within striking distance.
1760380	1765040	So at four, they're about 4,000 points behind MMM.
1765500	1767220	Actually, a little bit less. They're almost about 3,000.
1767220	1769180	And it depends, though.
1769180	1773940	If MMM wins this, they've basically fended off any attack, even if they lose in the finals.
1773940	1778140	I don't think anyone will be able to close the gap to them based on this event.
1778380	1782260	But if they lose now, and Perfect Root ends up winning in the finals...
1782680	1783920	That's going to put it real close.
1783920	1785100	It's going to put it very, very close.
1785100	1786920	And it will really depend on how they do in the main event.
1786920	1789240	Right. Let's not forget that they have almost...
1789240	1790780	Well, it's like a couple of hours.
1790780	1792240	It's three and a half hours of this.
1792480	1794300	Exactly. Left in the game here, too.
1795360	1797760	So definitely really exciting.
1798860	1805960	It's always fun when the competition is not decided until the last moment.
1805960	1806960	It can go down to the wire.
1806960	1809340	You want it to be... I mean, as an organizer, you want it to be.
1809340	1811220	As a player, you would love to win it early.
1811440	1812840	Sure, sure, sure.
1812840	1817500	When you're playing a CTF, how many times have you not been thinking,
1817500	1820220	like, oh, can we just not solve all challenges so I can go to bed?
1821380	1824420	But yeah, that's not going to happen in the Def Con CTF.
1824980	1829360	Okay, yeah, so I'm seeing Starbugs over here is definitely continuing to tweak their script
1829360	1834240	by pulling out the memory address that they're using.
1834240	1838240	They're verifying that memory and updating the IV that they're storing.
1838240	1839840	Yeah, you can see a syscall being made there.
1841000	1843880	And then they are trying to figure out what happens afterwards.
1843880	1847140	Oh, is that it? This might be it. Are we switching over to live?
1847800	1849480	Oh, did it work?
1849920	1851680	They look like they were...
1853100	1858300	This is going to be... I mean, it's going to be tight.
1859460	1863180	I think both teams have pretty good progress on this.
1865340	1868760	So, yeah, no, they have some bad instruction there.
1868760	1869640	There's something wrong.
1869640	1870440	Yeah, there's a bug earlier.
1870440	1873440	There's something wrong in their exploits.
1873900	1876980	So, not there quite yet.
1876980	1879160	They're going back to the assembler.
1879160	1880740	Oh, they switched it to...
1880740	1882720	Oh, there was a typo there.
1882720	1888200	They missed a zero at the end of an immediate value.
1888320	1890660	And so everything was shifted off, so the value was wrong.
1890660	1891460	And this is the thing.
1891980	1893140	That's the little bug.
1893140	1893660	Oh, here it is.
1894020	1894860	Hold on, hold on.
1894860	1895460	Did they just switch?
1895460	1897000	They just switched to throwing live.
1897500	1898780	They went through it live.
1899340	1900440	Are they going for it?
1901180	1902320	Oh, they are typing.
1902320	1903160	It's going fast.
1903160	1904080	I'm just checking here.
1904080	1904780	Oh, no.
1905580	1906100	They're...
1910850	1912810	Oh, they're going, they're going.
1913730	1915650	Oh, it did not work.
1916870	1918570	No such port.
1919730	1921590	Here it is, here it is, here it is.
1923630	1924590	Oh, typo.
1924590	1925310	There it is.
1925310	1927050	Starbucks, congratulations.
1927270	1928510	Well done.
1928570	1930990	A super fast speed race.
1930990	1932650	Well done on the challenge.
1932650	1934130	Ace of spades.
1934150	1936930	Congratulations to Starbucks who makes it to our finals.
1936930	1939310	We'll see you back here for our next round.
3244400	3245840	Bye.
3245840	3246080	Bye.
3246080	3246580	Bye.
3304870	3306010	Bye.
3306090	3314990	Bye.
3318190	3318650	Bye.
3318650	3322650	Bye.
3988580	3991980	Hello and welcome back to our second semifinal round.
3991980	3993580	I'm CypherTex here with Zeta2.
3993580	3994040	Hello.
3994040	3994900	I introduced you, sorry.
3994900	3997580	And on the line we also have LiveOverflow.
3997800	3999260	Hello, I'm back.
3999260	3999680	Excellent.
3999680	4003900	So we got a three commentator matchup today as we get closer and closer to the finals.
4003900	4006500	Here we're going to have Perfect Root and Wreck-a-Pig.
4006620	4008140	And let's just go ahead and count them down right away.
4008140	4008760	Everybody.
4009360	4014460	Five, four, three, two, one, go.
4015120	4016760	And we'll quickly switch over to the teams.
4016760	4018980	They are ready for this challenge.
4019140	4020300	Yeah, we saw.
4020300	4025080	So they've been given the name of the challenge, Loopy Brain, which...
4025080	4026380	And they were told it was an interpreter.
4026380	4027120	All right.
4027120	4028900	So where does that take us?
4028900	4035000	I think also the menu is immediately telling the teams what it is about.
4035000	4035600	Yeah.
4035660	4038320	They definitely knew what sort of challenges it was.
4038320	4045940	In fact, we even saw one of the teams beforehand where the web page opened with the spec for that particular flavor of language.
4047000	4048520	Both flavors of language, I guess.
4048520	4048880	Right.
4048880	4049800	I saw.
4049900	4053420	I was also actually looking at one of the competitors' computers before the start.
4053420	4060860	And they had in their exploit template, they already had helper functions for BrainFact code.
4060860	4062340	So, yeah.
4062340	4064500	They're taking this seriously.
4065340	4066340	So, wait.
4066340	4067420	Did I get this correctly?
4067420	4071020	You mentioned them the name and they immediately knew it was about BrainFact before?
4071020	4071520	Yes.
4071520	4073680	They knew before they even showed up.
4073680	4075300	They were ready.
4076360	4079360	Oh, you told them way in advance the name of the challenge?
4079360	4081420	We do tell every team the name of the challenge, yes.
4081420	4084180	Like an hour in advance because we want them to send up the right person.
4084180	4084740	Okay, I didn't know.
4084740	4086820	I think we had a problem with our stream capture.
4086820	4089180	We may have been having some glitches there, but I think we got it all straightened out now.
4089180	4090200	Yeah, it seems good.
4090200	4090820	Right, yes.
4090820	4092740	A little bit of a visual artifact there.
4092740	4094920	So, if you're on the stream, we should now be up.
4094920	4096220	Okay, so let's go ahead and take a look.
4096820	4098860	Again, they know that it's an interpreter.
4098940	4100480	They know that it's pwnable.
4100920	4103640	And I think this is actually a category of challenges that's been around for a long time.
4103640	4111680	In fact, we were looking and we realized that a friend of ours had written a version of this nine years ago for another CTF.
4111680	4112980	It was a different challenge.
4112980	4114440	Yes, but it has a lot of similarities.
4114440	4115280	Very, very similar.
4115280	4116380	Yeah, so we thought it was really funny.
4116380	4118240	It's a common idea.
4119140	4123420	Difficulty-wise, since, Carl, you wrote this, how would you rate this one relative to some of the other ones?
4123420	4129060	So, the original version of this was kind of difficult, I would say.
4129060	4133560	And then we toned down the difficulty a bit.
4133620	4138800	So, I would say it's still definitely not one of the easiest challenges we've had.
4138900	4142560	But I hope it's not one of the most difficult ones either.
4143060	4147980	I had a quick look at it and immediately I thought, oh, that's going to be an easy challenge.
4147980	4155240	Until I heard about or noticed a little twist that's in this challenge that does make it a little bit more tricky.
4155240	4156720	Yeah, go ahead and describe what you saw.
4156720	4162460	Because I think for the stream we're going to give them the pleasure of knowing what's going on, even as the competitors are having to figure it out.
4162760	4165940	Yeah, maybe I should mention what BrainFuck is.
4165940	4169700	It's an interpreted language that is working on symbols.
4170280	4175300	You have, like, imagine a big field or something.
4175300	4178020	And then you can move a cursor to the left, to the right.
4178020	4181240	You can increment, you can decrement a certain field.
4181880	4190680	And essentially here the movement on this big array has no constraints.
4190680	4193020	So you can have out-of-bounds reads and writes.
4193020	4196560	And so it should be pretty easy to go out-of-bounds.
4196620	4199700	I don't know if that field is on the stack.
4200020	4202300	No, it's on the stack, yeah.
4202300	4214480	Looking at it, you can just increment the data pointer outside the bounds of the data area into the return pointer and you're done, right?
4214820	4216580	Right, and that's what I thought.
4216580	4221460	Oh, they should figure this out very quickly and it would be quickly done.
4221460	4226940	Then it's just about the tooling to get the BrainFuck program to manipulate the memory in the correct way.
4226940	4232040	However, there's a size restriction on the BrainFuck program.
4232040	4236520	And that makes it significantly more difficult.
4237020	4239780	So like a lot of exploits, you're in a constrained environment.
4239780	4242460	You've got a small bit of shellcode or a small payload.
4242800	4246440	So what are you going to do with that?
4250200	4251300	Yeah, go ahead.
4251440	4257160	The players are looking for something to loosen their constraints.
4257960	4260140	And these things can get creative.
4260140	4263500	There are many ways how one could do that.
4265000	4269100	Maybe you can change the accepted size.
4269100	4279180	Maybe you can override the return pointer and find a very useful gadget in an interesting way.
4279180	4286820	I mean, it's a limited BrainFuck program, but with some creativity, they could find some very interesting exploitation paths for this.
4286820	4288720	It's a little similar to the involvement challenge before, right?
4288720	4293700	Where we actually had a simple command injection, except it was too few characters.
4293700	4297760	And so they had to use one of the other vulnerabilities to make the limit larger.
4297760	4300740	And then they were able to use the original kind of design.
4300740	4301640	Right, a lot of similarities here.
4301640	4309940	And I think a key thing here is that the data array sits just after the program array.
4310180	4311120	That's the key insight.
4311120	4318980	When we see them naming data and code and noticing they're adjacent to one another, that's going to be the point at which we know that they're on the way to figuring this out.
4318980	4325660	If we look here at EurekaPigs, who someone says how it's pronounced in the chat, if that's correct.
4325660	4327760	Yeah, I'm not sure exactly which one it is.
4327760	4333580	Yeah, we've been saying RekkaPigs throughout the tournament, but it might be EurekaPig because they're from the team Eureka.
4336980	4338200	That sounds good to me.
4338200	4339220	Yeah, sounds good.
4339220	4343840	Anyway, what I was going to say was that they saw that there's a win function in the program.
4343840	4348100	So they don't need to do a full exploit chain like a ROP chain or something like this.
4348100	4353180	They just need to take control of the instruction pointer and point it to the win function.
4353180	4356220	Yeah, there's different things to make it easier or harder.
4356220	4365300	And this one we already knew the challenge itself had enough difficulty with it that we wanted to make it a little bit easier once they had the ability to change a pointer, for example.
4365940	4366720	Right.
4367760	4377660	We also can see the interesting setup from RekkaPig with the interesting Windows 7 VM with all the reversing tools.
4377660	4377800	Yeah.
4377800	4380660	Not even full screening it, just like working in...
4380660	4387420	I don't need the full resolution. Two star bars are fine for me. I know. I'm impressed.
4387420	4395420	It feels a little bit like a handicap, like they're playing with the difficulty set to high just to flex.
4396600	4400420	Just switch over to Perfect Root here. I see a lot of blue stuff on the screen.
4400420	4411400	Yeah, so they've actually opened up the file in Vim. So they're hex editing the challenge to change the LD string? I don't think I've seen that before. It looked like they were changing...
4411400	4415480	Oh, right. It might be to make it easier to run the challenge locally.
4416200	4418060	Oh, modifying it to their version.
4418060	4420600	Yeah, you can see that it seems to be running now.
4422780	4427300	So did they also have problems with the version?
4427300	4431720	Yeah, I think it was the version of the loader is different than the one on their box.
4432480	4439240	So we actually give the loader with everyone. So you can, what the other teams demonstrated earlier, which actually Gamoza wasn't even aware of,
4439240	4447500	that you can run the loader as an executable and then pass it the argument of the application and it will still run it, which is basically what the kernel does for you when you execute it.
4447500	4457080	So instead of doing that, they just literally put a bunch of forward slashes into the raw string using Vim, where the reference to that library was,
4457080	4462380	so that it would use the local one that they had instead of the one on the original system.
4464620	4468460	I want to switch back over to Recapig.
4468780	4475100	You can see them running the debugger here as well with the challenge.
4475100	4482380	And you can see a little bit there in the background, you can barely see it, but they have this script and you can see all these like deck pointer, ink val, deck val and so on.
4482380	4485340	These are the helper...
4485340	4486580	Yeah, operations.
4486580	4491160	Yes, and you can also see that they had a comment in the code with the dot slash submitter too.
4491160	4495720	So they already have the string, the thing they have to run to win.
4495720	4499860	So they're trying to make all the different time savings.
4499860	4503300	Yes, they know that this can be tight since we are...
4503300	4505080	Seconds have literally mattered.
4505500	4511020	I was wondering, what are the rules if one team is accidentally running submitter with the wrong team number?
4511020	4515120	Then that result stands. So if you make the other team win, the other team wins.
4515120	4516580	We have told the teams this.
4516580	4520260	We did debate that and we told them that that was going to be the way that we would do it.
4520260	4522560	So be very, very careful with your...
4522560	4525980	And I will say, the risk isn't as bad as you might think.
4525980	4533580	Only because each team, when they first connect to the server, they choose their team and it gives them their exact information.
4533580	4537860	So most of the teams click their team name and then just copy and paste all the information from there.
4537860	4538260	Right.
4538480	4540040	Haven't had anybody mess it up yet, but...
4540720	4540920	No.
4540920	4541460	Yeah.
4541480	4548800	My fear there would be that someone would keep their templates from a previous match and then reuse it or something like this.
4548800	4548900	Yeah.
4548900	4551640	Maybe for next time we should have not just one or two, but a small...
4551640	4554860	We should match with the global IDs of the...
4554860	4555520	Yes.
4555520	4557640	My team has an ID on the DefCon network as well.
4557640	4558080	Yes.
4558460	4560300	We should do something like that.
4560300	4561500	Lesson learned for next year, yeah.
4561500	4567480	There are a lot of things we can improve, but I think it's been running pretty smooth, this whole thing.
4567480	4572920	I hope you've been enjoying it, the people who have been watching throughout the weekend.
4572920	4577100	So I haven't seen anybody yet figure out that first constraint, right?
4577100	4581060	I don't think I've seen anyone get their way out of...
4581060	4583660	Well, we can switch over here to...
4583660	4590320	It might be difficult to assess if they have seen it, because it's like a mental note they would make themselves, right?
4590320	4590760	Right.
4590760	4597160	We would have to look at when they start writing BrainFuck if they realize that they are constrained or not.
4597260	4600840	Right. And that's what I wanted to point out here on Perfect Root's screen.
4600860	4607920	So they tabbed away from it now, but just when you switch it, you can see that they had this small program with a loop and the input...
4607920	4609340	Right there. The P equals.
4609340	4610040	Yes.
4610040	4618940	You see the comma is the input. It will take one byte input from standard input and write it to the current cell on the tape.
4618940	4622960	And then the brackets are a loop. So they are...
4622960	4628580	They're kind of... I think they're going... You see the input in a loop thing going on.
4628580	4631580	So that's definitely on the right track.
4632980	4637780	Though I think they want the greater than sign rather than the plus sign.
4637780	4637940	Yeah.
4637940	4641040	But maybe they have another idea.
4641540	4647020	There are probably a lot of different solutions to this challenge, but you need to escape that initial constraint.
4647560	4655160	Yeah. And letting it overwrite into the next buffer and then getting the interpreter into that buffer...
4655160	4656320	Right. So there are like...
4656320	4658620	...is probably the main bug.
4658620	4659380	That's the bug.
4659900	4660640	Exactly.
4660640	4662700	Well, there are essentially two bugs, right?
4662700	4665320	It's the one that LiveOverflow mentioned initially here.
4665320	4671100	You can increment or decrement the data pointer outside the data region.
4671100	4671540	Right.
4671560	4678060	But then to be able to have enough code to do that in the first place, you need to escape this nine-character program limit.
4678160	4684780	And the way you can do that is you can actually get the instruction pointer to jump into the data region.
4686700	4690540	So they're going to stage up their shellcode. That's what we're looking to see.
4690540	4696560	If we don't see that in the next five minutes or so, I think we're going to want to give them a hint on that one.
4696560	4702480	Because we're going to want to see somebody with that second stage, because they still have even more to the challenge even after that point.
4702480	4705960	So we'll see the exact timing and we'll figure it out, but there's more work to do.
4705960	4712300	So this one is, again, this one's a little on the harder side, but it's also super interesting that they have to kind of like chain these things together.
4712300	4724540	Yes, so we can see here on Rikipix, the assembly, you can see that they're looking at the reading of the program.
4724540	4729840	Like when they're reading in the program, they're looking to see if they can smuggle.
4729840	4741380	For example, they saw that we're using the string length function there to maybe check if they can smuggle like null bytes or something into this.
4743180	4747660	Yeah, not exactly sure where they're going there, but just looking more into the...
4747660	4752840	You can see now, they have the cursor basically on half the bug there.
4752840	4761880	You can say that the loop of the interpreter keeps going specifically until the program counter.
4761940	4767980	Usually in a situation like this, you would have like a comparison be like program counter is less than the end.
4767980	4772280	But in this case, it's program counter not equals that specific size.
4772280	4778020	So if you manage to get the program counter larger than 9 in this case, it will keep going.
4779120	4782900	Yeah, so that's part of it, but then how do you get it past it in the first place?
4782900	4784840	So that's the other thing that they still have to find.
4784860	4795320	I also just noticed that I have seen the source code and I didn't quite realize at the moment, but I'm seeing it here in the disassembly that the size is hard-coded.
4795320	4798520	So it's not a variable that they can easily change.
4798520	4801920	So it is definitely a bit more tricky to escape that.
4801920	4809920	In my mind, I thought they can change that limit from a variable standpoint, but it's definitely hard-coded.
4809920	4813960	So it's right there as an actual value.
4813960	4817600	Yep, immediate right in the compilation.
4821860	4824420	That might be quite tricky.
4824420	4826780	Oh, they found a bug here on perfect root.
4826780	4827500	Yes, I see that.
4827500	4836400	If you saw there very briefly in their small initial payload, you saw that they had an unmatched opening loop bracket at the end of their code.
4836400	4838180	And that is exactly the bug.
4838180	4850580	So if you have an unmatched bracket, the subroutine that handles the loop, when it sees that initial bracket, it will then keep searching forward.
4850580	4853240	And it doesn't stop at the maximum limit that it should.
4853240	4856500	Exactly, because that check is in the outer loop.
4856500	4859600	It's handling that particular bracket.
4859600	4863320	Yes, and it will just keep going until it finds a matching end bracket.
4863320	4872740	So you need to first write a right bracket into the data section, and then have a left bracket in your code.
4873000	4874320	And then the program counter will then...
4874320	4881400	And just to clarify, when you say data section, it is specifically the buffer in memory that is for data.
4881400	4883020	Right, I'm not talking about...
4883020	4884800	The actual data section exists in the ELF.
4884800	4889920	No, I'm talking within the brainfuck context. We have the program and the data.
4891520	4897340	Excellent. So I would say perfect route, well underway, no hit needed, perfect timing.
4897440	4904180	That is great to see, and we're just looking to see if RikaPigs can catch up.
4904180	4907480	Which, certainly there's still a lot left to go, so it would be impossible.
4907480	4913080	In the previous matches RikaPig has shown, they spend a lot of time in IDA,
4913080	4916800	and it always feels like they are behind, because they are still just reversing,
4916800	4918500	they are not working on an exploit.
4918500	4922920	But then suddenly they start crafting their script almost blindly,
4922920	4925500	without really a lot of testing, it seems like.
4925500	4930700	And suddenly they really run full speed.
4930700	4935180	Yeah, exactly. Very different styles, you see a lot of both.
4935680	4944220	You can see that they are, I think, looking at the GOT table, and now back to the interpreter.
4945400	4949560	I haven't seen that much of their exploit script yet, so as I said,
4949560	4954820	they're just really looking at the code, trying to figure out what's going on.
4957620	4960320	Yeah, feel free to hang out with them for just a little bit too,
4960320	4962000	we'll wait and see if they bring up their code.
4962000	4966180	You might catch a glimpse of that, I'll keep an eye on Perfect Root,
4966180	4968680	let me know if something's happening over there.
4973740	4979160	This is really the situation where you would want to be able to read the minds of the players.
4979160	4981400	We just got a pause time, go over there and ask them,
4981400	4984000	what are you thinking right now? No problem.
4984180	4985920	That's surely going to be appreciated.
4986080	4988520	I'm sorry, can I interrupt you for a moment?
4988520	4991220	Just want to reel your train of thought, will it?
4991220	4997560	Right. But it feels like they have not quite seen this loop bug yet.
4997560	4999400	That's my impression.
4999740	5006740	When you do programming or reading assembly, when you have experience,
5006740	5011960	you have this mental model and you can really reason about the code that is happening,
5012520	5015660	but Brainfuck is a language you usually are not used to.
5015660	5022500	So now, not only do they need to craft the Brainfuck program,
5022500	5026640	but they have to craft a very small buggy program that does something interesting
5026640	5030480	and reasoning about this little code, condensing it down,
5030480	5036280	these kind of abstraction layers you have in your mind when working with code bases and so forth.
5036280	5039820	This is all missing with Brainfuck and I think that is really difficult to do,
5039820	5041300	especially under pressure.
5041300	5047620	Yeah, definitely. When I was creating the reference solution for this,
5047620	5052720	there were several moments where I went like, oh, I'll just do this.
5052720	5057280	And then I realized that doing this is something that would be trivial
5057280	5061180	in a normal programming language or anything.
5061400	5064960	But in this context, it's actually quite a hassle.
5064960	5067360	Yeah, and you're kind of merging these two contexts too, right?
5067360	5072520	And this is actually really interesting, because while this is clearly a toy language and not real,
5072520	5075860	it very much models what you see in a browser in JavaScript,
5075860	5080460	where they have a virtual machine, they have often multiple interpreted languages,
5080460	5084580	and you are both working within and outside of at the same time.
5084580	5087380	So you have to work within the memory model of the native program.
5090420	5094560	So I think because we're seeing progress here on PerfectRoot,
5094560	5096220	we're good without a hint.
5096220	5098540	They don't seem stuck.
5098540	5102720	They seem like they know what certainly the first challenge is.
5103040	5105440	And Recapic's still got time to catch up.
5105440	5106600	So I think we're okay.
5106600	5107940	Yeah, checking with the...
5107940	5110620	We also do have a little bit of extra time too, between this match and the next one.
5110620	5110900	Right.
5111160	5113320	I'm not sure if you mentioned it also.
5113640	5119780	I know you did with the unmatched loop variable that PerfectRoot has already in the code, right?
5119780	5121000	Yeah, exactly.
5121000	5121980	So you can tell there...
5121980	5125940	And you can also see there was some debugger output there
5125940	5127580	when they were looking at the memory.
5127780	5128420	And they're right here.
5128420	5130480	You can see all those three E's.
5130780	5136060	I think, if I remember correctly, that corresponds to a dot, right?
5136060	5137300	Yeah, a dot's two E's.
5137300	5138580	No, or is it the greater?
5139080	5141040	It's one of the relevant characters in this.
5141040	5142800	And you can see that there are way more than nine of those.
5142800	5143940	I think it's going to be the greater thing.
5143940	5145160	Because they've got the greater than times 128.
5145160	5145980	All right, you can see that in the payload.
5145980	5147340	They're writing in a lot of greater than.
5147340	5150800	Oh, and this is exactly what they need to do for the stage two.
5150960	5151820	This is exactly what...
5151820	5155260	Move that pointer all the way over into a return address or something else.
5156080	5157300	So they're definitely on the way.
5157300	5158660	So I think they're just calculating offsets.
5158660	5160580	They're just trying to figure out how far to move it over.
5160580	5160980	Right.
5160980	5163080	And then they need to figure out how far they need to...
5163080	5167280	or what they need to increment to get that original return address over to the win function.
5167280	5173000	Yeah, so the idea here is that you walk the data pointer over to the return address.
5173000	5174620	Pi is enabled.
5174620	5189100	So they will have to print the current return address on the stack.
5189380	5191600	Print the current return address on the stack.
5191820	5195700	Use that to calculate the address of the win function and then write back the new value.
5197360	5201800	Or a partial overwrite of the return address might also work fine.
5201860	5203240	Yeah, a couple of options.
5203240	5209380	Just for clarification again, what we are seeing right now with the BrainFog program from PerfectBrute.
5209540	5213500	They have an input loop. The comma is input.
5213820	5220720	So basically they have a loop that keeps wanting to get input data.
5220720	5224760	And then they send that and that causes writing more of the code.
5224760	5231100	And then the original program has the open bracket which is now matching what they were inputting later.
5231100	5239920	Yeah, so because they put another bracket later, the part of the program is looking for that match to jump over the end of the code.
5239920	5245040	And when it finishes in the data, the later on check that says, am I equal to the end?
5245040	5248500	It says, no, you're not equal to the end. Keep going. This is fine. And it continues to interpret.
5248500	5254020	And the additional data got in there through the input loop.
5254020	5256020	Came in through all those commas, exactly.
5256020	5264600	And you can see that the second phase there in the exploit script, it starts with a closing bracket to attach that jump.
5264600	5266120	Because otherwise it's going to go right past it.
5266120	5270920	The piece of code that's looking for the matching bracket just keeps going until it's either there or hits the end of the memory page.
5270920	5271620	Something's weird going to happen.
5271620	5273800	Yeah, exactly. So it's not going to do what you intend.
5274200	5278100	So they definitely know what they're doing here.
5278260	5284960	They just need to figure out the details here.
5286440	5297360	We're having some discussion in the chat here about the Google CTF Accelerate competition that I was involved with and a lot of my colleagues.
5298560	5303920	There are similarities to this, but there's the game hacking element to it as well.
5303920	5305380	It is a visual element, which is nice.
5305380	5309380	Right, yes. And we will be hosting that as well in September.
5309520	5312160	People are asking for videos. Are videos from 2021 coming out?
5312160	5322240	They are coming out. There was a lot of work. There were people getting long COVID.
5323540	5330160	There were a bunch of unfortunate events, but the video files still exist and we will release them.
5330160	5330740	Not lost, they're coming out.
5330740	5336020	No, no, no. We have them. I have a spreadsheet tracking all the different video files. They will be released.
5337100	5343960	Keep an eye out on social media for the Accelerate information as well. That's going to be super fun.
5343960	5345920	We're actually doing it on-site this year.
5345920	5346440	Very nice.
5346440	5351300	Trying to bring a bit of an eSports vibe to it as well. I think that would be super cool.
5351720	5359580	Fantastic. It's really exciting that we're seeing more and more of these events that try to let you see inside the hacking as it happens.
5361280	5365660	I guess it's not a coincidence then that those of us that are involved in it tend to be involved in multiple things too.
5365660	5376180	Yes. I would say the area of security, live hacking competitions. It's a very small field.
5376180	5376520	It's pretty niche.
5376520	5377360	Yeah, very niche.
5377860	5385260	Alright, so we've changed up the code a little bit. We've got our ending bracket. We're going to move the pointer just a little bit extra.
5386300	5395260	But that's actually... Is the problem that the data pointer and the instruction pointer are essentially overlapping right now in their code and they're trying to...
5396440	5403880	Yeah, this is exactly what I think LiveOverflow here you were talking about.
5404560	5412780	You need to create this mental model of these two pointers walking this buffer and it's not really something that you're familiar with.
5413500	5421400	So I'm just looking at this. My guess is that you can never win this race though, right? Because a single byte is a single byte.
5421400	5428360	And so if your data pointer and instruction pointer are the same and you're going to move them both the same rate, wouldn't you have to put it into a loop that would do it faster?
5428360	5436880	That's how I did it. I basically just had a loop that went on until... I had an input loop and then until I sent a null byte it would stop.
5436880	5446800	Yeah, I think they're going to need something like that because I think essentially just putting a bunch of move rights is going to increment both the program counter and the data counter at the same rate.
5447040	5450140	And so you're never going to win that race because they're both moving forward at the same rate.
5450680	5458760	I guess that would be different if each byte was stored in a bigger structure, like it was a DWORD or something like that. You might be able to misalign them differently that way.
5460160	5468480	So I think until we see that, they're going to be stuck on that stage unless I'm misunderstanding where that is at.
5468480	5473000	Are we seeing anything from Recapix? Because they have some ground to gain.
5473000	5477700	They have been staring at the IDA code still, I think.
5478000	5484760	I do wonder what they are thinking because they must see that they can move that array out of bounds.
5487360	5490740	It's too easy. They for sure have to know about it.
5490740	5497520	It's hard, though. When you get put in the spotlight, sometimes something that would be immediately obvious if you were sitting at home.
5497780	5506460	But I do wonder if they have seen the restrictions and they understand, okay, we can't actually pull it off and maybe they are hunting for a second bug.
5506920	5513800	And maybe playing around, they could notice it, but I think they are just in their head trying to figure it out.
5513800	5522820	Yeah, that's a good point, too. Again, it's what we saw earlier. Maybe they are trying to just put this together in a one shot as opposed to build a small piece, test it, build a small piece, test it.
5523580	5529480	Speaking of mental models again, you can see that thanks to how the program was compiled.
5529560	5535940	So if you look at the source code, the program array and the data array, there are two separate...
5535940	5536780	Oh, there we go.
5536780	5537760	Oh, nice.
5537860	5539460	That's a good looking one.
5543800	5548580	They are looking at the definition here. They are looking at the loop construct.
5548580	5553740	Yes, that is an interesting thing to look at. I think that's a fantastic thing to be looking at.
5554000	5565680	And look how they write the code here. They write it in pseudocode and probably translate it then into brain truck code because this is just easier for them to reason about what they are doing.
5565680	5584160	However, I do wonder if they missed then this trick with the keeping open bracket because that is something you can reason about in a brain truck program that's moving the cursor forward while a dangling open bracket is not something you would maybe think about.
5584180	5591320	No, if you were writing C and you would have an unmatched bracket, your code wouldn't compile. So that's like it's an error, you fix it and then you're done.
5594780	5601580	So I was saying that in the source code, the program array and the data array are the two separate variables next to each other.
5601580	5611800	But the way this is compiled, if you look at the decompilation, it looks like one array and then there are a bunch of offsets sometimes when this is being accessed.
5611800	5620760	So that can make it a little bit harder to reason about this. You need to detangle this and say, no, this is not one array. These are two arrays that happen to be next to each other.
5620760	5629340	Yeah, and that's the part that I think we're still not seeing perfect root kind of pieced together because they're trying to treat them independently without realizing that I think they happen to be overlapping.
5629340	5635680	They believe they've calculated the distance correctly, but I think that all they're going to end up doing is overwriting.
5636060	5644100	If they put too much data in, they're going to end up actually just overwriting the return address with their data, which won't help them.
5644940	5651800	Because they're not going to be able to write the proper values. They're all going to be things that happen to match these characters.
5654220	5664320	Perfect root is going for here now testing writing arbitrary bytes instead of increments with the input command, which obviously would save space.
5664900	5670160	Yeah, I think they came to that conclusion as well and realized, oh wait, let's just put the direct value that we want over top of it.
5670160	5677120	Again, I think that the only piece they're missing is that they need to be able to increment the pointer more efficiently.
5677300	5677660	Yeah.
5677660	5683960	Sorry, increment the data pointer. They need to be able to move the data pointer to the right without having the code pointer move at the same rate.
5683960	5689540	And so once they put that together, they should basically be done.
5689540	5692020	So there are basically two ways you could do this.
5697740	5698620	I think...
5699840	5700720	No.
5701780	5702740	It's a fundamental flaw.
5702740	5703200	They need a loop.
5703200	5704160	They have to have a loop.
5704160	5710700	Yeah, I thought that they could have stuff before the closing bracket, but that's the wrong direct. That's the other way around.
5710740	5715720	Right, right. It will be after that. It doesn't matter. The closing bracket always begins. It just makes the problem worse, in fact, if you do that.
5715720	5722260	Yeah, exactly. So yes, they do need the loop. And this is exactly the type of problem you would face here.
5722300	5730340	You're thinking like, oh, I'll just overflow the buffer. And then it's like, oh no, wait, but I'm kind of like cutting off the branch I'm sitting on while I'm doing it.
5730340	5732560	That's a great analogy. Yeah, it's a great analogy.
5734660	5744420	All right, so there is a chance that we need to give different hints, potentially. Maybe if they're both stuck and they're both not making progress, we need to give them each a relative hint.
5744420	5752480	I'd hate to do that. I would really prefer to give the same information to both. But if we end up... I think we're still okay on time. And so I don't think we need to immediately do anything.
5752660	5754400	But just something we got to kind of figure out.
5754400	5764060	Yeah, Recapig was highlighting the limitation of the length. So I think they are still struggling with...
5764060	5772420	Yeah, I think they need to get past that initial hurdle. And Perfect Root is just really still stuck on this one. But we have time, I think.
5772420	5779360	And honestly, Recapig could come to this realization and still catch up to Perfect Root. That is absolutely still possible here.
5779360	5787040	Maybe their mental model is already much further. I don't know. They spent a lot more time in IDA, so maybe they figured out the array situation.
5787040	5792080	Right, maybe they would better understand that and be able to create that loop to get them past that point.
5797630	5803890	I will say, though, that what Perfect Root is doing makes a lot of sense in terms of analyzing things in the debugger while they're doing it.
5803890	5814150	I think what they need to do is to track the variables that represent the pointers for the data and for the code in the virtual machine itself.
5814150	5822190	I think that would really help them realize this. So what they keep looking at is just the raw stack frames, basically. Just the raw data where everything lives.
5822190	5829410	They're not looking at what is the pointer for the code and what is the pointer for the data and what's happening there.
5829410	5836210	So I think checking that in their debug script each time would probably make it click for them, what they need to do.
5836930	5842670	But we'll see. We did get a question in chat. Actually, I would love to hear both y'all's opinion on this.
5842670	5846510	Somebody says, how can I start learning CTF? What do you guys each recommend?
5846510	5851610	That's a great question. Yeah, LiveOverflow, what's your take here? Let's start there.
5852370	5856550	Well, I hope my videos help. I have a binary application playlist.
5856550	5862550	And other than that, my go-to, because I learned by doing it. I didn't have videos.
5862550	5868930	So recommending the way I learned is through wargames like OverTheWire or PicoCTF.
5868930	5874430	I haven't done PicoCTF myself, but that seems to be an amazing resource everybody recommends.
5874430	5879850	And OverTheWire, these are the type of challenges that I really learned with.
5879850	5883870	Yeah, Pwnable.kr. Oh yeah, there are many of those.
5884010	5891190	I would definitely say, if I were to name one starting resource, that would be PicoCTF.
5891230	5894450	That's where I would start. It is really, really well done. They do a good job with that.
5894450	5900590	It starts very easy, very simple. They have help forums where you can ask about it.
5901730	5906110	And it slowly ramps up. They have a wide range of categories.
5906110	5909630	So it's not only the Pwnables that we've seen in this tournament.
5909730	5913350	They have web challenges, forensics, cryptography, all the stuff.
5914430	5919910	In all of these popular sites like PicoCTF and OverTheWire, there are lots of solutions online,
5919910	5927050	which you need to find the balance between avoiding the solutions and at some point looking them up.
5927050	5931650	But not just looking them up, working through them in case you choose to look through it.
5931650	5934950	Try to maybe look at it and then close it again and re-implement it.
5934950	5939230	There are various ways how you can learn, but just don't cheat yourself.
5939870	5942190	Yeah, you could fail on either side of that, right?
5942190	5944790	You can never look at the other resources, which is kind of...
5944790	5949470	Some people stubbornly refuse to get any outside kind of help, which takes them longer to learn things.
5949470	5953250	And then other people look too early and never force themselves to go through the learning process.
5953250	5954810	So I think that's a great way to describe it.
5954870	5960270	I mean, the reason why I enjoyed seeing live CTF back in the day was exactly this problem,
5960270	5966910	because I was playing these war games and doing it kind of my way.
5966910	5969470	And I've never seen anybody else. How do they do it?
5969470	5975770	And then I'm seeing live CTF and they solve a Pwnable and see how they do their exploit script and everything.
5975770	5977490	That was mind-blowing to me.
5977490	5982570	So yeah, I think it's important to take advantage of all these resources,
5982570	5985630	what they can offer and combining them all together.
5986190	5993050	Yeah, I think you're not going to be as fast as the folks we're seeing here today without years and years and years of practice.
5993050	5997490	These are people who are at the top of the field and have really practiced.
5997490	6001110	They play a ton of CTFs and it takes a lot to kind of get here.
6001110	6003630	So don't be intimidated if you see them doing this.
6003630	6009030	I mean, even as casters, when we're watching them, we're in awe at the speed that some of these people look at.
6009030	6016350	All three of us are fairly experienced CTF players, but we're still impressed by this.
6016350	6021450	I would say we're mid-tier compared to what we're seeing in front of us speed-wise, certainly.
6021710	6031350	And this challenge is doable. I think both players know that this is doable and still it takes them a lot of time.
6031350	6040230	And they are super fast. But maybe for an outsider it might seem crazy that you have to spend an hour on something that we would call easy.
6040290	6047510	But it's just a matter of the fact these things just take a lot of iteration, tons of information you need to think about and reason about.
6049070	6050430	Even an easy challenge takes a lot of time.
6050430	6052330	I think we do need to give a hint to both teams.
6052330	6055870	I think we're going to give the same hint to both. We're going to write two bits of information to each one of them.
6056210	6059830	Because we're going to write the same hint on both so they both get the same hint, but it will contain two parts.
6060510	6062330	The first part will...
6062330	6068910	What about doing like opening bracket, closing bracket, opening bracket as the...
6068910	6072870	As that one? Actually, maybe we each give them each just half the hint.
6072870	6074590	Because the problem is if we give...
6074590	6075650	Oh, then we tell them where they are.
6075650	6079850	We're telling them something that Perpetrator has already figured out.
6079850	6083530	So we need to tell them one bit of information to get them past where they're currently at.
6083530	6085010	Right, this is...
6085010	6091450	In terms of fairness, both hints, wouldn't it be like just put it on the same paper?
6091450	6093370	So, the problem with doing both hints...
6093370	6095450	Here's the problem with both hints.
6095450	6098590	If you give both hints, you're telling Rekebeg something that Perpetrator already knows.
6098590	6100270	Well, it depends on how we tell them, right?
6101010	6103570	So both of them are struggling with loops, right?
6104130	6108010	So maybe the hint is like maybe you need a loop for...
6108990	6110030	Have you considered using a loop?
6110030	6110890	The loop is the key.
6111130	6114690	That is the exact same hint for both of them. That's fantastic.
6114690	6117830	That is brilliant, and I love it.
6117830	6119770	And I think we should definitely...
6119770	6121070	I think we should do that.
6121070	6122870	So, that's a hint.
6123450	6124870	You need to use a loop.
6126110	6127710	Because they both do right now.
6127710	6129110	They both need to use a loop.
6130550	6133930	We will give the same hint, but they will have...
6133930	6136630	There's different contexts to it. That's fantastic.
6137390	6140950	So, Jordan is preparing this hint.
6142590	6145190	So, there was a question here in chat.
6146770	6150930	What would you guys say is the CTF level of this challenge?
6151210	6159950	So, like, in any normal CTF context, I would call this a fairly easy...
6160650	6163610	An easy challenge, but for like the...
6163610	6166950	If we talk the big, serious...
6167670	6169230	Not serious, that sounds so...
6169230	6172330	No, it's not an easy beginner challenge.
6172330	6174310	It's an easy challenge...
6174310	6178470	In the context of teams that have been playing CTF for 10 years.
6178470	6178750	Yes.
6178750	6183230	In that context, it's an easy challenge for anybody.
6183270	6187830	Like, even for me, you know, that's a nice challenge I would spend a couple of hours on, probably.
6188670	6191650	It's doable. It doesn't feel impossible.
6191650	6196250	But it's also, like, still has some trickery you need to figure out.
6196370	6197170	Right.
6197170	6200370	So, we are about to give them the hints now.
6200370	6202550	Jordan is going to go sort that out.
6203890	6207170	Yeah, there's this traditional...
6207710	6210330	So, mentioned here, it's like, there's someone saying it's a 200.
6210330	6218810	So, sometimes you will hear, especially older CTF players, like, rating some challenges on a 100 to 500 point scale.
6218910	6223790	Which, to players who started playing in, like, the last couple of years, doesn't really make sense.
6223790	6226550	Because nowadays we typically use the dynamic scoring system.
6226550	6233310	But, you know, the most common format of CTF is the Jeopardy style, like, inspired by the TV show.
6233310	6241130	And in that show, you have, like, in each category, you have five questions of, like, 100, 200, and so on, down to 500 points.
6241130	6245410	And that is how CTF challenges used to be scored back in the day.
6245410	6246630	So, yeah.
6246630	6250110	Yeah, so the dynamic scoring system that's currently in use makes a lot of sense.
6250110	6251550	Because you're sort of letting the...
6251550	6256070	One of the main problems, and you've seen it here this weekend, right, is we think something is easy and it turns out to be harder.
6256070	6257490	We think something is harder and it turns out to be easier.
6257490	6261970	Like, we generally have gotten it pretty right, but it's impossible to be perfect.
6261970	6263930	You're not going to get exactly the difficulty right.
6264070	6267210	Because you don't know exactly how people are going to solve things or what they're going to see.
6267490	6268750	And so dynamic scoring...
6269630	6272030	And what kind of technical problems do you run into?
6272030	6276730	I mean, solving the challenge thing is one thing, but then maybe you cannot run the binary.
6276730	6277130	Oh, yeah.
6277170	6279330	Maybe you look at the wrong thing.
6279710	6283370	Maybe you misinterpret something as a bug that is not a bug.
6283370	6287050	Or, you know, tons of dead ends you could run into and waste time on.
6287630	6290510	Yeah, and so all that can factor in.
6290510	6293250	So being able to dynamically score challenges is really nice.
6293250	6295330	And it's essentially the organizer saying,
6295330	6298890	the fewer teams that score this, or maybe the longer time it goes unscored,
6298890	6300170	the more points it's going to be worth.
6300170	6301990	And then the more people that solve it, the less it will be worth.
6301990	6303510	And so it kind of self-balances.
6303510	6307550	And so you gain more points by solving things that fewer other teams solve.
6307550	6308350	Which kind of makes sense.
6308350	6311330	And then if something is solved by fewer teams, it's more attractive.
6311490	6313530	More teams want to solve it because it's worth more.
6313790	6318310	And so it's sort of like it really does a good job of letting that problem of the organizers
6318310	6321210	not being able to perfectly gauge the difficulty doesn't really matter.
6321210	6325270	Because the team that solves overall the most things that were solved by the fewest other people
6325650	6327390	are going to be the ones with the highest score.
6328990	6335290	It also kind of took away the first blood that was often in some CTFs,
6335290	6338810	which is with time zones sometimes a little bit tricky.
6338810	6339890	Yeah, it's very controversial.
6339890	6346070	And even in person, even like here at DEF CON Finals, I'm not a huge fan of first blood.
6346070	6352030	So that concept is, you know, the first blood means just the first team to score on a particular service.
6352170	6356070	And so there was sometimes a bonus pool of points that could only be...
6356070	6361010	And sometimes there were even stages where the first three teams would get some sort of back off on points to do it.
6361130	6367690	But yeah, especially with things like time zones, it can be really hard to have that work out.
6367690	6371790	The other problem with first bloods is that...
6371790	6376750	Actually, some of the reasons that people did first bloods was to try to counteract big teams.
6376770	6380410	Because large teams can spread out on many, many different topics.
6380410	6385370	But a few really hard challenges that only an expert could solve by having first blood points,
6385370	6388070	because you're incentivizing your one particular really good person.
6388070	6392090	So that's actually one of the other things that organizers have to consider.
6392190	6397990	Is do they want to let their game be winnable just because somebody has a really, really good team of people who are all pretty good?
6397990	6402670	Or do you want to focus a core team of experts?
6402670	6410830	And these are topics that people who are in the CTF community or organizing CTFs love to discuss these things about.
6410930	6411890	It's a good bar topic.
6411890	6419030	How do we create a fair competition environment where you have these different conflicting aspects.
6419030	6425030	You want it to be accessible for new players while also being competitive for experienced players.
6425030	6428030	And you want to encourage the right type of behavior and so on.
6428030	6430430	So it's definitely not an easy thing.
6431530	6434250	Coming back at here what Perfect Root is doing.
6434250	6439990	I mean, they were given the hint now that loops might be the solution to the problem they are having.
6439990	6442990	But they haven't executed on it.
6442990	6445750	Their code still doesn't include any loop thing.
6445750	6447790	They might be set on something.
6447790	6451970	They might believe that they are on the right track and keep going as far as I can tell.
6451970	6456610	Yeah, I'm afraid they either thought the hint applied to the thing that they've already solved.
6456610	6457550	Which it kind of did.
6457550	6459630	Which is why it was relevant for RicaPigs.
6459630	6464170	But they might not see how it applies to their current problem.
6464170	6467650	No, so actually I just realized they might not need a loop.
6468690	6469310	Go on.
6469310	6472950	I mean, if they carefully overwrite the values, right?
6472950	6473930	No, so you...
6473930	6475210	Okay.
6475850	6478450	Everyone try to picture this in your mind now.
6478450	6479330	We need a whiteboard.
6479410	6481170	This is where we need a whiteboard.
6481770	6484130	Professor Karl needs to pull up a whiteboard.
6484530	6485350	Right.
6485350	6488250	So you have the program section.
6488250	6490610	It's small and you have the long data thing here, right?
6490610	6494570	And then you use a loop here in the program thing to start writing stuff here.
6494570	6495430	So you write...
6495430	6496170	Data is coming.
6496170	6498250	And you are writing a brain fact program here.
6498250	6502590	And then right in the beginning here you have an end bracket, right?
6502590	6506690	So your data pointer will go over here.
6506790	6508910	And then you will stop this.
6508910	6512950	And this will then jump to the end of your program and jump to the end bracket here.
6512950	6517990	So your instruction pointer is still in the beginning of your new program.
6517990	6520870	While the data pointer is in the middle or later.
6520870	6522610	Oh, is the data pointer at the end of the payload?
6522610	6524310	Yes, and then they keep going.
6524310	6530150	They do go in tandem, but the data pointer is always racing ahead of the program counter.
6530250	6532530	And then as long as you have enough instructions...
6532530	6536450	Because you're going to need to have to go back and forth a little bit to read and write.
6536450	6539050	And it might catch up to you.
6539050	6541050	So as long as you space all of that correctly...
6541050	6543630	And you actually could put some attentional padding there too, right?
6543630	6545250	You could just easily pad that out.
6545250	6550850	Oh, right. You could put just extra characters and have your data pointer be at the very end.
6550850	6552970	So this is definitely doable without...
6552970	6556010	Well, we think it is. We've proven it.
6556010	6557990	So it could be doable.
6558130	6561710	But it certainly would be easier to do it that way.
6561710	6564610	So we might just be seeing...
6565570	6568610	So maybe they're fine ignoring that hint and continuing on.
6568610	6570210	Which, we'll see how it goes.
6571270	6571950	Right.
6573890	6578930	RekkaPig is still working with the pseudocode.
6578930	6580150	Trying to reason about it.
6580150	6582950	There was a comment about a leak.
6583830	6586190	Pointer to the leak or something.
6586190	6590250	It's just unfortunately just below it.
6590250	6592030	What they are showing right now.
6593010	6593850	Yeah, it's...
6593850	6596890	But essentially it's the same loop, right?
6596990	6600870	Get the pointer while loop and then pointer get.
6600870	6602230	That's the correct thing.
6602230	6608570	I'm now just curious if they leave that bracket then at the end open.
6608570	6612250	This is the read-in loop that PerfectRoot also has.
6612690	6616870	If they figure out the open bracket, it's still unclear.
6617070	6618550	And I want to switch over to PerfectRoot here.
6618550	6620410	Because I see what I think they're trying to do.
6620410	6621990	And they have a bug in their code again.
6621990	6625510	You can see these dot plus, dot plus and so on in their code.
6625510	6629470	What I think they want here is a dot greater than, dot greater than.
6629470	6631510	To dump out...
6631510	6633170	I think there are eight of them.
6633210	6634830	Or maybe it's just six of them.
6635430	6641250	The idea here is that you want to use the dot to print the current value.
6641250	6643490	And then you advance the data pointer to the next step.
6643930	6647570	But the plus sign increments the current value that you're pointing at.
6647570	6649110	Which is not what you want to do.
6649110	6650010	Because then you're just...
6650410	6651950	They should see it at least, right?
6651950	6654750	So in the output, they'll notice that I'm just getting this increment.
6654750	6655670	This is why they're getting...
6655670	6658310	You can see in the output there, they're getting NOPQRS.
6658310	6662590	Because they're just incrementing the same byte and printing it out over and over again.
6662590	6665930	So they want to change those pluses to greater thans.
6665930	6667590	If they're trying to actually dump out.
6670430	6675870	You might notice that I've had to program a bit of brain fog to build this challenge.
6675870	6676390	I would think so.
6676390	6679050	Yes, this is not healthy.
6679050	6682930	It is at least one of the things I've seen teams do on similar kind of challenges.
6683150	6687270	Is just do a similar kind of virtual machine, but totally different instructions.
6687410	6689410	At least this one is sort of intuitive.
6689410	6692430	Like plus and dot and greater than and less than.
6692430	6696610	In fact, I think we even added one instruction here.
6696610	6699930	We extended the language with one instruction to make the challenge easier.
6699930	6703290	So in my original solution...
6703290	6708250	Because if you do an overwrite of the return address, you need the function to actually return, right?
6708510	6712650	And the only condition for the loop to break is if the program counter is at exactly 9.
6712670	6718530	So in my original solution, you had to make something to make the program counter jump all the way back to the beginning.
6718530	6726030	But we decided that we get rid of that and we instead add another instruction, which is the caret character.
6726030	6727030	And that will just...
6727030	6728450	It's a little up arrow.
6728450	6732230	Exactly. So instead of going left or right, you go up to go out.
6734170	6737010	But it is nice that this is at least kind of intuitive.
6737010	6738630	These are just random letters, I feel like.
6738630	6742650	Well, actually, if they were random letters, what you probably would see was them using more of those kind of macro helpers.
6742650	6747330	To find a variable that was called ink, or deck, or next, or prev, or something like that.
6747330	6750750	And you'd use those in line instead of the raw characters directly.
6750750	6752190	Right. Oh, you told...
6752190	6753390	Yes, go ahead.
6753390	6758110	I was just seeing in Recapit, they figured out the unmatched bracket.
6758390	6759350	Oh, fantastic.
6759690	6764870	You see here on line 60, there's a comment, unmatched bracket.
6764890	6767010	Oh, yes. Yes, I saw it.
6767010	6767530	Excellent.
6767530	6767670	Nice.
6767670	6768630	Very, very good.
6768630	6775970	And I also wanted to point out, over on the Perfect Root site, you can see that they changed all the pluses to greater than characters in there.
6775970	6776050	Yes.
6776230	6778970	They're both making good progress. This is fantastic.
6778970	6780570	Oh, that's really great.
6780590	6784570	So we can see, do we think that Recapit can catch up to this?
6784710	6788050	That's the, you know, exciting thing here.
6790390	6793230	Just trying to keep an eye on both teams here.
6793230	6801030	So back to the chat question, there's a little bit of discussion going on about dynamic scoring and whether it's a bad signal for beginners.
6801030	6801710	And that's true.
6801710	6810010	You can't actually, one of the downsides is if every challenge starts at 200 points or 100 points, and it's just based on however many people solve it, that you find the ultimate difficulty.
6810430	6812830	It's hard as a new person to know where to start.
6812850	6814690	A lot of CTFs will kind of give some hints.
6814690	6820690	They'll say an expected value, or they will say, you know, have some other difficulty ranking independent of the points.
6820690	6823410	So that way the organizers can say, we think this is hard.
6823410	6825690	Hey, it turns out it was easy. It was a bug that they didn't intend.
6825910	6827490	It ends up being easy, and the points drive low.
6827490	6832770	So you can see that signal afterwards and go, well, I wasn't going to try it, but looking at the people solving it, maybe I'm going to try it now.
6832770	6842290	A lot of the, like, long-running or, like, notoriously difficult CTFs sometimes have, like, a category that they call, like, baby or, like, a tag.
6842290	6843510	Baby's first or, yeah, baby challenges.
6843510	6852650	They would say, like, you know, okay, we have a lot of difficult challenges, but we have selected a few here that we think are going to be good just for people starting out.
6852690	6859010	Also, you can just wait a bit for, you know, wait a couple of hours into the CTF and see, like, which ones are being solved.
6859010	6859510	Yes.
6859510	6868070	But you don't even have to do that, because when I play CTFs like this and I try to find a challenge that is easy, I don't need to wait until the points are degraded.
6868070	6876390	I look at the first few solves of the challenge, and if it's teams I know, like, the big, you know, the top CTF time teams that solved it, I know, okay, that's probably hard.
6876390	6879990	But if it's, like, teams I don't know, then I assume, oh, this is doable.
6879990	6881930	That's a really interesting signal, yeah.
6881930	6886470	There's a lot of, like, metagaming that's been developed over the years.
6889020	6893320	All right, so we're still seeing perfect route is tweaking and tuning.
6893480	6900200	I haven't seen... okay, so they're inputting in...
6900200	6904220	Yeah, I mean, I'm looking at the code, at the payload there, and, like, the structure is all correct.
6904220	6905360	Like, they're dumping out.
6905360	6905620	Yeah.
6905620	6907220	They're rewinding the data pointer.
6907220	6909240	Then they... oh, no, no, they have another bug.
6909240	6916120	Do you see the last back arrow needs to go forwards instead?
6916120	6920100	Because they're running over the return address to print it out.
6920100	6922560	Then they're rewinding the data pointer.
6922560	6924240	But then they need to go forwards again.
6924240	6928600	So that last comma less than should be comma greater than.
6929940	6932540	So there are these small things.
6932540	6934200	And I will say, this is a good example.
6934200	6937260	We're actually building a program with more structure where you didn't use comma up here.
6937260	6939900	And you actually just instead did something more obvious.
6939900	6943820	Might have helped the mental cue of, like, no, no, what do I intend to do here?
6943820	6945980	Am I trying to go forward or backward or up or down?
6945980	6946820	Yeah, yeah.
6949400	6950760	But we'll see.
6950760	6952000	So I'm looking forward.
6952000	6958400	If Recapig catches up again, or Recapig, this absolutely could be a match again.
6958800	6962560	Yeah, I mean, Recapig is definitely catching up again.
6962560	6967060	Because Perfect Root has been at this stage now for quite a while.
6967060	6975300	And I don't know, the progress hasn't been as big leaps, I feel like, on Perfect Root's side.
6975300	6977940	I mean, they definitely have a better understanding of it.
6978300	6985920	But, you know, they are not close to solving it, I think.
6985920	6987380	Oh, no, you said the magic words.
6987380	6990620	As soon as we predict that, they tend to blow through and solve it.
6990620	6992640	It's like saying, oh, surely it won't rain today.
6992640	6994100	Because I just washed my car.
6995720	6998680	Yeah, maybe you should predict again that Recapig is behind.
6998700	7001420	Oh, Recapig is real bad. There's no way they can catch up.
7001420	7004420	And two minutes later, winner, winner pops up.
7004420	7008280	Yeah, there's a lot of caster's curse going on at this tournament.
7008280	7011560	I don't want to unduly influence the game here.
7012700	7014040	Okay, so what are they looking at?
7014040	7016020	They're dumping out...
7016020	7017560	They're printing what they believe to be a leak.
7017560	7018960	Okay, so they're verifying a leak.
7018960	7019980	They think they've got...
7019980	7021100	Yes, and you see there...
7021820	7023260	Oh, they just missed it.
7023720	7025080	No, they just missed it.
7025080	7026580	They still need to change that to a greater than.
7026580	7029900	Yes, so the other way you can do it is you can skip the rewinding
7029900	7032960	and just type the address in backwards.
7032960	7034880	But this is like an easier mental model.
7037240	7040540	I think Perfect Root is very close to solving it.
7040540	7041440	I think that they're actually...
7041440	7044860	I think they only need to flip that less than to a greater than.
7044860	7046020	And they're basically done.
7046020	7046900	Yeah, they're basically done.
7046900	7048620	And they'll still have to actually do the overwrite,
7048620	7050260	but they've got a leak, and they've got the address,
7050260	7051900	and they've got the difference, and then it's...
7051900	7052460	Yeah.
7052460	7053880	Right, four bytes in return.
7054040	7056800	The only last thing would be, do they see the escape?
7056800	7057880	If they don't see the exit...
7057880	7059880	Sorry, the exit operation?
7061160	7061880	Right.
7062160	7063320	They might not be able...
7063320	7066140	That might be another stumbling block.
7066200	7067540	All right, because they might be...
7067540	7070440	This is another danger of abstractions and mental models.
7070520	7072380	They might say, oh, this is brain fuck.
7072380	7072860	And then they just...
7072860	7073360	And not even look at it again.
7073360	7076240	No, and they're just not noticing that we have this extra...
7076240	7082200	Because then, if they do need to rewind the instruction pointer thing all the way to the back,
7082980	7086140	that's a little bit annoying, because you need to kind of shift...
7086140	7089680	The way you would do it is you have another unmatched...
7090080	7095460	You have more closing brackets, and then it will search backwards for corresponding opening brackets.
7095460	7097200	And you do that multiple times and stuff.
7097760	7098840	It's a bit annoying.
7098840	7099460	Yeah.
7101060	7101740	So, let's see.
7101860	7104060	What are we leaking over here on PerfectRoot?
7104060	7106000	We've got...
7107640	7110800	So, yeah.
7110800	7117600	It's really about working that debugger and seeing that they're not overriding what they think they're overriding.
7123760	7124600	Yes.
7124600	7133180	So, I want to switch over to RicaPigs, because I think they had the debugger up, looking into the code.
7133180	7136720	I want to see what payload they are currently sending.
7138620	7139060	It's...
7139060	7142180	You know, they have progress, clearly.
7142580	7144640	And now they're looking at...
7144640	7147060	I'm trying to see what part of the code this is.
7147460	7149600	It's the printing...
7149600	7151500	Yeah, so they're looking at the print...
7152140	7153840	The dot operator.
7155460	7155900	And...
7157080	7162240	I'm not entirely sure what the question they are trying to answer here right now.
7164620	7165060	It's...
7165720	7167920	Yeah, so...
7169260	7170140	This is...
7171500	7172680	Hard to tell.
7173480	7175700	Yeah, so we're internally debating right now.
7175700	7177760	Do we think they can solve it?
7177760	7180080	Are we going to be needing another hint?
7180080	7181760	Or do we need to switch to a sudden death?
7183980	7184700	It is...
7185080	7193240	The way that we've been handling that transition is, if we hit our time limit, which we are actually coming up on the original end.
7193240	7200060	But, because this match has an extra gap, we might go up and basically ask the team and say,
7200060	7201820	Do you want to move to sudden death, or do you want to switch this?
7201820	7203560	I really don't want to switch to sudden death, though.
7203560	7205240	We've seen what happened last time.
7205300	7209360	I will say, though, our sudden death is real sudden on this one.
7209360	7213720	So if we go to it, we're pretty sure that it would be solvable.
7214160	7217020	But certainly, we would rather have the teams be able to finish this out.
7217020	7221520	And we do have a little bit of extra. We built a gap in time here between the semi-finals and the finals.
7223860	7224260	So...
7225180	7227680	I keep... I'm trying to figure out what Perfecto is doing.
7227780	7231620	They're rerunning the same thing over and over.
7232180	7232800	Yeah.
7232980	7235600	That reminds me of how I play CTF.
7235600	7238660	Just hoping that it changes.
7238660	7243780	Oh, yeah. It was the same thing that Falck said yesterday.
7243780	7246360	Yeah, exactly. Even though I know it's not going to be good, I keep rerunning it.
7246580	7252740	They've got to be doing this thinking that there's some randomness that's impacting it.
7255120	7262100	In the meantime, I can give you a score update on the main scoreboard for the DEFCON CTF.
7262340	7263940	We just had a cycle, by the way.
7263940	7268320	We have MMM in first place, tightly followed by Katsubin.
7268320	7273880	It's the same top fight as we've seen multiple times before, I think.
7273900	7276900	And then we have a water paddler in third place.
7278180	7279840	Fairly close as well.
7279840	7283020	So there's definitely... a lot of things can happen.
7283020	7286800	And all this stuff has not factored in the points from this live CTF.
7286800	7288900	So it's going to be really interesting to see what happens.
7288980	7293340	Perfect Root, who is in this match, they are currently in fifth place.
7293340	7300720	But if they would win this, or even go on and win the finals, that would bring them almost up to first place.
7301580	7302160	Almost.
7302480	7308140	It might let them jump Katsubin, but it wouldn't let them jump Maple for sure.
7308140	7311160	Yes, but they will also get some points from the tournament.
7311160	7314400	Yeah, because MMM is going to be getting some points having made it to the semifinals.
7314400	7315060	Right.
7315340	7318540	How long will the main CTF run? When will that be over?
7318540	7322860	It runs for another two hours, so it's really getting there.
7322860	7325400	Yeah, these scores are probably not going to shift much.
7325400	7331860	And if you're not familiar, so just like a real quick summary of what the final format is for a DEF CON CTF.
7331860	7333840	It's an attack-defend CTF.
7334360	7340660	All the teams are given essentially a number of processes that are running on a system of theirs.
7340700	7343020	They have to defend it by patching those binaries.
7343020	7347460	And they have to attack their opponents by finding vulnerabilities, creating exploits, and sending them against everybody else.
7347500	7348940	And so it's a zero-sum game.
7348940	7351240	You sort of start with a certain amount of points.
7351440	7354840	And then as someone steals from you, you lose a point, they gain a point.
7355000	7361000	And so what happens is you see everyone started I think at 20,000 points or 16,000 points, something like that.
7361000	7362440	And then they're spreading out.
7362440	7364660	And so the top teams steal from the lower teams.
7364720	7367040	And so the lowest team now is down at 14,000 points.
7367040	7369080	And the highest team is up at 22,000 points.
7369120	7370540	So you don't start at zero and then build up.
7370540	7371800	You start kind of in the middle.
7371820	7376360	And then some go up and some go down with this particular scoring method.
7376360	7386560	And so that does mean, though, that there's not a lot of big shifts, wild shifts because there's only so many kind of points available.
7387000	7389440	And so it tends to be harder to come from behind at the very last minute.
7389540	7391340	Although it depends on how close you are.
7391340	7402060	And there's one new solve in a service that no one else has done can start to swing it because the graphs will shift in terms of the rate of scoring.
7402060	7402620	Go ahead, Laver.
7403480	7405080	We should look at Perfect Truth.
7405080	7409360	They were actually, I think, confident about something that the code did.
7409360	7413160	They had this, you see it now, uncomment echo pwned.
7413160	7419100	They were running it, which looked like they were checking if they got the code execution.
7420120	7423620	I think they think they are pretty close.
7424680	7429420	Yeah, I still think that they are missing that.
7429600	7431720	Unless they're doing something different than we expect.
7431720	7432640	I think you're right.
7432640	7435640	You can see they're trying to submit...
7439140	7444960	I mean, they did uncomment it out again, but it was in there.
7444960	7446640	And they had it running for a bit.
7447640	7449980	Do you see they have a while true loop?
7449980	7452040	They were thinking that something is...
7452040	7455940	Yeah, as you said, that something is random a little bit and weird.
7455940	7460920	So they were running it in a while true loop, just trying it over and over again.
7460920	7464220	There we go, that's what they were looking for.
7464220	7466380	Because they had a 90 at the end, they were off by one.
7466700	7468900	Now they have it, they have the return.
7468900	7471300	It was top of the stack, return address.
7471660	7476780	They were off by one, but they mainly added that extra right over there to the end.
7479860	7482160	Not the most reliable of exploits.
7485270	7487030	Yeah, that's...
7487030	7487790	Uh-oh.
7491060	7491900	Uh-oh?
7491980	7502020	Well, there have been... so depending on the challenges, there was a situation where you didn't always see your output.
7502100	7505910	And so if you try to do an echo pwn and detect on it, I know that at least some of the earlier challenges...
7506400	7508960	No, no, it was just the submitter program for some people.
7509420	7511920	This should not be an issue here. Also, they're just running this locally, right?
7511920	7515160	Oh, no, I think it was specifically the command injection with the backticks.
7516320	7519320	Right, because then you needed to do the semicolon.
7519320	7521240	Right, the backticks, you wouldn't see your output.
7521240	7523380	So I think, though, in this case, this is still solid.
7523380	7527220	If they actually get this, they should be right.
7527220	7531320	So I'm curious, is that 0, 069, is that them calling the win function?
7531380	7533180	Was that the offset of the...
7533620	7537160	I'm a little bit unsure, but to me it looked like...
7537760	7539520	Is pi enabled?
7539660	7542580	Pi is enabled, but they are leaking the...
7542580	7543680	Oh, yeah, they have a leak.
7543680	7545400	They have a leak.
7546920	7549180	But the thing is that...
7551750	7555610	Yes, in fact, pi is enabled because you can actually see Reciprocate has literally just now pulled up CheckSec.
7555610	7560110	Right, we just missed it on screen, but they were looking at CheckSec and they saw the pi.
7560110	7561250	They literally just highlighted it in their mouse.
7561250	7562750	Yeah, they looked annoyed by it.
7562750	7564270	They're like, oh, no, there is pi.
7564270	7569170	So, I mean, again, it is solvable, but that does mean that they can't just hard code something and win.
7569690	7570210	Right.
7570210	7572510	But, come on, we did get them a win function.
7572510	7580410	But if that's a concern for Recapig at this moment, they feel like they are getting close to tweaking some adverses maybe as well.
7580410	7582810	That's a good point. They may actually...
7582810	7587330	Yeah, I think we're really close here from Perfect Root.
7587330	7592510	And it is still possible that Recapig is able to...
7594670	7597050	Depending on what the state of their payload is.
7599170	7610470	I'm really curious to post-mortem analyze this later and figure out why the many, many, many, many runs on the Perfect Root side is...
7610470	7612630	What part of this is not reliable?
7613150	7617990	Or what are they analyzing when they're running it like a million times in a row?
7619670	7622070	Or they change it out to remote.
7624230	7626390	Yeah, they're just going to throw it.
7627770	7632090	They are confident that it's really just a little bit of randomness that's the problem.
7632150	7638270	And I'm not sure what randomness is coming into play that would be causing them trouble.
7638750	7641490	Are they maybe just partially... no, no, no, they have a leak.
7641490	7650410	It looked like they were partially overran. You can see that they took the leak and they sent back everything except the last...
7650410	7653830	Oh, they're brute-forcing.
7654530	7657690	That's what they're doing. Is they're brute-forcing the win relative address?
7658370	7660070	I bet that's exactly what they're doing.
7662530	7666870	Just writing the exact difference, like read the full value and then change it relatively.
7666870	7670450	I mean, I don't know why, but I think that's what they're doing.
7670910	7675410	It's the brain fog program in main because then the return pointer would be...
7676910	7680410	Oh, it's just an issue. They are not like...
7681770	7691410	I'm not so sure if I misremember this, but does it not point into libc start main and so that points to libc code and not...
7693670	7695410	Yeah, so...
7699960	7702420	Maybe I'm also saying something wrong.
7702920	7704220	That might be...
7705680	7706580	Yeah, actually, no.
7706580	7708060	Oh, that might be the issue.
7708060	7710220	They're not brute-forcing anything because they're not trying different...
7711900	7714700	Yeah, I mean, brute-forcing the last two bytes doesn't make sense.
7714700	7716380	So I realize that this might be the issue.
7716380	7717420	What is the issue?
7718220	7722440	That the return address is not to...
7722440	7724520	Like, since this is running...
7724520	7728680	Is this running in the main function?
7729000	7730640	And then...
7730640	7732940	Like, the return address is not...
7732940	7736420	It's to libc and not...
7739020	7744180	And not within the program, so they don't have a leak in that sense.
7745320	7747600	They would need to leak some other value.
7747600	7749400	So your solution, then, was...
7749740	7751780	Was it because it incremented or decremented it?
7751780	7756300	No, because I used a much more complicated solution before we simplified the challenge.
7756300	7763540	But my complicated solution still worked on the simplified challenge, but we didn't verify that the simplified...
7763540	7767600	So what was the complicated solution for correctly overriding the return address?
7767700	7770060	Well, it involved a ROP chain.
7770320	7771820	Oh, interesting.
7773360	7773800	But...
7773800	7775000	Sorry, we've got a little bit of a...
7775000	7777280	We've got a couple of bad cables we've been fighting.
7777280	7777800	Yeah.
7777800	7780440	So we lost the stream there for a second.
7791510	7793350	This is something...
7793350	7793790	Yeah.
7794030	7799050	Well, you have your script and you just keep running your thing, looking at memory values, just...
7799890	7802990	You know, running in circles a bit.
7806230	7807110	Yes.
7808810	7815110	I'm trying to think about whether they could leak some other value that's within the...
7816950	7818310	You know...
7818310	7820530	I mean, they totally could.
7821670	7828310	They just need to find some value on the stack that's within the program, right?
7828310	7837470	Isn't the C main also, like, a function that gets as a parameter the address of main, which might then also be somewhere on the stack?
7837470	7838310	Right, it has to be.
7838310	7839130	So, like, the...
7839130	7839670	One of the address...
7839670	7842190	It will be on the stack just a bit further away.
7842190	7843770	Oh, maybe then that's...
7844180	7847570	Maybe it's not the bug that they had the less than sign.
7847570	7848310	Maybe they're overriding...
7848930	7849630	But maybe they...
7849630	7849730	Oh.
7849730	7855210	So it was just that they needed to go a little bit further down the stack and then they go up again.
7855210	7856430	So maybe that's not a bug at all.
7856430	7857310	Maybe we've just misunderstood...
7857670	7861970	Yeah, they were intentionally leaking the main pointer, not as a return address, but as an argument.
7861970	7862050	Right.
7862050	7863090	And then they want to...
7863090	7863550	Yeah.
7863550	7864870	And then they're writing that back out.
7864870	7866750	So then the question is, like, so what is the bug leak?
7866750	7869590	What is PerfectRoot stuck on now, then?
7869630	7876130	If that's the case, they should be able to overwrite their return address with that main pointer plus the offset to the win instead, right?
7876130	7876710	Yeah.
7877170	7879730	Which should work.
7879730	7884090	I mean, that should absolutely be a valid solution where it will put them back into main...
7884090	7884650	Put them back...
7884650	7885150	Sorry.
7885150	7886370	Put them back into the win.
7888490	7890270	I can see them.
7893130	7893830	Yeah.
7895090	7895490	So...
7895490	7897410	Oh, this is so, you know...
7897410	7897750	I know.
7897750	7898570	It's nerve-wracking.
7898570	7900470	It's imperfect knowledge on all sides.
7900470	7901590	And let's just double-check back to...
7901590	7902110	Oh, look.
7902110	7902450	Oh, go ahead.
7902450	7903370	Yeah, because they...
7903370	7905990	Look, they are working here with some addresses as well.
7906630	7907030	They...
7907030	7909430	Second prog address, leak address, pointer address.
7909430	7912910	Slow and steady might still be valid here.
7912910	7913210	So, yeah.
7913210	7914830	Let's take a look at them for a while and see...
7914830	7918750	Now pointer should point to end of second program, right?
7919810	7921230	Which is a good understanding.
7921230	7921830	Which maybe...
7921830	7921870	Yeah.
7921870	7931930	I don't know if Perfect Root had that understanding where the pointer or the data pointer and the instruction pointer are pointing to of the brain fog program.
7932370	7933110	Yeah.
7933570	7943610	No, it's definitely interesting to see the completely different, you know, approaches here to, you know, the challenges from the different teams.
7945470	7946370	Oh, they have...
7946370	7946650	Okay.
7946650	7948210	So, I'm just keeping an eye on Perfect Root.
7948210	7950030	They actually had...
7950030	7951390	They had WIN.
7951670	7953930	Is that a back trace that they are showing or is that just...
7953930	7954450	This is simply...
7954450	7956190	They were...
7956190	7959130	Are you saying that they did have the address of the WIN function?
7959130	7961690	WIN itself showed up in one of these traces.
7961690	7962670	So, right there.
7963730	7964550	It's flickering.
7964770	7966230	Right there.
7967030	7968650	I think they're just doing a back trace.
7968650	7969250	I can't even tell.
7969250	7970110	I think that's a stack, right?
7970110	7970910	Right there at the bottom of the...
7970910	7971670	Right, that's...
7971670	7973050	Yeah, the bottom is a back trace.
7973050	7973690	They showed...
7973690	7974810	WIN showed up on there.
7974810	7977470	They had WIN in the stack trace and they were hitting the exception earlier.
7977470	7980830	So, something was blocking them from returning directly.
7981890	7982530	Yeah.
7982810	7985330	Because, I mean, they don't have in their program that they're running, right?
7985330	7986970	They don't have anything that returns.
7986990	7989070	But I've seen them hit the return instruction.
7989070	7990790	So, I'm a little bit unsure what's going on there.
7990790	7992890	So, are they...
7992890	7993890	Is that what...
7993890	7995270	That's what they're brute-forcing.
7995270	8000670	They're brute-forcing the behavior to try to get an exit that's clean instead of just calling exit.
8002930	8003510	Oh.
8003510	8005310	Is that what they're trying to get around?
8005450	8007790	If they literally just call the exit...
8010810	8011210	That's...
8011910	8013510	I mean, could be.
8013510	8014030	Oh, wow.
8014330	8014730	That's...
8014730	8015930	That might be what they're fighting.
8015930	8016090	It may...
8016090	8018890	Because, again, we don't see them calling the exit instruction.
8018890	8019330	No, no, no.
8019330	8019970	Yeah, exactly.
8019970	8022930	So, they should be able to just do that.
8024510	8025330	I mean, I think...
8025330	8026690	I think we need to tell both of them.
8026690	8028290	Because we haven't seen neither team use them.
8028290	8028310	Oh, right.
8028310	8028510	Yeah.
8028510	8030330	So, let's add a hint for the...
8033050	8034610	Because I think we need to let both of them know.
8034610	8035670	And this is probably going to be the last hint.
8035670	8038650	If we can't get it here soon, we're going to just have to, unfortunately, go to sudden death.
8038650	8040290	But let's see if we can...
8040290	8040730	Oh.
8042490	8043030	Oh, no.
8043030	8043930	We can't give that hint.
8043930	8045270	We can no longer give that hint.
8045370	8046550	I just saw that.
8047050	8047550	Yeah.
8047550	8049310	So, let's switch over to...
8049310	8049430	Yeah.
8049430	8051190	Let me switch over here to Wrecking Pink.
8051190	8051310	Interesting.
8051310	8052550	You see that they have...
8053250	8059770	They are calling the L just, so they are padding their code with the exit instruction.
8060090	8062190	So, they are very aware of...
8062190	8062410	Yeah.
8062410	8063290	...that they can use this.
8063290	8064250	They know exactly what that's going to do.
8064250	8066450	If these two players would combine their knowledge...
8066450	8066470	I know.
8066470	8067990	They should have half of an exploit.
8067990	8068650	Yeah.
8069150	8073730	Which is a good example of real CTF with teams.
8074010	8076230	They would complement each other so well...
8076230	8076330	Absolutely.
8076330	8080490	...and they would have solved this in a fraction of the time now.
8080490	8080610	Yeah.
8080610	8082310	And that's why playing with a team is so much more fun.
8082310	8084570	They catch your mistakes, they look over your shoulder, and they point out,
8084570	8087230	Hey, did you really mean to do a plus or a greater than?
8087710	8088350	Right.
8089650	8093130	It's so much more enjoyable to do a CTF with somebody else.
8093130	8093570	Right.
8093570	8101470	And the thing is here that Perfect Root, if we go back to them, they will not notice this because they are not even looking at the code anymore.
8101470	8101950	No.
8101950	8104230	They are looking at the exploit, they are looking at the debugger.
8104230	8107330	They are completely missing that there is this extra instruction.
8107790	8109150	What do you think they try to do?
8109450	8115650	Disconnect and then that makes main return because it exits out of the brainfuck loop?
8115650	8117890	Or how do they even reach the return?
8117890	8126090	I honestly think they are flailing and I think they don't have a clear plan and are just trying a bunch of different stuff to see if they can get it to...
8127170	8129010	Call system, hold on, what is this?
8129010	8129950	With main stopped...
8130550	8130870	Wait.
8130870	8133350	There was a red, look, they overwrote.
8133350	8136930	Main, red, they are at red and it's pointing into win.
8138030	8139770	Now they are executing win.
8139950	8141870	Yeah, this should just...
8144570	8146350	Oh, no, no, no, pop rvp.
8146910	8149790	Pop rvp is going to pop the pointer to win off.
8150610	8151410	Right?
8151930	8153430	Because win is on the stack.
8154090	8154870	No, no, that's...
8155890	8162410	I did pause on the... they were at the red of main and it pointed into win.
8164250	8167190	So somehow they reached that red apparently.
8169750	8172490	Yeah, they are having trouble with the call to system.
8174190	8177330	Are they accidentally... no? I don't know, yeah.
8177350	8180790	So they shouldn't have to worry about the arguments because win sets all that up for them.
8180790	8180890	Yeah.
8180890	8185030	But if they are breaking in there, what is breaking that's causing...
8185030	8189530	Are they trying to do like a small rob thing here instead of just...
8189530	8192570	Yeah, I'm not sure what they have actually switched over to doing.
8192870	8206730	So in one frame when I paused, they were at the return of main and so, you know, the Jeff output showed where it would continue and it pointed into win but at the end of win, at the return of win.
8206730	8209390	Oh, okay, so they are like off by a few bytes.
8209390	8216750	Yeah, but there was just one frame where I paused and then on a consecutive one, they were actually stepping through win.
8216750	8224210	So I don't know what changed, like why suddenly it was at the start of win, sometimes not.
8224210	8227950	Maybe that is the randomness they are observing and we haven't just noticed that.
8227950	8246090	Right. I want to switch back over to ReekyPig a little bit and look at how, I mean, you can't quite see it, now you can see it, like how beautiful their export script is here where they have created these abstractions for the instructions and they are giving them meaningful names instead of these random symbols.
8246810	8252770	And you can see how they are slowly building this up, adding the comments and going very methodical in this.
8252770	8259090	And, you know, they are slowly catching up, importing time, I'm not sure why, but...
8259090	8262990	Oh, okay, they are just going to do a short sleep here, it seems.
8265150	8273730	And I'm not sure exactly how far, but you can see they have the initial stager with the unmatched bracket.
8273730	8279430	They have the second stage here with padding out with the exit instruction.
8279430	8282430	So you see they are really getting there and...
8285350	8292430	PerfectDruid is, you don't have to switch back, but I'm just watching them, they are in the bowels of GDB debugging system trying to figure out...
8294570	8295490	Oh, it's like...
8296290	8308170	Trying to figure out, like, in the lib C and they are getting, like, yeah, like they are in, like, POSIX spawn action currently, like, they are just, there are some other exceptions being triggered, I don't know what has been corrupted or what's changed.
8308170	8314510	They must be really frustrating that they start looking through that.
8314530	8315250	Yeah.
8315490	8320670	See, we had a question what we want to do here, if we want to go to, if we are going to give them a hint or...
8320670	8321170	I mean...
8322030	8323190	I kind of still want to...
8324590	8327050	I feel like we do have a little bit of time.
8327190	8330310	We don't want to eat into all of our spare time before our final match.
8330310	8335470	We want to give the team, whoever wins, does want a little bit of a break to flush their head and not go straight into it.
8335470	8335950	Yeah.
8336670	8341250	But, like, yeah, we do have to cut this off at some point and switch to a sudden death.
8342790	8344070	This, this just...
8345010	8348610	Yeah, this still feels like something is inches away.
8348610	8351950	I mean, I don't know what in the world is even blocking this because we are seeing...
8352930	8354790	The win function is being called.
8354890	8356150	Like, they are calling win.
8356230	8361950	Could it be some, like, have they, like, messed up the stack pointer in such a way that there is, like, stack misalignment or...
8361950	8367910	I don't know and they certainly don't either, given the time the debugger being sent.
8367910	8369610	Oh, now they are going for one gadget.
8371510	8372310	Yeah.
8373730	8377950	So, they are going to try to avoid our win function and instead just go directly for...
8380210	8385550	Now, did your original one use the win function as well or was your original solution avoiding it too?
8385550	8387470	No, my original solution did not use the win function.
8387470	8391830	Yeah, so it may be that just by avoiding it they are going to end up getting a win here.
8391830	8395230	So, that is a possibility, but I just don't know how long it's going to take them to do that.
8395450	8402730	And then the question is, is RicaPig going to sort of slow and steady and be able to catch up or do we just need to call this one and move on?
8402730	8413550	Actually, now that you mentioned the misaligned stack, I do remember writing a challenge for the cybersecurity challenge Germany, like a basic pwnable.
8413550	8427810	And there was a win function, I believe, and when you solved it, there was a problem with misaligned stack because something in that code is expecting stuff to be aligned.
8427810	8433390	But there was a pretty clear exception that when you Google it, you would find the information about that.
8433390	8443830	And the solution, you actually had to do one basically pop red to align it again and then the win function did work.
8443830	8445970	Now that you mentioned this, I remember that.
8445970	8451050	Which though isn't really an option when you're working from an interpreter like this, right, where you sort of have this different environment.
8451050	8458210	So it's not clear what that would even look like because they have a single overwrite of the return address.
8458210	8462410	No, no, they can overwrite a lot of stuff if they want.
8462530	8469430	Yeah, but they'd have to find the next return address on the stack and then go overwrite that as well.
8469510	8470850	No, no, no, they could replace...
8470850	8471610	Oh, it's just two in a row.
8471610	8472550	Yeah, that's right.
8472550	8475570	Yeah, they could do that, definitely.
8475570	8481690	And since they have a leak, they can use that to just find a RET gadget.
8482170	8485330	Well, they already had the libc. Yeah, the libc leak was already essentially there.
8485330	8493570	Oh, let's switch over here again to Recapink because I just saw on the terminal, I saw the stack smashing detected message,
8493570	8496690	which means that they have overwritten the return.
8496690	8503010	And not only have they overwritten the return address, they have triggered the return because otherwise the stack smashing...
8503010	8505310	Well, we knew that they had those exits because they did that padding.
8505310	8510550	And so they have that part of it right away, which again, I don't see that at all.
8510830	8516910	Is it possible that we might see a big catch-up moment here from...
8516910	8519550	Hortense and Hare, this might be it.
8519770	8520490	Yes.
8523910	8537130	Yeah, there's a move apps instruction that doesn't like unaligned addresses, which happens in system.
8537350	8543490	I have a video on that, solving that basic pwnable challenges.
8543490	8545110	And I had this problem.
8545550	8550530	Yeah, you get a stack fault, stack fault at address zero, a very weird exception.
8550530	8556550	And then you look at what instruction caused the exception, and it's a move apps instruction.
8556550	8561930	And when you Google that, you can then find move apps, unaligned address, and then...
8562690	8566530	So that might be the issue here, that the win function is just not callable.
8566530	8570950	Well, no, my suspicion is it is callable if you exit cleanly.
8570950	8580790	So my suspicion is because that brute force that we're seeing from perfect root, I think is an artifact of how they're getting their return out.
8580790	8583730	I think that's what's potentially getting it misaligned.
8586190	8593230	Whereas if they were to actually just let the interpreter cleanly exit out, that they would...
8593230	8599310	And here I want to say, and we see here on RikaPig's screen that you see that, right, and you saw the stack smashing detected there.
8599310	8606050	So they have been just writing a bit too far on the stack.
8606170	8620210	I'm not entirely sure if this is an intentional smash to just verify that they are doing the right thing, or if it's an accidental smash because they misaligned some of their data.
8620210	8623030	But that still remains to be seen.
8624390	8628970	Yeah, I think we are going to have to certainly go to sudden death here pretty soon.
8628970	8633270	I think in certainly the next five minutes or so, if we're not real, real close.
8633270	8638470	Because we don't have confidence yet that...
8638470	8643850	We don't know for certain if the exit cleanly would solve it for perfect root, and we don't know...
8643850	8650430	And even the things that are changing now, this one gadget attempt might be a little ambitious for the time that's left, right?
8650430	8653910	So we're still trying to figure that out.
8655050	8661690	Yes. So the question is, do we ask them or do we just go to sudden death?
8664030	8666130	I don't think we give them an option.
8666830	8678770	We should give them as long as we can, and once we hit the moment where we can't go any further, because we just have to get on to queue up for the finals, then we're going to have to just cut it off.
8680350	8681070	Yeah.
8682390	8686090	So I don't know that we're there yet. We're seeing a one gadget attempt.
8687270	8689830	Man, I want them to do it.
8689830	8691790	Yeah, I really want to see this.
8692070	8694510	So how's it looking over there on Recapit?
8694510	8701430	Yeah, so, Recapit, they are inspecting the stack here in the debugger.
8705670	8711610	And you can see here their program, the padding that they filled out.
8711610	8727110	Oh, okay. So since they're doing this padding thing, I suspect that the smashing was because they miscalculated exactly how long their padding should be.
8727110	8743370	So we'll see if they can fix that alignment up for the size of the payload, and then to move on to actually controlling the overwrite, is what I'm trying to say.
8748060	8757980	Yeah, it's... I mean, for a while I was really like, okay, PerfectRoot is going to have this.
8758320	8764600	I'm not so sure anymore. This could really go either way.
8766120	8777460	Yeah, and again, I think I'm not confident. I'm going to say we've got, again, three more minutes to be sure someone's going to solve it, or we're just going to have to switch over to our sudden death.
8777460	8786940	Because we do want to give them at least a good 10-20 minutes to solve sudden death, and then go to the bathroom and come back for the finals, because you know when I have to end.
8786940	8792340	And the finals, unfortunately, we have to have enough time for that, because the scores have to be in.
8792340	8796140	We have to announce the winner, it has to go into the DefCon CTF final score.
8796220	8803800	So we do have some hard limits that we're unfortunately working against, where we need a winner to be able to allocate these points.
8803800	8809600	The good thing is that the teams can choose to send another player for the finals.
8809600	8812400	That's a great point, that's a great point. They're not required to send the same player.
8812400	8818880	So it is entirely possible that someone decides, hey, I'm burnt out, you've got to send somebody else. That live CTF ruined me.
8819300	8826360	Do you know how the other teams have done this so far? Have they sent other people in these subsequent rounds?
8826360	8832060	So far, only NNM. The total that any team would have to send is for four rounds.
8832060	8834960	So it's not an overwhelming amount spread out over these three days, right?
8834960	8839520	And so it's not too crazy. And so we've only seen so far NNM, I think is the only one that I've noticed.
8839520	8845340	Yeah, they swapped between Robert and Jinmo for their rounds.
8845340	8850480	So between their first and second and second and third, there was a switch in and switch out.
8852200	8855200	But everyone else seems to have been sending the same person.
8858340	8866900	Do you think the players did this voluntarily or do you think within the team they had to throw a coin?
8866900	8869340	That's a good question. Yeah, I'm not sure if it was...
8870060	8871700	It seems like that's varied.
8872240	8876600	Some other teams specifically said they were kind of like picking coins because multiple people wanted to go.
8876800	8879160	And they had to kind of pick out who was available.
8880760	8884980	Wanted to go is positive. I was more worried that they would feel uncomfortable.
8885020	8887520	Okay, I think we're gonna have to switch over to sudden death.
8887760	8891240	I hate to do this. Of course, we want to see them solve it.
8891240	8895560	But at this point, I'm just seeing some hesitation on Perfect Root.
8895560	8902340	Doesn't seem like Alex has kind of a sense of what it's gonna take to finish this out.
8902460	8907580	So let's go ahead and I'm gonna go ahead and let each team know that we're switching to sudden death
8907580	8909600	because we want to give them a break between the final round.
8910260	8914840	And we will... just give me a second. I'm gonna take off my gear. I'm gonna let them know.
8914840	8916420	And we'll count that one in shortly.
8917160	8919600	Right. So...
8919600	8925840	That's unfortunate to see. Obviously, we would want to see a finish, a working exploit.
8925840	8930620	But it's understandable. The schedule requires it.
8930660	8933900	And of course, they are also missing from the main CTF, right?
8933900	8938500	I mean, it's now the final hour kind of of the big CTF, maybe.
8938580	8942280	It is almost. There's one and a half hour left of the main CTF.
8942280	8946680	So it's not like that they can do that much. But still, they are missing from their main team, right?
8946680	8947020	Yes.
8947020	8948600	For quite a long time now.
8949200	8953080	And this is like a choice the teams have to make, right?
8954360	8958180	Like, which... who do they send for this? Like, to balance that.
8958180	8962940	Like, where do they think their most skilled players are of the most use?
8972360	8977340	Right. Sorry, there was some... you know, we were just preparing for the sudden death part here.
8977340	8985660	So we're just getting them set up, swapping out the challenge and giving them a new simple challenge.
8985660	8987820	And this challenge is going to be super simple.
8987820	8993240	I mean, I barely know if we're going to have the time to commentate on what's going to go on here.
8993540	8999240	Because I think we're picking our simplest challenge in the stash.
9000080	9001760	Yeah, it's going to be rough.
9009940	9013300	Okay, so Jordan is over with the players explaining the situation.
9013300	9016300	Somebody in chat asked what sudden death is.
9017640	9020060	This is when the weapons come out.
9021320	9022720	Yes, yes.
9022720	9025080	This is when we see the first blood.
9025080	9026440	Right, exactly.
9026440	9030900	No, so the sudden death is that we stop the current challenge.
9032200	9035380	And we should have people not walking past the camera.
9036280	9037400	But anyway.
9038840	9041680	Sudden death. We stop the current challenge. We swap it out.
9041680	9042960	Completely new challenge.
9042960	9047420	This new challenge is supposed to be super simple.
9047420	9049780	It's going to be fast.
9050940	9052080	It's starting now.
9053500	9055260	And then they have the new challenge.
9055260	9057740	And they're downloading it. We're switching over to the split view.
9057740	9059340	They're downloading the challenge.
9060660	9062400	And yeah, they're going to look at it.
9062400	9065140	And this is going to be a slaughter.
9065180	9067100	Is this the format string thing?
9073120	9074080	Jordan?
9074300	9075800	I'm not sure. Sorry.
9075800	9082120	I actually don't know which sudden death we had lined up for this one.
9083500	9088620	Right, so we can switch over to Perth.
9088620	9090280	Sorry, to Reykjavik.
9090920	9093560	And see, they just look at it here.
9093700	9098200	And it's about inputting some passwords here.
9098200	9101380	And you need to input your logins.
9101380	9105160	You can see that you need to login with admin and correct towards battery staple.
9105160	9107060	XKCD password joke.
9107060	9111540	And then, is it just reading in shellcode and executing it?
9112340	9113520	Is that what I saw?
9113520	9117400	I'm pretty sure that this one is meant to be pure speed.
9117520	9121260	Oh, perfect root is already opening Google.
9121260	9123760	Right, we have some shellcode in there.
9127080	9128940	Wow, this is stressful.
9128940	9135560	I think they basically just send a username and password and then send shellcode and it will be executed.
9135700	9137540	So, let's see who can do this first.
9137540	9141880	We can see them copy-pasting the username.
9143020	9149820	As we can see here, I'm going to switch over to Reykjavik because you can see very clearly in their exploit script.
9150540	9153360	Actually, you can see it clearly in both of them.
9153360	9155340	Oh, this is going to be rough.
9155340	9159620	I really hope the flag submission thing is...
9159620	9162080	Uh-oh, the LS didn't work.
9163580	9168920	Switch over to perfect root and see if there's something not working with their...
9168920	9178620	I think they might have to pad out the shellcode to be the size of the input.
9178620	9181440	There we go. Yep, that's exactly what we're seeing. We're seeing the padding coming in there.
9181440	9182560	Yeah, they're padding it out.
9184280	9188720	And then they're sending it and will it be... Yes, there it is. There's a shell.
9188920	9190340	There it is! We have a winner!
9192720	9194380	Congratulations to perfect root.
9194920	9195960	Oh my god.
9195960	9198380	That was brutal. That was very, very harsh.
9198980	9204620	We've got to go on a break. We've got to get back to the teams to talk to them real quickly and line up the final round.
9204620	9209600	We'll be here in 30 minutes with the finals. I look forward to seeing you back here then.
9209660	9210200	See ya.
9682310	10515190	See ya.
10515210	10890780	See ya.
11615460	11624380	See ya.
11786180	11787600	See ya.
11819220	11820620	See ya.
11849220	11850620	See ya.
11904000	11904080	See ya.
11906060	11945280	How's it going?
11945440	11951860	Hello and welcome back to our final event of a very long weekend. We are super excited to be here.
11951980	11957480	We're super excited to be looking at the best two teams. Are you ready? You said you were nervous a second ago.
11957480	11963100	Oh yeah, I mean this is like the final match. This is when it all comes together.
11963600	11969680	We've had perfect root. We've had Starbug. They've both battled through three other rounds to make it here to this final event.
11969680	11974180	And we're going to get the game started to get the competitors nervous and ready to go.
11974180	11978140	For context, the game is over. The DEF CON CTF itself is ended.
11978260	11983220	This is the final bit of points that anyone can get in this event before it's going to be tallied for the awards ceremony later today.
11983220	11986160	So, let's do it. Everybody, we're going to kick it off.
11986400	11991620	5, 4, 3, 2, 1, go!
11992760	11994640	And let's let them rip.
11994640	11997500	So let's take a look at the teams and what they're up to.
11997500	12001760	We're going to need a reset on our capture card over here. Capture card reset, please.
12002180	12002500	Yes.
12002500	12005000	We've got one that's not working, but we'll get that fixed.
12005000	12009200	In the meantime, we'll just go to Perfect Root and watch what they're doing.
12009400	12013420	And we can see that they're immediately going into IDA to look at the code of this challenge.
12013420	12016080	Oh, we've got different themes at least. So now we've got our black and white themes.
12016080	12016760	Yes.
12017220	12024980	Both doing the exact same thing, looking at both of their systems and popping open their default template scripts.
12024980	12027320	What is the name of this challenge that we're looking at today?
12027320	12029720	So we're looking at the F in the stack, right?
12029940	12032580	We actually had several challenges internally named F in the stack.
12032580	12034580	Yes, there was F in the stack and another F in the stack.
12034580	12037940	We changed the name of that one, but this is the original F in the stack.
12043000	12048060	So it's a reference obviously to the meme, like F in the chat, but on the stack.
12048400	12049120	Right.
12049160	12054600	So does it actually mean that we're looking at a stack-based buffer overflow, or is that just kind of a troll on the name?
12054600	12059820	Yeah, I'm not entirely sure. We have a menu here with four different options.
12060020	12064400	You can load a file. What else was there?
12064500	12069840	And then when you do that, there's a file name, there's a call to FStat or LStat actually.
12070760	12074380	Oh, that was interesting actually. Let's go ahead and take a look at that.
12074760	12081560	So you said it was FStat or LStat, but if we look closely, let's let that come up again.
12082680	12090260	So again, they're moving so fast, but if we notice, there's a call to one of them, but the error message says the other.
12090700	12091060	Right.
12091560	12093240	So that is interesting.
12093280	12093880	Interesting, yes.
12093880	12098720	This is the kind of thing as a... there we go, we're getting some Fs. Thank you, chat.
12099100	12100280	Love to see it. There we go.
12100280	12105160	So Fs in the chat for Fs in the stack. Well, maybe we do that once it gets solved.
12105160	12109480	Yeah, exactly. Once they actually beat it. Right now the challenge is standing tall.
12110780	12115860	By the way, the reference there to Defcon CTF is cancelled. Defcon is cancelled. It's very much a meme.
12115860	12119060	If you've not been to Defcon before, every year there's a joke that it is cancelled.
12120200	12124320	Excellent. Glad to see LiveOverflow in chat as well. Looking forward to...
12124320	12129040	Hi everybody on LiveOverflow's Twitch stream. I know he's been watching all weekend long with us.
12129600	12132720	Even on the times where he wasn't chatting with us live.
12132720	12137160	Right. So we had him as a commentator, as one of our three guest commentators.
12137160	12140660	We had one person from Nautilus Institute, Lightning, here on site.
12140660	12147340	And we had Gamoso Labs and LiveOverflow calling in remotely. It's been really adding to the...
12147340	12153620	In fact, we might want to... If we can get the title below our names fixed, we'll get that corrected.
12153620	12159840	That's awesome. But we can go to Starbucks. You can see that they are just dumping out ETC password.
12159880	12162480	So you can see here in the menu. They can load a file. They can print the loaded file.
12162480	12166980	They can unload the last file. And they have an extremely convenient call RAX.
12166980	12171040	Oh, that's a nice option. That's very handy of someone.
12171040	12177860	Right. So I would assume this means that you want to control the value in RAX.
12177860	12184180	We're looking at reading of PROC SELF MEM. So we're looking at interactions.
12186140	12189020	I freaked out for a second. I thought they had a shell installing.
12189020	12195820	They were looking at PROC SELF FT0. So like opening standard in as a file.
12195820	12200300	You can do a bunch of trickery stuff there. They were looking at PROC SELF MEM.
12200300	12206180	Also an interesting file. The whole PROC pseudo file system is pretty interesting in a lot of these challenges.
12206180	12209460	Absolutely. It comes in very handy. So yes, the reference there.
12210180	12214320	Avery is confirming DEF CON CTF. The main CFTF did end a little bit early.
12214320	12217200	I don't know the full story, but we heard from the Nautilus Institute that
12217200	12222560	there was some issues that they had to close down one hour earlier than expected.
12222560	12226000	So normally the intended end of the CTF this year was 2pm.
12226380	12230140	But they ended out slightly early, which means this is the only game left.
12230140	12232040	This is the only points that people can be getting.
12232340	12234240	And we've only got two teams that are in and running.
12234240	12236460	We've got Perfect Root and we've got Team Starbug.
12236780	12244080	And this definitely could change the destiny of Perfect Root in terms of making it into the top teams.
12244080	12246380	I don't think it's going to make them into first.
12246380	12250240	Having seen the scoreboard right before it went dark, it probably wouldn't get them all the way there.
12250240	12254580	Although it is worth noting, there was actually an incident earlier on.
12254580	12259680	One of the things that happens a lot with these kinds of CTFs is you're really worried about fair play
12259680	12261120	and what's appropriate and inappropriate.
12261120	12265000	And unfortunately, one of the members of Perfect Root was fork bombing one of the other boxes.
12265000	12267000	Maybe they weren't aware of the CTF culture.
12267100	12270960	And when their team caught it, they specifically said, hey, we're sorry.
12270960	12272780	One of our team members didn't know this was against the rules.
12272860	12274740	They were penalized a little bit for that.
12274740	12279620	Between that penalty plus the amount that they could get by winning, if they win this,
12279620	12285580	that would have maybe been enough to bring them all the way into first from that fourth position that they were in.
12285740	12291000	But I think with that penalty, they would probably end up somewhere in the second place range, even if they win.
12291000	12295140	So probably not going to upset the entire competition just as a result of this event.
12295740	12297280	But it's going to shuffle around the standings.
12297280	12298540	It's going to change the standings, yeah.
12298540	12303060	No matter what happens, in fact, even if it ends up being Team Starbuck, it's going to jump them way up in the board.
12303060	12305740	We should remember also that it's not only the winner who gets points.
12305740	12309260	There is a point distribution for all the teams in this tournament.
12309740	12315540	And as I said, it will probably not at this point change the winner, but it will shuffle around the standings.
12315600	12319160	I want to go and look at Starbuck.
12319380	12321920	Because I was seeing some interesting stuff there.
12321920	12324080	They're trying to play around with the file system.
12324080	12326400	What interesting file could they be looking at?
12327560	12333140	If I remember correctly, the intended solution involves a symlink or something?
12333140	12340640	You're supposed to open a symlink and then close it to get some kind of uninitialized memory or something like this?
12343500	12346180	I've heard that it does involve a symlink.
12346180	12350240	And that's the difference between that LSTAT and that FSTAT call.
12350240	12352840	Ah, right. Link STAT, file STAT.
12353340	12359180	I was actually going to ask about the difference there, as I did not remember this.
12359180	12364920	So the intended there, I believe, is an FSTAT, which if you call it on a symlink, will give you the file it's pointed at.
12364920	12366520	The ultimate actual file.
12366700	12370340	But if you use LSTAT, you're going to get just the symlink information.
12370340	12370720	Right.
12370720	12373220	So that's, I think, the difference.
12373220	12379060	And one of the changes, again, we've talked a lot about how getting the difficulty right on these can be an issue.
12380340	12385160	One of the things that we did during testing was realize, hey, let's make this a little bit more obvious that this is intended.
12385160	12389060	So that's why the error message that was in there just said before, STAT failed.
12389100	12391420	And now it says specifically FSTAT failed.
12391420	12391680	Right.
12391680	12395740	But that wasn't, as you said earlier when you saw the call, that's not the function that's called.
12395740	12398900	Right. It's a little bit subtle, but it's a hint.
12398900	12401280	It's a hint that's kind of baked into the challenge.
12401280	12404880	Hopefully, it's sufficient and it gets them what they need.
12404960	12405720	We'll see.
12405720	12407300	I still love the name of that menu choice, too.
12407420	12409060	Extremely Convenient Call RIS.
12409060	12409740	Yeah, yeah, yeah.
12409740	12410860	It's a little tongue-in-cheek.
12410860	12411660	It's a little...
12411660	12412060	Yes.
12412060	12416800	We've been, like, you know, because we want to make these challenges, like, simple enough that you can solve them very quickly.
12416860	12426100	We have been, like, putting in, like, a bit artificial gadgets and aspects of the programs here to make them easier to actually exploit.
12427060	12430660	So, let's just see if we can get caught up and get a sense of where everybody's at.
12430660	12434900	I don't know that anybody yet knows exactly what they're doing.
12435220	12436340	I don't think so either.
12436340	12438860	I haven't seen, like, I haven't seen any crashes.
12438860	12440560	I haven't seen any, like, weird behavior yet.
12440560	12444060	I think they're still, like, exploring the program, trying to figure out what's going on.
12444060	12446620	You could see their exploit in the exploit script there.
12446620	12460040	They're trying to, like, you know, start to build up that kind of, like, template we talked about before on the stream, like, building abstractions around those, like, interactions in the program so that you can just easily then put these building blocks together into an exploit.
12461360	12468320	Yeah, and I will point out again, these are the top players in what is already a collection of the top players in the world, right?
12468320	12468940	Right.
12469420	12480600	I think the one lesson we found is that the further along we make it in this competition, the harder it is to see what they're doing because they move so quickly that we need to freeze frame, we need to pause.
12481160	12486040	And one of the things I would love to do next year is actually bring them in for commentary afterwards, have a little debrief session.
12486040	12491000	But we kind of got to balance how much of their time we take up since we are going concurrently with the real event.
12491000	12492340	This is part of a competition.
12492340	12492420	Yeah.
12492420	12494200	It's a very prestigious competition.
12494340	12495220	All the teams are here.
12495220	12495500	They're playing to win.
12495500	12496400	Really, really want to win.
12496400	12496860	Yep.
12497820	12501540	They get the glory of winning the DEF CON CTF.
12501540	12503820	They are awarded black badges, right?
12503820	12505260	Eight black badges to the winning team.
12505260	12510060	It is the only event that has gotten consistently eight black badges every year.
12510060	12512980	Normal events get one, maybe, or maybe two.
12513040	12515300	And so this is the biggest pinnacle of all.
12515300	12520660	And there are dozens or hundreds maybe even of competitions, if you count all the little challenges all over the event.
12520680	12524060	There are tons and tons of things here at DEF CON, but this is the pinnacle.
12524060	12531580	And so we did our best to try to integrate within the CTF, but not take too much away from it.
12531580	12531800	Right.
12531800	12533020	We've got the best people up here.
12533020	12535440	We're only here for a maximum of about four hours each.
12535860	12540060	And that's over the course of a three-day event, I think, the best we could do.
12540060	12540700	Yes.
12541500	12549780	I mean, overall, the DEF CON CTF, within the CTF community, it's one of those, I would say, top five or so events of the year.
12550020	12552700	And it's certainly one of the most longest-running CTFs.
12552700	12553160	For sure.
12554560	12555200	Consistency.
12556060	12562360	It's probably the best known or maybe the only known outside of the CTF community.
12562520	12567180	I have actually had people recognize DEF CON CTF if I'm wearing my leather jacket.
12567180	12571300	So actually, it's one of the other things is that the winning team usually gets a leather jacket, or at least they have in the past.
12571300	12572500	I don't know if they still do that.
12572500	12578640	But you would get these DEF CON branded leather jackets, which doesn't do me a lot of good in Florida, but occasionally I get a chance to wear it.
12578640	12579200	Right.
12580040	12591980	So, switching over to Starbucks again, we can see here that they're looking at S-Maps, which I don't even know what that is.
12592380	12593440	ClockSelf S-Maps?
12593440	12594040	Yes.
12594040	12595260	I don't know either.
12595500	12597280	Maps will show you the memory mapping.
12597280	12601980	Which is actually what PerfectDude is doing right now. They did just that in their script. They leaked out ClockSelf maps.
12601980	12605860	Right. You can see there they're looking at a whole bunch of other mappings and stuff.
12605860	12614620	So, they're playing around with this. I don't know if they're looking for something specific or just checking around a bit to see what they can find.
12614620	12630700	I mean, certainly with that CallRAX that they're given an extremely suspicious menu option, it makes sense that in their script they might want to understand the base addresses so that they can shift and adjust to an actual pointer where something is loaded.
12630700	12631260	For sure.
12631260	12633860	So, combining those I think makes a lot of sense, but there's still...
12633860	12640260	You need to break that down into sub-goals. You know that the end goal is to control the value of this register, but...
12640260	12641160	Where are you going to point it?
12641160	12643480	Right. Where are you going to point it, and how do you get there?
12643480	12649880	Yes. And I think they know where they're going to point it by reading the ClockSelf maps. I think they both can figure that out. They can figure out the offsets.
12650000	12658660	And I don't remember, is there a win function in this binary? I don't remember if we've seen that. If it exists.
12658660	12668640	Does a win function exist in this binary? I'm asking our producer. Does a win function exist in this one? I don't know that it does, but we're going to double-check on that.
12668640	12676660	We're going to have an answer on this very shortly. In the meantime, we can see that PerfectRoot, they are...
12676660	12679540	Yes, PerfectRoot is still the same player. They have not swapped out.
12685540	12690180	Okay, so there are...
12690180	12699400	They're in the binary. There is not a traditional win function the way we've seen other ones, where it's literally just a system of bin.sh, which you could just call it and immediately get a shell.
12700160	12704800	These challenges have standard input wired up to the network socket teams are connecting to.
12706280	12715180	But you can either hit one gadget, or there's actually a component in the binary itself that has a syscall available that's kind of intended as another potential target.
12715480	12721840	And that's actually a good way to make it so that teams can... that we can make sure the difficulty is intended to be a little lower.
12721840	12728520	If there's only exactly one path through the binary, it decreases the odds that somebody's going to get to it in time.
12728520	12733840	So having a couple of different sort of parallel paths is often a nice way to make these accessible.
12733840	12739860	Okay, looking at... we're looking at Perfect Root. I almost said Perfect Blue, which again...
12739860	12742100	Perfect Root is one of the components.
12742100	12743120	Yeah, so again, many of these teams...
12743120	12745880	Perfect Blue and Rootimentary are the components of this team.
12746180	12749520	Yeah, and many of these teams are kind of combined here for DEF CON CTF.
12749520	12755200	And some of them I expect will play together afterwards, and some of them will kind of split back up.
12755200	12759320	Maybe only come together once a year, just for this event. I think we'll see probably both of those.
12759320	12760000	Yes.
12761520	12761960	So...
12761960	12765100	Okay, now this is... so we're looking at the right.
12768560	12779560	Yes. We have some cheer in the chat. Is that... let's see if I can not embarrass myself. Is that like Korean script?
12779640	12780780	That is Korean.
12780780	12781100	Yes.
12781100	12783240	For sure. I thought you were going to read it. I was like, oh, you can read it.
12783240	12787860	No, no, no, no, no, no, no, no. Let's not go that far. I just wanted to identify the right...
12787860	12789380	The character set.
12789380	12790640	All right, fair.
12792040	12798420	But I've actually heard that learning to read the Korean is actually relatively simple.
12798420	12807240	Yeah, the pronunciation is straightforward. Unlike Chinese, for example, I can read a little bit of it, but every character has its own words. I'm going to try.
12807240	12808180	Yeah, yeah.
12808180	12812500	I love how much love our contestants are getting. They are so handsome.
12812500	12812920	Yes.
12812920	12819360	They are so wonderful. And I'm glad our chat appreciates that. We have some fantastic competitors on both sides.
12819360	12827080	So actually, to answer your question in chat, I know we have Alex on the Perfect Root side, only because I saw a prompt earlier.
12827080	12836280	So they've got their path, their username is Alex in the virtual machine. I don't know if I've seen that for Team Starbug, the name of the player that they're sending.
12836660	12837100	Right.
12839120	12843560	There we go. So we've got the answers coming through. Oh, yeah, yeah. Excellent.
12843560	12851140	Yeah, that's, you know, also something I learned when playing CTFs in Korea, that you have the fighting.
12851160	12852820	That's just like working hard.
12852820	12862120	There's like a pose thing. I think it was like, you know, this. I apologize for any like, you know, misremembrance of like how this is supposed to be.
12862120	12867480	But back to the game. Let's go to Starbugs.
12867480	12884340	You can see here that they have some kind of leak, I think, because the PwnTools output is switching to the hex output, which it does when there are non-ASCII characters in your debug log.
12884340	12894300	So this is something I really like when using PwnTools, like when you use the Tubes library, turn on that like debugging things, you can just see all the bytes being sent and received from it.
12894300	12902720	And you can see that within, or pre-pended to that text, there is some, you know, seemingly random bytes, but, you know, probably...
12902720	12905080	Well, that looks like maybe a pointer actually.
12905220	12906360	That looks very much like a pointer.
12906360	12907040	That might be a pointer.
12907040	12908380	There are two pointers there actually.
12908380	12908960	Yeah.
12909060	12923080	So you can see that pattern with the 0F0000 looks like the three upper bytes of an address, typically either, probably a library are going to be in that range.
12923080	12926440	Yeah, like the libc or something else.
12926440	12928980	So thank you very much for chat, we appreciate the love.
12928980	12930760	It has been exhausting.
12930760	12932600	We are really excited to see these teams.
12932600	12937360	We're also really excited to be done and rest our voices and just lay on the ground, I think, and be quiet for a little bit.
12937660	12939700	I'm just going to crash on the floor here right after.
12939700	12940740	Just like, yeah.
12940760	12945900	But no, I mean, if you are here in Vegas at DEF CON, after like, you know...
12945900	12947560	Void Mercy, sorry.
12947640	12948660	Void Mercy is the name.
12948660	12950300	Yes, that makes a ton of sense.
12951680	12952700	Oh, okay, nice.
12952700	12954140	That's the handle.
12954140	12955080	There we go.
12955280	12955680	Right.
12956300	12959540	So if you are here at the event, you know, come talk to us afterwards.
12959940	12963280	Tell us what you think about the event so far.
12963280	12968400	Maybe you have anything to the wish list for next year if we do this again.
12969400	12972980	Let's come back and take a look at Perfect Root because they're payload now.
12972980	12979880	They've actually been using the ability to send things into...
12979880	12980680	No, where did it go?
12980680	12981680	It went away.
12981680	12983020	Oh, the allocate chunk right there.
12983020	12988240	So by doing a load file from standard input and then sending some data,
12988240	12989900	they're able to allocate chunks of different sizes.
12989900	12995940	So they are looking into ways to control the heap allocations by using that standard input
12995940	12999360	as a file read and then just sending an arbitrary amount of data to fill up that buffer.
12999360	13002720	So that's a really clever way to get exact sized allocations.
13004660	13008760	And we'll see if they are going to need that for their exploit.
13008760	13010460	I still don't...
13010460	13016060	I don't see anyone who has actually found the vulnerability itself.
13016060	13018660	We're about 15 minutes in now.
13021820	13022260	And...
13022900	13024820	Yeah, just standard end, right?
13024820	13027620	You don't even need to do the other version of it.
13027620	13032820	But I'm still waiting to see somebody demonstrate knowledge of the actual flaw itself.
13033300	13036600	They could be in their head, but I'm not seeing any scripts yet.
13036600	13039460	So this is the leak that we're seeing here.
13039500	13041880	I'm pretty sure this is some kind of memory leak.
13041880	13043120	Yeah, it looks like it.
13044260	13048280	You're calculating the libc base by taking the leak and subtracting an offset.
13048280	13051680	The classic part of your exploit, right?
13052240	13055040	So there's definitely some progress there.
13055420	13059200	I'm not sure if that will take them all the way.
13059300	13065240	So we're saying that one possible solution here is to leak a libc address,
13065240	13070660	get your libc base, somehow control the REX register,
13070660	13072080	and then go for the one gadget.
13072240	13074520	We're still looking for somebody to find that bug.
13074720	13076820	How do they get that RAX control?
13076820	13080660	Once they have that, I think that the rest of the components are pretty straightforward.
13080680	13082560	So that's what we're looking to see.
13082560	13083660	And we've got plenty of time.
13083660	13088020	The good news is this final round can also, much like the last semifinal round,
13088020	13091420	which was able to go a little bit longer before we went to the sudden death,
13091420	13093280	we do have a good hour and a half,
13093280	13095760	I think before we were going to have to switch over to a sudden death.
13095760	13097880	But we do still have a hard limit.
13097880	13098180	Yes.
13098180	13102220	So if we're not able to solve it, we will switch to one of our sudden deaths.
13102220	13106060	And as you noticed in the last round, our sudden deaths have gotten real fast.
13106060	13108260	We made sure that our sudden deaths are just very, very quick.
13108260	13111820	Oh, that one was like under five minutes.
13111820	13112960	It was pretty quick.
13112960	13113520	Yeah.
13113680	13119820	So in terms of both teams being Korean-based, actually I think we have a mixed mixture.
13119820	13124900	Perfect Root has a couple of different groups that have come together, I know.
13124900	13125520	Right.
13125520	13130220	But I do think Starbuck may be predominantly Korean.
13130220	13134280	Right. And Perfect Root, I think, is mostly U.S.-based, but...
13134280	13138360	Students who may have come over or may have been from a variety of places.
13138460	13141780	They have, I think, friends from Crofton.
13141780	13146140	I know that Perfect Blue is a U.S.-based team.
13146140	13147700	At one time it was a college team, right?
13147700	13148360	Right.
13148360	13153360	I think many of them have graduated and are now in industry, but they kind of met and started there.
13153680	13154040	Yes.
13155220	13157580	So, all right, we're still...
13157580	13159360	See, this is surprising to me.
13159360	13162460	I wonder, are they...
13162920	13169460	I feel like this is a lot of work on both teams, and yet almost just stepping back and looking and saying, where's the bug?
13169740	13170120	Right?
13170120	13172280	Because I don't see anybody who's found the bug yet.
13172280	13177520	And I feel like all this work that they're doing, it's a lot of motion, but not a lot of destination yet.
13177520	13185660	I kind of want to see somebody just stop and just spend some time really marking this up in a decompiler, really looking at...
13185660	13186680	Yes.
13186680	13192380	Although, if I did not see a stack smashing detected there, right?
13192560	13195640	Then maybe we do know the bug on Starbug's side.
13195640	13197900	That's interesting, because...
13197900	13198940	So, what is this script doing?
13199080	13202580	That was a shell, I think.
13202580	13203580	Or was it?
13204880	13211360	Yeah. So, copying into the VM. This is what we've seen before. Copying out of the VM and going to throw it on against the 10th service.
13211580	13214480	Oh, it's not working remotely. Oh my god.
13214700	13217920	Okay, so we're very close. We can hear the frustration.
13218880	13220400	And the teammates are behind.
13220400	13223720	Yeah, they're cheering on. The emotions are there.
13223720	13226160	As long as they're not telling advice. Yeah, that's the downside.
13226160	13230640	As long as they're not giving any hints, they can show all the emotions.
13230640	13232340	Yeah, it's exactly encouraged.
13232340	13235820	Oh, they're trying to figure it out. It's so... yeah.
13236720	13241800	So, I would love to see. Take a look at that exploit the next time it comes up. And I'm very curious. Are we seeing that...
13241800	13245520	They're trying to run it remotely. Oh, they're running it.
13245520	13246620	Is this it? Is this it?
13246620	13247640	They're double checking.
13247640	13248980	Yes. Team 2, team 2, team 2.
13249040	13250480	That's it! We have a winner!
13251920	13252560	Congratulations!
13253240	13253880	Congratulations!
13254340	13257300	Very well done. Very well done.
13258160	13267680	All right. That was amazing. Let's go ahead and just step back. Congratulations to Team Starbug. Starbug was the winning team.
13267800	13273060	So, well done. Made it through all four rounds of live CTF this whole weekend.
13273420	13276660	The amount of stress... it was stressful for us just watching.
13276740	13281400	I cannot imagine how much effort and energy these teams have just been exhausting themselves.
13281400	13285300	It is so hard to sit up here in a room full of people staring over your shoulder.
13285300	13287940	The pressure is crushing.
13287940	13293120	It is amazing. So, Chad, thank you very much. You guys hung out with us this all weekend.
13293440	13296920	Look forward. I can't wait to see a lot of people figuring out afterwards.
13296920	13302720	They're going to freeze frame in slow-mo and we're going to get much more information about the different approaches and how things worked.
13302720	13309280	I think Clive Overflow is still running his recap stream. Are you going to head over there after this ends?
13310440	13315940	Keep an eye out for the challenges because we are also going to be releasing all of these challenges to the public.
13315940	13320200	We'll put out a GitHub repo with both source code and the exact binaries that teams were given.
13320200	13325180	Probably put some information on the website there, a link to the different things, the YouTube channel, the GitHub repo.
13325460	13331300	Let's go ahead and take a look at that bracket one last time and pull that up and we'll show what we did this last several days.
13331300	13335680	So, we had teams coming from the Round of 16 all the way up to this final event.
13335980	13338100	What a great showing. That was super fun.
13338100	13342420	We want to also thank a big thanks to everyone who helped out making this possible.
13342640	13351180	So, we had us and Glenn here on-site in Vegas for this and we had multiple people off-site as well.
13351180	13357240	Thanks to Josh for all the challenges. Thanks to Nick for a challenge. Thanks to Rusty for a bunch of work on challenges.
13357520	13362700	Thanks to Brumley for bringing us food because we had several meals brought to us here that was super, super helpful.
13362700	13363420	So nice.
13363420	13365000	So, this was a blast.
13365000	13372940	And then we had Live Overflow on commentary. We had Brandon Falk and Gamosolabs on commentary as well.
13373300	13375060	And Lightning, of course, from Nautilus Institute.
13375060	13379800	And speaking of, big thanks to Nautilus Institute for bringing us out in the first place.
13379800	13380260	Right.
13380260	13386600	We really appreciate that. So, good job to Starbugs for winning. Fantastic.
13386600	13390980	Alright, we are going to pack it in. I think that's about it for the stream for now.
13390980	13392400	We look forward to coming back.
13392400	13397460	Live CTF is not going away forever. We would love to come back again for DEF CON CTF next year.
13397460	13404540	But if you're actually interested in Live CTF coming to another CTF, we want other people to be doing this as well, too.
13404540	13412260	We think just the idea of showing what teams are doing and talking about it and being able to make it a little bit more accessible is super fun.
13412400	13414240	And so, we're looking forward to that happening.
13414360	13417640	Right. So, yeah. That's going to be it for us.
13417640	13420020	I've been Carl, CTAH2.
13420020	13422960	I've been Cyberdex, and we will see you next time.
13423240	13424120	Bye.
13424120	13424880	Take care.
13804240	13806380	Transcribed by https://otter.ai