WEBVTT

04:16.230 --> 04:16.930
A little

04:39.510 --> 04:49.430
pause...

04:49.430 --> 04:49.530
and we are back.

04:49.530 --> 04:50.190
A little pause... and we are back.

05:19.410 --> 05:19.550
A little pause... and we are back.

11:21.220 --> 11:24.380
A little pause... and we are back.

20:04.780 --> 20:10.240
Good morning and welcome back to day three of HackASAT here at DEF CON CTF30.

20:10.280 --> 20:11.800
Let's get ready to do it.

20:11.840 --> 20:12.460
Not HackASAT.

20:12.460 --> 20:13.640
I did it!

20:13.640 --> 20:14.720
I did it!

20:14.720 --> 20:16.140
I was so afraid I was going to do it.

20:16.140 --> 20:17.360
Welcome back to live CTF.

20:17.360 --> 20:19.820
Listen, we're going to edit that on the VOD.

20:19.940 --> 20:21.400
We're going to change it.

20:21.720 --> 20:27.840
Welcome back to live CTF here at DEF CON CTF finals DEF CON 30.

20:27.920 --> 20:28.800
Let's get ready to do it.

20:28.800 --> 20:31.780
Let's let the teams get going for the semi-final round.

20:32.020 --> 20:37.080
5, 4, 3, 2, 1, go!

20:38.240 --> 20:45.840
Alright, so as you can see, we are starting to get a little bit tired here as we get towards the end of the competition.

20:45.840 --> 20:47.980
But we are down to the semi-finals.

20:48.020 --> 20:51.100
So we're going to have two semi-finals today and then the grand finals.

20:51.400 --> 20:53.860
And these are important matches.

20:53.860 --> 20:59.580
Looking at the current scoreboard of the DEF CON CTF, these points will affect the final standings.

20:59.580 --> 21:00.780
Yes, absolutely.

21:00.780 --> 21:11.660
We're at the point where both the point totals are going up, the amount that teams are getting for making it further into live CTF, and the teams that are here are all teams in the top half of the scoreboard.

21:11.660 --> 21:13.740
And so this can change things.

21:13.740 --> 21:14.700
It really can.

21:14.700 --> 21:18.760
Let's just take a quick look at each of the teams and see what they're doing.

21:18.780 --> 21:21.940
Starting over here with MMM.

21:22.780 --> 21:24.760
Pulling up Gidra.

21:24.760 --> 21:28.900
Is that what they were using in the previous matches?

21:28.900 --> 21:29.660
I don't remember.

21:29.660 --> 21:32.680
So they've changed their players before.

21:32.820 --> 21:35.120
I think Jimmo was using Ida, but...

21:35.120 --> 21:36.500
Yeah, Ida on Windows.

21:36.500 --> 21:37.180
Yes, yes.

21:37.180 --> 21:42.780
But we may have had Gidra before from Robert, so I'm not sure.

21:45.580 --> 21:47.820
Let's check with Starbucks.

21:47.820 --> 21:51.880
We can see a bit of Terminal, starting with Python.

21:51.900 --> 21:55.180
Let's go ahead and tell everybody the name of the challenge, the information on this one.

21:55.180 --> 21:57.840
This is called AES of Spades.

21:59.400 --> 22:01.440
Because really that's what it's all about, right?

22:01.460 --> 22:06.580
It's very important that you get the good name, the good pun, and then you figure out how to make a challenge out of it.

22:06.580 --> 22:14.020
And I originally made this challenge, or I started making this challenge, and it was in a messy state.

22:14.020 --> 22:20.420
And then Josh came in and kind of salvaged it and turned it into something that we see here today.

22:20.420 --> 22:25.720
So I don't really know what the challenge is about, except that as the name...

22:25.720 --> 22:26.920
You know what it was about originally.

22:26.920 --> 22:27.300
Yes, yes.

22:27.300 --> 22:29.420
And it's changed, and so we're going to find out too.

22:29.420 --> 22:29.560
Right .

22:29.560 --> 22:32.320
I mean, it does involve AES encryption.

22:34.020 --> 22:35.420
That's definitely still there.

22:35.420 --> 22:45.580
We can see, if we switch over to MMM's decouplation here, you can see that AES-128 init and AES-128 encrypt.

22:45.580 --> 22:50.460
So there is some kind of AES encryption thing going on here.

22:50.900 --> 23:02.920
They are doing a little bit of decouplation, trying to name the variables, making sense of what the program is doing.

23:02.940 --> 23:11.780
So we've been told that basically it's an arbitrary write dressed up with some AES encryption.

23:11.780 --> 23:14.860
That's basically what the challenge is about.

23:16.000 --> 23:25.760
If we switch over to Starbucks again, we can see that they are using an online disassembler.

23:25.760 --> 23:27.240
I thought that was a little unusual.

23:27.420 --> 23:27.680
Yes.

23:27.680 --> 23:29.600
I was a little surprised by that too.

23:29.720 --> 23:32.120
So they are... I'm not entirely sure.

23:32.120 --> 23:34.580
They are verifying a couple of...

23:34.580 --> 23:36.380
Oh, they're doing some calculation with some offsets.

23:36.380 --> 23:38.140
Trying to look at maybe some opcodes.

23:39.020 --> 23:43.560
Or they are writing a little piece of shellcode.

23:44.320 --> 23:46.560
You can see...

23:47.440 --> 23:50.040
So they are putting together a small piece of shellcode.

23:51.340 --> 23:53.120
They really need to learn Binja.

23:53.380 --> 23:55.380
This is what Binja is really good at.

23:55.380 --> 23:58.120
I'm trying not to do it too much, but I have to.

23:58.540 --> 24:00.820
This is exactly the kind of thing it works really well for.

24:00.820 --> 24:03.160
You can stay right in the one app.

24:04.360 --> 24:07.020
So building up their payload using an online disassembler.

24:07.020 --> 24:08.540
Online assembler, rather.

24:09.400 --> 24:10.240
And there we go.

24:10.240 --> 24:11.720
We get a brief little glance at the source code.

24:11.720 --> 24:12.420
And they're off again.

24:12.420 --> 24:24.120
So this is interesting, because we can see that in contrast to MMM, who started more analyzing the code, they went straight into putting together some kind of payload.

24:24.900 --> 24:28.580
You can see here their exploit scripts being put together.

24:28.580 --> 24:31.060
There's some shellcode there that has been assembled.

24:31.060 --> 24:33.580
I'm not entirely sure what the shellcode was doing.

24:33.580 --> 24:35.160
I saw that it was...

24:35.160 --> 24:36.640
It looked like a pointer address.

24:36.640 --> 24:39.380
It was using some kind of pointer within the program.

24:39.380 --> 24:41.120
And there was a syscall in there.

24:41.720 --> 24:43.640
Maybe changing memory protections?

24:44.640 --> 24:48.200
Well, it says it's code, and it looks like they're dropping...

24:48.200 --> 24:51.340
Right, so it could be an mprotect plus shellcode, right?

24:51.340 --> 24:52.100
Yeah.

24:52.520 --> 24:55.520
Yeah, but the thing that had labeled code looked like it had a...

24:55.520 --> 24:56.780
Is that a pointer?

24:57.520 --> 24:58.780
No, we'll see.

24:58.780 --> 24:59.280
I think it is.

24:59.280 --> 25:08.860
If we do switch over to MMM, we see that they've also started putting together an exploit script here.

25:08.860 --> 25:12.880
You can see they have this calculateKey function.

25:13.620 --> 25:25.360
I guess that in this program, your resulting payload could be the result of the encryption.

25:26.540 --> 25:32.320
I mean, I will say, watching Starbugs, it looks like they know what they're doing.

25:32.320 --> 25:37.620
They certainly are making an attempt to...

25:38.800 --> 25:43.840
They're XORing the IV with their shellcode.

25:43.840 --> 25:44.740
Oh, okay.

25:44.740 --> 25:48.900
So that sure sounds like a thing that would be useful.

25:49.200 --> 25:49.960
Yeah.

25:50.060 --> 25:50.880
Yeah, so here...

25:50.880 --> 25:53.460
Okay, so the payload is the IV.

25:53.460 --> 25:54.260
Oh, interesting.

25:54.260 --> 25:59.220
The IV that's used for the encryption is part of the payload.

25:59.220 --> 26:00.580
So actually that makes a lot of sense.

26:00.580 --> 26:02.240
We're seeing them XOR that in.

26:02.840 --> 26:03.420
Yeah.

26:03.420 --> 26:05.140
Yeah, they saw that very, very quickly.

26:05.140 --> 26:08.600
Certainly faster than we could follow along as they looked at it.

26:08.600 --> 26:09.540
It makes sense, though.

26:09.700 --> 26:14.520
These are our top teams.

26:14.520 --> 26:15.360
Oh , so actually that...

26:15.360 --> 26:15.940
Where did that...

26:15.940 --> 26:16.560
Oh, okay.

26:16.560 --> 26:17.700
So that was memory.

26:17.920 --> 26:20.420
That was a piece of memory that they pulled out of the binary.

26:20.700 --> 26:23.520
And they're XORing that with the code, which is the IV.

26:23.520 --> 26:24.120
Oh, okay.

26:24.120 --> 26:25.120
That's interesting.

26:25.120 --> 26:27.000
But it's actually interesting to see now.

26:27.000 --> 26:28.600
So they are looking now in the debugger.

26:28.600 --> 26:34.060
I guess they are now testing out their payload to see if it is working.

26:34.460 --> 26:37.140
So this could be a quick one.

26:37.480 --> 26:38.560
Yeah, could really be.

26:38.560 --> 26:41.040
I mean, I'm not sure exactly how many steps there are to this.

26:41.040 --> 26:48.580
But if we are already seeing some shellcode being thrown in there, there might not be too many steps involved here at all.

26:48.800 --> 26:55.140
If we switch over back to MMM, we can see that they also have this calculation function.

26:55.140 --> 26:57.080
They put a bunch of A's and B's in there.

26:57.080 --> 26:59.560
And from that, they're calculating a key and an IV.

27:00.600 --> 27:07.280
And we can see they're starting to put together the interaction to send this key, send the IV, receiving an address.

27:07.280 --> 27:09.680
Maybe it's like a leak, like an intentional thing.

27:09.680 --> 27:10.940
We would just give them something there.

27:11.060 --> 27:14.920
Yeah, and I don't see them yet creating that key.

27:14.920 --> 27:20.600
So if I'm looking at this now, it looks like Starbucks is a little bit ahead just based on how they've already got the memory address pulled out.

27:20.600 --> 27:22.720
They're XORing the IV, which is their code.

27:22.720 --> 27:24.440
So I'm seeing that.

27:25.500 --> 27:27.740
That looks certainly further along.

27:27.960 --> 27:31.960
And we did see Starbucks show up earlier into that payload and start it.

27:31.960 --> 27:36.980
That said, I would say that the first person to start writing their payload script has not been an indicator of success.

27:36.980 --> 27:42.020
It's been sometimes slow and steady wins the race, and sometimes quick to get your script out does.

27:42.020 --> 27:43.480
And so it's not made consistent.

27:43.480 --> 27:46.500
We saw MMM here testing their payload.

27:46.500 --> 27:52.200
I saw them connecting to a local setup of the challenge.

27:54.600 --> 27:57.320
It was not a successful exploit, at least.

27:57.320 --> 27:57.920
That's all I know.

27:57.920 --> 28:03.360
It was hard to tell to what extent it was successful or not.

28:03.360 --> 28:08.960
The further along we get in this competition, the more we need pause because these players are so fast.

28:09.320 --> 28:11.260
Just trying to kind of keep up with them.

28:11.260 --> 28:16.340
We did see some of the classic AAAs being put in on Starbucks just a second ago off camera.

28:16.340 --> 28:16.560
Right.

28:16.560 --> 28:20.140
They're also checking memory mappings there, was it?

28:20.500 --> 28:24.900
Yeah, I don't know if they're searching for their values that they sent in.

28:26.600 --> 28:27.560
Right.

28:28.960 --> 28:33.900
So just to do quickly a little bit recap of where we are in the tournament.

28:33.900 --> 28:36.960
This is one of the first semifinals between Starbucks and MMM.

28:36.960 --> 28:41.760
And then right after we will have the second semifinals between Perfect Root and Wreck-a-Pig.

28:41.760 --> 28:46.360
And the winners of those respective matches go to the finals.

28:46.360 --> 28:46.960
Yep.

28:48.700 --> 28:56.220
And these teams, I'm trying to look over a little bit at the scoreboard of the main event.

28:56.560 --> 29:04.300
And yeah, these are all in the top half, at least, of the scoreboard.

29:04.300 --> 29:06.780
Actually, Wreck-a-Pig might not be.

29:07.840 --> 29:13.480
So in order relative to one another on the top scoreboard, MMM isn't in number one.

29:13.580 --> 29:17.420
But Perfect Root is in number four.

29:17.420 --> 29:20.380
And I would say they're within striking distance.

29:20.380 --> 29:25.040
So at four, they're about 4,000 points behind MMM.

29:25.500 --> 29:26.440
Actually, a little bit less.

29:26.440 --> 29:27.220
They're almost about 3,000.

29:27.220 --> 29:29.180
And it depends, though.

29:29.180 --> 29:33.940
If MMM wins this, they've basically fended off any attack, even if they lose in the finals.

29:33.940 --> 29:38.140
I don't think anyone will be able to close the gap to them based on this event.

29:38.380 --> 29:42.260
But if they lose now, and Perfect Root ends up winning in the finals...

29:42.680 --> 29:43.920
That's going to put it real close.

29:43.920 --> 29:45.100
It's going to put it very, very close.

29:45.100 --> 29:46.920
And it will really depend on how they do in the main event.

29:46.920 --> 29:47.160
Right.

29:47.160 --> 29:49.240
Let's not forget that they have almost...

29:49.240 --> 29:50.780
Well, it's like a couple of hours.

29:50.780 --> 29:52.240
It's three and a half hours of this.

29:52.480 --> 29:53.040
Exactly.

29:53.040 --> 29:54.300
Left in the game here, too.

29:55.360 --> 29:57.760
So definitely really exciting.

29:58.860 --> 30:05.960
It's always fun when the competition is not decided until the last moment.

30:05.960 --> 30:06.960
It can go down to the wire.

30:06.960 --> 30:09.340
You want it to be... I mean, as an organizer, you want it to be.

30:09.340 --> 30:11.220
As a player, you would love to win it early.

30:11.440 --> 30:12.840
Sure, sure, sure.

30:12.840 --> 30:20.220
When you're playing a CTF, how many times have you not been thinking, like , oh, can we just not solve all challenges so I can go to bed?

30:21.380 --> 30:24.420
But yeah, that's not going to happen in the Def Con CTF.

30:24.980 --> 30:34.240
Okay, yeah, so I'm seeing Starbugs over here is definitely continuing to tweak their script by pulling out the memory address that they're using.

30:34.240 --> 30:38.240
They're verifying that memory and updating the IV that they're storing.

30:38.240 --> 30:39.840
Yeah , you can see a syscall being made there.

30:41.000 --> 30:43.880
And then they are trying to figure out what happens afterwards.

30:43.880 --> 30:44.320
Oh , is that it ?

30:44.640 --> 30:45.480
This might be it.

30:45.480 --> 30:47.140
Are we switching over to live?

30:47.800 --> 30:49.480
Oh, did it work?

30:49.920 --> 30:51.680
They look like they were...

30:53.100 --> 30:58.300
This is going to be... I mean, it's going to be tight.

30:59.460 --> 31:03.180
I think both teams have pretty good progress on this.

31:05.340 --> 31:08.760
So, yeah, no, they have some bad instruction there.

31:08.760 --> 31:09.640
There's something wrong.

31:09.640 --> 31:10.440
Yeah, there's a bug earlier.

31:10.440 --> 31:13.440
There's something wrong in their exploits.

31:13.900 --> 31:16.980
So, not there quite yet.

31:16.980 --> 31:19.160
They're going back to the assembler.

31:19.160 --> 31:20.740
Oh, they switched it to...

31:20.740 --> 31:22.720
Oh, there was a typo there.

31:22.720 --> 31:28.200
They missed a zero at the end of an immediate value.

31:28.320 --> 31:30.660
And so everything was shifted off, so the value was wrong.

31:30.660 --> 31:31.460
And this is the thing.

31:31.980 --> 31:33.140
That's the little bug.

31:33.140 --> 31:33.660
Oh , here it is.

31:34.020 --> 31:34.860
Hold on, hold on.

31:34.860 --> 31:35.460
Did they just switch?

31:35.460 --> 31:37.000
They just switched to throwing live.

31:37.500 --> 31:38.780
They went through it live.

31:39.340 --> 31:40.440
Are they going for it?

31:41.180 --> 31:42.320
Oh, they are typing.

31:42.320 --> 31:43.160
It's going fast.

31:43.160 --> 31:44.080
I'm just checking here.

31:44.080 --> 31:44.780
Oh, no.

31:45.580 --> 31:46.100
They're...

31:50.850 --> 31:52.810
Oh, they're going, they're going.

31:53.730 --> 31:55.650
Oh, it did not work.

31:56.870 --> 31:58.570
No such port.

31:59.730 --> 32:01.590
Here it is, here it is, here it is.

32:03.630 --> 32:04.590
Oh, typo.

32:04.590 --> 32:05.310
There it is.

32:05.310 --> 32:07.050
Starbucks, congratulations.

32:07.270 --> 32:08.510
Well done.

32:08.570 --> 32:10.990
A super fast speed race.

32:10.990 --> 32:12.650
Well done on the challenge.

32:12.650 --> 32:14.130
Ace of spades.

32:14.150 --> 32:16.930
Congratulations to Starbucks who makes it to our finals.

32:16.930 --> 32:19.310
We'll see you back here for our next round.

54:04.400 --> 54:05.840
Bye.

54:05.840 --> 54:06.080
Bye.

54:06.080 --> 54:06.580
Bye .

55:04.870 --> 55:06.010
Bye.

55:06.090 --> 55:07.050
Bye

55:13.990 --> 55:14.990
.

55:18.190 --> 55:18.650
Bye.

55:18.650 --> 55:22.650
Bye.

01:06:28.580 --> 01:06:31.980
Hello and welcome back to our second semifinal round.

01:06:31.980 --> 01:06:33.580
I'm CypherTex here with Zeta2.

01:06:33.580 --> 01:06:34.040
Hello.

01:06:34.040 --> 01:06:34.900
I introduced you, sorry.

01:06:34.900 --> 01:06:37.580
And on the line we also have LiveOverflow.

01:06:37.800 --> 01:06:39.260
Hello, I'm back.

01:06:39.260 --> 01:06:39.680
Excellent.

01:06:39.680 --> 01:06:43.900
So we got a three commentator matchup today as we get closer and closer to the finals.

01:06:43.900 --> 01:06:46.500
Here we're going to have Perfect Root and Wreck-a-Pig.

01:06:46.620 --> 01:06:48.140
And let's just go ahead and count them down right away.

01:06:48.140 --> 01:06:48.760
Everybody.

01:06:49.360 --> 01:06:54.460
Five, four, three, two, one, go.

01:06:55.120 --> 01:06:56.760
And we'll quickly switch over to the teams.

01:06:56.760 --> 01:06:58.980
They are ready for this challenge.

01:06:59.140 --> 01:07:00.300
Yeah, we saw.

01:07:00.300 --> 01:07:05.080
So they've been given the name of the challenge, Loopy Brain, which...

01:07:05.080 --> 01:07:06.380
And they were told it was an interpreter.

01:07:06.380 --> 01:07:07.120
All right.

01:07:07.120 --> 01:07:08.900
So where does that take us?

01:07:08.900 --> 01:07:15.000
I think also the menu is immediately telling the teams what it is about.

01:07:15.000 --> 01:07:15.600
Yeah.

01:07:15.660 --> 01:07:18.320
They definitely knew what sort of challenges it was.

01:07:18.320 --> 01:07:25.940
In fact, we even saw one of the teams beforehand where the web page opened with the spec for that particular flavor of language.

01:07:27.000 --> 01:07:28.520
Both flavors of language, I guess.

01:07:28.520 --> 01:07:28.880
Right.

01:07:28.880 --> 01:07:29.800
I saw.

01:07:29.900 --> 01:07:33.420
I was also actually looking at one of the competitors' computers before the start.

01:07:33.420 --> 01:07:40.860
And they had in their exploit template, they already had helper functions for BrainFact code.

01:07:40.860 --> 01:07:42.340
So , yeah.

01:07:42.340 --> 01:07:44.500
They're taking this seriously.

01:07:45.340 --> 01:07:46.340
So, wait.

01:07:46.340 --> 01:07:47.420
Did I get this correctly?

01:07:47.420 --> 01:07:51.020
You mentioned them the name and they immediately knew it was about BrainFact before?

01:07:51.020 --> 01:07:51.520
Yes.

01:07:51.520 --> 01:07:53.680
They knew before they even showed up.

01:07:53.680 --> 01:07:55.300
They were ready.

01:07:56.360 --> 01:07:59.360
Oh, you told them way in advance the name of the challenge?

01:07:59.360 --> 01:08:01.420
We do tell every team the name of the challenge, yes.

01:08:01.420 --> 01:08:04.180
Like an hour in advance because we want them to send up the right person.

01:08:04.180 --> 01:08:04.740
Okay , I didn't know.

01:08:04.740 --> 01:08:06.820
I think we had a problem with our stream capture.

01:08:06.820 --> 01:08:09.180
We may have been having some glitches there, but I think we got it all straightened out now.

01:08:09.180 --> 01:08:10.200
Yeah, it seems good.

01:08:10.200 --> 01:08:10.820
Right, yes.

01:08:10.820 --> 01:08:12.740
A little bit of a visual artifact there.

01:08:12.740 --> 01:08:14.920
So, if you're on the stream, we should now be up.

01:08:14.920 --> 01:08:16.220
Okay, so let's go ahead and take a look.

01:08:16.820 --> 01:08:18.860
Again, they know that it's an interpreter.

01:08:18.940 --> 01:08:20.480
They know that it's pwnable.

01:08:20.920 --> 01:08:23.640
And I think this is actually a category of challenges that's been around for a long time.

01:08:23.640 --> 01:08:31.680
In fact, we were looking and we realized that a friend of ours had written a version of this nine years ago for another CTF.

01:08:31.680 --> 01:08:32.980
It was a different challenge.

01:08:32.980 --> 01:08:34.440
Yes, but it has a lot of similarities.

01:08:34.440 --> 01:08:35.280
Very, very similar.

01:08:35.280 --> 01:08:36.380
Yeah, so we thought it was really funny.

01:08:36.380 --> 01:08:38.240
It's a common idea.

01:08:39.140 --> 01:08:43.420
Difficulty-wise, since, Carl, you wrote this, how would you rate this one relative to some of the other ones?

01:08:43.420 --> 01:08:49.060
So, the original version of this was kind of difficult, I would say.

01:08:49.060 --> 01:08:53.560
And then we toned down the difficulty a bit.

01:08:53.620 --> 01:08:58.800
So, I would say it's still definitely not one of the easiest challenges we've had.

01:08:58.900 --> 01:09:02.560
But I hope it's not one of the most difficult ones either.

01:09:03.060 --> 01:09:07.980
I had a quick look at it and immediately I thought, oh, that's going to be an easy challenge.

01:09:07.980 --> 01:09:15.240
Until I heard about or noticed a little twist that's in this challenge that does make it a little bit more tricky.

01:09:15.240 --> 01:09:16.720
Yeah, go ahead and describe what you saw.

01:09:16.720 --> 01:09:22.460
Because I think for the stream we're going to give them the pleasure of knowing what's going on, even as the competitors are having to figure it out.

01:09:22.760 --> 01:09:25.940
Yeah, maybe I should mention what BrainFuck is.

01:09:25.940 --> 01:09:29.700
It's an interpreted language that is working on symbols.

01:09:30.280 --> 01:09:35.300
You have, like, imagine a big field or something.

01:09:35.300 --> 01:09:38.020
And then you can move a cursor to the left, to the right.

01:09:38.020 --> 01:09:41.240
You can increment, you can decrement a certain field.

01:09:41.880 --> 01:09:50.680
And essentially here the movement on this big array has no constraints.

01:09:50.680 --> 01:09:53.020
So you can have out-of-bounds reads and writes.

01:09:53.020 --> 01:09:56.560
And so it should be pretty easy to go out-of-bounds.

01:09:56.620 --> 01:09:59.700
I don't know if that field is on the stack.

01:10:00.020 --> 01:10:02.300
No, it's on the stack, yeah.

01:10:02.300 --> 01:10:14.480
Looking at it, you can just increment the data pointer outside the bounds of the data area into the return pointer and you're done, right?

01:10:14.820 --> 01:10:16.580
Right, and that's what I thought.

01:10:16.580 --> 01:10:21.460
Oh, they should figure this out very quickly and it would be quickly done.

01:10:21.460 --> 01:10:26.940
Then it's just about the tooling to get the BrainFuck program to manipulate the memory in the correct way.

01:10:26.940 --> 01:10:32.040
However, there's a size restriction on the BrainFuck program.

01:10:32.040 --> 01:10:36.520
And that makes it significantly more difficult.

01:10:37.020 --> 01:10:39.780
So like a lot of exploits, you're in a constrained environment.

01:10:39.780 --> 01:10:42.460
You've got a small bit of shellcode or a small payload.

01:10:42.800 --> 01:10:46.440
So what are you going to do with that?

01:10:50.200 --> 01:10:51.300
Yeah, go ahead.

01:10:51.440 --> 01:10:57.160
The players are looking for something to loosen their constraints.

01:10:57.960 --> 01:11:00.140
And these things can get creative.

01:11:00.140 --> 01:11:03.500
There are many ways how one could do that.

01:11:05.000 --> 01:11:09.100
Maybe you can change the accepted size.

01:11:09.100 --> 01:11:19.180
Maybe you can override the return pointer and find a very useful gadget in an interesting way.

01:11:19.180 --> 01:11:26.820
I mean, it's a limited BrainFuck program, but with some creativity, they could find some very interesting exploitation paths for this.

01:11:26.820 --> 01:11:28.720
It's a little similar to the involvement challenge before, right?

01:11:28.720 --> 01:11:33.700
Where we actually had a simple command injection, except it was too few characters.

01:11:33.700 --> 01:11:37.760
And so they had to use one of the other vulnerabilities to make the limit larger.

01:11:37.760 --> 01:11:40.740
And then they were able to use the original kind of design.

01:11:40.740 --> 01:11:41.640
Right , a lot of similarities here.

01:11:41.640 --> 01:11:49.940
And I think a key thing here is that the data array sits just after the program array.

01:11:50.180 --> 01:11:51.120
That's the key insight.

01:11:51.120 --> 01:11:58.980
When we see them naming data and code and noticing they're adjacent to one another, that's going to be the point at which we know that they're on the way to figuring this out.

01:11:58.980 --> 01:12:05.660
If we look here at EurekaPigs, who someone says how it's pronounced in the chat, if that's correct.

01:12:05.660 --> 01:12:07.760
Yeah, I'm not sure exactly which one it is.

01:12:07.760 --> 01:12:13.580
Yeah, we've been saying RekkaPigs throughout the tournament, but it might be EurekaPig because they're from the team Eureka.

01:12:16.980 --> 01:12:18.200
That sounds good to me.

01:12:18.200 --> 01:12:19.220
Yeah, sounds good.

01:12:19.220 --> 01:12:23.840
Anyway, what I was going to say was that they saw that there's a win function in the program.

01:12:23.840 --> 01:12:28.100
So they don't need to do a full exploit chain like a ROP chain or something like this.

01:12:28.100 --> 01:12:33.180
They just need to take control of the instruction pointer and point it to the win function.

01:12:33.180 --> 01:12:36.220
Yeah, there's different things to make it easier or harder.

01:12:36.220 --> 01:12:45.300
And this one we already knew the challenge itself had enough difficulty with it that we wanted to make it a little bit easier once they had the ability to change a pointer, for example.

01:12:45.940 --> 01:12:46.720
Right.

01:12:47.760 --> 01:12:57.660
We also can see the interesting setup from RekkaPig with the interesting Windows 7 VM with all the reversing tools.

01:12:57.660 --> 01:12:57.800
Yeah .

01:12:57.800 --> 01:13:00.660
Not even full screening it, just like working in...

01:13:00.660 --> 01:13:03.380
I don't need the full resolution.

01:13:03.380 --> 01:13:05.280
Two star bars are fine for me.

01:13:05.280 --> 01:13:05.780
I know.

01:13:06.320 --> 01:13:07.420
I'm impressed.

01:13:07.420 --> 01:13:15.420
It feels a little bit like a handicap, like they're playing with the difficulty set to high just to flex.

01:13:16.600 --> 01:13:18.820
Just switch over to Perfect Root here.

01:13:18.820 --> 01:13:20.420
I see a lot of blue stuff on the screen.

01:13:20.420 --> 01:13:22.360
Yeah , so they've actually opened up the file in Vim.

01:13:22.360 --> 01:13:28.900
So they're hex editing the challenge to change the LD string?

01:13:29.120 --> 01:13:30.200
I don't think I've seen that before.

01:13:30.200 --> 01:13:31.400
It looked like they were changing...

01:13:31.400 --> 01:13:31.700
Oh, right.

01:13:31.700 --> 01:13:35.480
It might be to make it easier to run the challenge locally.

01:13:36.200 --> 01:13:38.060
Oh, modifying it to their version.

01:13:38.060 --> 01:13:40.600
Yeah, you can see that it seems to be running now.

01:13:42.780 --> 01:13:47.300
So did they also have problems with the version?

01:13:47.300 --> 01:13:51.720
Yeah, I think it was the version of the loader is different than the one on their box.

01:13:52.480 --> 01:13:55.600
So we actually give the loader with everyone.

01:13:55.600 --> 01:14:07.500
So you can, what the other teams demonstrated earlier, which actually Gamoza wasn't even aware of, that you can run the loader as an executable and then pass it the argument of the application and it will still run it, which is basically what the kernel does for you when you execute it.

01:14:07.500 --> 01:14:22.380
So instead of doing that, they just literally put a bunch of forward slashes into the raw string using Vim, where the reference to that library was, so that it would use the local one that they had instead of the one on the original system.

01:14:24.620 --> 01:14:28.460
I want to switch back over to Recapig.

01:14:28.780 --> 01:14:35.100
You can see them running the debugger here as well with the challenge.

01:14:35.100 --> 01:14:42.380
And you can see a little bit there in the background, you can barely see it, but they have this script and you can see all these like deck pointer, ink val, deck val and so on.

01:14:42.380 --> 01:14:45.340
These are the helper...

01:14:45.340 --> 01:14:46.580
Yeah, operations.

01:14:46.580 --> 01:14:51.160
Yes, and you can also see that they had a comment in the code with the dot slash submitter too.

01:14:51.160 --> 01:14:55.720
So they already have the string, the thing they have to run to win.

01:14:55.720 --> 01:14:59.860
So they're trying to make all the different time savings.

01:14:59.860 --> 01:15:03.300
Yes, they know that this can be tight since we are...

01:15:03.300 --> 01:15:05.080
Seconds have literally mattered.

01:15:05.500 --> 01:15:11.020
I was wondering, what are the rules if one team is accidentally running submitter with the wrong team number?

01:15:11.020 --> 01:15:12.440
Then that result stands.

01:15:12.440 --> 01:15:15.120
So if you make the other team win, the other team wins.

01:15:15.120 --> 01:15:16.580
We have told the teams this.

01:15:16.580 --> 01:15:20.260
We did debate that and we told them that that was going to be the way that we would do it.

01:15:20.260 --> 01:15:22.560
So be very, very careful with your...

01:15:22.560 --> 01:15:25.980
And I will say, the risk isn't as bad as you might think.

01:15:25.980 --> 01:15:33.580
Only because each team, when they first connect to the server, they choose their team and it gives them their exact information.

01:15:33.580 --> 01:15:37.860
So most of the teams click their team name and then just copy and paste all the information from there.

01:15:37.860 --> 01:15:38.260
Right .

01:15:38.480 --> 01:15:40.040
Haven't had anybody mess it up yet, but...

01:15:40.720 --> 01:15:40.920
No.

01:15:40.920 --> 01:15:41.460
Yeah.

01:15:41.480 --> 01:15:48.800
My fear there would be that someone would keep their templates from a previous match and then reuse it or something like this.

01:15:48.800 --> 01:15:48.900
Yeah .

01:15:48.900 --> 01:15:51.640
Maybe for next time we should have not just one or two, but a small...

01:15:51.640 --> 01:15:54.860
We should match with the global IDs of the...

01:15:54.860 --> 01:15:55.520
Yes.

01:15:55.520 --> 01:15:57.640
My team has an ID on the DefCon network as well.

01:15:57.640 --> 01:15:58.080
Yes .

01:15:58.460 --> 01:16:00.300
We should do something like that.

01:16:00.300 --> 01:16:01.500
Lesson learned for next year, yeah.

01:16:01.500 --> 01:16:07.480
There are a lot of things we can improve, but I think it's been running pretty smooth, this whole thing.

01:16:07.480 --> 01:16:12.920
I hope you've been enjoying it, the people who have been watching throughout the weekend.

01:16:12.920 --> 01:16:17.100
So I haven't seen anybody yet figure out that first constraint, right?

01:16:17.100 --> 01:16:21.060
I don't think I've seen anyone get their way out of...

01:16:21.060 --> 01:16:23.660
Well, we can switch over here to...

01:16:23.660 --> 01:16:30.320
It might be difficult to assess if they have seen it, because it's like a mental note they would make themselves, right?

01:16:30.320 --> 01:16:30.760
Right.

01:16:30.760 --> 01:16:37.160
We would have to look at when they start writing BrainFuck if they realize that they are constrained or not.

01:16:37.260 --> 01:16:37.540
Right.

01:16:37.540 --> 01:16:40.840
And that's what I wanted to point out here on Perfect Root's screen.

01:16:40.860 --> 01:16:47.920
So they tabbed away from it now, but just when you switch it, you can see that they had this small program with a loop and the input...

01:16:47.920 --> 01:16:48.160
Right there.

01:16:48.160 --> 01:16:49.340
The P equals.

01:16:49.340 --> 01:16:50.040
Yes.

01:16:50.040 --> 01:16:52.660
You see the comma is the input.

01:16:52.660 --> 01:16:58.940
It will take one byte input from standard input and write it to the current cell on the tape.

01:16:58.940 --> 01:17:01.100
And then the brackets are a loop.

01:17:01.700 --> 01:17:02.960
So they are...

01:17:02.960 --> 01:17:08.580
They're kind of... I think they're going... You see the input in a loop thing going on.

01:17:08.580 --> 01:17:11.580
So that's definitely on the right track.

01:17:12.980 --> 01:17:17.780
Though I think they want the greater than sign rather than the plus sign.

01:17:17.780 --> 01:17:17.940
Yeah .

01:17:17.940 --> 01:17:21.040
But maybe they have another idea.

01:17:21.540 --> 01:17:27.020
There are probably a lot of different solutions to this challenge, but you need to escape that initial constraint.

01:17:27.560 --> 01:17:27.780
Yeah.

01:17:27.780 --> 01:17:35.160
And letting it overwrite into the next buffer and then getting the interpreter into that buffer...

01:17:35.160 --> 01:17:35.540
Right.

01:17:35.540 --> 01:17:36.320
So there are like...

01:17:36.320 --> 01:17:38.620
...is probably the main bug.

01:17:38.620 --> 01:17:39.380
That's the bug.

01:17:39.900 --> 01:17:40.640
Exactly.

01:17:40.640 --> 01:17:42.700
Well, there are essentially two bugs, right?

01:17:42.700 --> 01:17:45.320
It's the one that LiveOverflow mentioned initially here.

01:17:45.320 --> 01:17:51.100
You can increment or decrement the data pointer outside the data region.

01:17:51.100 --> 01:17:51.540
Right .

01:17:51.560 --> 01:17:58.060
But then to be able to have enough code to do that in the first place, you need to escape this nine-character program limit.

01:17:58.160 --> 01:18:04.780
And the way you can do that is you can actually get the instruction pointer to jump into the data region.

01:18:06.700 --> 01:18:09.160
So they're going to stage up their shellcode.

01:18:09.300 --> 01:18:10.540
That's what we're looking to see.

01:18:10.540 --> 01:18:16.560
If we don't see that in the next five minutes or so, I think we're going to want to give them a hint on that one.

01:18:16.560 --> 01:18:22.480
Because we're going to want to see somebody with that second stage, because they still have even more to the challenge even after that point.

01:18:22.480 --> 01:18:25.960
So we'll see the exact timing and we'll figure it out, but there's more work to do.

01:18:25.960 --> 01:18:32.300
So this one is, again, this one's a little on the harder side, but it's also super interesting that they have to kind of like chain these things together.

01:18:32.300 --> 01:18:44.540
Yes, so we can see here on Rikipix, the assembly, you can see that they're looking at the reading of the program.

01:18:44.540 --> 01:18:49.840
Like when they're reading in the program, they're looking to see if they can smuggle.

01:18:49.840 --> 01:19:01.380
For example, they saw that we're using the string length function there to maybe check if they can smuggle like null bytes or something into this.

01:19:03.180 --> 01:19:07.660
Yeah, not exactly sure where they're going there, but just looking more into the...

01:19:07.660 --> 01:19:12.840
You can see now, they have the cursor basically on half the bug there.

01:19:12.840 --> 01:19:21.880
You can say that the loop of the interpreter keeps going specifically until the program counter.

01:19:21.940 --> 01:19:27.980
Usually in a situation like this, you would have like a comparison be like program counter is less than the end.

01:19:27.980 --> 01:19:32.280
But in this case, it's program counter not equals that specific size.

01:19:32.280 --> 01:19:38.020
So if you manage to get the program counter larger than 9 in this case, it will keep going.

01:19:39.120 --> 01:19:42.900
Yeah, so that's part of it, but then how do you get it past it in the first place?

01:19:42.900 --> 01:19:44.840
So that's the other thing that they still have to find.

01:19:44.860 --> 01:19:55.320
I also just noticed that I have seen the source code and I didn't quite realize at the moment, but I'm seeing it here in the disassembly that the size is hard-coded.

01:19:55.320 --> 01:19:58.520
So it's not a variable that they can easily change.

01:19:58.520 --> 01:20:01.920
So it is definitely a bit more tricky to escape that.

01:20:01.920 --> 01:20:09.920
In my mind, I thought they can change that limit from a variable standpoint, but it's definitely hard-coded.

01:20:09.920 --> 01:20:13.960
So it's right there as an actual value.

01:20:13.960 --> 01:20:17.600
Yep, immediate right in the compilation.

01:20:21.860 --> 01:20:24.420
That might be quite tricky.

01:20:24.420 --> 01:20:26.780
Oh, they found a bug here on perfect root.

01:20:26.780 --> 01:20:27.500
Yes, I see that.

01:20:27.500 --> 01:20:36.400
If you saw there very briefly in their small initial payload, you saw that they had an unmatched opening loop bracket at the end of their code.

01:20:36.400 --> 01:20:38.180
And that is exactly the bug.

01:20:38.180 --> 01:20:50.580
So if you have an unmatched bracket, the subroutine that handles the loop, when it sees that initial bracket, it will then keep searching forward.

01:20:50.580 --> 01:20:53.240
And it doesn't stop at the maximum limit that it should.

01:20:53.240 --> 01:20:56.500
Exactly, because that check is in the outer loop.

01:20:56.500 --> 01:20:59.600
It's handling that particular bracket.

01:20:59.600 --> 01:21:03.320
Yes, and it will just keep going until it finds a matching end bracket.

01:21:03.320 --> 01:21:12.740
So you need to first write a right bracket into the data section, and then have a left bracket in your code.

01:21:13.000 --> 01:21:14.320
And then the program counter will then...

01:21:14.320 --> 01:21:21.400
And just to clarify, when you say data section, it is specifically the buffer in memory that is for data.

01:21:21.400 --> 01:21:23.020
Right, I'm not talking about...

01:21:23.020 --> 01:21:24.800
The actual data section exists in the ELF.

01:21:24.800 --> 01:21:28.000
No, I'm talking within the brainfuck context.

01:21:28.000 --> 01:21:29.920
We have the program and the data.

01:21:31.520 --> 01:21:32.140
Excellent.

01:21:32.140 --> 01:21:37.340
So I would say perfect route, well underway, no hit needed, perfect timing.

01:21:37.440 --> 01:21:44.180
That is great to see, and we're just looking to see if RikaPigs can catch up.

01:21:44.180 --> 01:21:47.480
Which, certainly there's still a lot left to go, so it would be impossible.

01:21:47.480 --> 01:21:58.500
In the previous matches RikaPig has shown, they spend a lot of time in IDA, and it always feels like they are behind, because they are still just reversing, they are not working on an exploit.

01:21:58.500 --> 01:22:05.500
But then suddenly they start crafting their script almost blindly, without really a lot of testing, it seems like.

01:22:05.500 --> 01:22:10.700
And suddenly they really run full speed.

01:22:10.700 --> 01:22:11.620
Yeah, exactly.

01:22:11.680 --> 01:22:15.180
Very different styles, you see a lot of both.

01:22:15.680 --> 01:22:24.220
You can see that they are, I think, looking at the GOT table, and now back to the interpreter.

01:22:25.400 --> 01:22:34.820
I haven't seen that much of their exploit script yet, so as I said, they're just really looking at the code, trying to figure out what's going on.

01:22:37.620 --> 01:22:42.000
Yeah, feel free to hang out with them for just a little bit too, we'll wait and see if they bring up their code.

01:22:42.000 --> 01:22:48.680
You might catch a glimpse of that, I'll keep an eye on Perfect Root, let me know if something's happening over there.

01:22:53.740 --> 01:22:59.160
This is really the situation where you would want to be able to read the minds of the players.

01:22:59.160 --> 01:23:02.620
We just got a pause time, go over there and ask them, what are you thinking right now?

01:23:02.980 --> 01:23:04.000
No problem.

01:23:04.180 --> 01:23:05.920
That's surely going to be appreciated.

01:23:06.080 --> 01:23:08.520
I'm sorry, can I interrupt you for a moment?

01:23:08.520 --> 01:23:11.220
Just want to reel your train of thought, will it?

01:23:11.220 --> 01:23:12.040
Right.

01:23:12.160 --> 01:23:17.560
But it feels like they have not quite seen this loop bug yet.

01:23:17.560 --> 01:23:19.400
That's my impression.

01:23:19.740 --> 01:23:35.660
When you do programming or reading assembly, when you have experience, you have this mental model and you can really reason about the code that is happening, but Brainfuck is a language you usually are not used to.

01:23:35.660 --> 01:23:56.280
So now, not only do they need to craft the Brainfuck program, but they have to craft a very small buggy program that does something interesting and reasoning about this little code, condensing it down, these kind of abstraction layers you have in your mind when working with code bases and so forth.

01:23:56.280 --> 01:24:01.300
This is all missing with Brainfuck and I think that is really difficult to do, especially under pressure.

01:24:01.300 --> 01:24:02.360
Yeah, definitely.

01:24:03.540 --> 01:24:12.720
When I was creating the reference solution for this, there were several moments where I went like, oh, I'll just do this.

01:24:12.720 --> 01:24:21.180
And then I realized that doing this is something that would be trivial in a normal programming language or anything.

01:24:21.400 --> 01:24:24.960
But in this context, it's actually quite a hassle.

01:24:24.960 --> 01:24:27.360
Yeah, and you're kind of merging these two contexts too, right?

01:24:27.360 --> 01:24:44.580
And this is actually really interesting, because while this is clearly a toy language and not real, it very much models what you see in a browser in JavaScript, where they have a virtual machine, they have often multiple interpreted languages, and you are both working within and outside of at the same time.

01:24:44.580 --> 01:24:47.380
So you have to work within the memory model of the native program.

01:24:50.420 --> 01:24:56.220
So I think because we're seeing progress here on PerfectRoot, we're good without a hint.

01:24:56.220 --> 01:24:58.540
They don't seem stuck.

01:24:58.540 --> 01:25:02.720
They seem like they know what certainly the first challenge is.

01:25:03.040 --> 01:25:05.440
And Recapic's still got time to catch up.

01:25:05.440 --> 01:25:06.600
So I think we're okay.

01:25:06.600 --> 01:25:07.940
Yeah, checking with the...

01:25:07.940 --> 01:25:10.620
We also do have a little bit of extra time too, between this match and the next one.

01:25:10.620 --> 01:25:10.900
Right.

01:25:11.160 --> 01:25:13.320
I'm not sure if you mentioned it also.

01:25:13.640 --> 01:25:19.780
I know you did with the unmatched loop variable that PerfectRoot has already in the code, right?

01:25:19.780 --> 01:25:21.000
Yeah, exactly.

01:25:21.000 --> 01:25:21.980
So you can tell there...

01:25:21.980 --> 01:25:27.580
And you can also see there was some debugger output there when they were looking at the memory.

01:25:27.780 --> 01:25:28.420
And they're right here.

01:25:28.420 --> 01:25:30.480
You can see all those three E's.

01:25:30.780 --> 01:25:36.060
I think, if I remember correctly, that corresponds to a dot, right?

01:25:36.060 --> 01:25:37.300
Yeah, a dot's two E's.

01:25:37.300 --> 01:25:38.580
No, or is it the greater?

01:25:39.080 --> 01:25:41.040
It's one of the relevant characters in this.

01:25:41.040 --> 01:25:42.800
And you can see that there are way more than nine of those.

01:25:42.800 --> 01:25:43.940
I think it's going to be the greater thing.

01:25:43.940 --> 01:25:45.160
Because they've got the greater than times 128.

01:25:45.160 --> 01:25:45.980
All right , you can see that in the payload.

01:25:45.980 --> 01:25:47.340
They're writing in a lot of greater than.

01:25:47.340 --> 01:25:50.800
Oh, and this is exactly what they need to do for the stage two.

01:25:50.960 --> 01:25:51.820
This is exactly what...

01:25:51.820 --> 01:25:55.260
Move that pointer all the way over into a return address or something else.

01:25:56.080 --> 01:25:57.300
So they're definitely on the way.

01:25:57.300 --> 01:25:58.660
So I think they're just calculating offsets.

01:25:58.660 --> 01:26:00.580
They're just trying to figure out how far to move it over.

01:26:00.580 --> 01:26:00.980
Right.

01:26:00.980 --> 01:26:03.080
And then they need to figure out how far they need to...

01:26:03.080 --> 01:26:07.280
or what they need to increment to get that original return address over to the win function.

01:26:07.280 --> 01:26:13.000
Yeah, so the idea here is that you walk the data pointer over to the return address.

01:26:13.000 --> 01:26:14.620
Pi is enabled.

01:26:14.620 --> 01:26:29.100
So they will have to print the current return address on the stack.

01:26:29.380 --> 01:26:31.600
Print the current return address on the stack.

01:26:31.820 --> 01:26:35.700
Use that to calculate the address of the win function and then write back the new value.

01:26:37.360 --> 01:26:41.800
Or a partial overwrite of the return address might also work fine.

01:26:41.860 --> 01:26:43.240
Yeah, a couple of options.

01:26:43.240 --> 01:26:49.380
Just for clarification again, what we are seeing right now with the BrainFog program from PerfectBrute.

01:26:49.540 --> 01:26:52.100
They have an input loop.

01:26:52.100 --> 01:26:53.500
The comma is input.

01:26:53.820 --> 01:27:00.720
So basically they have a loop that keeps wanting to get input data.

01:27:00.720 --> 01:27:04.760
And then they send that and that causes writing more of the code.

01:27:04.760 --> 01:27:11.100
And then the original program has the open bracket which is now matching what they were inputting later.

01:27:11.100 --> 01:27:19.920
Yeah, so because they put another bracket later, the part of the program is looking for that match to jump over the end of the code.

01:27:19.920 --> 01:27:25.040
And when it finishes in the data, the later on check that says, am I equal to the end?

01:27:25.040 --> 01:27:26.200
It says, no, you're not equal to the end.

01:27:26.200 --> 01:27:26.660
Keep going.

01:27:26.660 --> 01:27:27.200
This is fine.

01:27:27.200 --> 01:27:28.500
And it continues to interpret.

01:27:28.500 --> 01:27:34.020
And the additional data got in there through the input loop.

01:27:34.020 --> 01:27:36.020
Came in through all those commas, exactly.

01:27:36.020 --> 01:27:44.600
And you can see that the second phase there in the exploit script, it starts with a closing bracket to attach that jump.

01:27:44.600 --> 01:27:46.120
Because otherwise it's going to go right past it.

01:27:46.120 --> 01:27:50.920
The piece of code that's looking for the matching bracket just keeps going until it's either there or hits the end of the memory page.

01:27:50.920 --> 01:27:51.620
Something's weird going to happen.

01:27:51.620 --> 01:27:52.220
Yeah, exactly.

01:27:52.220 --> 01:27:53.800
So it's not going to do what you intend.

01:27:54.200 --> 01:27:58.100
So they definitely know what they're doing here.

01:27:58.260 --> 01:28:04.960
They just need to figure out the details here.

01:28:06.440 --> 01:28:17.360
We're having some discussion in the chat here about the Google CTF Accelerate competition that I was involved with and a lot of my colleagues.

01:28:18.560 --> 01:28:23.920
There are similarities to this, but there's the game hacking element to it as well.

01:28:23.920 --> 01:28:25.380
It is a visual element, which is nice.

01:28:25.380 --> 01:28:26.300
Right, yes.

01:28:26.300 --> 01:28:29.380
And we will be hosting that as well in September.

01:28:29.520 --> 01:28:30.560
People are asking for videos.

01:28:30.560 --> 01:28:32.160
Are videos from 2021 coming out?

01:28:32.160 --> 01:28:33.560
They are coming out.

01:28:34.640 --> 01:28:38.540
There was a lot of work.

01:28:38.540 --> 01:28:42.240
There were people getting long COVID.

01:28:43.540 --> 01:28:50.160
There were a bunch of unfortunate events, but the video files still exist and we will release them.

01:28:50.160 --> 01:28:50.740
Not lost, they're coming out.

01:28:50.740 --> 01:28:51.160
No, no, no.

01:28:51.160 --> 01:28:51.640
We have them.

01:28:51.640 --> 01:28:54.720
I have a spreadsheet tracking all the different video files.

01:28:54.720 --> 01:28:56.020
They will be released.

01:28:57.100 --> 01:29:02.600
Keep an eye out on social media for the Accelerate information as well.

01:29:02.600 --> 01:29:03.960
That's going to be super fun.

01:29:03.960 --> 01:29:05.920
We're actually doing it on-site this year.

01:29:05.920 --> 01:29:06.440
Very nice.

01:29:06.440 --> 01:29:09.820
Trying to bring a bit of an eSports vibe to it as well.

01:29:09.840 --> 01:29:11.300
I think that would be super cool.

01:29:11.720 --> 01:29:12.220
Fantastic.

01:29:12.380 --> 01:29:19.580
It's really exciting that we're seeing more and more of these events that try to let you see inside the hacking as it happens.

01:29:21.280 --> 01:29:25.660
I guess it's not a coincidence then that those of us that are involved in it tend to be involved in multiple things too.

01:29:25.660 --> 01:29:26.620
Yes.

01:29:26.620 --> 01:29:34.660
I would say the area of security, live hacking competitions.

01:29:34.660 --> 01:29:36.180
It's a very small field.

01:29:36.180 --> 01:29:36.520
It's pretty niche.

01:29:36.520 --> 01:29:37.360
Yeah , very niche.

01:29:37.860 --> 01:29:39.800
Alright, so we've changed up the code a little bit.

01:29:39.800 --> 01:29:41.200
We've got our ending bracket.

01:29:41.400 --> 01:29:45.260
We're going to move the pointer just a little bit extra.

01:29:46.300 --> 01:29:55.260
But that's actually... Is the problem that the data pointer and the instruction pointer are essentially overlapping right now in their code and they're trying to...

01:29:56.440 --> 01:30:03.880
Yeah, this is exactly what I think LiveOverflow here you were talking about.

01:30:04.560 --> 01:30:12.780
You need to create this mental model of these two pointers walking this buffer and it's not really something that you're familiar with.

01:30:13.500 --> 01:30:14.920
So I'm just looking at this.

01:30:14.920 --> 01:30:18.040
My guess is that you can never win this race though, right?

01:30:18.120 --> 01:30:21.400
Because a single byte is a single byte.

01:30:21.400 --> 01:30:28.360
And so if your data pointer and instruction pointer are the same and you're going to move them both the same rate, wouldn't you have to put it into a loop that would do it faster?

01:30:28.360 --> 01:30:29.280
That's how I did it.

01:30:29.280 --> 01:30:36.880
I basically just had a loop that went on until... I had an input loop and then until I sent a null byte it would stop.

01:30:36.880 --> 01:30:46.800
Yeah, I think they're going to need something like that because I think essentially just putting a bunch of move rights is going to increment both the program counter and the data counter at the same rate.

01:30:47.040 --> 01:30:50.140
And so you're never going to win that race because they're both moving forward at the same rate.

01:30:50.680 --> 01:30:56.940
I guess that would be different if each byte was stored in a bigger structure, like it was a DWORD or something like that.

01:30:56.940 --> 01:30:58.760
You might be able to misalign them differently that way.

01:31:00.160 --> 01:31:08.480
So I think until we see that, they're going to be stuck on that stage unless I'm misunderstanding where that is at.

01:31:08.480 --> 01:31:11.120
Are we seeing anything from Recapix?

01:31:11.120 --> 01:31:13.000
Because they have some ground to gain.

01:31:13.000 --> 01:31:17.700
They have been staring at the IDA code still, I think.

01:31:18.000 --> 01:31:24.760
I do wonder what they are thinking because they must see that they can move that array out of bounds.

01:31:27.360 --> 01:31:28.420
It's too easy.

01:31:28.420 --> 01:31:30.740
They for sure have to know about it.

01:31:30.740 --> 01:31:31.620
It's hard, though.

01:31:31.620 --> 01:31:37.520
When you get put in the spotlight, sometimes something that would be immediately obvious if you were sitting at home.

01:31:37.780 --> 01:31:46.460
But I do wonder if they have seen the restrictions and they understand, okay, we can't actually pull it off and maybe they are hunting for a second bug.

01:31:46.920 --> 01:31:53.800
And maybe playing around, they could notice it, but I think they are just in their head trying to figure it out.

01:31:53.800 --> 01:31:55.040
Yeah, that's a good point, too.

01:31:55.040 --> 01:31:56.020
Again, it's what we saw earlier.

01:31:56.020 --> 01:32:02.820
Maybe they are trying to just put this together in a one shot as opposed to build a small piece, test it, build a small piece, test it.

01:32:03.580 --> 01:32:09.480
Speaking of mental models again, you can see that thanks to how the program was compiled.

01:32:09.560 --> 01:32:15.940
So if you look at the source code, the program array and the data array, there are two separate...

01:32:15.940 --> 01:32:16.780
Oh, there we go.

01:32:16.780 --> 01:32:17.760
Oh, nice.

01:32:17.860 --> 01:32:19.460
That's a good looking one.

01:32:23.800 --> 01:32:25.300
They are looking at the definition here.

01:32:25.300 --> 01:32:28.580
They are looking at the loop construct.

01:32:28.580 --> 01:32:30.940
Yes, that is an interesting thing to look at.

01:32:30.940 --> 01:32:33.740
I think that's a fantastic thing to be looking at.

01:32:34.000 --> 01:32:35.920
And look how they write the code here.

01:32:35.920 --> 01:32:45.680
They write it in pseudocode and probably translate it then into brain truck code because this is just easier for them to reason about what they are doing.

01:32:45.680 --> 01:33:04.160
However, I do wonder if they missed then this trick with the keeping open bracket because that is something you can reason about in a brain truck program that's moving the cursor forward while a dangling open bracket is not something you would maybe think about.

01:33:04.180 --> 01:33:08.160
No , if you were writing C and you would have an unmatched bracket, your code wouldn't compile.

01:33:08.160 --> 01:33:11.320
So that's like it's an error, you fix it and then you're done.

01:33:14.780 --> 01:33:21.580
So I was saying that in the source code, the program array and the data array are the two separate variables next to each other.

01:33:21.580 --> 01:33:31.800
But the way this is compiled, if you look at the decompilation, it looks like one array and then there are a bunch of offsets sometimes when this is being accessed.

01:33:31.800 --> 01:33:35.100
So that can make it a little bit harder to reason about this.

01:33:35.100 --> 01:33:38.340
You need to detangle this and say, no, this is not one array.

01:33:38.340 --> 01:33:40.760
These are two arrays that happen to be next to each other.

01:33:40.760 --> 01:33:49.340
Yeah, and that's the part that I think we're still not seeing perfect root kind of pieced together because they're trying to treat them independently without realizing that I think they happen to be overlapping.

01:33:49.340 --> 01:33:55.680
They believe they've calculated the distance correctly, but I think that all they're going to end up doing is overwriting.

01:33:56.060 --> 01:34:04.100
If they put too much data in, they're going to end up actually just overwriting the return address with their data, which won't help them.

01:34:04.940 --> 01:34:07.500
Because they're not going to be able to write the proper values.

01:34:07.500 --> 01:34:11.800
They're all going to be things that happen to match these characters.

01:34:14.220 --> 01:34:24.320
Perfect root is going for here now testing writing arbitrary bytes instead of increments with the input command, which obviously would save space.

01:34:24.900 --> 01:34:30.160
Yeah, I think they came to that conclusion as well and realized, oh wait, let's just put the direct value that we want over top of it.

01:34:30.160 --> 01:34:37.120
Again, I think that the only piece they're missing is that they need to be able to increment the pointer more efficiently.

01:34:37.300 --> 01:34:37.660
Yeah .

01:34:37.660 --> 01:34:39.080
Sorry, increment the data pointer.

01:34:39.080 --> 01:34:43.960
They need to be able to move the data pointer to the right without having the code pointer move at the same rate.

01:34:43.960 --> 01:34:49.540
And so once they put that together, they should basically be done.

01:34:49.540 --> 01:34:52.020
So there are basically two ways you could do this.

01:34:57.740 --> 01:34:58.620
I think...

01:34:59.840 --> 01:35:00.720
No.

01:35:01.780 --> 01:35:02.740
It's a fundamental flaw.

01:35:02.740 --> 01:35:03.200
They need a loop.

01:35:03.200 --> 01:35:04.160
They have to have a loop.

01:35:04.160 --> 01:35:09.460
Yeah, I thought that they could have stuff before the closing bracket, but that's the wrong direct.

01:35:09.460 --> 01:35:10.700
That's the other way around.

01:35:10.740 --> 01:35:11.020
Right , right.

01:35:11.020 --> 01:35:12.080
It will be after that.

01:35:12.080 --> 01:35:12.680
It doesn't matter.

01:35:12.680 --> 01:35:14.180
The closing bracket always begins.

01:35:14.180 --> 01:35:15.720
It just makes the problem worse, in fact, if you do that.

01:35:15.720 --> 01:35:16.680
Yeah, exactly.

01:35:17.020 --> 01:35:19.320
So yes, they do need the loop.

01:35:19.320 --> 01:35:22.260
And this is exactly the type of problem you would face here.

01:35:22.300 --> 01:35:25.240
You're thinking like, oh, I'll just overflow the buffer.

01:35:25.240 --> 01:35:30.340
And then it's like, oh no, wait, but I'm kind of like cutting off the branch I'm sitting on while I'm doing it.

01:35:30.340 --> 01:35:31.440
That's a great analogy.

01:35:31.440 --> 01:35:32.560
Yeah, it's a great analogy.

01:35:34.660 --> 01:35:41.140
All right, so there is a chance that we need to give different hints, potentially.

01:35:41.140 --> 01:35:44.420
Maybe if they're both stuck and they're both not making progress, we need to give them each a relative hint.

01:35:44.420 --> 01:35:45.140
I'd hate to do that.

01:35:45.140 --> 01:35:48.000
I would really prefer to give the same information to both.

01:35:48.000 --> 01:35:50.280
But if we end up... I think we're still okay on time.

01:35:50.280 --> 01:35:52.480
And so I don't think we need to immediately do anything.

01:35:52.660 --> 01:35:54.400
But just something we got to kind of figure out.

01:35:54.400 --> 01:36:01.120
Yeah, Recapig was highlighting the limitation of the length.

01:36:01.120 --> 01:36:04.060
So I think they are still struggling with...

01:36:04.060 --> 01:36:06.980
Yeah, I think they need to get past that initial hurdle.

01:36:07.200 --> 01:36:10.680
And Perfect Root is just really still stuck on this one.

01:36:10.840 --> 01:36:12.420
But we have time, I think.

01:36:12.420 --> 01:36:17.240
And honestly, Recapig could come to this realization and still catch up to Perfect Root.

01:36:17.240 --> 01:36:19.360
That is absolutely still possible here.

01:36:19.360 --> 01:36:22.460
Maybe their mental model is already much further.

01:36:22.460 --> 01:36:22.760
I don't know.

01:36:22.760 --> 01:36:27.040
They spent a lot more time in IDA, so maybe they figured out the array situation.

01:36:27.040 --> 01:36:32.080
Right, maybe they would better understand that and be able to create that loop to get them past that point.

01:36:37.630 --> 01:36:43.890
I will say, though, that what Perfect Root is doing makes a lot of sense in terms of analyzing things in the debugger while they're doing it.

01:36:43.890 --> 01:36:54.150
I think what they need to do is to track the variables that represent the pointers for the data and for the code in the virtual machine itself.

01:36:54.150 --> 01:36:57.030
I think that would really help them realize this.

01:36:57.070 --> 01:36:59.870
So what they keep looking at is just the raw stack frames, basically.

01:36:59.870 --> 01:37:02.190
Just the raw data where everything lives.

01:37:02.190 --> 01:37:09.410
They're not looking at what is the pointer for the code and what is the pointer for the data and what's happening there.

01:37:09.410 --> 01:37:16.210
So I think checking that in their debug script each time would probably make it click for them, what they need to do.

01:37:16.930 --> 01:37:17.850
But we'll see.

01:37:18.070 --> 01:37:19.670
We did get a question in chat.

01:37:19.670 --> 01:37:22.670
Actually, I would love to hear both y'all's opinion on this.

01:37:22.670 --> 01:37:25.050
Somebody says, how can I start learning CTF?

01:37:25.050 --> 01:37:26.510
What do you guys each recommend?

01:37:26.510 --> 01:37:27.770
That's a great question.

01:37:28.590 --> 01:37:30.670
Yeah, LiveOverflow, what's your take here?

01:37:30.670 --> 01:37:31.610
Let's start there.

01:37:32.370 --> 01:37:34.190
Well, I hope my videos help.

01:37:34.190 --> 01:37:36.550
I have a binary application playlist.

01:37:36.550 --> 01:37:41.050
And other than that, my go-to, because I learned by doing it.

01:37:41.050 --> 01:37:42.550
I didn't have videos.

01:37:42.550 --> 01:37:48.930
So recommending the way I learned is through wargames like OverTheWire or PicoCTF.

01:37:48.930 --> 01:37:54.430
I haven't done PicoCTF myself, but that seems to be an amazing resource everybody recommends.

01:37:54.430 --> 01:37:59.850
And OverTheWire, these are the type of challenges that I really learned with.

01:37:59.850 --> 01:38:01.930
Yeah, Pwnable.kr.

01:38:02.150 --> 01:38:03.870
Oh yeah, there are many of those.

01:38:04.010 --> 01:38:11.190
I would definitely say, if I were to name one starting resource, that would be PicoCTF.

01:38:11.230 --> 01:38:12.250
That's where I would start.

01:38:12.250 --> 01:38:13.350
It is really, really well done.

01:38:13.350 --> 01:38:14.450
They do a good job with that.

01:38:14.450 --> 01:38:16.930
It starts very easy, very simple.

01:38:17.030 --> 01:38:20.590
They have help forums where you can ask about it.

01:38:21.730 --> 01:38:23.570
And it slowly ramps up.

01:38:23.570 --> 01:38:26.110
They have a wide range of categories.

01:38:26.110 --> 01:38:29.630
So it's not only the Pwnables that we've seen in this tournament.

01:38:29.730 --> 01:38:33.350
They have web challenges, forensics, cryptography, all the stuff.

01:38:34.430 --> 01:38:47.050
In all of these popular sites like PicoCTF and OverTheWire, there are lots of solutions online, which you need to find the balance between avoiding the solutions and at some point looking them up.

01:38:47.050 --> 01:38:51.650
But not just looking them up, working through them in case you choose to look through it.

01:38:51.650 --> 01:38:54.950
Try to maybe look at it and then close it again and re-implement it.

01:38:54.950 --> 01:38:59.230
There are various ways how you can learn, but just don't cheat yourself.

01:38:59.870 --> 01:39:02.190
Yeah, you could fail on either side of that, right?

01:39:02.190 --> 01:39:04.790
You can never look at the other resources, which is kind of...

01:39:04.790 --> 01:39:09.470
Some people stubbornly refuse to get any outside kind of help, which takes them longer to learn things.

01:39:09.470 --> 01:39:13.250
And then other people look too early and never force themselves to go through the learning process.

01:39:13.250 --> 01:39:14.810
So I think that's a great way to describe it.

01:39:14.870 --> 01:39:26.910
I mean, the reason why I enjoyed seeing live CTF back in the day was exactly this problem, because I was playing these war games and doing it kind of my way.

01:39:26.910 --> 01:39:28.490
And I've never seen anybody else.

01:39:28.490 --> 01:39:29.470
How do they do it?

01:39:29.470 --> 01:39:35.770
And then I'm seeing live CTF and they solve a Pwnable and see how they do their exploit script and everything.

01:39:35.770 --> 01:39:37.490
That was mind-blowing to me.

01:39:37.490 --> 01:39:45.630
So yeah, I think it's important to take advantage of all these resources, what they can offer and combining them all together.

01:39:46.190 --> 01:39:53.050
Yeah, I think you're not going to be as fast as the folks we're seeing here today without years and years and years of practice.

01:39:53.050 --> 01:39:57.490
These are people who are at the top of the field and have really practiced.

01:39:57.490 --> 01:40:01.110
They play a ton of CTFs and it takes a lot to kind of get here.

01:40:01.110 --> 01:40:03.630
So don't be intimidated if you see them doing this.

01:40:03.630 --> 01:40:09.030
I mean, even as casters, when we're watching them, we're in awe at the speed that some of these people look at.

01:40:09.030 --> 01:40:16.350
All three of us are fairly experienced CTF players, but we're still impressed by this.

01:40:16.350 --> 01:40:21.450
I would say we're mid-tier compared to what we're seeing in front of us speed-wise, certainly.

01:40:21.710 --> 01:40:24.530
And this challenge is doable.

01:40:24.530 --> 01:40:31.350
I think both players know that this is doable and still it takes them a lot of time.

01:40:31.350 --> 01:40:32.810
And they are super fast.

01:40:32.970 --> 01:40:40.230
But maybe for an outsider it might seem crazy that you have to spend an hour on something that we would call easy.

01:40:40.290 --> 01:40:47.510
But it's just a matter of the fact these things just take a lot of iteration, tons of information you need to think about and reason about.

01:40:49.070 --> 01:40:50.430
Even an easy challenge takes a lot of time.

01:40:50.430 --> 01:40:52.330
I think we do need to give a hint to both teams.

01:40:52.330 --> 01:40:53.530
I think we're going to give the same hint to both.

01:40:53.530 --> 01:40:55.870
We're going to write two bits of information to each one of them.

01:40:56.210 --> 01:40:59.830
Because we're going to write the same hint on both so they both get the same hint, but it will contain two parts.

01:41:00.510 --> 01:41:02.330
The first part will...

01:41:02.330 --> 01:41:08.910
What about doing like opening bracket, closing bracket, opening bracket as the...

01:41:08.910 --> 01:41:10.030
As that one?

01:41:10.030 --> 01:41:12.870
Actually, maybe we each give them each just half the hint.

01:41:12.870 --> 01:41:14.590
Because the problem is if we give...

01:41:14.590 --> 01:41:15.650
Oh, then we tell them where they are.

01:41:15.650 --> 01:41:19.850
We're telling them something that Perpetrator has already figured out.

01:41:19.850 --> 01:41:23.530
So we need to tell them one bit of information to get them past where they're currently at.

01:41:23.530 --> 01:41:25.010
Right, this is...

01:41:25.010 --> 01:41:31.450
In terms of fairness, both hints, wouldn't it be like just put it on the same paper?

01:41:31.450 --> 01:41:33.370
So , the problem with doing both hints...

01:41:33.370 --> 01:41:35.450
Here's the problem with both hints.

01:41:35.450 --> 01:41:38.590
If you give both hints, you're telling Rekebeg something that Perpetrator already knows.

01:41:38.590 --> 01:41:40.270
Well , it depends on how we tell them, right?

01:41:41.010 --> 01:41:43.570
So both of them are struggling with loops, right?

01:41:44.130 --> 01:41:48.010
So maybe the hint is like maybe you need a loop for...

01:41:48.990 --> 01:41:50.030
Have you considered using a loop?

01:41:50.030 --> 01:41:50.890
The loop is the key.

01:41:51.130 --> 01:41:53.770
That is the exact same hint for both of them.

01:41:53.770 --> 01:41:54.690
That's fantastic.

01:41:54.690 --> 01:41:57.830
That is brilliant, and I love it.

01:41:57.830 --> 01:41:59.770
And I think we should definitely...

01:41:59.770 --> 01:42:01.070
I think we should do that.

01:42:01.070 --> 01:42:02.870
So, that's a hint.

01:42:03.450 --> 01:42:04.870
You need to use a loop.

01:42:06.110 --> 01:42:07.710
Because they both do right now.

01:42:07.710 --> 01:42:09.110
They both need to use a loop.

01:42:10.550 --> 01:42:13.930
We will give the same hint, but they will have...

01:42:13.930 --> 01:42:15.610
There's different contexts to it.

01:42:15.610 --> 01:42:16.630
That's fantastic.

01:42:17.390 --> 01:42:20.950
So, Jordan is preparing this hint.

01:42:22.590 --> 01:42:25.190
So, there was a question here in chat.

01:42:26.770 --> 01:42:30.930
What would you guys say is the CTF level of this challenge?

01:42:31.210 --> 01:42:39.950
So, like, in any normal CTF context, I would call this a fairly easy...

01:42:40.650 --> 01:42:43.610
An easy challenge, but for like the...

01:42:43.610 --> 01:42:46.950
If we talk the big, serious...

01:42:47.670 --> 01:42:49.230
Not serious, that sounds so...

01:42:49.230 --> 01:42:52.330
No, it's not an easy beginner challenge.

01:42:52.330 --> 01:42:54.310
It's an easy challenge...

01:42:54.310 --> 01:42:58.470
In the context of teams that have been playing CTF for 10 years.

01:42:58.470 --> 01:42:58.750
Yes.

01:42:58.750 --> 01:43:03.230
In that context, it's an easy challenge for anybody.

01:43:03.270 --> 01:43:07.830
Like, even for me, you know, that's a nice challenge I would spend a couple of hours on, probably.

01:43:08.670 --> 01:43:09.890
It's doable.

01:43:09.890 --> 01:43:11.650
It doesn't feel impossible.

01:43:11.650 --> 01:43:16.250
But it's also, like, still has some trickery you need to figure out.

01:43:16.370 --> 01:43:17.170
Right.

01:43:17.170 --> 01:43:20.370
So, we are about to give them the hints now.

01:43:20.370 --> 01:43:22.550
Jordan is going to go sort that out.

01:43:23.890 --> 01:43:27.170
Yeah, there's this traditional...

01:43:27.710 --> 01:43:30.330
So, mentioned here, it's like, there's someone saying it's a 200.

01:43:30.330 --> 01:43:38.810
So, sometimes you will hear, especially older CTF players, like, rating some challenges on a 100 to 500 point scale.

01:43:38.910 --> 01:43:43.790
Which, to players who started playing in, like, the last couple of years, doesn't really make sense.

01:43:43.790 --> 01:43:46.550
Because nowadays we typically use the dynamic scoring system.

01:43:46.550 --> 01:43:53.310
But, you know, the most common format of CTF is the Jeopardy style, like, inspired by the TV show.

01:43:53.310 --> 01:44:01.130
And in that show, you have, like, in each category, you have five questions of, like, 100, 200, and so on, down to 500 points.

01:44:01.130 --> 01:44:05.410
And that is how CTF challenges used to be scored back in the day.

01:44:05.410 --> 01:44:06.630
So, yeah.

01:44:06.630 --> 01:44:10.110
Yeah, so the dynamic scoring system that's currently in use makes a lot of sense.

01:44:10.110 --> 01:44:11.550
Because you're sort of letting the...

01:44:11.550 --> 01:44:16.070
One of the main problems, and you've seen it here this weekend, right, is we think something is easy and it turns out to be harder.

01:44:16.070 --> 01:44:17.490
We think something is harder and it turns out to be easier.

01:44:17.490 --> 01:44:21.970
Like, we generally have gotten it pretty right, but it's impossible to be perfect.

01:44:21.970 --> 01:44:23.930
You're not going to get exactly the difficulty right.

01:44:24.070 --> 01:44:27.210
Because you don't know exactly how people are going to solve things or what they're going to see.

01:44:27.490 --> 01:44:28.750
And so dynamic scoring...

01:44:29.630 --> 01:44:32.030
And what kind of technical problems do you run into?

01:44:32.030 --> 01:44:36.730
I mean, solving the challenge thing is one thing, but then maybe you cannot run the binary.

01:44:36.730 --> 01:44:37.130
Oh, yeah.

01:44:37.170 --> 01:44:39.330
Maybe you look at the wrong thing.

01:44:39.710 --> 01:44:43.370
Maybe you misinterpret something as a bug that is not a bug.

01:44:43.370 --> 01:44:47.050
Or , you know, tons of dead ends you could run into and waste time on.

01:44:47.630 --> 01:44:50.510
Yeah, and so all that can factor in.

01:44:50.510 --> 01:44:53.250
So being able to dynamically score challenges is really nice.

01:44:53.250 --> 01:45:00.170
And it's essentially the organizer saying, the fewer teams that score this, or maybe the longer time it goes unscored, the more points it's going to be worth.

01:45:00.170 --> 01:45:01.990
And then the more people that solve it, the less it will be worth.

01:45:01.990 --> 01:45:03.510
And so it kind of self-balances.

01:45:03.510 --> 01:45:07.550
And so you gain more points by solving things that fewer other teams solve.

01:45:07.550 --> 01:45:08.350
Which kind of makes sense.

01:45:08.350 --> 01:45:11.330
And then if something is solved by fewer teams, it's more attractive.

01:45:11.490 --> 01:45:13.530
More teams want to solve it because it's worth more.

01:45:13.790 --> 01:45:21.210
And so it's sort of like it really does a good job of letting that problem of the organizers not being able to perfectly gauge the difficulty doesn't really matter.

01:45:21.210 --> 01:45:27.390
Because the team that solves overall the most things that were solved by the fewest other people are going to be the ones with the highest score.

01:45:28.990 --> 01:45:38.810
It also kind of took away the first blood that was often in some CTFs, which is with time zones sometimes a little bit tricky.

01:45:38.810 --> 01:45:39.890
Yeah , it's very controversial.

01:45:39.890 --> 01:45:46.070
And even in person, even like here at DEF CON Finals, I'm not a huge fan of first blood.

01:45:46.070 --> 01:45:52.030
So that concept is, you know, the first blood means just the first team to score on a particular service.

01:45:52.170 --> 01:45:56.070
And so there was sometimes a bonus pool of points that could only be...

01:45:56.070 --> 01:46:01.010
And sometimes there were even stages where the first three teams would get some sort of back off on points to do it.

01:46:01.130 --> 01:46:07.690
But yeah, especially with things like time zones, it can be really hard to have that work out.

01:46:07.690 --> 01:46:11.790
The other problem with first bloods is that...

01:46:11.790 --> 01:46:16.750
Actually, some of the reasons that people did first bloods was to try to counteract big teams.

01:46:16.770 --> 01:46:20.410
Because large teams can spread out on many, many different topics.

01:46:20.410 --> 01:46:28.070
But a few really hard challenges that only an expert could solve by having first blood points, because you're incentivizing your one particular really good person.

01:46:28.070 --> 01:46:32.090
So that's actually one of the other things that organizers have to consider.

01:46:32.190 --> 01:46:37.990
Is do they want to let their game be winnable just because somebody has a really, really good team of people who are all pretty good?

01:46:37.990 --> 01:46:42.670
Or do you want to focus a core team of experts?

01:46:42.670 --> 01:46:50.830
And these are topics that people who are in the CTF community or organizing CTFs love to discuss these things about.

01:46:50.930 --> 01:46:51.890
It's a good bar topic.

01:46:51.890 --> 01:46:59.030
How do we create a fair competition environment where you have these different conflicting aspects.

01:46:59.030 --> 01:47:05.030
You want it to be accessible for new players while also being competitive for experienced players.

01:47:05.030 --> 01:47:08.030
And you want to encourage the right type of behavior and so on.

01:47:08.030 --> 01:47:10.430
So it's definitely not an easy thing.

01:47:11.530 --> 01:47:14.250
Coming back at here what Perfect Root is doing.

01:47:14.250 --> 01:47:19.990
I mean, they were given the hint now that loops might be the solution to the problem they are having.

01:47:19.990 --> 01:47:22.990
But they haven't executed on it.

01:47:22.990 --> 01:47:25.750
Their code still doesn't include any loop thing.

01:47:25.750 --> 01:47:27.790
They might be set on something.

01:47:27.790 --> 01:47:31.970
They might believe that they are on the right track and keep going as far as I can tell.

01:47:31.970 --> 01:47:36.610
Yeah, I'm afraid they either thought the hint applied to the thing that they've already solved.

01:47:36.610 --> 01:47:37.550
Which it kind of did.

01:47:37.550 --> 01:47:39.630
Which is why it was relevant for RicaPigs.

01:47:39.630 --> 01:47:44.170
But they might not see how it applies to their current problem.

01:47:44.170 --> 01:47:47.650
No, so actually I just realized they might not need a loop.

01:47:48.690 --> 01:47:49.310
Go on.

01:47:49.310 --> 01:47:52.950
I mean, if they carefully overwrite the values, right?

01:47:52.950 --> 01:47:53.930
No, so you...

01:47:53.930 --> 01:47:55.210
Okay.

01:47:55.850 --> 01:47:58.450
Everyone try to picture this in your mind now.

01:47:58.450 --> 01:47:59.330
We need a whiteboard.

01:47:59.410 --> 01:48:01.170
This is where we need a whiteboard.

01:48:01.770 --> 01:48:04.130
Professor Karl needs to pull up a whiteboard.

01:48:04.530 --> 01:48:05.350
Right.

01:48:05.350 --> 01:48:08.250
So you have the program section.

01:48:08.250 --> 01:48:10.610
It's small and you have the long data thing here, right?

01:48:10.610 --> 01:48:14.570
And then you use a loop here in the program thing to start writing stuff here.

01:48:14.570 --> 01:48:15.430
So you write...

01:48:15.430 --> 01:48:16.170
Data is coming.

01:48:16.170 --> 01:48:18.250
And you are writing a brain fact program here.

01:48:18.250 --> 01:48:22.590
And then right in the beginning here you have an end bracket, right?

01:48:22.590 --> 01:48:26.690
So your data pointer will go over here.

01:48:26.790 --> 01:48:28.910
And then you will stop this.

01:48:28.910 --> 01:48:32.950
And this will then jump to the end of your program and jump to the end bracket here.

01:48:32.950 --> 01:48:37.990
So your instruction pointer is still in the beginning of your new program.

01:48:37.990 --> 01:48:40.870
While the data pointer is in the middle or later.

01:48:40.870 --> 01:48:42.610
Oh , is the data pointer at the end of the payload?

01:48:42.610 --> 01:48:44.310
Yes , and then they keep going.

01:48:44.310 --> 01:48:50.150
They do go in tandem, but the data pointer is always racing ahead of the program counter.

01:48:50.250 --> 01:48:52.530
And then as long as you have enough instructions...

01:48:52.530 --> 01:48:56.450
Because you're going to need to have to go back and forth a little bit to read and write.

01:48:56.450 --> 01:48:59.050
And it might catch up to you.

01:48:59.050 --> 01:49:01.050
So as long as you space all of that correctly...

01:49:01.050 --> 01:49:03.630
And you actually could put some attentional padding there too, right?

01:49:03.630 --> 01:49:05.250
You could just easily pad that out.

01:49:05.250 --> 01:49:05.610
Oh, right.

01:49:05.610 --> 01:49:10.850
You could put just extra characters and have your data pointer be at the very end.

01:49:10.850 --> 01:49:12.970
So this is definitely doable without...

01:49:12.970 --> 01:49:14.810
Well, we think it is.

01:49:14.810 --> 01:49:16.010
We've proven it.

01:49:16.010 --> 01:49:17.990
So it could be doable.

01:49:18.130 --> 01:49:21.710
But it certainly would be easier to do it that way.

01:49:21.710 --> 01:49:24.610
So we might just be seeing...

01:49:25.570 --> 01:49:28.610
So maybe they're fine ignoring that hint and continuing on.

01:49:28.610 --> 01:49:30.210
Which, we'll see how it goes.

01:49:31.270 --> 01:49:31.950
Right.

01:49:33.890 --> 01:49:38.930
RekkaPig is still working with the pseudocode.

01:49:38.930 --> 01:49:40.150
Trying to reason about it.

01:49:40.150 --> 01:49:42.950
There was a comment about a leak.

01:49:43.830 --> 01:49:46.190
Pointer to the leak or something.

01:49:46.190 --> 01:49:50.250
It's just unfortunately just below it.

01:49:50.250 --> 01:49:52.030
What they are showing right now.

01:49:53.010 --> 01:49:53.850
Yeah, it's...

01:49:53.850 --> 01:49:56.890
But essentially it's the same loop, right?

01:49:56.990 --> 01:50:00.870
Get the pointer while loop and then pointer get.

01:50:00.870 --> 01:50:02.230
That's the correct thing.

01:50:02.230 --> 01:50:08.570
I'm now just curious if they leave that bracket then at the end open.

01:50:08.570 --> 01:50:12.250
This is the read-in loop that PerfectRoot also has.

01:50:12.690 --> 01:50:16.870
If they figure out the open bracket, it's still unclear.

01:50:17.070 --> 01:50:18.550
And I want to switch over to PerfectRoot here.

01:50:18.550 --> 01:50:20.410
Because I see what I think they're trying to do.

01:50:20.410 --> 01:50:21.990
And they have a bug in their code again.

01:50:21.990 --> 01:50:25.510
You can see these dot plus, dot plus and so on in their code.

01:50:25.510 --> 01:50:29.470
What I think they want here is a dot greater than, dot greater than.

01:50:29.470 --> 01:50:31.510
To dump out...

01:50:31.510 --> 01:50:33.170
I think there are eight of them.

01:50:33.210 --> 01:50:34.830
Or maybe it's just six of them.

01:50:35.430 --> 01:50:41.250
The idea here is that you want to use the dot to print the current value.

01:50:41.250 --> 01:50:43.490
And then you advance the data pointer to the next step.

01:50:43.930 --> 01:50:47.570
But the plus sign increments the current value that you're pointing at.

01:50:47.570 --> 01:50:49.110
Which is not what you want to do.

01:50:49.110 --> 01:50:50.010
Because then you're just...

01:50:50.410 --> 01:50:51.950
They should see it at least, right?

01:50:51.950 --> 01:50:54.750
So in the output, they'll notice that I'm just getting this increment.

01:50:54.750 --> 01:50:55.670
This is why they're getting...

01:50:55.670 --> 01:50:58.310
You can see in the output there, they're getting NOPQRS.

01:50:58.310 --> 01:51:02.590
Because they're just incrementing the same byte and printing it out over and over again.

01:51:02.590 --> 01:51:05.930
So they want to change those pluses to greater thans.

01:51:05.930 --> 01:51:07.590
If they're trying to actually dump out.

01:51:10.430 --> 01:51:15.870
You might notice that I've had to program a bit of brain fog to build this challenge.

01:51:15.870 --> 01:51:16.390
I would think so.

01:51:16.390 --> 01:51:19.050
Yes, this is not healthy.

01:51:19.050 --> 01:51:22.930
It is at least one of the things I've seen teams do on similar kind of challenges.

01:51:23.150 --> 01:51:27.270
Is just do a similar kind of virtual machine, but totally different instructions.

01:51:27.410 --> 01:51:29.410
At least this one is sort of intuitive.

01:51:29.410 --> 01:51:32.430
Like plus and dot and greater than and less than.

01:51:32.430 --> 01:51:36.610
In fact, I think we even added one instruction here.

01:51:36.610 --> 01:51:39.930
We extended the language with one instruction to make the challenge easier.

01:51:39.930 --> 01:51:43.290
So in my original solution...

01:51:43.290 --> 01:51:48.250
Because if you do an overwrite of the return address, you need the function to actually return, right?

01:51:48.510 --> 01:51:52.650
And the only condition for the loop to break is if the program counter is at exactly 9.

01:51:52.670 --> 01:51:58.530
So in my original solution, you had to make something to make the program counter jump all the way back to the beginning.

01:51:58.530 --> 01:52:06.030
But we decided that we get rid of that and we instead add another instruction, which is the caret character.

01:52:06.030 --> 01:52:07.030
And that will just...

01:52:07.030 --> 01:52:08.450
It's a little up arrow.

01:52:08.450 --> 01:52:08.950
Exactly.

01:52:08.950 --> 01:52:12.230
So instead of going left or right, you go up to go out.

01:52:14.170 --> 01:52:17.010
But it is nice that this is at least kind of intuitive.

01:52:17.010 --> 01:52:18.630
These are just random letters, I feel like.

01:52:18.630 --> 01:52:22.650
Well, actually, if they were random letters, what you probably would see was them using more of those kind of macro helpers.

01:52:22.650 --> 01:52:27.330
To find a variable that was called ink, or deck, or next, or prev, or something like that.

01:52:27.330 --> 01:52:30.750
And you'd use those in line instead of the raw characters directly.

01:52:30.750 --> 01:52:30.990
Right.

01:52:30.990 --> 01:52:32.190
Oh, you told...

01:52:32.190 --> 01:52:33.390
Yes, go ahead.

01:52:33.390 --> 01:52:38.110
I was just seeing in Recapit, they figured out the unmatched bracket.

01:52:38.390 --> 01:52:39.350
Oh, fantastic.

01:52:39.690 --> 01:52:44.870
You see here on line 60, there's a comment, unmatched bracket.

01:52:44.890 --> 01:52:45.910
Oh, yes.

01:52:46.090 --> 01:52:47.010
Yes, I saw it.

01:52:47.010 --> 01:52:47.530
Excellent.

01:52:47.530 --> 01:52:47.670
Nice.

01:52:47.670 --> 01:52:48.630
Very, very good.

01:52:48.630 --> 01:52:55.970
And I also wanted to point out, over on the Perfect Root site, you can see that they changed all the pluses to greater than characters in there.

01:52:55.970 --> 01:52:56.050
Yes .

01:52:56.230 --> 01:52:57.910
They're both making good progress.

01:52:57.910 --> 01:52:58.970
This is fantastic.

01:52:58.970 --> 01:53:00.570
Oh, that's really great.

01:53:00.590 --> 01:53:04.570
So we can see, do we think that Recapit can catch up to this?

01:53:04.710 --> 01:53:08.050
That's the, you know, exciting thing here.

01:53:10.390 --> 01:53:13.230
Just trying to keep an eye on both teams here.

01:53:13.230 --> 01:53:21.030
So back to the chat question, there's a little bit of discussion going on about dynamic scoring and whether it's a bad signal for beginners.

01:53:21.030 --> 01:53:21.710
And that's true.

01:53:21.710 --> 01:53:30.010
You can't actually, one of the downsides is if every challenge starts at 200 points or 100 points, and it's just based on however many people solve it, that you find the ultimate difficulty.

01:53:30.430 --> 01:53:32.830
It's hard as a new person to know where to start.

01:53:32.850 --> 01:53:34.690
A lot of CTFs will kind of give some hints.

01:53:34.690 --> 01:53:40.690
They'll say an expected value, or they will say, you know, have some other difficulty ranking independent of the points.

01:53:40.690 --> 01:53:43.410
So that way the organizers can say, we think this is hard.

01:53:43.410 --> 01:53:44.270
Hey, it turns out it was easy.

01:53:44.270 --> 01:53:45.690
It was a bug that they didn't intend.

01:53:45.910 --> 01:53:47.490
It ends up being easy, and the points drive low.

01:53:47.490 --> 01:53:52.770
So you can see that signal afterwards and go, well, I wasn't going to try it, but looking at the people solving it, maybe I'm going to try it now.

01:53:52.770 --> 01:54:02.290
A lot of the, like, long-running or, like, notoriously difficult CTFs sometimes have, like, a category that they call, like, baby or, like, a tag.

01:54:02.290 --> 01:54:03.510
Baby's first or, yeah, baby challenges.

01:54:03.510 --> 01:54:12.650
They would say, like, you know, okay, we have a lot of difficult challenges, but we have selected a few here that we think are going to be good just for people starting out.

01:54:12.690 --> 01:54:19.010
Also, you can just wait a bit for, you know, wait a couple of hours into the CTF and see, like, which ones are being solved.

01:54:19.010 --> 01:54:19.510
Yes.

01:54:19.510 --> 01:54:28.070
But you don't even have to do that, because when I play CTFs like this and I try to find a challenge that is easy, I don't need to wait until the points are degraded.

01:54:28.070 --> 01:54:36.390
I look at the first few solves of the challenge, and if it's teams I know, like, the big, you know, the top CTF time teams that solved it, I know, okay, that's probably hard.

01:54:36.390 --> 01:54:39.990
But if it's, like, teams I don't know, then I assume, oh, this is doable.

01:54:39.990 --> 01:54:41.930
That's a really interesting signal, yeah.

01:54:41.930 --> 01:54:46.470
There's a lot of, like, metagaming that's been developed over the years.

01:54:49.020 --> 01:54:53.320
All right, so we're still seeing perfect route is tweaking and tuning.

01:54:53.480 --> 01:55:00.200
I haven't seen... okay, so they're inputting in...

01:55:00.200 --> 01:55:04.220
Yeah, I mean, I'm looking at the code, at the payload there, and, like, the structure is all correct.

01:55:04.220 --> 01:55:05.360
Like, they're dumping out.

01:55:05.360 --> 01:55:05.620
Yeah.

01:55:05.620 --> 01:55:07.220
They're rewinding the data pointer.

01:55:07.220 --> 01:55:09.240
Then they... oh, no, no, they have another bug.

01:55:09.240 --> 01:55:16.120
Do you see the last back arrow needs to go forwards instead?

01:55:16.120 --> 01:55:20.100
Because they're running over the return address to print it out.

01:55:20.100 --> 01:55:22.560
Then they're rewinding the data pointer.

01:55:22.560 --> 01:55:24.240
But then they need to go forwards again.

01:55:24.240 --> 01:55:28.600
So that last comma less than should be comma greater than.

01:55:29.940 --> 01:55:32.540
So there are these small things.

01:55:32.540 --> 01:55:34.200
And I will say, this is a good example.

01:55:34.200 --> 01:55:37.260
We're actually building a program with more structure where you didn't use comma up here.

01:55:37.260 --> 01:55:39.900
And you actually just instead did something more obvious.

01:55:39.900 --> 01:55:43.820
Might have helped the mental cue of, like, no, no, what do I intend to do here?

01:55:43.820 --> 01:55:45.980
Am I trying to go forward or backward or up or down?

01:55:45.980 --> 01:55:46.820
Yeah, yeah.

01:55:49.400 --> 01:55:50.760
But we'll see.

01:55:50.760 --> 01:55:52.000
So I'm looking forward.

01:55:52.000 --> 01:55:58.400
If Recapig catches up again, or Recapig, this absolutely could be a match again.

01:55:58.800 --> 01:56:02.560
Yeah, I mean, Recapig is definitely catching up again.

01:56:02.560 --> 01:56:07.060
Because Perfect Root has been at this stage now for quite a while.

01:56:07.060 --> 01:56:15.300
And I don't know, the progress hasn't been as big leaps, I feel like, on Perfect Root's side.

01:56:15.300 --> 01:56:17.940
I mean, they definitely have a better understanding of it.

01:56:18.300 --> 01:56:25.920
But, you know, they are not close to solving it, I think.

01:56:25.920 --> 01:56:27.380
Oh, no, you said the magic words.

01:56:27.380 --> 01:56:30.620
As soon as we predict that, they tend to blow through and solve it.

01:56:30.620 --> 01:56:32.640
It's like saying, oh, surely it won't rain today.

01:56:32.640 --> 01:56:34.100
Because I just washed my car.

01:56:35.720 --> 01:56:38.680
Yeah, maybe you should predict again that Recapig is behind.

01:56:38.700 --> 01:56:40.220
Oh, Recapig is real bad.

01:56:40.220 --> 01:56:41.420
There's no way they can catch up.

01:56:41.420 --> 01:56:44.420
And two minutes later, winner, winner pops up.

01:56:44.420 --> 01:56:48.280
Yeah, there's a lot of caster's curse going on at this tournament.

01:56:48.280 --> 01:56:51.560
I don't want to unduly influence the game here.

01:56:52.700 --> 01:56:54.040
Okay, so what are they looking at?

01:56:54.040 --> 01:56:56.020
They're dumping out...

01:56:56.020 --> 01:56:57.560
They're printing what they believe to be a leak.

01:56:57.560 --> 01:56:58.960
Okay, so they're verifying a leak.

01:56:58.960 --> 01:56:59.980
They think they've got...

01:56:59.980 --> 01:57:01.100
Yes, and you see there...

01:57:01.820 --> 01:57:03.260
Oh, they just missed it.

01:57:03.720 --> 01:57:05.080
No, they just missed it.

01:57:05.080 --> 01:57:06.580
They still need to change that to a greater than.

01:57:06.580 --> 01:57:12.960
Yes, so the other way you can do it is you can skip the rewinding and just type the address in backwards.

01:57:12.960 --> 01:57:14.880
But this is like an easier mental model.

01:57:17.240 --> 01:57:20.540
I think Perfect Root is very close to solving it.

01:57:20.540 --> 01:57:21.440
I think that they're actually...

01:57:21.440 --> 01:57:24.860
I think they only need to flip that less than to a greater than.

01:57:24.860 --> 01:57:26.020
And they're basically done.

01:57:26.020 --> 01:57:26.900
Yeah, they're basically done.

01:57:26.900 --> 01:57:31.900
And they'll still have to actually do the overwrite, but they've got a leak, and they've got the address, and they've got the difference, and then it's...

01:57:31.900 --> 01:57:32.460
Yeah.

01:57:32.460 --> 01:57:33.880
Right, four bytes in return.

01:57:34.040 --> 01:57:36.800
The only last thing would be, do they see the escape?

01:57:36.800 --> 01:57:37.880
If they don't see the exit...

01:57:37.880 --> 01:57:39.880
Sorry, the exit operation?

01:57:41.160 --> 01:57:41.880
Right.

01:57:42.160 --> 01:57:43.320
They might not be able...

01:57:43.320 --> 01:57:46.140
That might be another stumbling block.

01:57:46.200 --> 01:57:47.540
All right, because they might be...

01:57:47.540 --> 01:57:50.440
This is another danger of abstractions and mental models.

01:57:50.520 --> 01:57:52.380
They might say, oh, this is brain fuck.

01:57:52.380 --> 01:57:52.860
And then they just...

01:57:52.860 --> 01:57:53.360
And not even look at it again.

01:57:53.360 --> 01:57:56.240
No, and they're just not noticing that we have this extra...

01:57:56.240 --> 01:58:06.140
Because then, if they do need to rewind the instruction pointer thing all the way to the back, that's a little bit annoying, because you need to kind of shift...

01:58:06.140 --> 01:58:09.680
The way you would do it is you have another unmatched...

01:58:10.080 --> 01:58:15.460
You have more closing brackets, and then it will search backwards for corresponding opening brackets.

01:58:15.460 --> 01:58:17.200
And you do that multiple times and stuff.

01:58:17.760 --> 01:58:18.840
It's a bit annoying.

01:58:18.840 --> 01:58:19.460
Yeah.

01:58:21.060 --> 01:58:21.740
So, let's see.

01:58:21.860 --> 01:58:24.060
What are we leaking over here on PerfectRoot?

01:58:24.060 --> 01:58:26.000
We've got...

01:58:27.640 --> 01:58:30.800
So, yeah.

01:58:30.800 --> 01:58:37.600
It's really about working that debugger and seeing that they're not overriding what they think they're overriding.

01:58:43.760 --> 01:58:44.600
Yes.

01:58:44.600 --> 01:58:53.180
So, I want to switch over to RicaPigs, because I think they had the debugger up, looking into the code.

01:58:53.180 --> 01:58:56.720
I want to see what payload they are currently sending.

01:58:58.620 --> 01:58:59.060
It's...

01:58:59.060 --> 01:59:02.180
You know, they have progress, clearly.

01:59:02.580 --> 01:59:04.640
And now they're looking at...

01:59:04.640 --> 01:59:07.060
I'm trying to see what part of the code this is.

01:59:07.460 --> 01:59:09.600
It's the printing...

01:59:09.600 --> 01:59:11.500
Yeah, so they're looking at the print...

01:59:12.140 --> 01:59:13.840
The dot operator.

01:59:15.460 --> 01:59:15.900
And...

01:59:17.080 --> 01:59:22.240
I'm not entirely sure what the question they are trying to answer here right now.

01:59:24.620 --> 01:59:25.060
It's...

01:59:25.720 --> 01:59:27.920
Yeah, so...

01:59:29.260 --> 01:59:30.140
This is...

01:59:31.500 --> 01:59:32.680
Hard to tell.

01:59:33.480 --> 01:59:35.700
Yeah, so we're internally debating right now.

01:59:35.700 --> 01:59:37.760
Do we think they can solve it?

01:59:37.760 --> 01:59:40.080
Are we going to be needing another hint?

01:59:40.080 --> 01:59:41.760
Or do we need to switch to a sudden death?

01:59:43.980 --> 01:59:44.700
It is...

01:59:45.080 --> 01:59:53.240
The way that we've been handling that transition is, if we hit our time limit, which we are actually coming up on the original end.

01:59:53.240 --> 02:00:01.820
But, because this match has an extra gap, we might go up and basically ask the team and say, Do you want to move to sudden death, or do you want to switch this?

02:00:01.820 --> 02:00:03.560
I really don't want to switch to sudden death, though.

02:00:03.560 --> 02:00:05.240
We've seen what happened last time.

02:00:05.300 --> 02:00:09.360
I will say, though, our sudden death is real sudden on this one.

02:00:09.360 --> 02:00:13.720
So if we go to it, we're pretty sure that it would be solvable.

02:00:14.160 --> 02:00:17.020
But certainly, we would rather have the teams be able to finish this out.

02:00:17.020 --> 02:00:18.180
And we do have a little bit of extra.

02:00:18.180 --> 02:00:21.520
We built a gap in time here between the semi-finals and the finals.

02:00:23.860 --> 02:00:24.260
So...

02:00:25.180 --> 02:00:27.680
I keep... I'm trying to figure out what Perfecto is doing.

02:00:27.780 --> 02:00:31.620
They're rerunning the same thing over and over.

02:00:32.180 --> 02:00:32.800
Yeah.

02:00:32.980 --> 02:00:35.600
That reminds me of how I play CTF.

02:00:35.600 --> 02:00:38.660
Just hoping that it changes.

02:00:38.660 --> 02:00:39.340
Oh, yeah.

02:00:39.340 --> 02:00:43.780
It was the same thing that Falck said yesterday.

02:00:43.780 --> 02:00:44.560
Yeah, exactly.

02:00:44.560 --> 02:00:46.360
Even though I know it's not going to be good, I keep rerunning it.

02:00:46.580 --> 02:00:52.740
They've got to be doing this thinking that there's some randomness that's impacting it.

02:00:55.120 --> 02:01:02.100
In the meantime, I can give you a score update on the main scoreboard for the DEFCON CTF.

02:01:02.340 --> 02:01:03.940
We just had a cycle, by the way.

02:01:03.940 --> 02:01:08.320
We have MMM in first place, tightly followed by Katsubin.

02:01:08.320 --> 02:01:13.880
It's the same top fight as we've seen multiple times before, I think.

02:01:13.900 --> 02:01:16.900
And then we have a water paddler in third place.

02:01:18.180 --> 02:01:19.840
Fairly close as well.

02:01:19.840 --> 02:01:23.020
So there's definitely... a lot of things can happen.

02:01:23.020 --> 02:01:26.800
And all this stuff has not factored in the points from this live CTF.

02:01:26.800 --> 02:01:28.900
So it's going to be really interesting to see what happens.

02:01:28.980 --> 02:01:33.340
Perfect Root, who is in this match, they are currently in fifth place.

02:01:33.340 --> 02:01:40.720
But if they would win this, or even go on and win the finals, that would bring them almost up to first place.

02:01:41.580 --> 02:01:42.160
Almost.

02:01:42.480 --> 02:01:48.140
It might let them jump Katsubin, but it wouldn't let them jump Maple for sure.

02:01:48.140 --> 02:01:51.160
Yes, but they will also get some points from the tournament.

02:01:51.160 --> 02:01:54.400
Yeah , because MMM is going to be getting some points having made it to the semifinals.

02:01:54.400 --> 02:01:55.060
Right.

02:01:55.340 --> 02:01:57.580
How long will the main CTF run?

02:01:57.580 --> 02:01:58.540
When will that be over?

02:01:58.540 --> 02:02:02.860
It runs for another two hours, so it's really getting there.

02:02:02.860 --> 02:02:05.400
Yeah, these scores are probably not going to shift much.

02:02:05.400 --> 02:02:11.860
And if you're not familiar, so just like a real quick summary of what the final format is for a DEF CON CTF.

02:02:11.860 --> 02:02:13.840
It's an attack-defend CTF.

02:02:14.360 --> 02:02:20.660
All the teams are given essentially a number of processes that are running on a system of theirs.

02:02:20.700 --> 02:02:23.020
They have to defend it by patching those binaries.

02:02:23.020 --> 02:02:27.460
And they have to attack their opponents by finding vulnerabilities, creating exploits, and sending them against everybody else.

02:02:27.500 --> 02:02:28.940
And so it's a zero-sum game.

02:02:28.940 --> 02:02:31.240
You sort of start with a certain amount of points.

02:02:31.440 --> 02:02:34.840
And then as someone steals from you, you lose a point, they gain a point.

02:02:35.000 --> 02:02:41.000
And so what happens is you see everyone started I think at 20,000 points or 16,000 points, something like that.

02:02:41.000 --> 02:02:42.440
And then they're spreading out.

02:02:42.440 --> 02:02:44.660
And so the top teams steal from the lower teams.

02:02:44.720 --> 02:02:47.040
And so the lowest team now is down at 14,000 points.

02:02:47.040 --> 02:02:49.080
And the highest team is up at 22,000 points.

02:02:49.120 --> 02:02:50.540
So you don't start at zero and then build up.

02:02:50.540 --> 02:02:51.800
You start kind of in the middle.

02:02:51.820 --> 02:02:56.360
And then some go up and some go down with this particular scoring method.

02:02:56.360 --> 02:03:06.560
And so that does mean, though, that there's not a lot of big shifts, wild shifts because there's only so many kind of points available.

02:03:07.000 --> 02:03:09.440
And so it tends to be harder to come from behind at the very last minute.

02:03:09.540 --> 02:03:11.340
Although it depends on how close you are.

02:03:11.340 --> 02:03:22.060
And there's one new solve in a service that no one else has done can start to swing it because the graphs will shift in terms of the rate of scoring.

02:03:22.060 --> 02:03:22.620
Go ahead, Laver.

02:03:23.480 --> 02:03:25.080
We should look at Perfect Truth.

02:03:25.080 --> 02:03:29.360
They were actually, I think, confident about something that the code did.

02:03:29.360 --> 02:03:33.160
They had this, you see it now, uncomment echo pwned.

02:03:33.160 --> 02:03:39.100
They were running it, which looked like they were checking if they got the code execution.

02:03:40.120 --> 02:03:43.620
I think they think they are pretty close.

02:03:44.680 --> 02:03:49.420
Yeah, I still think that they are missing that.

02:03:49.600 --> 02:03:51.720
Unless they're doing something different than we expect.

02:03:51.720 --> 02:03:52.640
I think you're right.

02:03:52.640 --> 02:03:55.640
You can see they're trying to submit...

02:03:59.140 --> 02:04:04.960
I mean, they did uncomment it out again, but it was in there.

02:04:04.960 --> 02:04:06.640
And they had it running for a bit.

02:04:07.640 --> 02:04:09.980
Do you see they have a while true loop?

02:04:09.980 --> 02:04:12.040
They were thinking that something is...

02:04:12.040 --> 02:04:15.940
Yeah, as you said, that something is random a little bit and weird.

02:04:15.940 --> 02:04:20.920
So they were running it in a while true loop, just trying it over and over again.

02:04:20.920 --> 02:04:24.220
There we go, that's what they were looking for.

02:04:24.220 --> 02:04:26.380
Because they had a 90 at the end, they were off by one.

02:04:26.700 --> 02:04:28.900
Now they have it, they have the return.

02:04:28.900 --> 02:04:31.300
It was top of the stack, return address.

02:04:31.660 --> 02:04:36.780
They were off by one, but they mainly added that extra right over there to the end.

02:04:39.860 --> 02:04:42.160
Not the most reliable of exploits.

02:04:45.270 --> 02:04:47.030
Yeah, that's...

02:04:47.030 --> 02:04:47.790
Uh-oh.

02:04:51.060 --> 02:04:51.900
Uh-oh?

02:04:51.980 --> 02:05:02.020
Well, there have been... so depending on the challenges, there was a situation where you didn't always see your output.

02:05:02.100 --> 02:05:05.910
And so if you try to do an echo pwn and detect on it, I know that at least some of the earlier challenges...

02:05:06.400 --> 02:05:08.960
No, no, it was just the submitter program for some people.

02:05:09.420 --> 02:05:10.620
This should not be an issue here.

02:05:10.620 --> 02:05:11.920
Also, they're just running this locally, right?

02:05:11.920 --> 02:05:15.160
Oh, no, I think it was specifically the command injection with the backticks.

02:05:16.320 --> 02:05:19.320
Right, because then you needed to do the semicolon.

02:05:19.320 --> 02:05:21.240
Right , the backticks, you wouldn't see your output.

02:05:21.240 --> 02:05:23.380
So I think, though, in this case, this is still solid.

02:05:23.380 --> 02:05:27.220
If they actually get this, they should be right.

02:05:27.220 --> 02:05:31.320
So I'm curious, is that 0, 069, is that them calling the win function?

02:05:31.380 --> 02:05:33.180
Was that the offset of the...

02:05:33.620 --> 02:05:37.160
I'm a little bit unsure, but to me it looked like...

02:05:37.760 --> 02:05:39.520
Is pi enabled?

02:05:39.660 --> 02:05:42.580
Pi is enabled, but they are leaking the...

02:05:42.580 --> 02:05:43.680
Oh, yeah, they have a leak.

02:05:43.680 --> 02:05:45.400
They have a leak.

02:05:46.920 --> 02:05:49.180
But the thing is that...

02:05:51.750 --> 02:05:55.610
Yes, in fact, pi is enabled because you can actually see Reciprocate has literally just now pulled up CheckSec.

02:05:55.610 --> 02:06:00.110
Right, we just missed it on screen, but they were looking at CheckSec and they saw the pi.

02:06:00.110 --> 02:06:01.250
They literally just highlighted it in their mouse.

02:06:01.250 --> 02:06:02.750
Yeah, they looked annoyed by it.

02:06:02.750 --> 02:06:04.270
They're like, oh, no, there is pi.

02:06:04.270 --> 02:06:09.170
So, I mean, again, it is solvable, but that does mean that they can't just hard code something and win.

02:06:09.690 --> 02:06:10.210
Right.

02:06:10.210 --> 02:06:12.510
But, come on, we did get them a win function.

02:06:12.510 --> 02:06:20.410
But if that's a concern for Recapig at this moment, they feel like they are getting close to tweaking some adverses maybe as well.

02:06:20.410 --> 02:06:21.190
That's a good point.

02:06:21.190 --> 02:06:22.810
They may actually...

02:06:22.810 --> 02:06:27.330
Yeah, I think we're really close here from Perfect Root.

02:06:27.330 --> 02:06:32.510
And it is still possible that Recapig is able to...

02:06:34.670 --> 02:06:37.050
Depending on what the state of their payload is.

02:06:39.170 --> 02:06:50.470
I'm really curious to post-mortem analyze this later and figure out why the many, many, many, many runs on the Perfect Root side is...

02:06:50.470 --> 02:06:52.630
What part of this is not reliable?

02:06:53.150 --> 02:06:57.990
Or what are they analyzing when they're running it like a million times in a row?

02:06:59.670 --> 02:07:02.070
Or they change it out to remote.

02:07:04.230 --> 02:07:06.390
Yeah, they're just going to throw it.

02:07:07.770 --> 02:07:12.090
They are confident that it's really just a little bit of randomness that's the problem.

02:07:12.150 --> 02:07:18.270
And I'm not sure what randomness is coming into play that would be causing them trouble.

02:07:18.750 --> 02:07:21.490
Are they maybe just partially... no, no, no, they have a leak.

02:07:21.490 --> 02:07:22.890
It looked like they were partially overran.

02:07:22.890 --> 02:07:30.410
You can see that they took the leak and they sent back everything except the last...

02:07:30.410 --> 02:07:33.830
Oh, they're brute-forcing.

02:07:34.530 --> 02:07:35.610
That's what they're doing.

02:07:35.610 --> 02:07:37.690
Is they're brute-forcing the win relative address?

02:07:38.370 --> 02:07:40.070
I bet that's exactly what they're doing.

02:07:42.530 --> 02:07:46.870
Just writing the exact difference, like read the full value and then change it relatively.

02:07:46.870 --> 02:07:50.450
I mean, I don't know why, but I think that's what they're doing.

02:07:50.910 --> 02:07:55.410
It's the brain fog program in main because then the return pointer would be...

02:07:56.910 --> 02:07:58.790
Oh, it's just an issue.

02:07:58.790 --> 02:08:00.410
They are not like...

02:08:01.770 --> 02:08:11.410
I'm not so sure if I misremember this, but does it not point into libc start main and so that points to libc code and not...

02:08:13.670 --> 02:08:15.410
Yeah, so...

02:08:19.960 --> 02:08:22.420
Maybe I'm also saying something wrong.

02:08:22.920 --> 02:08:24.220
That might be...

02:08:25.680 --> 02:08:26.580
Yeah, actually, no.

02:08:26.580 --> 02:08:28.060
Oh, that might be the issue.

02:08:28.060 --> 02:08:30.220
They're not brute-forcing anything because they're not trying different...

02:08:31.900 --> 02:08:34.700
Yeah, I mean, brute-forcing the last two bytes doesn't make sense.

02:08:34.700 --> 02:08:36.380
So I realize that this might be the issue.

02:08:36.380 --> 02:08:37.420
What is the issue?

02:08:38.220 --> 02:08:42.440
That the return address is not to...

02:08:42.440 --> 02:08:44.520
Like, since this is running...

02:08:44.520 --> 02:08:48.680
Is this running in the main function?

02:08:49.000 --> 02:08:50.640
And then...

02:08:50.640 --> 02:08:52.940
Like, the return address is not...

02:08:52.940 --> 02:08:56.420
It's to libc and not...

02:08:59.020 --> 02:09:04.180
And not within the program, so they don't have a leak in that sense.

02:09:05.320 --> 02:09:07.600
They would need to leak some other value.

02:09:07.600 --> 02:09:09.400
So your solution, then, was...

02:09:09.740 --> 02:09:11.780
Was it because it incremented or decremented it?

02:09:11.780 --> 02:09:16.300
No, because I used a much more complicated solution before we simplified the challenge.

02:09:16.300 --> 02:09:23.540
But my complicated solution still worked on the simplified challenge, but we didn't verify that the simplified...

02:09:23.540 --> 02:09:27.600
So what was the complicated solution for correctly overriding the return address?

02:09:27.700 --> 02:09:30.060
Well, it involved a ROP chain.

02:09:30.320 --> 02:09:31.820
Oh, interesting.

02:09:33.360 --> 02:09:33.800
But...

02:09:33.800 --> 02:09:35.000
Sorry , we've got a little bit of a...

02:09:35.000 --> 02:09:37.280
We've got a couple of bad cables we've been fighting.

02:09:37.280 --> 02:09:37.800
Yeah.

02:09:37.800 --> 02:09:40.440
So we lost the stream there for a second.

02:09:51.510 --> 02:09:53.350
This is something...

02:09:53.350 --> 02:09:53.790
Yeah .

02:09:54.030 --> 02:09:59.050
Well, you have your script and you just keep running your thing, looking at memory values, just...

02:09:59.890 --> 02:10:02.990
You know, running in circles a bit.

02:10:06.230 --> 02:10:07.110
Yes.

02:10:08.810 --> 02:10:15.110
I'm trying to think about whether they could leak some other value that's within the...

02:10:16.950 --> 02:10:18.310
You know...

02:10:18.310 --> 02:10:20.530
I mean, they totally could.

02:10:21.670 --> 02:10:28.310
They just need to find some value on the stack that's within the program, right?

02:10:28.310 --> 02:10:37.470
Isn't the C main also, like, a function that gets as a parameter the address of main, which might then also be somewhere on the stack?

02:10:37.470 --> 02:10:38.310
Right , it has to be.

02:10:38.310 --> 02:10:39.130
So , like, the...

02:10:39.130 --> 02:10:39.670
One of the address...

02:10:39.670 --> 02:10:42.190
It will be on the stack just a bit further away.

02:10:42.190 --> 02:10:43.770
Oh, maybe then that's...

02:10:44.180 --> 02:10:47.570
Maybe it's not the bug that they had the less than sign.

02:10:47.570 --> 02:10:48.310
Maybe they're overriding...

02:10:48.930 --> 02:10:49.630
But maybe they...

02:10:49.630 --> 02:10:49.730
Oh .

02:10:49.730 --> 02:10:55.210
So it was just that they needed to go a little bit further down the stack and then they go up again.

02:10:55.210 --> 02:10:56.430
So maybe that's not a bug at all.

02:10:56.430 --> 02:10:57.310
Maybe we've just misunderstood...

02:10:57.670 --> 02:11:01.970
Yeah, they were intentionally leaking the main pointer, not as a return address, but as an argument.

02:11:01.970 --> 02:11:02.050
Right .

02:11:02.050 --> 02:11:03.090
And then they want to...

02:11:03.090 --> 02:11:03.550
Yeah.

02:11:03.550 --> 02:11:04.870
And then they're writing that back out.

02:11:04.870 --> 02:11:06.750
So then the question is, like, so what is the bug leak?

02:11:06.750 --> 02:11:09.590
What is PerfectRoot stuck on now, then?

02:11:09.630 --> 02:11:16.130
If that's the case, they should be able to overwrite their return address with that main pointer plus the offset to the win instead, right?

02:11:16.130 --> 02:11:16.710
Yeah.

02:11:17.170 --> 02:11:19.730
Which should work.

02:11:19.730 --> 02:11:24.090
I mean, that should absolutely be a valid solution where it will put them back into main...

02:11:24.090 --> 02:11:24.650
Put them back...

02:11:24.650 --> 02:11:25.150
Sorry.

02:11:25.150 --> 02:11:26.370
Put them back into the win.

02:11:28.490 --> 02:11:30.270
I can see them.

02:11:33.130 --> 02:11:33.830
Yeah.

02:11:35.090 --> 02:11:35.490
So...

02:11:35.490 --> 02:11:37.410
Oh, this is so, you know...

02:11:37.410 --> 02:11:37.750
I know.

02:11:37.750 --> 02:11:38.570
It's nerve-wracking.

02:11:38.570 --> 02:11:40.470
It's imperfect knowledge on all sides.

02:11:40.470 --> 02:11:41.590
And let's just double-check back to...

02:11:41.590 --> 02:11:42.110
Oh, look.

02:11:42.110 --> 02:11:42.450
Oh, go ahead.

02:11:42.450 --> 02:11:43.370
Yeah, because they...

02:11:43.370 --> 02:11:45.990
Look, they are working here with some addresses as well.

02:11:46.630 --> 02:11:47.030
They...

02:11:47.030 --> 02:11:49.430
Second prog address, leak address, pointer address.

02:11:49.430 --> 02:11:52.910
Slow and steady might still be valid here.

02:11:52.910 --> 02:11:53.210
So, yeah.

02:11:53.210 --> 02:11:54.830
Let's take a look at them for a while and see...

02:11:54.830 --> 02:11:58.750
Now pointer should point to end of second program, right?

02:11:59.810 --> 02:12:01.230
Which is a good understanding.

02:12:01.230 --> 02:12:01.830
Which maybe...

02:12:01.830 --> 02:12:01.870
Yeah.

02:12:01.870 --> 02:12:11.930
I don't know if Perfect Root had that understanding where the pointer or the data pointer and the instruction pointer are pointing to of the brain fog program.

02:12:12.370 --> 02:12:13.110
Yeah.

02:12:13.570 --> 02:12:23.610
No, it's definitely interesting to see the completely different, you know, approaches here to, you know, the challenges from the different teams.

02:12:25.470 --> 02:12:26.370
Oh, they have...

02:12:26.370 --> 02:12:26.650
Okay.

02:12:26.650 --> 02:12:28.210
So, I'm just keeping an eye on Perfect Root.

02:12:28.210 --> 02:12:30.030
They actually had...

02:12:30.030 --> 02:12:31.390
They had WIN.

02:12:31.670 --> 02:12:33.930
Is that a back trace that they are showing or is that just...

02:12:33.930 --> 02:12:34.450
This is simply...

02:12:34.450 --> 02:12:36.190
They were...

02:12:36.190 --> 02:12:39.130
Are you saying that they did have the address of the WIN function?

02:12:39.130 --> 02:12:41.690
WIN itself showed up in one of these traces.

02:12:41.690 --> 02:12:42.670
So, right there.

02:12:43.730 --> 02:12:44.550
It's flickering.

02:12:44.770 --> 02:12:46.230
Right there.

02:12:47.030 --> 02:12:48.650
I think they're just doing a back trace.

02:12:48.650 --> 02:12:49.250
I can't even tell.

02:12:49.250 --> 02:12:50.110
I think that's a stack, right?

02:12:50.110 --> 02:12:50.910
Right there at the bottom of the...

02:12:50.910 --> 02:12:51.670
Right, that's...

02:12:51.670 --> 02:12:53.050
Yeah, the bottom is a back trace.

02:12:53.050 --> 02:12:53.690
They showed...

02:12:53.690 --> 02:12:54.810
WIN showed up on there.

02:12:54.810 --> 02:12:57.470
They had WIN in the stack trace and they were hitting the exception earlier.

02:12:57.470 --> 02:13:00.830
So, something was blocking them from returning directly.

02:13:01.890 --> 02:13:02.530
Yeah.

02:13:02.810 --> 02:13:05.330
Because, I mean, they don't have in their program that they're running, right?

02:13:05.330 --> 02:13:06.970
They don't have anything that returns.

02:13:06.990 --> 02:13:09.070
But I've seen them hit the return instruction.

02:13:09.070 --> 02:13:10.790
So, I'm a little bit unsure what's going on there.

02:13:10.790 --> 02:13:12.890
So, are they...

02:13:12.890 --> 02:13:13.890
Is that what...

02:13:13.890 --> 02:13:15.270
That's what they're brute-forcing.

02:13:15.270 --> 02:13:20.670
They're brute-forcing the behavior to try to get an exit that's clean instead of just calling exit.

02:13:22.930 --> 02:13:23.510
Oh.

02:13:23.510 --> 02:13:25.310
Is that what they're trying to get around?

02:13:25.450 --> 02:13:27.790
If they literally just call the exit...

02:13:30.810 --> 02:13:31.210
That's...

02:13:31.910 --> 02:13:33.510
I mean, could be.

02:13:33.510 --> 02:13:34.030
Oh, wow.

02:13:34.330 --> 02:13:34.730
That's...

02:13:34.730 --> 02:13:35.930
That might be what they're fighting.

02:13:35.930 --> 02:13:36.090
It may...

02:13:36.090 --> 02:13:38.890
Because, again, we don't see them calling the exit instruction.

02:13:38.890 --> 02:13:39.330
No, no, no.

02:13:39.330 --> 02:13:39.970
Yeah, exactly.

02:13:39.970 --> 02:13:42.930
So, they should be able to just do that.

02:13:44.510 --> 02:13:45.330
I mean, I think...

02:13:45.330 --> 02:13:46.690
I think we need to tell both of them.

02:13:46.690 --> 02:13:48.290
Because we haven't seen neither team use them.

02:13:48.290 --> 02:13:48.310
Oh , right .

02:13:48.310 --> 02:13:48.510
Yeah.

02:13:48.510 --> 02:13:50.330
So, let's add a hint for the...

02:13:53.050 --> 02:13:54.610
Because I think we need to let both of them know.

02:13:54.610 --> 02:13:55.670
And this is probably going to be the last hint.

02:13:55.670 --> 02:13:58.650
If we can't get it here soon, we're going to just have to, unfortunately, go to sudden death.

02:13:58.650 --> 02:14:00.290
But let's see if we can...

02:14:00.290 --> 02:14:00.730
Oh.

02:14:02.490 --> 02:14:03.030
Oh, no.

02:14:03.030 --> 02:14:03.930
We can't give that hint.

02:14:03.930 --> 02:14:05.270
We can no longer give that hint.

02:14:05.370 --> 02:14:06.550
I just saw that.

02:14:07.050 --> 02:14:07.550
Yeah.

02:14:07.550 --> 02:14:09.310
So, let's switch over to...

02:14:09.310 --> 02:14:09.430
Yeah.

02:14:09.430 --> 02:14:11.190
Let me switch over here to Wrecking Pink.

02:14:11.190 --> 02:14:11.310
Interesting.

02:14:11.310 --> 02:14:12.550
You see that they have...

02:14:13.250 --> 02:14:19.770
They are calling the L just, so they are padding their code with the exit instruction.

02:14:20.090 --> 02:14:22.190
So, they are very aware of...

02:14:22.190 --> 02:14:22.410
Yeah.

02:14:22.410 --> 02:14:23.290
...that they can use this.

02:14:23.290 --> 02:14:24.250
They know exactly what that's going to do.

02:14:24.250 --> 02:14:26.450
If these two players would combine their knowledge...

02:14:26.450 --> 02:14:26.470
I know .

02:14:26.470 --> 02:14:27.990
They should have half of an exploit.

02:14:27.990 --> 02:14:28.650
Yeah.

02:14:29.150 --> 02:14:33.730
Which is a good example of real CTF with teams.

02:14:34.010 --> 02:14:36.230
They would complement each other so well...

02:14:36.230 --> 02:14:36.330
Absolutely.

02:14:36.330 --> 02:14:40.490
...and they would have solved this in a fraction of the time now.

02:14:40.490 --> 02:14:40.610
Yeah.

02:14:40.610 --> 02:14:42.310
And that's why playing with a team is so much more fun.

02:14:42.310 --> 02:14:47.230
They catch your mistakes, they look over your shoulder, and they point out, Hey, did you really mean to do a plus or a greater than?

02:14:47.710 --> 02:14:48.350
Right.

02:14:49.650 --> 02:14:53.130
It's so much more enjoyable to do a CTF with somebody else.

02:14:53.130 --> 02:14:53.570
Right.

02:14:53.570 --> 02:15:01.470
And the thing is here that Perfect Root, if we go back to them, they will not notice this because they are not even looking at the code anymore.

02:15:01.470 --> 02:15:01.950
No.

02:15:01.950 --> 02:15:04.230
They are looking at the exploit, they are looking at the debugger.

02:15:04.230 --> 02:15:07.330
They are completely missing that there is this extra instruction.

02:15:07.790 --> 02:15:09.150
What do you think they try to do?

02:15:09.450 --> 02:15:15.650
Disconnect and then that makes main return because it exits out of the brainfuck loop?

02:15:15.650 --> 02:15:17.890
Or how do they even reach the return?

02:15:17.890 --> 02:15:26.090
I honestly think they are flailing and I think they don't have a clear plan and are just trying a bunch of different stuff to see if they can get it to...

02:15:27.170 --> 02:15:29.010
Call system, hold on, what is this?

02:15:29.010 --> 02:15:29.950
With main stopped...

02:15:30.550 --> 02:15:30.870
Wait.

02:15:30.870 --> 02:15:33.350
There was a red, look, they overwrote.

02:15:33.350 --> 02:15:36.930
Main, red, they are at red and it's pointing into win.

02:15:38.030 --> 02:15:39.770
Now they are executing win.

02:15:39.950 --> 02:15:41.870
Yeah, this should just...

02:15:44.570 --> 02:15:46.350
Oh, no, no, no, pop rvp.

02:15:46.910 --> 02:15:49.790
Pop rvp is going to pop the pointer to win off.

02:15:50.610 --> 02:15:51.410
Right?

02:15:51.930 --> 02:15:53.430
Because win is on the stack.

02:15:54.090 --> 02:15:54.870
No, no, that's...

02:15:55.890 --> 02:16:02.410
I did pause on the... they were at the red of main and it pointed into win.

02:16:04.250 --> 02:16:07.190
So somehow they reached that red apparently.

02:16:09.750 --> 02:16:12.490
Yeah, they are having trouble with the call to system.

02:16:14.190 --> 02:16:16.230
Are they accidentally... no?

02:16:16.230 --> 02:16:17.330
I don't know, yeah.

02:16:17.350 --> 02:16:20.790
So they shouldn't have to worry about the arguments because win sets all that up for them.

02:16:20.790 --> 02:16:20.890
Yeah .

02:16:20.890 --> 02:16:25.030
But if they are breaking in there, what is breaking that's causing...

02:16:25.030 --> 02:16:29.530
Are they trying to do like a small rob thing here instead of just...

02:16:29.530 --> 02:16:32.570
Yeah, I'm not sure what they have actually switched over to doing.

02:16:32.870 --> 02:16:46.730
So in one frame when I paused, they were at the return of main and so, you know, the Jeff output showed where it would continue and it pointed into win but at the end of win, at the return of win.

02:16:46.730 --> 02:16:49.390
Oh, okay, so they are like off by a few bytes.

02:16:49.390 --> 02:16:56.750
Yeah, but there was just one frame where I paused and then on a consecutive one, they were actually stepping through win.

02:16:56.750 --> 02:17:04.210
So I don't know what changed, like why suddenly it was at the start of win, sometimes not.

02:17:04.210 --> 02:17:07.950
Maybe that is the randomness they are observing and we haven't just noticed that.

02:17:07.950 --> 02:17:08.490
Right.

02:17:08.710 --> 02:17:26.090
I want to switch back over to ReekyPig a little bit and look at how, I mean, you can't quite see it, now you can see it, like how beautiful their export script is here where they have created these abstractions for the instructions and they are giving them meaningful names instead of these random symbols.

02:17:26.810 --> 02:17:32.770
And you can see how they are slowly building this up, adding the comments and going very methodical in this.

02:17:32.770 --> 02:17:39.090
And, you know, they are slowly catching up, importing time, I'm not sure why, but...

02:17:39.090 --> 02:17:42.990
Oh, okay, they are just going to do a short sleep here, it seems.

02:17:45.150 --> 02:17:53.730
And I'm not sure exactly how far, but you can see they have the initial stager with the unmatched bracket.

02:17:53.730 --> 02:17:59.430
They have the second stage here with padding out with the exit instruction.

02:17:59.430 --> 02:18:02.430
So you see they are really getting there and...

02:18:05.350 --> 02:18:12.430
PerfectDruid is, you don't have to switch back, but I'm just watching them, they are in the bowels of GDB debugging system trying to figure out...

02:18:14.570 --> 02:18:15.490
Oh, it's like...

02:18:16.290 --> 02:18:28.170
Trying to figure out, like, in the lib C and they are getting, like, yeah, like they are in, like, POSIX spawn action currently, like, they are just, there are some other exceptions being triggered, I don't know what has been corrupted or what's changed.

02:18:28.170 --> 02:18:34.510
They must be really frustrating that they start looking through that.

02:18:34.530 --> 02:18:35.250
Yeah.

02:18:35.490 --> 02:18:40.670
See, we had a question what we want to do here, if we want to go to, if we are going to give them a hint or...

02:18:40.670 --> 02:18:41.170
I mean...

02:18:42.030 --> 02:18:43.190
I kind of still want to...

02:18:44.590 --> 02:18:47.050
I feel like we do have a little bit of time.

02:18:47.190 --> 02:18:50.310
We don't want to eat into all of our spare time before our final match.

02:18:50.310 --> 02:18:55.470
We want to give the team, whoever wins, does want a little bit of a break to flush their head and not go straight into it.

02:18:55.470 --> 02:18:55.950
Yeah.

02:18:56.670 --> 02:19:01.250
But, like, yeah, we do have to cut this off at some point and switch to a sudden death.

02:19:02.790 --> 02:19:04.070
This, this just...

02:19:05.010 --> 02:19:08.610
Yeah, this still feels like something is inches away.

02:19:08.610 --> 02:19:11.950
I mean, I don't know what in the world is even blocking this because we are seeing...

02:19:12.930 --> 02:19:14.790
The win function is being called.

02:19:14.890 --> 02:19:16.150
Like, they are calling win.

02:19:16.230 --> 02:19:21.950
Could it be some, like, have they, like, messed up the stack pointer in such a way that there is, like, stack misalignment or...

02:19:21.950 --> 02:19:27.910
I don't know and they certainly don't either, given the time the debugger being sent.

02:19:27.910 --> 02:19:29.610
Oh , now they are going for one gadget.

02:19:31.510 --> 02:19:32.310
Yeah.

02:19:33.730 --> 02:19:37.950
So, they are going to try to avoid our win function and instead just go directly for...

02:19:40.210 --> 02:19:45.550
Now, did your original one use the win function as well or was your original solution avoiding it too?

02:19:45.550 --> 02:19:47.470
No, my original solution did not use the win function.

02:19:47.470 --> 02:19:51.830
Yeah, so it may be that just by avoiding it they are going to end up getting a win here.

02:19:51.830 --> 02:19:55.230
So, that is a possibility, but I just don't know how long it's going to take them to do that.

02:19:55.450 --> 02:20:02.730
And then the question is, is RicaPig going to sort of slow and steady and be able to catch up or do we just need to call this one and move on?

02:20:02.730 --> 02:20:13.550
Actually, now that you mentioned the misaligned stack, I do remember writing a challenge for the cybersecurity challenge Germany, like a basic pwnable.

02:20:13.550 --> 02:20:27.810
And there was a win function, I believe, and when you solved it, there was a problem with misaligned stack because something in that code is expecting stuff to be aligned.

02:20:27.810 --> 02:20:33.390
But there was a pretty clear exception that when you Google it, you would find the information about that.

02:20:33.390 --> 02:20:43.830
And the solution, you actually had to do one basically pop red to align it again and then the win function did work.

02:20:43.830 --> 02:20:45.970
Now that you mentioned this, I remember that.

02:20:45.970 --> 02:20:51.050
Which though isn't really an option when you're working from an interpreter like this, right, where you sort of have this different environment.

02:20:51.050 --> 02:20:58.210
So it's not clear what that would even look like because they have a single overwrite of the return address.

02:20:58.210 --> 02:21:02.410
No, no, they can overwrite a lot of stuff if they want.

02:21:02.530 --> 02:21:09.430
Yeah, but they'd have to find the next return address on the stack and then go overwrite that as well.

02:21:09.510 --> 02:21:10.850
No, no, no, they could replace...

02:21:10.850 --> 02:21:11.610
Oh , it's just two in a row.

02:21:11.610 --> 02:21:12.550
Yeah, that's right.

02:21:12.550 --> 02:21:15.570
Yeah, they could do that, definitely.

02:21:15.570 --> 02:21:21.690
And since they have a leak, they can use that to just find a RET gadget.

02:21:22.170 --> 02:21:23.070
Well, they already had the libc.

02:21:23.070 --> 02:21:25.330
Yeah, the libc leak was already essentially there.

02:21:25.330 --> 02:21:36.690
Oh , let's switch over here again to Recapink because I just saw on the terminal, I saw the stack smashing detected message, which means that they have overwritten the return.

02:21:36.690 --> 02:21:43.010
And not only have they overwritten the return address, they have triggered the return because otherwise the stack smashing...

02:21:43.010 --> 02:21:45.310
Well, we knew that they had those exits because they did that padding.

02:21:45.310 --> 02:21:50.550
And so they have that part of it right away, which again, I don't see that at all.

02:21:50.830 --> 02:21:56.910
Is it possible that we might see a big catch-up moment here from...

02:21:56.910 --> 02:21:59.550
Hortense and Hare, this might be it.

02:21:59.770 --> 02:22:00.490
Yes.

02:22:03.910 --> 02:22:17.130
Yeah, there's a move apps instruction that doesn't like unaligned addresses, which happens in system.

02:22:17.350 --> 02:22:23.490
I have a video on that, solving that basic pwnable challenges.

02:22:23.490 --> 02:22:25.110
And I had this problem.

02:22:25.550 --> 02:22:30.530
Yeah, you get a stack fault, stack fault at address zero, a very weird exception.

02:22:30.530 --> 02:22:36.550
And then you look at what instruction caused the exception, and it's a move apps instruction.

02:22:36.550 --> 02:22:41.930
And when you Google that, you can then find move apps, unaligned address, and then...

02:22:42.690 --> 02:22:46.530
So that might be the issue here, that the win function is just not callable.

02:22:46.530 --> 02:22:50.950
Well, no, my suspicion is it is callable if you exit cleanly.

02:22:50.950 --> 02:23:00.790
So my suspicion is because that brute force that we're seeing from perfect root, I think is an artifact of how they're getting their return out.

02:23:00.790 --> 02:23:03.730
I think that's what's potentially getting it misaligned.

02:23:06.190 --> 02:23:13.230
Whereas if they were to actually just let the interpreter cleanly exit out, that they would...

02:23:13.230 --> 02:23:19.310
And here I want to say, and we see here on RikaPig's screen that you see that, right, and you saw the stack smashing detected there.

02:23:19.310 --> 02:23:26.050
So they have been just writing a bit too far on the stack.

02:23:26.170 --> 02:23:40.210
I'm not entirely sure if this is an intentional smash to just verify that they are doing the right thing, or if it's an accidental smash because they misaligned some of their data.

02:23:40.210 --> 02:23:43.030
But that still remains to be seen.

02:23:44.390 --> 02:23:48.970
Yeah, I think we are going to have to certainly go to sudden death here pretty soon.

02:23:48.970 --> 02:23:53.270
I think in certainly the next five minutes or so, if we're not real, real close.

02:23:53.270 --> 02:23:58.470
Because we don't have confidence yet that...

02:23:58.470 --> 02:24:03.850
We don't know for certain if the exit cleanly would solve it for perfect root, and we don't know...

02:24:03.850 --> 02:24:10.430
And even the things that are changing now, this one gadget attempt might be a little ambitious for the time that's left, right?

02:24:10.430 --> 02:24:13.910
So we're still trying to figure that out.

02:24:15.050 --> 02:24:15.810
Yes.

02:24:15.850 --> 02:24:21.690
So the question is, do we ask them or do we just go to sudden death?

02:24:24.030 --> 02:24:26.130
I don't think we give them an option.

02:24:26.830 --> 02:24:38.770
We should give them as long as we can, and once we hit the moment where we can't go any further, because we just have to get on to queue up for the finals, then we're going to have to just cut it off.

02:24:40.350 --> 02:24:41.070
Yeah.

02:24:42.390 --> 02:24:44.170
So I don't know that we're there yet.

02:24:44.170 --> 02:24:46.090
We're seeing a one gadget attempt.

02:24:47.270 --> 02:24:49.830
Man, I want them to do it.

02:24:49.830 --> 02:24:51.790
Yeah, I really want to see this.

02:24:52.070 --> 02:24:54.510
So how's it looking over there on Recapit?

02:24:54.510 --> 02:25:01.430
Yeah, so, Recapit, they are inspecting the stack here in the debugger.

02:25:05.670 --> 02:25:11.610
And you can see here their program, the padding that they filled out.

02:25:11.610 --> 02:25:13.310
Oh, okay.

02:25:13.630 --> 02:25:27.110
So since they're doing this padding thing, I suspect that the smashing was because they miscalculated exactly how long their padding should be.

02:25:27.110 --> 02:25:43.370
So we'll see if they can fix that alignment up for the size of the payload, and then to move on to actually controlling the overwrite, is what I'm trying to say.

02:25:48.060 --> 02:25:57.980
Yeah, it's... I mean, for a while I was really like, okay, PerfectRoot is going to have this.

02:25:58.320 --> 02:26:01.280
I'm not so sure anymore.

02:26:01.280 --> 02:26:04.600
This could really go either way.

02:26:06.120 --> 02:26:09.660
Yeah, and again, I think I'm not confident.

02:26:09.840 --> 02:26:17.460
I'm going to say we've got, again, three more minutes to be sure someone's going to solve it, or we're just going to have to switch over to our sudden death.

02:26:17.460 --> 02:26:26.940
Because we do want to give them at least a good 10-20 minutes to solve sudden death, and then go to the bathroom and come back for the finals, because you know when I have to end.

02:26:26.940 --> 02:26:32.340
And the finals, unfortunately, we have to have enough time for that, because the scores have to be in.

02:26:32.340 --> 02:26:36.140
We have to announce the winner, it has to go into the DefCon CTF final score.

02:26:36.220 --> 02:26:43.800
So we do have some hard limits that we're unfortunately working against, where we need a winner to be able to allocate these points.

02:26:43.800 --> 02:26:49.600
The good thing is that the teams can choose to send another player for the finals.

02:26:49.600 --> 02:26:50.880
That's a great point, that's a great point.

02:26:50.880 --> 02:26:52.400
They're not required to send the same player.

02:26:52.400 --> 02:26:57.220
So it is entirely possible that someone decides, hey, I'm burnt out, you've got to send somebody else.

02:26:57.320 --> 02:26:58.880
That live CTF ruined me.

02:26:59.300 --> 02:27:03.680
Do you know how the other teams have done this so far?

02:27:03.680 --> 02:27:06.360
Have they sent other people in these subsequent rounds?

02:27:06.360 --> 02:27:07.540
So far, only NNM.

02:27:08.140 --> 02:27:12.060
The total that any team would have to send is for four rounds.

02:27:12.060 --> 02:27:14.960
So it's not an overwhelming amount spread out over these three days, right?

02:27:14.960 --> 02:27:16.140
And so it's not too crazy.

02:27:16.140 --> 02:27:19.520
And so we've only seen so far NNM, I think is the only one that I've noticed.

02:27:19.520 --> 02:27:25.340
Yeah, they swapped between Robert and Jinmo for their rounds.

02:27:25.340 --> 02:27:30.480
So between their first and second and second and third, there was a switch in and switch out.

02:27:32.200 --> 02:27:35.200
But everyone else seems to have been sending the same person.

02:27:38.340 --> 02:27:46.900
Do you think the players did this voluntarily or do you think within the team they had to throw a coin?

02:27:46.900 --> 02:27:48.240
That's a good question.

02:27:48.240 --> 02:27:49.340
Yeah, I'm not sure if it was...

02:27:50.060 --> 02:27:51.700
It seems like that's varied.

02:27:52.240 --> 02:27:56.600
Some other teams specifically said they were kind of like picking coins because multiple people wanted to go.

02:27:56.800 --> 02:27:59.160
And they had to kind of pick out who was available.

02:28:00.760 --> 02:28:02.020
Wanted to go is positive.

02:28:02.020 --> 02:28:04.980
I was more worried that they would feel uncomfortable.

02:28:05.020 --> 02:28:07.520
Okay , I think we're gonna have to switch over to sudden death.

02:28:07.760 --> 02:28:09.800
I hate to do this.

02:28:09.800 --> 02:28:11.240
Of course, we want to see them solve it.

02:28:11.240 --> 02:28:15.560
But at this point, I'm just seeing some hesitation on Perfect Root.

02:28:15.560 --> 02:28:22.340
Doesn't seem like Alex has kind of a sense of what it's gonna take to finish this out.

02:28:22.460 --> 02:28:29.600
So let's go ahead and I'm gonna go ahead and let each team know that we're switching to sudden death because we want to give them a break between the final round.

02:28:30.260 --> 02:28:32.700
And we will... just give me a second.

02:28:32.700 --> 02:28:34.180
I'm gonna take off my gear.

02:28:34.180 --> 02:28:34.840
I'm gonna let them know.

02:28:34.840 --> 02:28:36.420
And we'll count that one in shortly.

02:28:37.160 --> 02:28:38.120
Right.

02:28:39.120 --> 02:28:39.600
So...

02:28:39.600 --> 02:28:41.360
That's unfortunate to see.

02:28:41.360 --> 02:28:45.840
Obviously, we would want to see a finish, a working exploit.

02:28:45.840 --> 02:28:47.140
But it's understandable.

02:28:47.940 --> 02:28:50.620
The schedule requires it.

02:28:50.660 --> 02:28:53.900
And of course, they are also missing from the main CTF, right?

02:28:53.900 --> 02:28:58.500
I mean, it's now the final hour kind of of the big CTF, maybe.

02:28:58.580 --> 02:28:59.780
It is almost.

02:28:59.780 --> 02:29:02.280
There's one and a half hour left of the main CTF.

02:29:02.280 --> 02:29:04.380
So it's not like that they can do that much.

02:29:04.380 --> 02:29:06.680
But still, they are missing from their main team, right?

02:29:06.680 --> 02:29:07.020
Yes.

02:29:07.020 --> 02:29:08.600
For quite a long time now.

02:29:09.200 --> 02:29:13.080
And this is like a choice the teams have to make, right?

02:29:14.360 --> 02:29:17.080
Like, which... who do they send for this?

02:29:17.080 --> 02:29:18.180
Like, to balance that.

02:29:18.180 --> 02:29:22.940
Like, where do they think their most skilled players are of the most use?

02:29:32.360 --> 02:29:32.880
Right.

02:29:32.880 --> 02:29:37.340
Sorry, there was some... you know, we were just preparing for the sudden death part here.

02:29:37.340 --> 02:29:45.660
So we're just getting them set up, swapping out the challenge and giving them a new simple challenge.

02:29:45.660 --> 02:29:47.820
And this challenge is going to be super simple.

02:29:47.820 --> 02:29:53.240
I mean, I barely know if we're going to have the time to commentate on what's going to go on here.

02:29:53.540 --> 02:29:59.240
Because I think we're picking our simplest challenge in the stash.

02:30:00.080 --> 02:30:01.760
Yeah, it's going to be rough.

02:30:09.940 --> 02:30:13.300
Okay, so Jordan is over with the players explaining the situation.

02:30:13.300 --> 02:30:16.300
Somebody in chat asked what sudden death is.

02:30:17.640 --> 02:30:20.060
This is when the weapons come out.

02:30:21.320 --> 02:30:22.720
Yes, yes.

02:30:22.720 --> 02:30:25.080
This is when we see the first blood.

02:30:25.080 --> 02:30:26.440
Right, exactly.

02:30:26.440 --> 02:30:30.900
No, so the sudden death is that we stop the current challenge.

02:30:32.200 --> 02:30:35.380
And we should have people not walking past the camera.

02:30:36.280 --> 02:30:37.400
But anyway.

02:30:38.840 --> 02:30:39.640
Sudden death.

02:30:39.640 --> 02:30:40.720
We stop the current challenge.

02:30:40.720 --> 02:30:41.680
We swap it out.

02:30:41.680 --> 02:30:42.960
Completely new challenge.

02:30:42.960 --> 02:30:47.420
This new challenge is supposed to be super simple.

02:30:47.420 --> 02:30:49.780
It's going to be fast.

02:30:50.940 --> 02:30:52.080
It's starting now.

02:30:53.500 --> 02:30:55.260
And then they have the new challenge.

02:30:55.260 --> 02:30:56.160
And they're downloading it.

02:30:56.160 --> 02:30:57.740
We're switching over to the split view.

02:30:57.740 --> 02:30:59.340
They're downloading the challenge.

02:31:00.660 --> 02:31:02.400
And yeah, they're going to look at it.

02:31:02.400 --> 02:31:05.140
And this is going to be a slaughter.

02:31:05.180 --> 02:31:07.100
Is this the format string thing?

02:31:13.120 --> 02:31:14.080
Jordan?

02:31:14.300 --> 02:31:15.340
I'm not sure.

02:31:15.340 --> 02:31:15.800
Sorry.

02:31:15.800 --> 02:31:22.120
I actually don't know which sudden death we had lined up for this one.

02:31:23.500 --> 02:31:28.620
Right, so we can switch over to Perth.

02:31:28.620 --> 02:31:30.280
Sorry, to Reykjavik.

02:31:30.920 --> 02:31:33.560
And see, they just look at it here.

02:31:33.700 --> 02:31:38.200
And it's about inputting some passwords here.

02:31:38.200 --> 02:31:41.380
And you need to input your logins.

02:31:41.380 --> 02:31:45.160
You can see that you need to login with admin and correct towards battery staple.

02:31:45.160 --> 02:31:47.060
XKCD password joke.

02:31:47.060 --> 02:31:51.540
And then, is it just reading in shellcode and executing it?

02:31:52.340 --> 02:31:53.520
Is that what I saw?

02:31:53.520 --> 02:31:57.400
I'm pretty sure that this one is meant to be pure speed.

02:31:57.520 --> 02:32:01.260
Oh, perfect root is already opening Google.

02:32:01.260 --> 02:32:03.760
Right, we have some shellcode in there.

02:32:07.080 --> 02:32:08.940
Wow, this is stressful.

02:32:08.940 --> 02:32:15.560
I think they basically just send a username and password and then send shellcode and it will be executed.

02:32:15.700 --> 02:32:17.540
So, let's see who can do this first.

02:32:17.540 --> 02:32:21.880
We can see them copy-pasting the username.

02:32:23.020 --> 02:32:29.820
As we can see here, I'm going to switch over to Reykjavik because you can see very clearly in their exploit script.

02:32:30.540 --> 02:32:33.360
Actually, you can see it clearly in both of them.

02:32:33.360 --> 02:32:35.340
Oh, this is going to be rough.

02:32:35.340 --> 02:32:39.620
I really hope the flag submission thing is...

02:32:39.620 --> 02:32:42.080
Uh -oh, the LS didn't work.

02:32:43.580 --> 02:32:48.920
Switch over to perfect root and see if there's something not working with their...

02:32:48.920 --> 02:32:58.620
I think they might have to pad out the shellcode to be the size of the input.

02:32:58.620 --> 02:32:59.140
There we go.

02:32:59.140 --> 02:33:00.260
Yep, that's exactly what we're seeing.

02:33:00.260 --> 02:33:01.440
We're seeing the padding coming in there.

02:33:01.440 --> 02:33:02.560
Yeah , they're padding it out.

02:33:04.280 --> 02:33:07.520
And then they're sending it and will it be... Yes, there it is.

02:33:07.680 --> 02:33:08.720
There's a shell.

02:33:08.920 --> 02:33:09.480
There it is!

02:33:09.480 --> 02:33:10.340
We have a winner!

02:33:12.720 --> 02:33:14.380
Congratulations to perfect root.

02:33:14.920 --> 02:33:15.960
Oh my god.

02:33:15.960 --> 02:33:16.960
That was brutal.

02:33:16.960 --> 02:33:18.380
That was very, very harsh.

02:33:18.980 --> 02:33:20.080
We've got to go on a break.

02:33:20.080 --> 02:33:24.620
We've got to get back to the teams to talk to them real quickly and line up the final round.

02:33:24.620 --> 02:33:28.040
We'll be here in 30 minutes with the finals.

02:33:28.100 --> 02:33:29.600
I look forward to seeing you back here then.

02:33:29.660 --> 02:33:30.200
See ya.

02:41:22.310 --> 02:41:23.710
See

02:55:15.190 --> 02:55:15.190
ya.

02:55:15.210 --> 02:55:17.890
See

03:00:17.200 --> 03:01:30.780
ya.

03:13:35.460 --> 03:13:36.860
See

03:13:44.380 --> 03:13:44.380
ya.

03:16:26.180 --> 03:16:27.600
See ya.

03:16:59.220 --> 03:17:00.620
See ya.

03:17:29.220 --> 03:17:30.620
See ya.

03:18:24.000 --> 03:18:24.080
See ya.

03:18:26.060 --> 03:18:28.820
How's it going

03:19:04.840 --> 03:19:05.280
?

03:19:05.440 --> 03:19:10.040
Hello and welcome back to our final event of a very long weekend.

03:19:10.040 --> 03:19:11.860
We are super excited to be here.

03:19:11.980 --> 03:19:14.620
We're super excited to be looking at the best two teams.

03:19:15.000 --> 03:19:16.140
Are you ready?

03:19:16.140 --> 03:19:17.480
You said you were nervous a second ago.

03:19:17.480 --> 03:19:21.280
Oh yeah, I mean this is like the final match.

03:19:21.280 --> 03:19:23.100
This is when it all comes together.

03:19:23.600 --> 03:19:25.160
We've had perfect root.

03:19:25.160 --> 03:19:26.040
We've had Starbug.

03:19:26.040 --> 03:19:29.680
They've both battled through three other rounds to make it here to this final event.

03:19:29.680 --> 03:19:34.180
And we're going to get the game started to get the competitors nervous and ready to go.

03:19:34.180 --> 03:19:35.980
For context, the game is over.

03:19:35.980 --> 03:19:38.140
The DEF CON CTF itself is ended.

03:19:38.260 --> 03:19:43.220
This is the final bit of points that anyone can get in this event before it's going to be tallied for the awards ceremony later today.

03:19:43.220 --> 03:19:44.560
So, let's do it.

03:19:44.560 --> 03:19:46.160
Everybody, we're going to kick it off.

03:19:46.400 --> 03:19:51.620
5, 4, 3, 2, 1, go!

03:19:52.760 --> 03:19:54.640
And let's let them rip.

03:19:54.640 --> 03:19:57.500
So let's take a look at the teams and what they're up to.

03:19:57.500 --> 03:20:00.020
We're going to need a reset on our capture card over here.

03:20:00.240 --> 03:20:01.760
Capture card reset, please.

03:20:02.180 --> 03:20:02.500
Yes.

03:20:02.500 --> 03:20:05.000
We've got one that's not working, but we'll get that fixed.

03:20:05.000 --> 03:20:09.200
In the meantime , we'll just go to Perfect Root and watch what they're doing.

03:20:09.400 --> 03:20:13.420
And we can see that they're immediately going into IDA to look at the code of this challenge.

03:20:13.420 --> 03:20:14.540
Oh, we've got different themes at least.

03:20:14.540 --> 03:20:16.080
So now we've got our black and white themes.

03:20:16.080 --> 03:20:16.760
Yes.

03:20:17.220 --> 03:20:24.980
Both doing the exact same thing, looking at both of their systems and popping open their default template scripts.

03:20:24.980 --> 03:20:27.320
What is the name of this challenge that we're looking at today?

03:20:27.320 --> 03:20:29.720
So we're looking at the F in the stack, right?

03:20:29.940 --> 03:20:32.580
We actually had several challenges internally named F in the stack.

03:20:32.580 --> 03:20:34.580
Yes , there was F in the stack and another F in the stack.

03:20:34.580 --> 03:20:37.940
We changed the name of that one, but this is the original F in the stack.

03:20:43.000 --> 03:20:48.060
So it's a reference obviously to the meme, like F in the chat, but on the stack.

03:20:48.400 --> 03:20:49.120
Right.

03:20:49.160 --> 03:20:54.600
So does it actually mean that we're looking at a stack-based buffer overflow, or is that just kind of a troll on the name?

03:20:54.600 --> 03:20:56.660
Yeah, I'm not entirely sure.

03:20:56.660 --> 03:20:59.820
We have a menu here with four different options.

03:21:00.020 --> 03:21:01.900
You can load a file.

03:21:02.620 --> 03:21:04.400
What else was there?

03:21:04.500 --> 03:21:09.840
And then when you do that, there's a file name, there's a call to FStat or LStat actually.

03:21:10.760 --> 03:21:12.620
Oh, that was interesting actually.

03:21:12.620 --> 03:21:14.380
Let's go ahead and take a look at that.

03:21:14.760 --> 03:21:21.560
So you said it was FStat or LStat, but if we look closely, let's let that come up again.

03:21:22.680 --> 03:21:30.260
So again, they're moving so fast, but if we notice, there's a call to one of them, but the error message says the other.

03:21:30.700 --> 03:21:31.060
Right .

03:21:31.560 --> 03:21:33.240
So that is interesting.

03:21:33.280 --> 03:21:33.880
Interesting, yes.

03:21:33.880 --> 03:21:36.860
This is the kind of thing as a... there we go, we're getting some Fs.

03:21:36.860 --> 03:21:38.720
Thank you, chat.

03:21:39.100 --> 03:21:39.620
Love to see it.

03:21:39.620 --> 03:21:40.280
There we go.

03:21:40.280 --> 03:21:43.320
So Fs in the chat for Fs in the stack.

03:21:43.320 --> 03:21:45.160
Well, maybe we do that once it gets solved.

03:21:45.160 --> 03:21:46.180
Yeah, exactly.

03:21:46.300 --> 03:21:47.360
Once they actually beat it.

03:21:47.360 --> 03:21:49.480
Right now the challenge is standing tall.

03:21:50.780 --> 03:21:53.780
By the way, the reference there to Defcon CTF is cancelled.

03:21:54.080 --> 03:21:54.940
Defcon is cancelled.

03:21:54.940 --> 03:21:55.860
It's very much a meme.

03:21:55.860 --> 03:21:59.060
If you've not been to Defcon before, every year there's a joke that it is cancelled.

03:22:00.200 --> 03:22:00.780
Excellent.

03:22:00.780 --> 03:22:03.180
Glad to see LiveOverflow in chat as well.

03:22:03.520 --> 03:22:04.320
Looking forward to...

03:22:04.320 --> 03:22:06.680
Hi everybody on LiveOverflow's Twitch stream.

03:22:06.680 --> 03:22:09.040
I know he's been watching all weekend long with us.

03:22:09.600 --> 03:22:12.720
Even on the times where he wasn't chatting with us live.

03:22:12.720 --> 03:22:13.040
Right.

03:22:13.040 --> 03:22:17.160
So we had him as a commentator, as one of our three guest commentators.

03:22:17.160 --> 03:22:20.660
We had one person from Nautilus Institute, Lightning, here on site.

03:22:20.660 --> 03:22:25.320
And we had Gamoso Labs and LiveOverflow calling in remotely.

03:22:25.320 --> 03:22:27.340
It's been really adding to the...

03:22:27.340 --> 03:22:33.620
In fact, we might want to... If we can get the title below our names fixed, we'll get that corrected.

03:22:33.620 --> 03:22:33.880
That's awesome.

03:22:33.880 --> 03:22:36.140
But we can go to Starbucks.

03:22:36.140 --> 03:22:39.840
You can see that they are just dumping out ETC password.

03:22:39.880 --> 03:22:40.880
So you can see here in the menu.

03:22:40.880 --> 03:22:41.520
They can load a file.

03:22:41.520 --> 03:22:42.480
They can print the loaded file.

03:22:42.480 --> 03:22:43.920
They can unload the last file.

03:22:43.920 --> 03:22:46.980
And they have an extremely convenient call RAX.

03:22:46.980 --> 03:22:49.040
Oh, that's a nice option.

03:22:49.040 --> 03:22:51.040
That's very handy of someone.

03:22:51.040 --> 03:22:51.600
Right.

03:22:51.600 --> 03:22:57.860
So I would assume this means that you want to control the value in RAX.

03:22:57.860 --> 03:23:01.160
We're looking at reading of PROC SELF MEM.

03:23:01.340 --> 03:23:04.180
So we're looking at interactions.

03:23:06.140 --> 03:23:07.860
I freaked out for a second.

03:23:07.860 --> 03:23:09.020
I thought they had a shell installing.

03:23:09.020 --> 03:23:13.400
They were looking at PROC SELF FT0.

03:23:13.400 --> 03:23:15.820
So like opening standard in as a file.

03:23:15.820 --> 03:23:18.540
You can do a bunch of trickery stuff there.

03:23:18.540 --> 03:23:20.300
They were looking at PROC SELF MEM.

03:23:20.300 --> 03:23:21.560
Also an interesting file.

03:23:21.560 --> 03:23:26.180
The whole PROC pseudo file system is pretty interesting in a lot of these challenges.

03:23:26.180 --> 03:23:26.600
Absolutely.

03:23:26.600 --> 03:23:27.620
It comes in very handy.

03:23:27.620 --> 03:23:29.460
So yes, the reference there.

03:23:30.180 --> 03:23:31.840
Avery is confirming DEF CON CTF.

03:23:31.840 --> 03:23:34.320
The main CFTF did end a little bit early.

03:23:34.320 --> 03:23:42.560
I don't know the full story, but we heard from the Nautilus Institute that there was some issues that they had to close down one hour earlier than expected.

03:23:42.560 --> 03:23:46.000
So normally the intended end of the CTF this year was 2pm.

03:23:46.380 --> 03:23:50.140
But they ended out slightly early, which means this is the only game left.

03:23:50.140 --> 03:23:52.040
This is the only points that people can be getting.

03:23:52.340 --> 03:23:54.240
And we've only got two teams that are in and running.

03:23:54.240 --> 03:23:56.460
We've got Perfect Root and we've got Team Starbug.

03:23:56.780 --> 03:24:04.080
And this definitely could change the destiny of Perfect Root in terms of making it into the top teams.

03:24:04.080 --> 03:24:06.380
I don't think it's going to make them into first.

03:24:06.380 --> 03:24:10.240
Having seen the scoreboard right before it went dark, it probably wouldn't get them all the way there.

03:24:10.240 --> 03:24:14.580
Although it is worth noting, there was actually an incident earlier on.

03:24:14.580 --> 03:24:21.120
One of the things that happens a lot with these kinds of CTFs is you're really worried about fair play and what's appropriate and inappropriate.

03:24:21.120 --> 03:24:25.000
And unfortunately, one of the members of Perfect Root was fork bombing one of the other boxes.

03:24:25.000 --> 03:24:27.000
Maybe they weren't aware of the CTF culture.

03:24:27.100 --> 03:24:30.960
And when their team caught it, they specifically said, hey, we're sorry.

03:24:30.960 --> 03:24:32.780
One of our team members didn't know this was against the rules.

03:24:32.860 --> 03:24:34.740
They were penalized a little bit for that.

03:24:34.740 --> 03:24:45.580
Between that penalty plus the amount that they could get by winning, if they win this, that would have maybe been enough to bring them all the way into first from that fourth position that they were in.

03:24:45.740 --> 03:24:51.000
But I think with that penalty, they would probably end up somewhere in the second place range, even if they win.

03:24:51.000 --> 03:24:55.140
So probably not going to upset the entire competition just as a result of this event.

03:24:55.740 --> 03:24:57.280
But it's going to shuffle around the standings.

03:24:57.280 --> 03:24:58.540
It's going to change the standings, yeah.

03:24:58.540 --> 03:25:03.060
No matter what happens, in fact, even if it ends up being Team Starbuck, it's going to jump them way up in the board.

03:25:03.060 --> 03:25:05.740
We should remember also that it's not only the winner who gets points.

03:25:05.740 --> 03:25:09.260
There is a point distribution for all the teams in this tournament.

03:25:09.740 --> 03:25:15.540
And as I said, it will probably not at this point change the winner, but it will shuffle around the standings.

03:25:15.600 --> 03:25:19.160
I want to go and look at Starbuck.

03:25:19.380 --> 03:25:21.920
Because I was seeing some interesting stuff there.

03:25:21.920 --> 03:25:24.080
They're trying to play around with the file system.

03:25:24.080 --> 03:25:26.400
What interesting file could they be looking at?

03:25:27.560 --> 03:25:33.140
If I remember correctly, the intended solution involves a symlink or something?

03:25:33.140 --> 03:25:40.640
You're supposed to open a symlink and then close it to get some kind of uninitialized memory or something like this?

03:25:43.500 --> 03:25:46.180
I've heard that it does involve a symlink.

03:25:46.180 --> 03:25:50.240
And that's the difference between that LSTAT and that FSTAT call.

03:25:50.240 --> 03:25:50.860
Ah, right.

03:25:50.860 --> 03:25:52.840
Link STAT, file STAT.

03:25:53.340 --> 03:25:59.180
I was actually going to ask about the difference there, as I did not remember this.

03:25:59.180 --> 03:26:04.920
So the intended there, I believe, is an FSTAT, which if you call it on a symlink, will give you the file it's pointed at.

03:26:04.920 --> 03:26:06.520
The ultimate actual file.

03:26:06.700 --> 03:26:10.340
But if you use LSTAT, you're going to get just the symlink information.

03:26:10.340 --> 03:26:10.720
Right.

03:26:10.720 --> 03:26:13.220
So that's, I think, the difference.

03:26:13.220 --> 03:26:19.060
And one of the changes, again, we've talked a lot about how getting the difficulty right on these can be an issue.

03:26:20.340 --> 03:26:25.160
One of the things that we did during testing was realize, hey, let's make this a little bit more obvious that this is intended.

03:26:25.160 --> 03:26:29.060
So that's why the error message that was in there just said before, STAT failed.

03:26:29.100 --> 03:26:31.420
And now it says specifically FSTAT failed.

03:26:31.420 --> 03:26:31.680
Right.

03:26:31.680 --> 03:26:35.740
But that wasn't, as you said earlier when you saw the call, that's not the function that's called.

03:26:35.740 --> 03:26:36.000
Right.

03:26:36.520 --> 03:26:38.900
It's a little bit subtle, but it's a hint.

03:26:38.900 --> 03:26:41.280
It's a hint that's kind of baked into the challenge.

03:26:41.280 --> 03:26:44.880
Hopefully, it's sufficient and it gets them what they need.

03:26:44.960 --> 03:26:45.720
We'll see.

03:26:45.720 --> 03:26:47.300
I still love the name of that menu choice, too.

03:26:47.420 --> 03:26:49.060
Extremely Convenient Call RIS.

03:26:49.060 --> 03:26:49.740
Yeah, yeah, yeah.

03:26:49.740 --> 03:26:50.860
It's a little tongue-in-cheek.

03:26:50.860 --> 03:26:51.660
It's a little...

03:26:51.660 --> 03:26:52.060
Yes.

03:26:52.060 --> 03:26:56.800
We've been, like, you know, because we want to make these challenges, like, simple enough that you can solve them very quickly.

03:26:56.860 --> 03:27:06.100
We have been, like, putting in, like, a bit artificial gadgets and aspects of the programs here to make them easier to actually exploit.

03:27:07.060 --> 03:27:10.660
So, let's just see if we can get caught up and get a sense of where everybody's at.

03:27:10.660 --> 03:27:14.900
I don't know that anybody yet knows exactly what they're doing.

03:27:15.220 --> 03:27:16.340
I don't think so either.

03:27:16.340 --> 03:27:18.860
I haven't seen, like, I haven't seen any crashes.

03:27:18.860 --> 03:27:20.560
I haven't seen any, like, weird behavior yet.

03:27:20.560 --> 03:27:24.060
I think they're still, like, exploring the program, trying to figure out what's going on.

03:27:24.060 --> 03:27:26.620
You could see their exploit in the exploit script there.

03:27:26.620 --> 03:27:40.040
They're trying to, like, you know, start to build up that kind of, like, template we talked about before on the stream, like, building abstractions around those, like, interactions in the program so that you can just easily then put these building blocks together into an exploit.

03:27:41.360 --> 03:27:48.320
Yeah, and I will point out again, these are the top players in what is already a collection of the top players in the world, right?

03:27:48.320 --> 03:27:48.940
Right.

03:27:49.420 --> 03:28:00.600
I think the one lesson we found is that the further along we make it in this competition, the harder it is to see what they're doing because they move so quickly that we need to freeze frame, we need to pause.

03:28:01.160 --> 03:28:06.040
And one of the things I would love to do next year is actually bring them in for commentary afterwards, have a little debrief session.

03:28:06.040 --> 03:28:11.000
But we kind of got to balance how much of their time we take up since we are going concurrently with the real event.

03:28:11.000 --> 03:28:12.340
This is part of a competition.

03:28:12.340 --> 03:28:12.420
Yeah.

03:28:12.420 --> 03:28:14.200
It's a very prestigious competition.

03:28:14.340 --> 03:28:15.220
All the teams are here.

03:28:15.220 --> 03:28:15.500
They're playing to win.

03:28:15.500 --> 03:28:16.400
Really, really want to win.

03:28:16.400 --> 03:28:16.860
Yep.

03:28:17.820 --> 03:28:21.540
They get the glory of winning the DEF CON CTF.

03:28:21.540 --> 03:28:23.820
They are awarded black badges, right?

03:28:23.820 --> 03:28:25.260
Eight black badges to the winning team.

03:28:25.260 --> 03:28:30.060
It is the only event that has gotten consistently eight black badges every year.

03:28:30.060 --> 03:28:32.980
Normal events get one, maybe, or maybe two.

03:28:33.040 --> 03:28:35.300
And so this is the biggest pinnacle of all.

03:28:35.300 --> 03:28:40.660
And there are dozens or hundreds maybe even of competitions, if you count all the little challenges all over the event.

03:28:40.680 --> 03:28:44.060
There are tons and tons of things here at DEF CON, but this is the pinnacle.

03:28:44.060 --> 03:28:51.580
And so we did our best to try to integrate within the CTF, but not take too much away from it.

03:28:51.580 --> 03:28:51.800
Right .

03:28:51.800 --> 03:28:53.020
We've got the best people up here.

03:28:53.020 --> 03:28:55.440
We're only here for a maximum of about four hours each.

03:28:55.860 --> 03:29:00.060
And that's over the course of a three-day event, I think, the best we could do.

03:29:00.060 --> 03:29:00.700
Yes.

03:29:01.500 --> 03:29:09.780
I mean, overall, the DEF CON CTF, within the CTF community, it's one of those, I would say, top five or so events of the year.

03:29:10.020 --> 03:29:12.700
And it's certainly one of the most longest-running CTFs.

03:29:12.700 --> 03:29:13.160
For sure.

03:29:14.560 --> 03:29:15.200
Consistency.

03:29:16.060 --> 03:29:22.360
It's probably the best known or maybe the only known outside of the CTF community.

03:29:22.520 --> 03:29:27.180
I have actually had people recognize DEF CON CTF if I'm wearing my leather jacket.

03:29:27.180 --> 03:29:31.300
So actually, it's one of the other things is that the winning team usually gets a leather jacket, or at least they have in the past.

03:29:31.300 --> 03:29:32.500
I don't know if they still do that.

03:29:32.500 --> 03:29:38.640
But you would get these DEF CON branded leather jackets, which doesn't do me a lot of good in Florida, but occasionally I get a chance to wear it.

03:29:38.640 --> 03:29:39.200
Right.

03:29:40.040 --> 03:29:51.980
So, switching over to Starbucks again, we can see here that they're looking at S-Maps, which I don't even know what that is.

03:29:52.380 --> 03:29:53.440
ClockSelf S-Maps?

03:29:53.440 --> 03:29:54.040
Yes.

03:29:54.040 --> 03:29:55.260
I don't know either.

03:29:55.500 --> 03:29:57.280
Maps will show you the memory mapping.

03:29:57.280 --> 03:29:58.880
Which is actually what PerfectDude is doing right now.

03:29:58.880 --> 03:30:00.520
They did just that in their script.

03:30:00.520 --> 03:30:01.980
They leaked out ClockSelf maps.

03:30:01.980 --> 03:30:01.980
Right .

03:30:01.980 --> 03:30:05.860
You can see there they're looking at a whole bunch of other mappings and stuff.

03:30:05.860 --> 03:30:07.340
So, they're playing around with this.

03:30:07.340 --> 03:30:14.620
I don't know if they're looking for something specific or just checking around a bit to see what they can find.

03:30:14.620 --> 03:30:30.700
I mean, certainly with that CallRAX that they're given an extremely suspicious menu option, it makes sense that in their script they might want to understand the base addresses so that they can shift and adjust to an actual pointer where something is loaded.

03:30:30.700 --> 03:30:31.260
For sure.

03:30:31.260 --> 03:30:33.860
So , combining those I think makes a lot of sense, but there's still...

03:30:33.860 --> 03:30:36.040
You need to break that down into sub-goals.

03:30:36.040 --> 03:30:40.260
You know that the end goal is to control the value of this register, but...

03:30:40.260 --> 03:30:41.160
Where are you going to point it?

03:30:41.160 --> 03:30:41.500
Right.

03:30:41.500 --> 03:30:43.480
Where are you going to point it, and how do you get there?

03:30:43.480 --> 03:30:44.000
Yes.

03:30:44.000 --> 03:30:47.060
And I think they know where they're going to point it by reading the ClockSelf maps.

03:30:47.060 --> 03:30:48.840
I think they both can figure that out.

03:30:48.840 --> 03:30:49.880
They can figure out the offsets.

03:30:50.000 --> 03:30:53.780
And I don't remember, is there a win function in this binary?

03:30:53.780 --> 03:30:55.500
I don't remember if we've seen that.

03:30:57.340 --> 03:30:58.660
If it exists.

03:30:58.660 --> 03:31:00.980
Does a win function exist in this binary?

03:31:00.980 --> 03:31:02.060
I'm asking our producer.

03:31:02.060 --> 03:31:04.500
Does a win function exist in this one?

03:31:04.820 --> 03:31:08.640
I don't know that it does, but we're going to double-check on that.

03:31:08.640 --> 03:31:10.620
We're going to have an answer on this very shortly.

03:31:11.640 --> 03:31:16.660
In the meantime, we can see that PerfectRoot, they are...

03:31:16.660 --> 03:31:18.260
Yes, PerfectRoot is still the same player.

03:31:18.260 --> 03:31:19.540
They have not swapped out.

03:31:25.540 --> 03:31:30.180
Okay, so there are...

03:31:30.180 --> 03:31:31.920
They're in the binary.

03:31:31.920 --> 03:31:39.400
There is not a traditional win function the way we've seen other ones, where it's literally just a system of bin.sh, which you could just call it and immediately get a shell.

03:31:40.160 --> 03:31:44.800
These challenges have standard input wired up to the network socket teams are connecting to.

03:31:46.280 --> 03:31:55.180
But you can either hit one gadget, or there's actually a component in the binary itself that has a syscall available that's kind of intended as another potential target.

03:31:55.480 --> 03:32:01.840
And that's actually a good way to make it so that teams can... that we can make sure the difficulty is intended to be a little lower.

03:32:01.840 --> 03:32:08.520
If there's only exactly one path through the binary, it decreases the odds that somebody's going to get to it in time.

03:32:08.520 --> 03:32:13.840
So having a couple of different sort of parallel paths is often a nice way to make these accessible.

03:32:13.840 --> 03:32:17.940
Okay, looking at... we're looking at Perfect Root.

03:32:17.940 --> 03:32:19.860
I almost said Perfect Blue, which again...

03:32:19.860 --> 03:32:22.100
Perfect Root is one of the components.

03:32:22.100 --> 03:32:23.120
Yeah , so again, many of these teams...

03:32:23.120 --> 03:32:25.880
Perfect Blue and Rootimentary are the components of this team.

03:32:26.180 --> 03:32:29.520
Yeah, and many of these teams are kind of combined here for DEF CON CTF.

03:32:29.520 --> 03:32:35.200
And some of them I expect will play together afterwards, and some of them will kind of split back up.

03:32:35.200 --> 03:32:37.740
Maybe only come together once a year, just for this event.

03:32:37.740 --> 03:32:39.320
I think we'll see probably both of those.

03:32:39.320 --> 03:32:40.000
Yes.

03:32:41.520 --> 03:32:41.960
So...

03:32:41.960 --> 03:32:45.100
Okay, now this is... so we're looking at the right.

03:32:48.560 --> 03:32:49.260
Yes.

03:32:49.260 --> 03:32:53.160
We have some cheer in the chat.

03:32:53.160 --> 03:32:57.120
Is that... let's see if I can not embarrass myself.

03:32:57.120 --> 03:32:59.560
Is that like Korean script?

03:32:59.640 --> 03:33:00.780
That is Korean.

03:33:00.780 --> 03:33:01.100
Yes.

03:33:01.100 --> 03:33:01.800
For sure.

03:33:01.900 --> 03:33:02.860
I thought you were going to read it.

03:33:02.860 --> 03:33:03.240
I was like, oh, you can read it.

03:33:03.240 --> 03:33:04.460
No, no, no, no, no, no, no, no.

03:33:04.460 --> 03:33:05.820
Let's not go that far.

03:33:05.820 --> 03:33:07.860
I just wanted to identify the right...

03:33:07.860 --> 03:33:09.380
The character set.

03:33:09.380 --> 03:33:10.640
All right, fair.

03:33:12.040 --> 03:33:18.420
But I've actually heard that learning to read the Korean is actually relatively simple.

03:33:18.420 --> 03:33:20.680
Yeah, the pronunciation is straightforward.

03:33:20.680 --> 03:33:26.940
Unlike Chinese, for example, I can read a little bit of it, but every character has its own words.

03:33:26.940 --> 03:33:27.240
I'm going to try.

03:33:27.240 --> 03:33:28.180
Yeah, yeah.

03:33:28.180 --> 03:33:31.540
I love how much love our contestants are getting.

03:33:31.540 --> 03:33:32.500
They are so handsome.

03:33:32.500 --> 03:33:32.920
Yes.

03:33:32.920 --> 03:33:33.860
They are so wonderful.

03:33:34.120 --> 03:33:36.200
And I'm glad our chat appreciates that.

03:33:36.200 --> 03:33:39.360
We have some fantastic competitors on both sides.

03:33:39.360 --> 03:33:47.080
So actually, to answer your question in chat, I know we have Alex on the Perfect Root side, only because I saw a prompt earlier.

03:33:47.080 --> 03:33:50.680
So they've got their path, their username is Alex in the virtual machine.

03:33:50.680 --> 03:33:56.280
I don't know if I've seen that for Team Starbug, the name of the player that they're sending.

03:33:56.660 --> 03:33:57.100
Right .

03:33:59.120 --> 03:34:00.260
There we go.

03:34:00.260 --> 03:34:02.300
So we've got the answers coming through.

03:34:02.300 --> 03:34:02.960
Oh, yeah, yeah.

03:34:02.960 --> 03:34:03.560
Excellent.

03:34:03.560 --> 03:34:11.140
Yeah, that's, you know, also something I learned when playing CTFs in Korea, that you have the fighting.

03:34:11.160 --> 03:34:12.820
That's just like working hard.

03:34:12.820 --> 03:34:14.040
There's like a pose thing.

03:34:14.040 --> 03:34:16.800
I think it was like, you know, this.

03:34:16.800 --> 03:34:22.120
I apologize for any like, you know, misremembrance of like how this is supposed to be.

03:34:22.120 --> 03:34:24.040
But back to the game.

03:34:24.040 --> 03:34:27.480
Let's go to Starbugs.

03:34:27.480 --> 03:34:44.340
You can see here that they have some kind of leak, I think, because the PwnTools output is switching to the hex output, which it does when there are non-ASCII characters in your debug log.

03:34:44.340 --> 03:34:54.300
So this is something I really like when using PwnTools, like when you use the Tubes library, turn on that like debugging things, you can just see all the bytes being sent and received from it.

03:34:54.300 --> 03:35:02.720
And you can see that within, or pre-pended to that text, there is some, you know, seemingly random bytes, but, you know, probably...

03:35:02.720 --> 03:35:05.080
Well, that looks like maybe a pointer actually.

03:35:05.220 --> 03:35:06.360
That looks very much like a pointer.

03:35:06.360 --> 03:35:07.040
That might be a pointer.

03:35:07.040 --> 03:35:08.380
There are two pointers there actually.

03:35:08.380 --> 03:35:08.960
Yeah.

03:35:09.060 --> 03:35:23.080
So you can see that pattern with the 0F0000 looks like the three upper bytes of an address, typically either, probably a library are going to be in that range.

03:35:23.080 --> 03:35:26.440
Yeah, like the libc or something else.

03:35:26.440 --> 03:35:28.980
So thank you very much for chat, we appreciate the love.

03:35:28.980 --> 03:35:30.760
It has been exhausting.

03:35:30.760 --> 03:35:32.600
We are really excited to see these teams.

03:35:32.600 --> 03:35:37.360
We're also really excited to be done and rest our voices and just lay on the ground, I think, and be quiet for a little bit.

03:35:37.660 --> 03:35:39.700
I'm just going to crash on the floor here right after.

03:35:39.700 --> 03:35:40.740
Just like, yeah.

03:35:40.760 --> 03:35:45.900
But no, I mean, if you are here in Vegas at DEF CON, after like, you know...

03:35:45.900 --> 03:35:47.560
Void Mercy, sorry.

03:35:47.640 --> 03:35:48.660
Void Mercy is the name.

03:35:48.660 --> 03:35:50.300
Yes, that makes a ton of sense.

03:35:51.680 --> 03:35:52.700
Oh, okay, nice.

03:35:52.700 --> 03:35:54.140
That's the handle.

03:35:54.140 --> 03:35:55.080
There we go.

03:35:55.280 --> 03:35:55.680
Right .

03:35:56.300 --> 03:35:59.540
So if you are here at the event, you know, come talk to us afterwards.

03:35:59.940 --> 03:36:03.280
Tell us what you think about the event so far.

03:36:03.280 --> 03:36:08.400
Maybe you have anything to the wish list for next year if we do this again.

03:36:09.400 --> 03:36:12.980
Let's come back and take a look at Perfect Root because they're payload now.

03:36:12.980 --> 03:36:19.880
They've actually been using the ability to send things into...

03:36:19.880 --> 03:36:20.680
No, where did it go?

03:36:20.680 --> 03:36:21.680
It went away.

03:36:21.680 --> 03:36:23.020
Oh, the allocate chunk right there.

03:36:23.020 --> 03:36:29.900
So by doing a load file from standard input and then sending some data, they're able to allocate chunks of different sizes.

03:36:29.900 --> 03:36:39.360
So they are looking into ways to control the heap allocations by using that standard input as a file read and then just sending an arbitrary amount of data to fill up that buffer.

03:36:39.360 --> 03:36:42.720
So that's a really clever way to get exact sized allocations.

03:36:44.660 --> 03:36:48.760
And we'll see if they are going to need that for their exploit.

03:36:48.760 --> 03:36:50.460
I still don't...

03:36:50.460 --> 03:36:56.060
I don't see anyone who has actually found the vulnerability itself.

03:36:56.060 --> 03:36:58.660
We're about 15 minutes in now.

03:37:01.820 --> 03:37:02.260
And...

03:37:02.900 --> 03:37:04.820
Yeah, just standard end, right?

03:37:04.820 --> 03:37:07.620
You don't even need to do the other version of it.

03:37:07.620 --> 03:37:12.820
But I'm still waiting to see somebody demonstrate knowledge of the actual flaw itself.

03:37:13.300 --> 03:37:16.600
They could be in their head, but I'm not seeing any scripts yet.

03:37:16.600 --> 03:37:19.460
So this is the leak that we're seeing here.

03:37:19.500 --> 03:37:21.880
I'm pretty sure this is some kind of memory leak.

03:37:21.880 --> 03:37:23.120
Yeah, it looks like it.

03:37:24.260 --> 03:37:28.280
You're calculating the libc base by taking the leak and subtracting an offset.

03:37:28.280 --> 03:37:31.680
The classic part of your exploit, right?

03:37:32.240 --> 03:37:35.040
So there's definitely some progress there.

03:37:35.420 --> 03:37:39.200
I'm not sure if that will take them all the way.

03:37:39.300 --> 03:37:52.080
So we're saying that one possible solution here is to leak a libc address, get your libc base, somehow control the REX register, and then go for the one gadget.

03:37:52.240 --> 03:37:54.520
We're still looking for somebody to find that bug.

03:37:54.720 --> 03:37:56.820
How do they get that RAX control?

03:37:56.820 --> 03:38:00.660
Once they have that, I think that the rest of the components are pretty straightforward.

03:38:00.680 --> 03:38:02.560
So that's what we're looking to see.

03:38:02.560 --> 03:38:03.660
And we've got plenty of time.

03:38:03.660 --> 03:38:15.760
The good news is this final round can also, much like the last semifinal round, which was able to go a little bit longer before we went to the sudden death, we do have a good hour and a half, I think before we were going to have to switch over to a sudden death.

03:38:15.760 --> 03:38:17.880
But we do still have a hard limit.

03:38:17.880 --> 03:38:18.180
Yes.

03:38:18.180 --> 03:38:22.220
So if we're not able to solve it, we will switch to one of our sudden deaths.

03:38:22.220 --> 03:38:26.060
And as you noticed in the last round, our sudden deaths have gotten real fast.

03:38:26.060 --> 03:38:28.260
We made sure that our sudden deaths are just very, very quick.

03:38:28.260 --> 03:38:31.820
Oh , that one was like under five minutes.

03:38:31.820 --> 03:38:32.960
It was pretty quick.

03:38:32.960 --> 03:38:33.520
Yeah.

03:38:33.680 --> 03:38:39.820
So in terms of both teams being Korean-based, actually I think we have a mixed mixture.

03:38:39.820 --> 03:38:44.900
Perfect Root has a couple of different groups that have come together, I know.

03:38:44.900 --> 03:38:45.520
Right.

03:38:45.520 --> 03:38:50.220
But I do think Starbuck may be predominantly Korean.

03:38:50.220 --> 03:38:50.480
Right.

03:38:50.480 --> 03:38:54.280
And Perfect Root, I think, is mostly U.S.-based, but...

03:38:54.280 --> 03:38:58.360
Students who may have come over or may have been from a variety of places.

03:38:58.460 --> 03:39:01.780
They have, I think, friends from Crofton.

03:39:01.780 --> 03:39:06.140
I know that Perfect Blue is a U.S.-based team.

03:39:06.140 --> 03:39:07.700
At one time it was a college team, right?

03:39:07.700 --> 03:39:08.360
Right.

03:39:08.360 --> 03:39:13.360
I think many of them have graduated and are now in industry, but they kind of met and started there.

03:39:13.680 --> 03:39:14.040
Yes .

03:39:15.220 --> 03:39:17.580
So, all right, we're still...

03:39:17.580 --> 03:39:19.360
See, this is surprising to me.

03:39:19.360 --> 03:39:22.460
I wonder, are they...

03:39:22.920 --> 03:39:29.460
I feel like this is a lot of work on both teams, and yet almost just stepping back and looking and saying, where's the bug?

03:39:29.740 --> 03:39:30.120
Right?

03:39:30.120 --> 03:39:32.280
Because I don't see anybody who's found the bug yet.

03:39:32.280 --> 03:39:37.520
And I feel like all this work that they're doing, it's a lot of motion, but not a lot of destination yet.

03:39:37.520 --> 03:39:45.660
I kind of want to see somebody just stop and just spend some time really marking this up in a decompiler, really looking at...

03:39:45.660 --> 03:39:46.680
Yes.

03:39:46.680 --> 03:39:52.380
Although, if I did not see a stack smashing detected there, right?

03:39:52.560 --> 03:39:55.640
Then maybe we do know the bug on Starbug's side.

03:39:55.640 --> 03:39:57.900
That's interesting, because...

03:39:57.900 --> 03:39:58.940
So, what is this script doing?

03:39:59.080 --> 03:40:02.580
That was a shell, I think.

03:40:02.580 --> 03:40:03.580
Or was it?

03:40:04.880 --> 03:40:05.440
Yeah.

03:40:05.440 --> 03:40:06.740
So, copying into the VM.

03:40:06.740 --> 03:40:07.540
This is what we've seen before.

03:40:07.540 --> 03:40:11.360
Copying out of the VM and going to throw it on against the 10th service.

03:40:11.580 --> 03:40:13.280
Oh, it's not working remotely.

03:40:13.520 --> 03:40:14.480
Oh my god.

03:40:14.700 --> 03:40:16.180
Okay, so we're very close.

03:40:16.180 --> 03:40:17.920
We can hear the frustration.

03:40:18.880 --> 03:40:20.400
And the teammates are behind.

03:40:20.400 --> 03:40:21.900
Yeah, they're cheering on.

03:40:22.180 --> 03:40:23.720
The emotions are there.

03:40:23.720 --> 03:40:25.020
As long as they're not telling advice.

03:40:25.020 --> 03:40:26.160
Yeah, that's the downside.

03:40:26.160 --> 03:40:30.640
As long as they're not giving any hints, they can show all the emotions.

03:40:30.640 --> 03:40:32.340
Yeah, it's exactly encouraged.

03:40:32.340 --> 03:40:33.520
Oh, they're trying to figure it out.

03:40:33.520 --> 03:40:35.820
It's so... yeah.

03:40:36.720 --> 03:40:37.700
So, I would love to see.

03:40:37.700 --> 03:40:39.580
Take a look at that exploit the next time it comes up.

03:40:39.580 --> 03:40:40.420
And I'm very curious.

03:40:40.420 --> 03:40:41.800
Are we seeing that...

03:40:41.800 --> 03:40:43.100
They're trying to run it remotely.

03:40:43.100 --> 03:40:45.520
Oh, they're running it.

03:40:45.520 --> 03:40:46.140
Is this it?

03:40:46.140 --> 03:40:46.620
Is this it?

03:40:46.620 --> 03:40:47.640
They're double checking.

03:40:47.640 --> 03:40:48.000
Yes.

03:40:48.000 --> 03:40:48.980
Team 2, team 2, team 2.

03:40:49.040 --> 03:40:49.560
That's it!

03:40:49.560 --> 03:40:50.480
We have a winner!

03:40:51.920 --> 03:40:52.560
Congratulations!

03:40:53.240 --> 03:40:53.880
Congratulations!

03:40:54.340 --> 03:40:55.700
Very well done.

03:40:56.080 --> 03:40:57.300
Very well done.

03:40:58.160 --> 03:40:59.420
All right.

03:41:00.260 --> 03:41:01.860
That was amazing.

03:41:01.860 --> 03:41:03.940
Let's go ahead and just step back.

03:41:03.940 --> 03:41:05.760
Congratulations to Team Starbug.

03:41:05.780 --> 03:41:07.680
Starbug was the winning team.

03:41:07.800 --> 03:41:09.480
So, well done.

03:41:09.480 --> 03:41:13.060
Made it through all four rounds of live CTF this whole weekend.

03:41:13.420 --> 03:41:16.660
The amount of stress... it was stressful for us just watching.

03:41:16.740 --> 03:41:21.400
I cannot imagine how much effort and energy these teams have just been exhausting themselves.

03:41:21.400 --> 03:41:25.300
It is so hard to sit up here in a room full of people staring over your shoulder.

03:41:25.300 --> 03:41:27.940
The pressure is crushing.

03:41:27.940 --> 03:41:29.260
It is amazing.

03:41:29.300 --> 03:41:30.940
So, Chad, thank you very much.

03:41:30.940 --> 03:41:33.120
You guys hung out with us this all weekend.

03:41:33.440 --> 03:41:34.220
Look forward.

03:41:34.220 --> 03:41:36.920
I can't wait to see a lot of people figuring out afterwards.

03:41:36.920 --> 03:41:42.720
They're going to freeze frame in slow-mo and we're going to get much more information about the different approaches and how things worked.

03:41:42.720 --> 03:41:45.580
I think Clive Overflow is still running his recap stream.

03:41:46.280 --> 03:41:49.280
Are you going to head over there after this ends?

03:41:50.440 --> 03:41:55.940
Keep an eye out for the challenges because we are also going to be releasing all of these challenges to the public.

03:41:55.940 --> 03:42:00.200
We'll put out a GitHub repo with both source code and the exact binaries that teams were given.

03:42:00.200 --> 03:42:05.180
Probably put some information on the website there, a link to the different things, the YouTube channel, the GitHub repo.

03:42:05.460 --> 03:42:11.300
Let's go ahead and take a look at that bracket one last time and pull that up and we'll show what we did this last several days.

03:42:11.300 --> 03:42:15.680
So, we had teams coming from the Round of 16 all the way up to this final event.

03:42:15.980 --> 03:42:17.200
What a great showing.

03:42:17.200 --> 03:42:18.100
That was super fun.

03:42:18.100 --> 03:42:22.420
We want to also thank a big thanks to everyone who helped out making this possible.

03:42:22.640 --> 03:42:31.180
So, we had us and Glenn here on-site in Vegas for this and we had multiple people off-site as well.

03:42:31.180 --> 03:42:32.860
Thanks to Josh for all the challenges.

03:42:32.860 --> 03:42:34.800
Thanks to Nick for a challenge.

03:42:34.800 --> 03:42:37.240
Thanks to Rusty for a bunch of work on challenges.

03:42:37.520 --> 03:42:42.700
Thanks to Brumley for bringing us food because we had several meals brought to us here that was super, super helpful.

03:42:42.700 --> 03:42:43.420
So nice.

03:42:43.420 --> 03:42:45.000
So, this was a blast.

03:42:45.000 --> 03:42:48.660
And then we had Live Overflow on commentary.

03:42:48.660 --> 03:42:52.940
We had Brandon Falk and Gamosolabs on commentary as well.

03:42:53.300 --> 03:42:55.060
And Lightning, of course, from Nautilus Institute.

03:42:55.060 --> 03:42:59.800
And speaking of, big thanks to Nautilus Institute for bringing us out in the first place.

03:42:59.800 --> 03:43:00.260
Right .

03:43:00.260 --> 03:43:01.580
We really appreciate that.

03:43:01.580 --> 03:43:04.880
So, good job to Starbugs for winning.

03:43:05.760 --> 03:43:06.600
Fantastic.

03:43:06.600 --> 03:43:08.980
Alright, we are going to pack it in.

03:43:08.980 --> 03:43:10.980
I think that's about it for the stream for now.

03:43:10.980 --> 03:43:12.400
We look forward to coming back.

03:43:12.400 --> 03:43:14.760
Live CTF is not going away forever.

03:43:14.980 --> 03:43:17.460
We would love to come back again for DEF CON CTF next year.

03:43:17.460 --> 03:43:24.540
But if you're actually interested in Live CTF coming to another CTF, we want other people to be doing this as well, too.

03:43:24.540 --> 03:43:32.260
We think just the idea of showing what teams are doing and talking about it and being able to make it a little bit more accessible is super fun.

03:43:32.400 --> 03:43:34.240
And so, we're looking forward to that happening.

03:43:34.360 --> 03:43:35.080
Right.

03:43:35.220 --> 03:43:36.020
So, yeah.

03:43:36.020 --> 03:43:37.640
That's going to be it for us.

03:43:37.640 --> 03:43:40.020
I've been Carl, CTAH2.

03:43:40.020 --> 03:43:42.960
I've been Cyberdex, and we will see you next time.

03:43:43.240 --> 03:43:44.120
Bye.

03:43:44.120 --> 03:43:44.880
Take care.

03:50:04.240 --> 03:50:06.380
Transcribed by https://otter.ai