1
00:00:01,620 --> 00:00:04,620
its goal the innermost secrets of the

2
00:00:04,620 --> 00:00:07,200
cosmos the key to the very creation of

3
00:00:07,200 --> 00:00:09,740
that universe

4
00:00:10,620 --> 00:00:12,000
challenge

5
00:00:12,000 --> 00:00:14,400
by exploiting the hakasat three-game web

6
00:00:14,400 --> 00:00:17,220
server teams became aware of an FTP site

7
00:00:17,220 --> 00:00:19,500
that might contain important files

8
00:00:19,500 --> 00:00:21,720
although the FTP server might have been

9
00:00:21,720 --> 00:00:23,039
previously found using a network

10
00:00:23,039 --> 00:00:25,260
scanning tool the information from the

11
00:00:25,260 --> 00:00:27,060
web server provides credentials for an

12
00:00:27,060 --> 00:00:29,099
account on the FTP site

13
00:00:29,099 --> 00:00:31,260
unfortunately the only thing available

14
00:00:31,260 --> 00:00:33,300
from that account is the binary of the

15
00:00:33,300 --> 00:00:35,219
FTP server itself

16
00:00:35,219 --> 00:00:37,079
teams need to reverse engineer this

17
00:00:37,079 --> 00:00:38,520
binary to see if they can gain

18
00:00:38,520 --> 00:00:40,200
additional access to this server and

19
00:00:40,200 --> 00:00:42,660
perhaps find more useful information

20
00:00:42,660 --> 00:00:44,100
solution

21
00:00:44,100 --> 00:00:46,800
upon analysis the binary is determined

22
00:00:46,800 --> 00:00:48,600
to be a custom server that implements

23
00:00:48,600 --> 00:00:51,420
the main features of the FTP protocol

24
00:00:51,420 --> 00:00:53,820
however it also includes some extensions

25
00:00:53,820 --> 00:00:56,460
that allows for the queuing of commands

26
00:00:56,460 --> 00:00:58,020
the implementation of this queuing

27
00:00:58,020 --> 00:00:59,879
feature includes a double free error

28
00:00:59,879 --> 00:01:01,680
that along with a pointer leak from

29
00:01:01,680 --> 00:01:03,840
another bug can be exploited to allow

30
00:01:03,840 --> 00:01:05,760
full access to the file system of the

31
00:01:05,760 --> 00:01:06,659
server

32
00:01:06,659 --> 00:01:08,700
in the home directory of another account

33
00:01:08,700 --> 00:01:11,460
are a trove of flight software binaries

34
00:01:11,460 --> 00:01:13,619
if exploitable bugs can be found in the

35
00:01:13,619 --> 00:01:15,540
flight software teams can now direct

36
00:01:15,540 --> 00:01:19,520
their attacks at the orbiting satellites