1
00:00:02,750 --> 00:00:03,930
Excuse me.

2
00:00:04,050 --> 00:00:06,910
So, we're setting up for sudden death.

3
00:00:08,830 --> 00:00:11,190
Okay, sudden death is preparing.

4
00:00:12,790 --> 00:00:14,410
Oh my goodness.

5
00:00:14,410 --> 00:00:20,250
So, when you were looking at the challenge to verify it, did you have that rollercoaster of emotion?

6
00:00:20,670 --> 00:00:24,950
You know, I can't say I did, but I also wasn't live on stream racing against someone right in front of me.

7
00:00:24,950 --> 00:00:25,610
That's true.

8
00:00:25,610 --> 00:00:30,130
I think that you have to give these competitors credit.

9
00:00:30,130 --> 00:00:35,190
This is such a difficult competition just in the pressure.

10
00:00:35,370 --> 00:00:39,170
And these scorers are contributing back to their team for the DEFCON CTF Finals.

11
00:00:39,170 --> 00:00:40,070
Oh, absolutely.

12
00:00:40,070 --> 00:00:44,130
So, they know the weight is on their shoulders to get this solved.

13
00:00:44,130 --> 00:00:45,110
They want to win.

14
00:00:45,110 --> 00:00:46,650
They want to help their team.

15
00:00:48,090 --> 00:00:54,870
And it looks like over on the other game, we missed this, NorseCode won the other match.

16
00:00:54,970 --> 00:00:59,130
About, what, 20 minutes in?

17
00:00:59,790 --> 00:01:07,330
Yes, and that's kind of what we expected based on some of the discussions that we had, the verification time.

18
00:01:09,210 --> 00:01:17,570
The expectation that we have on our side, though, is it's really just a guess compared to what the other competitors are going to come up with.

19
00:01:18,950 --> 00:01:22,710
So, we're working on getting this set up.

20
00:01:22,770 --> 00:01:26,230
You know, infrastructure, a lot going on behind the scenes here.

21
00:01:26,230 --> 00:01:28,790
This is not a simple operation.

22
00:01:28,790 --> 00:01:32,570
And I have to say, our team has done a great job overcoming difficulties.

23
00:01:32,570 --> 00:01:34,810
We had several hardware failures.

24
00:01:35,710 --> 00:01:40,410
And so, getting through and just running this game is really a testament.

25
00:01:40,410 --> 00:01:47,090
This is somewhat of a hostile environment in that there's a lot going on in DEFCON spaces.

26
00:01:47,230 --> 00:01:53,690
You got everything from network issues, cable problems, laptop problems, anything can happen.

27
00:01:53,690 --> 00:02:01,810
Just getting the game up and having this many matches, this many competitors, it's really a feat.

28
00:02:01,810 --> 00:02:04,170
And we're ready for sudden death.

29
00:02:04,550 --> 00:02:06,150
So, we're going to count it in.

30
00:02:06,150 --> 00:02:07,950
Again, this is an easier challenge.

31
00:02:08,890 --> 00:02:10,770
Alright, let's count them in.

32
00:02:10,910 --> 00:02:16,610
In 5, 4, 3, 2, 1, go.

33
00:02:16,610 --> 00:02:19,150
Alright, let's switch over to our competitors.

34
00:02:19,150 --> 00:02:22,050
So, we're looking at Blue Water here.

35
00:02:22,050 --> 00:02:23,590
They're just downloading.

36
00:02:24,090 --> 00:02:25,930
Alright, downloading the challenge.

37
00:02:26,130 --> 00:02:31,650
Okay, the name of this challenge is LOL RWX.

38
00:02:34,110 --> 00:02:34,990
Surprise!

39
00:02:35,470 --> 00:02:37,430
Text is now RWX.

40
00:02:37,430 --> 00:02:38,990
It's a sudden death challenge.

41
00:02:39,150 --> 00:02:40,430
Please solve it.

42
00:02:40,530 --> 00:02:42,630
I've got an idea that...

43
00:02:42,630 --> 00:02:44,030
Oh, shaking the mouse.

44
00:02:44,030 --> 00:02:45,130
They're like, come on, come on, come on.

45
00:02:45,130 --> 00:02:47,430
The name of the challenge should really give it away.

46
00:02:47,430 --> 00:02:49,510
The excitement for sudden death is real.

47
00:02:49,510 --> 00:02:50,370
I can't wait to see.

48
00:02:50,410 --> 00:02:50,950
Exactly.

49
00:02:50,950 --> 00:02:52,650
Sudden death.text is RWX.

50
00:02:52,650 --> 00:02:53,410
Where to write?

51
00:02:53,410 --> 00:02:54,130
What to write?

52
00:02:54,130 --> 00:02:55,550
How many do you want to write?

53
00:02:55,850 --> 00:02:58,870
Okay, so we see Blue Water just loading into IDA.

54
00:02:58,890 --> 00:03:01,310
Undefined just got the big Ghidra dragon on their screen.

55
00:03:01,310 --> 00:03:03,150
So, they're just loading in right now.

56
00:03:03,210 --> 00:03:05,630
I don't think analysis speed is going to come into this at all.

57
00:03:05,630 --> 00:03:07,430
It's a very simple binary.

58
00:03:07,990 --> 00:03:09,710
Text is RWX.

59
00:03:09,890 --> 00:03:11,010
Jump anywhere.

60
00:03:11,010 --> 00:03:11,970
Do whatever you want.

61
00:03:12,010 --> 00:03:13,050
Overwrite main.

62
00:03:13,050 --> 00:03:15,550
Looking at that main function, it's pretty straightforward.

63
00:03:15,550 --> 00:03:17,470
You got the loop.

64
00:03:18,170 --> 00:03:19,030
Where to write?

65
00:03:19,030 --> 00:03:19,970
What to write?

66
00:03:21,490 --> 00:03:23,550
I think it's going to be a pretty fast one.

67
00:03:23,550 --> 00:03:24,470
It should be pretty easy.

68
00:03:24,470 --> 00:03:28,370
It's basically who can interact with the binary faster at this point.

69
00:03:28,370 --> 00:03:31,730
Because, you know, just write shellcode to the beginning of main.

70
00:03:31,910 --> 00:03:32,990
Jump back to it.

71
00:03:32,990 --> 00:03:33,530
Easy.

72
00:03:33,550 --> 00:03:41,050
Undefined checking out that VM map command, showing them all of the sections in there, protections.

73
00:03:42,730 --> 00:03:47,810
Meanwhile, over on Blue Water, we just saw him highlight the prompt.

74
00:03:47,810 --> 00:03:49,690
Be like, no way.

75
00:03:49,770 --> 00:03:51,250
This is it?

76
00:03:51,330 --> 00:03:57,510
All you have to do is write shellcode to the program and away you go.

77
00:03:58,030 --> 00:04:03,210
Now, I really, really hope Endianess doesn't bite these guys in the butt.

78
00:04:03,570 --> 00:04:06,310
I really hope they remember to reverse it.

79
00:04:06,770 --> 00:04:07,150
Oh, no.

80
00:04:07,150 --> 00:04:08,430
Using U64.

81
00:04:08,430 --> 00:04:09,770
So, U64 handles Endianess.

82
00:04:09,770 --> 00:04:10,250
So, that's fine.

83
00:04:11,730 --> 00:04:16,830
Also, that's my most used utility in PwnTools is P64 and U64 for pack and unpack.

84
00:04:16,830 --> 00:04:18,850
And it handles Endianess swap.

85
00:04:18,930 --> 00:04:20,450
It's so nice.

86
00:04:20,450 --> 00:04:22,650
I honestly, that's the main reason why I use the library.

87
00:04:22,650 --> 00:04:29,510
Yeah, the automatic, hey, setting the context to the elf, though they're setting it manually in that script.

88
00:04:30,610 --> 00:04:31,490
Really helpful.

89
00:04:31,490 --> 00:04:37,230
And Python pack and unpack, you know, it's one of those not written for hackers.

90
00:04:37,230 --> 00:04:38,010
No.

91
00:04:38,650 --> 00:04:41,910
Less than I and everything, I don't know what's in there.

92
00:04:41,910 --> 00:04:42,250
All right.

93
00:04:42,250 --> 00:04:47,670
And I think on the undefined side, also, we see a similar, just racing to get that shellcode written.

94
00:04:48,450 --> 00:04:53,190
You know, we're writing eight bytes at a time, so they just need to enumerate.

95
00:04:53,190 --> 00:04:55,070
Oh, identical code almost.

96
00:04:55,070 --> 00:04:55,670
Yeah.

97
00:04:56,550 --> 00:05:00,970
We see the same idea on both sides and it's just a matter of how do I interact with this thing?

98
00:05:00,970 --> 00:05:03,090
How do I write these bytes there?

99
00:05:03,090 --> 00:05:07,610
And on blue water, we just saw them write their full shellcode, send one.

100
00:05:08,130 --> 00:05:09,370
Where are they writing it to?

101
00:05:10,210 --> 00:05:13,550
4012CA, I think is right after the main loop.

102
00:05:13,910 --> 00:05:22,450
Now, when I verified this challenge, I wrote it to the beginning of text because I didn't want to deal with, oh, I only have so many bytes, oh, I, you know, main is at the end of text in this.

103
00:05:22,450 --> 00:05:23,030
Oh.

104
00:05:23,030 --> 00:05:27,750
So if you write over the end, you're, you know, that's not RWX.

105
00:05:27,750 --> 00:05:36,950
See, I was thinking, hey, I'll just write all my shellcode just past where that loop is happening and then just nop out or jump directly after the loop.

106
00:05:36,950 --> 00:05:40,210
Yeah, with like a 17-byte bin SH, right, that would work.

107
00:05:40,210 --> 00:05:45,590
But PwnTool's Shellcraft SH is, I think, more verbose than that because it has to do the full setup.

108
00:05:45,590 --> 00:05:48,350
You can't guarantee entry still on anything.

109
00:05:48,850 --> 00:05:51,990
Oh, oh, they got local shell, blue water.

110
00:05:51,990 --> 00:05:53,470
Oh, and he's just pointing at remote.

111
00:05:53,470 --> 00:05:55,890
Yep, just pointing at remote, LS, submitter.

112
00:05:55,890 --> 00:05:57,510
Oh, submitted.

113
00:05:58,430 --> 00:06:00,270
And blue water wins it.

114
00:06:00,270 --> 00:06:01,830
Blue water takes it, congratulations.

115
00:06:01,830 --> 00:06:03,770
Congratulations, blue water.

116
00:06:03,770 --> 00:06:04,630
Wow.

117
00:06:04,670 --> 00:06:06,430
They won the sudden death.

118
00:06:06,430 --> 00:06:08,650
They were close on the main challenge.

119
00:06:09,510 --> 00:06:12,350
Very good match, very close match between the two.

120
00:06:12,350 --> 00:06:17,230
We saw trading leads back and forth a couple times as far as knowledge and exploit progress.

121
00:06:18,190 --> 00:06:20,610
Really, really good match.

122
00:06:20,930 --> 00:06:23,630
Yeah, I mean, bravo to both competitors.

123
00:06:24,230 --> 00:06:26,970
The code looked so similar on both sides.

124
00:06:26,970 --> 00:06:32,490
They're just looking at it, just trying to get it down, and blue water edges them out.

125
00:06:32,490 --> 00:06:38,150
Yeah, over on our screens we see Undefined still working through their code.

126
00:06:38,150 --> 00:06:40,790
I think they might have just gotten it.

127
00:06:41,310 --> 00:06:44,710
Oh, no, they have a loop going right now, but they're so, so close.

128
00:06:45,070 --> 00:06:49,670
So that was, let's see what the bracket looks like now.

129
00:06:49,670 --> 00:06:54,590
So SuperDiceCode out by NorseCode.

130
00:06:55,190 --> 00:06:58,730
Kicked out of the bracket, so they're out first round.

131
00:06:58,910 --> 00:07:04,390
And Undefined now out by blue water, the number one in the qualifier, I think.

132
00:07:04,570 --> 00:07:10,790
Indeed, yes, they were coming in as the one seed, and now they'll move on in the double limb in the losers bracket.

133
00:07:10,790 --> 00:07:14,930
But they'll have a chance to go all the way back up, and they could still win this.

134
00:07:14,930 --> 00:07:20,130
Yeah, so blue water going to go against NorseCode as a follow-up to this at 12pm.

135
00:07:20,130 --> 00:07:27,130
But up next, we have OrgekrautPigButtsad on the player screen streams.

136
00:07:27,130 --> 00:07:31,310
And then coming up next on the main, we have Shellfish versus TWN48.

137
00:07:31,770 --> 00:07:37,070
Alright, so we'll take a quick break here, but then we'll be back very shortly with that next round.

138
00:07:37,070 --> 00:07:40,390
Absolutely, thanks for joining us, and I'm glad it was a good match.

139
00:07:40,490 --> 00:07:41,830
Yep, we'll see you soon.