start	end	text
2750	6910	Excuse me. So, we're setting up for sudden death.
8830	11190	Okay, sudden death is preparing.
12790	14410	Oh my goodness.
14410	20250	So, when you were looking at the challenge to verify it, did you have that rollercoaster of emotion?
20670	24950	You know, I can't say I did, but I also wasn't live on stream racing against someone right in front of me.
24950	30130	That's true. I think that you have to give these competitors credit.
30130	35190	This is such a difficult competition just in the pressure.
35370	39170	And these scorers are contributing back to their team for the DEFCON CTF Finals.
39170	40070	Oh, absolutely.
40070	44130	So, they know the weight is on their shoulders to get this solved.
44130	46650	They want to win. They want to help their team.
48090	54870	And it looks like over on the other game, we missed this, NorseCode won the other match.
54970	59130	About, what, 20 minutes in?
59790	67330	Yes, and that's kind of what we expected based on some of the discussions that we had, the verification time.
69210	77570	The expectation that we have on our side, though, is it's really just a guess compared to what the other competitors are going to come up with.
78950	82710	So, we're working on getting this set up.
82770	86230	You know, infrastructure, a lot going on behind the scenes here.
86230	88790	This is not a simple operation.
88790	92570	And I have to say, our team has done a great job overcoming difficulties.
92570	94810	We had several hardware failures.
95710	100410	And so, getting through and just running this game is really a testament.
100410	107090	This is somewhat of a hostile environment in that there's a lot going on in DEFCON spaces.
107230	113690	You got everything from network issues, cable problems, laptop problems, anything can happen.
113690	121810	Just getting the game up and having this many matches, this many competitors, it's really a feat.
121810	124170	And we're ready for sudden death.
124550	127950	So, we're going to count it in. Again, this is an easier challenge.
128890	130770	Alright, let's count them in.
130910	136610	In 5, 4, 3, 2, 1, go.
136610	139150	Alright, let's switch over to our competitors.
139150	143590	So, we're looking at Blue Water here. They're just downloading.
144090	145930	Alright, downloading the challenge.
146130	151650	Okay, the name of this challenge is LOL RWX.
154110	160430	Surprise! Text is now RWX. It's a sudden death challenge. Please solve it.
160530	162630	I've got an idea that...
162630	165130	Oh, shaking the mouse. They're like, come on, come on, come on.
165130	167430	The name of the challenge should really give it away.
167430	169510	The excitement for sudden death is real.
169510	172650	I can't wait to see. Exactly. Sudden death.text is RWX.
172650	175550	Where to write? What to write? How many do you want to write?
175850	178870	Okay, so we see Blue Water just loading into IDA.
178890	181310	Undefined just got the big Ghidra dragon on their screen.
181310	183150	So, they're just loading in right now.
183210	185630	I don't think analysis speed is going to come into this at all.
185630	187430	It's a very simple binary.
187990	193050	Text is RWX. Jump anywhere. Do whatever you want. Overwrite main.
193050	195550	Looking at that main function, it's pretty straightforward.
195550	199970	You got the loop. Where to write? What to write?
201490	203550	I think it's going to be a pretty fast one.
203550	204470	It should be pretty easy.
204470	208370	It's basically who can interact with the binary faster at this point.
208370	211730	Because, you know, just write shellcode to the beginning of main.
211910	213530	Jump back to it. Easy.
213550	218110	Undefined checking out that VM map command,
218110	221050	showing them all of the sections in there, protections.
222730	227810	Meanwhile, over on Blue Water, we just saw him highlight the prompt.
227810	231250	Be like, no way. This is it?
231330	237510	All you have to do is write shellcode to the program and away you go.
238030	243210	Now, I really, really hope Endianess doesn't bite these guys in the butt.
243570	246310	I really hope they remember to reverse it.
246770	248430	Oh, no. Using U64.
248430	250250	So, U64 handles Endianess. So, that's fine.
251730	256830	Also, that's my most used utility in PwnTools is P64 and U64 for pack and unpack.
256830	258850	And it handles Endianess swap.
258930	262650	It's so nice. I honestly, that's the main reason why I use the library.
262650	269510	Yeah, the automatic, hey, setting the context to the elf, though they're setting it manually in that script.
270610	277230	Really helpful. And Python pack and unpack, you know, it's one of those not written for hackers.
277230	281910	No. Less than I and everything, I don't know what's in there.
281910	287670	All right. And I think on the undefined side, also, we see a similar, just racing to get that shellcode written.
288450	293190	You know, we're writing eight bytes at a time, so they just need to enumerate.
293190	295070	Oh, identical code almost.
295070	300970	Yeah. We see the same idea on both sides and it's just a matter of how do I interact with this thing?
300970	303090	How do I write these bytes there?
303090	307610	And on blue water, we just saw them write their full shellcode, send one.
308130	309370	Where are they writing it to?
310210	313550	4012CA, I think is right after the main loop.
313910	318570	Now, when I verified this challenge, I wrote it to the beginning of text because I didn't want to deal with,
318570	322450	oh, I only have so many bytes, oh, I, you know, main is at the end of text in this.
322450	323030	Oh.
323030	327750	So if you write over the end, you're, you know, that's not RWX.
327750	333330	See, I was thinking, hey, I'll just write all my shellcode just past where that loop is happening
333330	336950	and then just nop out or jump directly after the loop.
336950	340210	Yeah, with like a 17-byte bin SH, right, that would work.
340210	345590	But PwnTool's Shellcraft SH is, I think, more verbose than that because it has to do the full setup.
345590	348350	You can't guarantee entry still on anything.
348850	351990	Oh, oh, they got local shell, blue water.
351990	353470	Oh, and he's just pointing at remote.
353470	355890	Yep, just pointing at remote, LS, submitter.
355890	357510	Oh, submitted.
358430	360270	And blue water wins it.
360270	361830	Blue water takes it, congratulations.
361830	363770	Congratulations, blue water.
363770	364630	Wow.
364670	366430	They won the sudden death.
366430	368650	They were close on the main challenge.
369510	372350	Very good match, very close match between the two.
372350	377230	We saw trading leads back and forth a couple times as far as knowledge and exploit progress.
378190	380610	Really, really good match.
380930	383630	Yeah, I mean, bravo to both competitors.
384230	386970	The code looked so similar on both sides.
386970	392490	They're just looking at it, just trying to get it down, and blue water edges them out.
392490	398150	Yeah, over on our screens we see Undefined still working through their code.
398150	400790	I think they might have just gotten it.
401310	404710	Oh, no, they have a loop going right now, but they're so, so close.
405070	409670	So that was, let's see what the bracket looks like now.
409670	414590	So SuperDiceCode out by NorseCode.
415190	418730	Kicked out of the bracket, so they're out first round.
418910	424390	And Undefined now out by blue water, the number one in the qualifier, I think.
424570	430790	Indeed, yes, they were coming in as the one seed, and now they'll move on in the double limb in the losers bracket.
430790	434930	But they'll have a chance to go all the way back up, and they could still win this.
434930	440130	Yeah, so blue water going to go against NorseCode as a follow-up to this at 12pm.
440130	447130	But up next, we have OrgekrautPigButtsad on the player screen streams.
447130	451310	And then coming up next on the main, we have Shellfish versus TWN48.
451770	457070	Alright, so we'll take a quick break here, but then we'll be back very shortly with that next round.
457070	460390	Absolutely, thanks for joining us, and I'm glad it was a good match.
460490	461830	Yep, we'll see you soon.