1 00:00:00,000 --> 00:00:03,720 Good morning 2 00:00:25,060 --> 00:00:26,020 and welcome back. 3 00:00:26,020 --> 00:00:28,680 We're here with live CTF day 2. 4 00:00:28,680 --> 00:00:29,480 I'm Mark. 5 00:00:29,480 --> 00:00:30,680 I'm Josh. 6 00:00:30,680 --> 00:00:35,360 And we're bringing to you the first of day 2 here. 7 00:00:35,360 --> 00:00:39,480 We've got two matches, head-to-head going on behind this wall. 8 00:00:39,480 --> 00:00:40,960 Speed match. 9 00:00:40,960 --> 00:00:45,640 We're looking at... we're going to have Undefined versus BlueWater on screen. 10 00:00:45,640 --> 00:00:50,260 And then we're going to have... SuperDiceCode versus NorseCode off screen. 11 00:00:50,260 --> 00:00:51,820 Now we're in the lower bracket here. 12 00:00:51,820 --> 00:00:52,900 Sorry to cut you off. 13 00:00:52,900 --> 00:00:54,380 But we're in lower bracket here. 14 00:00:54,380 --> 00:00:56,780 So a team that loses this is out. 15 00:00:56,780 --> 00:00:58,420 They're out of the entire bracket. 16 00:00:58,420 --> 00:00:59,780 Yeah, a lot of pressure is on. 17 00:00:59,780 --> 00:01:03,380 But we've got a good challenge cooked up for them and I think we're ready to start. 18 00:01:03,460 --> 00:01:09,700 I think we're good to go, except our production team has now turned into ghosts or are hiding. 19 00:01:09,700 --> 00:01:10,640 But we're good to go. 20 00:01:10,640 --> 00:01:12,100 We're good to go, so let's count it down. 21 00:01:12,100 --> 00:01:12,860 Yeah, together. 22 00:01:13,480 --> 00:01:17,600 5, 4, 3, 2, 1. 23 00:01:17,600 --> 00:01:18,640 Let's go. 24 00:01:18,640 --> 00:01:23,640 All right, and bear with us here as we figure out... 25 00:01:27,640 --> 00:01:29,100 There we go. 26 00:01:29,100 --> 00:01:31,900 All right, and so we're watching Undefined first. 27 00:01:32,320 --> 00:01:33,780 All right, Undefined. 28 00:01:33,780 --> 00:01:36,340 And so this challenge is called Jammer. 29 00:01:36,340 --> 00:01:44,680 And this is a special one because it's another throwback challenge to a time when things were a bit simpler, you know? 30 00:01:44,680 --> 00:01:46,060 Ah, better times. 31 00:01:46,060 --> 00:01:48,240 Yeah, really the golden age for vulnerabilities. 32 00:01:48,240 --> 00:01:50,600 But this is a stack buffer overflow. 33 00:01:50,840 --> 00:01:52,520 First Ghidra. 34 00:01:53,480 --> 00:02:01,480 Yeah, I think someone noted in the comments yesterday that it was 7 out of 8 teams that they watched had Ida and one Ghidra user. 35 00:02:01,480 --> 00:02:04,000 So I really like to see the variety. 36 00:02:04,000 --> 00:02:10,240 Yeah, we're starting off with Ida versus Ghidra battle of the second and third best reverse engineering tools. 37 00:02:10,240 --> 00:02:15,340 Yeah, you know, I'm a Binary Ninja fan myself, but... 38 00:02:15,840 --> 00:02:17,540 I'm a Binary Ninja dev myself. 39 00:02:17,540 --> 00:02:21,640 People use what they're used to and they're definitely all going to be... 40 00:02:21,640 --> 00:02:22,140 Absolutely. 41 00:02:22,140 --> 00:02:24,700 The best tool is the one you can use effectively. 42 00:02:24,700 --> 00:02:25,380 Exactly. 43 00:02:25,380 --> 00:02:28,240 And people do get really good at using their favorite. 44 00:02:28,620 --> 00:02:29,740 So let's... 45 00:02:29,740 --> 00:02:33,920 So, okay, we see again two different approaches here. 46 00:02:33,920 --> 00:02:37,680 We see Undefined going with... 47 00:02:37,680 --> 00:02:39,320 That's us. 48 00:02:40,140 --> 00:02:41,660 Team 2 overlay. 49 00:02:45,150 --> 00:02:47,390 All right, so we see Undefined. 50 00:02:47,390 --> 00:02:53,430 They started out a little bit doing, whatchamacallit, dynamic analysis. 51 00:02:53,430 --> 00:02:56,210 Just interacting with the program, seeing what it looks like. 52 00:02:56,210 --> 00:03:01,390 And now they're hopping back into Ghidra, trying to figure out where interaction starts, where they can go. 53 00:03:01,690 --> 00:03:03,190 What is this challenge? 54 00:03:03,190 --> 00:03:04,430 You wrote this challenge. 55 00:03:04,790 --> 00:03:06,670 Right, well, yes, I did. 56 00:03:06,730 --> 00:03:09,270 And this is, as I said, a throwback challenge. 57 00:03:09,270 --> 00:03:15,170 This is a challenge that was originally written for the DARPA Cyber Grand Challenge in 2016. 58 00:03:15,170 --> 00:03:15,610 Really ? 59 00:03:15,610 --> 00:03:19,210 Yes, so it's a rematch of a rematch challenge, really. 60 00:03:19,330 --> 00:03:19,570 Nice. 61 00:03:19,570 --> 00:03:22,990 So shout out to Debbie Nuttall, who was the original author of the challenge. 62 00:03:22,990 --> 00:03:26,790 And I lightly modified it so it would fit for our scope here. 63 00:03:27,670 --> 00:03:33,530 But it is a throwback to a bug from 2002. 64 00:03:33,530 --> 00:03:35,870 If you remember the sequel, Slammer Worm? 65 00:03:36,350 --> 00:03:37,430 Slammer Worm? 66 00:03:37,430 --> 00:03:39,170 No, I don't think I was around for that one. 67 00:03:39,170 --> 00:03:46,770 Yeah, yeah, so early in 2003 is when sequel Slammer was taken over the internet. 68 00:03:46,770 --> 00:03:51,310 And so this is a stack-based buffer overflow, a classic stir copy. 69 00:03:51,310 --> 00:03:55,350 And so I think here what we're really going to be looking for is how fast can they find that? 70 00:03:55,610 --> 00:03:58,510 Slammer Jammer, I just got the, I like it. 71 00:03:58,970 --> 00:04:00,590 We're very clever here. 72 00:04:01,170 --> 00:04:03,230 So I was the one that verified this challenge. 73 00:04:03,230 --> 00:04:09,990 So I can say going from zero knowledge to a full solution on this challenge, it was pretty clean. 74 00:04:09,990 --> 00:04:17,410 You know, you figure an interaction flow with the program, and then you start building an idea of what to do, I want to say. 75 00:04:17,410 --> 00:04:19,410 Like, you're not lost in the sauce. 76 00:04:19,410 --> 00:04:23,130 Yeah, yeah, and it is, you know, a simplified challenge. 77 00:04:23,130 --> 00:04:37,630 The DARPA Cyber Grand Challenge was built to be, these challenges were built to be analyzed by automated competitors, which I think is funny because it's like the biggest data set ever produced to be looked at by machines, right? 78 00:04:37,730 --> 00:04:42,670 And so let's see how fast our competitors can figure this one out. 79 00:04:42,670 --> 00:04:51,260 So let's switch over and look at Blue Water here. 80 00:04:54,150 --> 00:05:00,350 All right, so they're going through, now this binary isn't stripped, is it? 81 00:05:00,350 --> 00:05:01,190 No. 82 00:05:01,190 --> 00:05:03,750 Okay, so they have some symbols to work with in the beginning. 83 00:05:03,990 --> 00:05:06,430 So they're going through, they're annotating different structs. 84 00:05:06,850 --> 00:05:14,070 And they're kind of figuring out, okay, so they're building a struct just called instance, and I think that's returned by create instance. 85 00:05:14,110 --> 00:05:19,390 So the names of these functions really do help you out with your first initial look around. 86 00:05:19,930 --> 00:05:27,270 Yeah, and so what's interesting with this is that we're actually seeing both competitors digging into the structs right away. 87 00:05:27,270 --> 00:05:35,950 And this is an interesting one because there's a decent bit here, but actually the vulnerability itself doesn't require any knowledge of the structure. 88 00:05:35,950 --> 00:05:36,690 Really? 89 00:05:36,690 --> 00:05:37,530 Oh, you're right. 90 00:05:37,530 --> 00:05:39,770 It's just a stack-based str copy. 91 00:05:39,770 --> 00:05:42,450 So a classic bug, very simple. 92 00:05:42,450 --> 00:05:46,610 And really the challenge here, because it's a speed race, is who can find it and exploit it faster? 93 00:05:46,610 --> 00:05:49,330 So this is kind of a reverse engineering pwn challenge. 94 00:05:49,330 --> 00:05:53,870 Like you need to find the right area first, obviously recognize the bug. 95 00:05:53,870 --> 00:05:59,210 But then popping a shell after that is, these guys should be used to it. 96 00:05:59,210 --> 00:05:59,810 Right, right. 97 00:05:59,810 --> 00:06:08,490 And so that's one of the things that I enjoy about this challenge in particular with the speed challenges is you just have to win first. 98 00:06:08,490 --> 00:06:18,650 And so one strategy, which I'm not seeing either competitor do, is to look at the key functions that might be the fast win functions. 99 00:06:18,650 --> 00:06:23,410 So you can see a reference on BlueWater's screen here. 100 00:06:23,410 --> 00:06:26,610 On the left-hand side you see the list of imports and you see str copy there. 101 00:06:26,690 --> 00:06:29,130 And str copy can be innocuous. 102 00:06:29,270 --> 00:06:31,650 Yeah, but do you see a stern copy and a str copy? 103 00:06:31,650 --> 00:06:35,310 I kind of raised an eyebrow at that and I'm like, the author left this in. 104 00:06:35,510 --> 00:06:36,110 That's true. 105 00:06:36,110 --> 00:06:41,050 And especially whenever you're dealing with strings in C code, you have to be careful. 106 00:06:41,050 --> 00:06:45,210 And so you want to, it's always reasonable to take a quick peek at those and see where it gets used. 107 00:06:45,210 --> 00:06:45,870 Oh, yeah. 108 00:06:45,870 --> 00:06:48,710 For as much flack as I give Go, they do strings better. 109 00:06:49,890 --> 00:06:52,270 I think C sets a pretty low bar. 110 00:06:52,450 --> 00:06:53,690 Yeah, maybe. 111 00:06:54,630 --> 00:06:55,390 What are you talking about? 112 00:06:55,390 --> 00:06:58,610 I'll never bash fgets. 113 00:06:59,930 --> 00:07:04,210 You know, as a friend of mine likes to say, no, I love C. 114 00:07:04,370 --> 00:07:06,470 I like bugs and I don't want it to go away. 115 00:07:06,470 --> 00:07:07,330 Yeah, I love C. 116 00:07:07,330 --> 00:07:08,150 I love my job. 117 00:07:10,190 --> 00:07:12,170 All right, so we see... 118 00:07:12,170 --> 00:07:13,710 Let's flip over here. 119 00:07:13,710 --> 00:07:14,530 Nope. 120 00:07:14,910 --> 00:07:16,870 Just hit this one right here. 121 00:07:17,330 --> 00:07:18,190 Just this. 122 00:07:18,910 --> 00:07:21,970 Yeah, no, we have a fancy new stream set up for day two. 123 00:07:21,970 --> 00:07:27,670 Jordan was here late and early setting stuff up, moving stuff around, so we have no idea what we're working with anymore. 124 00:07:27,670 --> 00:07:28,610 Thank you. 125 00:07:28,610 --> 00:07:32,650 I have to say it's very impressive and I'm very bad at using it so far, but we'll get there. 126 00:07:32,650 --> 00:07:34,010 It's the first match of the day. 127 00:07:34,010 --> 00:07:35,850 We're how many minutes in? 128 00:07:35,850 --> 00:07:36,070 Yeah. 129 00:07:36,070 --> 00:07:36,890 A couple. 130 00:07:37,170 --> 00:07:42,970 So as our competitors are digging into it here, they're doing the standard reverse engineering. 131 00:07:42,970 --> 00:07:45,330 Do you want to take a look at the bracket and sort of... 132 00:07:46,010 --> 00:07:48,590 Yeah, we can talk about the bracket, what we're going to see today. 133 00:07:48,590 --> 00:07:49,130 Yeah. 134 00:07:52,500 --> 00:07:57,440 So we've got, as you can see, it's a double elimination bracket. 135 00:07:57,440 --> 00:08:00,660 And so this was a number one feedback from last year, right? 136 00:08:00,660 --> 00:08:01,520 Oh, absolutely. 137 00:08:01,520 --> 00:08:04,220 Teams were upset that they got a challenge they weren't familiar with. 138 00:08:04,220 --> 00:08:08,120 We didn't tell them the categories last year either, which was an oversight on our part. 139 00:08:08,260 --> 00:08:10,580 But you were out after one match last year. 140 00:08:10,580 --> 00:08:14,420 And that was absolutely... we got feedback saying this is absolutely not what we want to do. 141 00:08:14,420 --> 00:08:16,500 That's so unfair and stressful. 142 00:08:16,500 --> 00:08:21,400 So it's a double elimination bracket this year, which means a lot more work for us, but a lot more fair for the teams. 143 00:08:21,400 --> 00:08:23,660 And honestly, that's a good tradeoff as far as we're concerned. 144 00:08:23,660 --> 00:08:29,160 Yeah, it's really good to see that because you can be really, really good. 145 00:08:29,240 --> 00:08:36,700 And as we said, sometimes you just notice something that your competitor doesn't and that can get you ahead real fast. 146 00:08:37,000 --> 00:08:37,560 Absolutely. 147 00:08:37,560 --> 00:08:43,240 And all these players are good, so we do want to see the best player come out on top. 148 00:08:46,500 --> 00:08:49,460 So switching over to Undefined. 149 00:08:51,080 --> 00:08:52,740 Let's see, what are they doing? 150 00:08:52,740 --> 00:08:54,820 Oh, that's... see, I don't use Ghidra. 151 00:08:54,820 --> 00:08:59,580 So all of these UIs are new to me, but they also look like they were before my time. 152 00:09:00,060 --> 00:09:03,480 Yeah, well, Ghidra... I mean, it's an impressive tool. 153 00:09:03,480 --> 00:09:07,840 You can do so much with it, and it is not my go-to, but their struct editor... 154 00:09:07,840 --> 00:09:13,820 I like the visual of the sizing going on and being able to pick out specific stuff. 155 00:09:13,820 --> 00:09:15,260 Oh, that's what that is down there. 156 00:09:15,320 --> 00:09:16,220 That's nice. 157 00:09:16,220 --> 00:09:17,340 Yeah, I like that. 158 00:09:18,320 --> 00:09:20,080 I'm not stealing ideas here. 159 00:09:20,160 --> 00:09:20,900 Yeah. 160 00:09:21,620 --> 00:09:23,060 Scoping out the competition. 161 00:09:23,340 --> 00:09:28,240 I got to say, though, with both Ida and Ghidra, I'm not a light theme guy. 162 00:09:28,240 --> 00:09:29,680 I really do prefer the dark theme. 163 00:09:29,680 --> 00:09:34,100 I definitely don't appreciate having two monitors with light themes blasting into our eyes. 164 00:09:34,100 --> 00:09:36,400 It's brighter than the studio lights we have here. 165 00:09:36,440 --> 00:09:38,080 It's definitely good to wake you up, though. 166 00:09:38,080 --> 00:09:39,400 Oh, absolutely. 167 00:09:39,400 --> 00:09:41,000 The coffee wasn't enough. 168 00:09:41,520 --> 00:09:43,280 All right, so they're still annotating strokes. 169 00:09:43,280 --> 00:09:44,520 They're still going through... 170 00:09:45,680 --> 00:09:51,140 They're kind of going through the normal CTF mindset of, OK, get all of my bearings, figure out what's going on. 171 00:09:51,140 --> 00:09:53,780 Then we look for the bug once I know what everything is. 172 00:09:53,960 --> 00:09:59,660 Yeah, well, once you've got a decent bit of annotation here, I really do think that the bug's going to pop out. 173 00:09:59,660 --> 00:10:03,840 And this isn't just, hey, I'm going to go through and name everything. 174 00:10:03,840 --> 00:10:07,620 It's also they're understanding the algorithm as they name things. 175 00:10:07,620 --> 00:10:11,900 And so right now they're looking at strcmp and thinking about, OK, what does this do? 176 00:10:11,900 --> 00:10:18,040 I think if you were taking this approach and you get to the target function with the strcpy, it's going to pop right out. 177 00:10:18,040 --> 00:10:18,600 Oh, yeah. 178 00:10:18,600 --> 00:10:20,280 No, you're going to see that immediately. 179 00:10:22,340 --> 00:10:25,560 Especially because... So what is kind of this challenge? 180 00:10:25,560 --> 00:10:29,680 Like, in a nutshell, what does the interaction flow look like? 181 00:10:29,680 --> 00:10:31,080 What is it supposed to be? 182 00:10:31,080 --> 00:10:39,660 Yeah, so as we're seeing here, both competitors looking at these functions are talking about querying and servers. 183 00:10:39,660 --> 00:10:44,100 So this is an address resolution service was the sort of origin of the bug. 184 00:10:44,100 --> 00:10:49,920 And the CGC challenge called itself server resolution service. 185 00:10:49,920 --> 00:10:57,380 So really this is about, hey, can you create a query to enumerate these instances and find things? 186 00:10:57,600 --> 00:11:05,360 And it's just copying one of these fields to another in a request leads to an overflow. 187 00:11:06,900 --> 00:11:07,360 Nice. 188 00:11:07,360 --> 00:11:07,580 Yeah. 189 00:11:07,580 --> 00:11:12,820 So it's a fairly standard service interaction flow, I want to say. 190 00:11:12,820 --> 00:11:15,120 You have creation. 191 00:11:15,120 --> 00:11:15,960 You have querying. 192 00:11:15,960 --> 00:11:17,400 I don't think you have any deletion here. 193 00:11:17,400 --> 00:11:20,680 So it's not going to be like a false double free or something. 194 00:11:21,260 --> 00:11:23,260 Oh yeah, I don't see free in the function list. 195 00:11:26,800 --> 00:11:29,660 I'm going to flip over to Bluewater here. 196 00:11:29,680 --> 00:11:32,160 It looks like they are... I see them. 197 00:11:32,160 --> 00:11:35,120 They just labeled something in a stir copy right there. 198 00:11:37,560 --> 00:11:43,540 It's funny when you see somebody and you know they're close and you're starting to see as he's clicking around. 199 00:11:43,540 --> 00:11:45,760 Oh, he's looking right at the stir copy. 200 00:11:45,760 --> 00:11:47,020 Oh, is he? 201 00:11:47,020 --> 00:11:48,780 Oh, he sees that it's a stack. 202 00:11:48,780 --> 00:11:49,840 He sees it. 203 00:11:49,840 --> 00:11:51,760 I think that we're seeing... 204 00:11:53,300 --> 00:11:54,600 Immediately back to the terminal. 205 00:11:54,600 --> 00:11:57,580 When they flip back to the terminal after that. 206 00:11:57,780 --> 00:12:00,920 Check sec, no railroad, NX disabled, no canary, no pie. 207 00:12:00,920 --> 00:12:02,740 I think he sees his path now. 208 00:12:03,280 --> 00:12:06,700 Yeah, I think he's just like, oh my god, I spent all of that time. 209 00:12:06,840 --> 00:12:15,300 Yeah, well, but also there's a lot of excitement because he's just had a breakthrough and he just wants to know how close is the other competitor. 210 00:12:15,300 --> 00:12:18,000 Oh, yeah, he has no idea if they've already found the bug. 211 00:12:18,000 --> 00:12:20,620 If they're building a ROP chain, there's no NX. 212 00:12:20,620 --> 00:12:22,340 I don't know why. 213 00:12:22,340 --> 00:12:26,260 ROP chains, there's always ROP chains when you have no NX. 214 00:12:26,360 --> 00:12:27,980 I think it's just practice. 215 00:12:28,140 --> 00:12:31,660 And especially there's no ASLR in play. 216 00:12:31,780 --> 00:12:37,960 Do you really think that's faster than just, you know, finding one call or like pop call gadget? 217 00:12:38,520 --> 00:12:44,400 Yeah, and if I recall this one, there is a friendly gadget. 218 00:12:44,400 --> 00:12:46,640 Yes, there's a very friendly gadget. 219 00:12:46,860 --> 00:12:51,280 When I verified this challenge, I sent my solution and I looked at the source like, oh, what does this look like? 220 00:12:51,280 --> 00:12:54,360 And I see a comment on it saying, we left this here to be nice. 221 00:12:54,540 --> 00:13:05,780 Yeah, well, like I said, there's a little modification because we really don't want to beat the players up with things that aren't really the core bug here. 222 00:13:05,780 --> 00:13:07,300 And we want this to go fast. 223 00:13:07,300 --> 00:13:09,560 Yeah, these challenges are meant to be solved. 224 00:13:09,560 --> 00:13:11,680 So the challenge is finding the bug. 225 00:13:11,680 --> 00:13:15,800 We might give you, you know, an easy primitive or two to just kind of facilitate. 226 00:13:15,800 --> 00:13:19,080 So you don't need to search the entire binary space, binary search, if you will. 227 00:13:19,540 --> 00:13:22,320 And, you know, find the right primitive to use here. 228 00:13:22,320 --> 00:13:23,840 We just kind of lay it out for you. 229 00:13:24,460 --> 00:13:28,820 Yeah, and it's a line to walk when you're designing challenges. 230 00:13:28,920 --> 00:13:30,740 How easy do you want to make? 231 00:13:30,740 --> 00:13:33,200 What is the real challenge that you want them to solve? 232 00:13:33,200 --> 00:13:43,820 And in this case, it was really just finding that stir copy, understanding what you've got on your hands, understanding the mitigations, and then writing your exploit. 233 00:13:44,120 --> 00:13:46,340 Yeah, so now they're going. 234 00:13:46,940 --> 00:13:52,240 BlueWater is going to be stepping through, figuring out their offsets, and starting to write their exploit. 235 00:13:52,240 --> 00:13:54,300 What is Undefined doing right about now? 236 00:13:54,400 --> 00:13:55,520 Yeah, let's flip over and see. 237 00:13:55,520 --> 00:14:03,560 It looks like they're reversing in the main function, so they're exploring sort of the switch statement that... 238 00:14:03,560 --> 00:14:09,940 This is almost a menu sort of setup, where you've got a switch statement that handles the different kinds of requests. 239 00:14:10,180 --> 00:14:11,520 And there's not a lot, right? 240 00:14:11,900 --> 00:14:20,600 Originally, in the CGC version, there was more stuff, and we kind of commented that out because we didn't want the competitors to have to spend all their time just sort of digging through, you know? 241 00:14:20,600 --> 00:14:21,360 Yeah. 242 00:14:22,220 --> 00:14:29,800 And it looks like Undefined hasn't reached the area of code with the stir copy yet. 243 00:14:30,080 --> 00:14:32,000 Right, they're still labeling. 244 00:14:32,000 --> 00:14:33,740 They're building their understanding. 245 00:14:33,980 --> 00:14:41,540 Now, this might help them in the long run, if they know offsets better, because it looks like BlueWater is over there calculating offsets. 246 00:14:41,540 --> 00:14:52,360 And you can tell, based on what they're looking at, that they're real concerned about linked lists, which are a common source of bugs, mishandling linked lists. 247 00:14:52,380 --> 00:14:54,200 Not in this case, though. 248 00:14:55,600 --> 00:15:05,160 And I think that this is kind of an interesting thing to talk about, because in the CGC, you had these automated competitors that they aren't looking at the binary, right? 249 00:15:05,160 --> 00:15:05,480 Yeah. 250 00:15:05,480 --> 00:15:08,220 They're not reversing or annotating. 251 00:15:08,220 --> 00:15:17,140 They were fuzzing and doing symbolic execution, but they can cover a lot of ground, whereas our competitors here are having to manually reverse engineer and find bugs. 252 00:15:17,140 --> 00:15:20,640 As good as you are, you're, at the end of the day, only one person. 253 00:15:20,640 --> 00:15:21,620 That's true. 254 00:15:21,620 --> 00:15:30,840 I have been hoping to see somebody pull out, you know, a fuzzer or some other extra tooling to try to overcome this. 255 00:15:30,840 --> 00:15:32,260 Oh, I'm really looking forward to it. 256 00:15:32,260 --> 00:15:35,480 But it looks like teams are going to the basics, what they can do the fastest. 257 00:15:36,280 --> 00:15:43,280 And that looks like, you know, GDB with whatever fancy wrapper they want to put on it, Geph or Pwnbag or PETA. 258 00:15:45,120 --> 00:15:47,320 IDA, Ghidra, no Binge yet. 259 00:15:47,700 --> 00:15:48,340 Sad. 260 00:15:48,600 --> 00:15:52,740 But they're going with what they know and what they've been using for the longest time. 261 00:15:52,740 --> 00:16:03,460 Yeah, and I think that the discussion really is, if you have to solve something in only 20, 30 minutes, do you have time to work with something like an anger? 262 00:16:03,460 --> 00:16:04,760 Like, you have to be really practiced. 263 00:16:04,760 --> 00:16:08,560 And there's still a little, you know, finesse involved, unless it pops the answer right out. 264 00:16:08,560 --> 00:16:08,880 Yeah. 265 00:16:08,880 --> 00:16:13,340 Well, we saw yesterday with the final match of the day that teams were racing to build ROP chains. 266 00:16:13,460 --> 00:16:17,700 And one team had a full layout, he had the offsets right, and everything was going right. 267 00:16:17,700 --> 00:16:21,640 And then Pwn Tools kept throwing like, oh, you can't append to a relocated ROP chain. 268 00:16:22,420 --> 00:16:24,800 And he was stuck there for 10 minutes. 269 00:16:24,800 --> 00:16:26,260 We had to go into sudden death. 270 00:16:26,260 --> 00:16:30,420 And then sudden death was a ROP off again, a ROP race. 271 00:16:31,020 --> 00:16:39,300 And, you know, you get these really fancy tools, but if you trip over all their bells and whistles, you might be better off with basics. 272 00:16:39,720 --> 00:16:48,480 Yeah, and I think it's interesting because this isn't actually what you'd see in the real world, so to speak. 273 00:16:48,480 --> 00:16:49,740 This is a competition. 274 00:16:49,740 --> 00:16:53,840 This is testing, pushing people to their limits. 275 00:16:53,860 --> 00:16:59,780 But in a normal situation, if you were looking for bugs and trying to write an exploit, you could really take your time. 276 00:16:59,780 --> 00:17:00,560 Oh, yeah. 277 00:17:00,560 --> 00:17:01,260 No. 278 00:17:01,500 --> 00:17:07,460 I mean, in daily jobs, you know, reliability and undetectability of exploits is one thing. 279 00:17:07,540 --> 00:17:11,580 But CTF code is notoriously messy. 280 00:17:11,580 --> 00:17:19,400 It is built on a pile of commented out things that didn't work, curses, variable names that are just frustration with the author and the challenge. 281 00:17:19,960 --> 00:17:22,140 Yeah, we're looking at BlueWater right now. 282 00:17:22,140 --> 00:17:26,600 The A's and the B's are sort of the classic visual padding. 283 00:17:27,280 --> 00:17:36,160 But , you know, so far I haven't seen a lot of variable names like LOL or HA or WTF, but I've definitely seen that before. 284 00:17:36,160 --> 00:17:38,640 Yeah, a lot of maybe, a lot of underscore IDK. 285 00:17:38,640 --> 00:17:39,500 Yeah, yeah. 286 00:17:39,500 --> 00:17:44,340 But BlueWater is writing in their solution script undefined. 287 00:17:44,340 --> 00:17:47,840 It looks like they're also building out their script. 288 00:17:47,840 --> 00:17:55,940 So they've enumerated that, hey, there's there's a couple of commands here and they've broken down what each command type can take. 289 00:17:55,940 --> 00:17:58,240 So they have the idea. 290 00:17:58,240 --> 00:17:59,680 I don't think that they've seen the bug yet. 291 00:17:59,760 --> 00:18:02,800 Just just based on what we're looking at here. 292 00:18:02,800 --> 00:18:05,080 But they they've got the skeleton going. 293 00:18:05,080 --> 00:18:10,480 It looks like over on BlueWater, they're starting to send their BNSH shellcode. 294 00:18:10,800 --> 00:18:13,000 Yeah, they look like they're pretty close. 295 00:18:13,000 --> 00:18:13,440 Oh, yeah. 296 00:18:13,440 --> 00:18:15,120 And they're going to pack an address. 297 00:18:15,360 --> 00:18:16,800 Oh, do they have their gadget? 298 00:18:16,800 --> 00:18:17,660 Oh, do they? 299 00:18:17,660 --> 00:18:19,140 Oh, the receive buffer. 300 00:18:20,360 --> 00:18:23,620 OK, so they're putting the address of the receive buffer. 301 00:18:23,960 --> 00:18:30,080 But do they have no ASLR in place so they can they can use the binary address? 302 00:18:30,080 --> 00:18:32,500 Yeah, no, no, no, nothing. 303 00:18:32,500 --> 00:18:35,840 But do they have the gadget? 304 00:18:36,800 --> 00:18:39,220 Because, oh, you know what? 305 00:18:39,500 --> 00:18:46,260 They might just put on top of the stack and then, you know, Red will get to it or leave. 306 00:18:46,780 --> 00:18:47,520 Hmm. 307 00:18:47,760 --> 00:18:50,620 I'm not sure exactly. 308 00:18:50,620 --> 00:18:52,020 I think we're seeing them. 309 00:18:52,500 --> 00:18:56,940 I think they're they're they're still exploring here, but they're pretty close. 310 00:18:57,260 --> 00:18:57,800 Oh, yeah. 311 00:18:57,800 --> 00:18:58,740 OK, they're going back. 312 00:18:58,740 --> 00:19:00,240 They're double checking their offsets. 313 00:19:00,240 --> 00:19:02,640 They're making sure they're in the right function here. 314 00:19:04,320 --> 00:19:09,380 OK, and then they have a jump and they're like, but but the leaves should load it. 315 00:19:09,380 --> 00:19:10,760 It should work. 316 00:19:13,060 --> 00:19:15,560 So setting a breakpoint, walking through. 317 00:19:17,060 --> 00:19:19,820 Yeah, and he knows he's so close, right? 318 00:19:19,820 --> 00:19:24,480 This is this is the tense almost to the finish line. 319 00:19:24,480 --> 00:19:26,700 Just got to figure this last bit out. 320 00:19:27,520 --> 00:19:35,520 It looks like he's going to hard code the stack, which will work fine in local execution GDB, but stack address not fixed. 321 00:19:36,360 --> 00:19:37,800 Yeah , yeah, stack addresses. 322 00:19:39,880 --> 00:19:44,680 Not as not your reliable binary gadget here. 323 00:19:44,680 --> 00:19:46,480 Yeah, no, it is not built into the binary. 324 00:19:46,480 --> 00:19:47,860 It is not affected by Pi. 325 00:19:47,860 --> 00:19:49,460 I'm sure it is in some way or another. 326 00:19:51,020 --> 00:19:53,220 OK, so we see the first mean variable name. 327 00:19:56,700 --> 00:19:58,860 All right, so they're building out shellcode. 328 00:19:58,860 --> 00:20:02,500 Yeah, this is starting to look like the code that I wrote to solve this. 329 00:20:05,330 --> 00:20:08,550 Building out padding correctly, making sure everything lines up properly. 330 00:20:08,890 --> 00:20:13,830 And walking through, they're going to get segfaults here, but they're going to know where exactly in their chain they're segfaulting. 331 00:20:13,830 --> 00:20:16,530 It'll give them a better idea where to hone in on that offset. 332 00:20:17,210 --> 00:20:25,110 Yeah, and some of this really is just that iterative try one thing, see where see where we're at, maybe a missed assumption or things just. 333 00:20:25,110 --> 00:20:26,330 Yeah, here we go. 334 00:20:26,330 --> 00:20:28,970 So top of the stack is the address of the receive buffer. 335 00:20:29,350 --> 00:20:34,250 And then it looks like the shellcode isn't being written properly. 336 00:20:35,190 --> 00:20:38,610 Oh, nope, I saw push x68. 337 00:20:38,790 --> 00:20:39,310 OK. 338 00:20:39,310 --> 00:20:40,690 That looks promising. 339 00:20:40,690 --> 00:20:47,030 The SBB, the add, that doesn't look like the shellcode, but looks like they're landing something. 340 00:20:47,130 --> 00:20:48,490 Yeah, they're definitely somewhere. 341 00:20:48,490 --> 00:20:49,750 They're almost there. 342 00:20:49,750 --> 00:20:53,630 Over on undefined, let's see what's going on. 343 00:20:53,630 --> 00:20:55,290 Python solved up high. 344 00:20:55,910 --> 00:20:57,850 OK, so they're printing out receive packet information. 345 00:20:57,850 --> 00:21:00,190 They're still writing an interaction here. 346 00:21:00,190 --> 00:21:02,270 Do they have the query one implemented yet? 347 00:21:02,270 --> 00:21:03,610 I can't see quite that far. 348 00:21:03,610 --> 00:21:07,710 They have a function written to do the query one. 349 00:21:07,710 --> 00:21:14,670 I'm not sure that I've seen them bring that up, though, in terms of looking at it in Ghidra and finding... 350 00:21:14,670 --> 00:21:17,190 Oh, they're going really in-depth in the query all. 351 00:21:17,190 --> 00:21:25,850 Yeah, they're going a little deep on the reverse engineering, and it may cost them because the bug isn't... 352 00:21:25,850 --> 00:21:28,430 It's not too complicated in this case. 353 00:21:30,810 --> 00:21:32,350 But we're seeing them. 354 00:21:33,670 --> 00:21:35,630 They're giving it everything they've got. 355 00:21:35,970 --> 00:21:37,490 They're frantically looking through. 356 00:21:37,490 --> 00:21:44,970 I think the speed that they work at is impressive, but you can also, I think at this point, start to sense a little desperation. 357 00:21:44,970 --> 00:21:47,170 I'm sure that they're feeling, where is the bug? 358 00:21:47,170 --> 00:21:48,210 Where is the bug? 359 00:21:48,210 --> 00:21:49,410 Yeah, they're looking through. 360 00:21:49,410 --> 00:21:55,910 They're getting a really solid understanding of the binary, but they're missing shallow bugs looking for deep ones. 361 00:21:55,910 --> 00:21:57,670 Okay, so hint number one just dropped. 362 00:21:57,670 --> 00:21:59,570 The hints are set up to drop. 363 00:22:00,750 --> 00:22:01,310 Let's see. 364 00:22:01,310 --> 00:22:01,990 What is hint number one? 365 00:22:01,990 --> 00:22:03,710 This is a classic old-school bug. 366 00:22:03,710 --> 00:22:05,530 What a helpful hint, Mark. 367 00:22:11,330 --> 00:22:14,150 When I think of old-school bugs, I think of string bugs. 368 00:22:14,150 --> 00:22:14,610 I don't know about you. 369 00:22:14,610 --> 00:22:15,170 Fair. 370 00:22:16,030 --> 00:22:19,150 String handling bugs, I'm looking at... 371 00:22:19,150 --> 00:22:20,850 Stack buffer overflow, too. 372 00:22:20,850 --> 00:22:21,930 Yeah, stack buffer overflow. 373 00:22:21,930 --> 00:22:23,090 Okay, it is a helpful hint. 374 00:22:23,090 --> 00:22:24,510 I'm not thinking linked list. 375 00:22:24,510 --> 00:22:25,870 I'm not thinking heap. 376 00:22:26,030 --> 00:22:28,190 It's not an IOU ring, but... 377 00:22:28,190 --> 00:22:30,270 There's a stack buffer overflow somewhere. 378 00:22:31,050 --> 00:22:37,370 And for me, I'm looking at strcpy, strcat, hoping something like that. 379 00:22:37,370 --> 00:22:39,390 Any of the classic overflow vectors. 380 00:22:39,390 --> 00:22:40,410 Right, right. 381 00:22:41,890 --> 00:22:56,830 Now, for all of these challenges, we're doing it to try to set them on the right track, especially a case like this, where maybe they're just looking in the wrong spot, and so hint number one is trying to guide them towards the right spot. 382 00:22:56,910 --> 00:23:00,250 And then hint number two is like, okay, here it is, just do this. 383 00:23:00,370 --> 00:23:02,370 Hints released at 20, 35 minutes. 384 00:23:02,370 --> 00:23:04,210 50 minutes, we go into sudden death. 385 00:23:04,490 --> 00:23:06,810 We're setting a hard cutoff on that this year. 386 00:23:06,810 --> 00:23:09,170 We made the mistake last year of being too lenient with it. 387 00:23:10,310 --> 00:23:14,410 But it looks like we're 15, 18 minutes in, somewhere in there. 388 00:23:15,630 --> 00:23:17,770 Yeah, and really, looking at... 389 00:23:18,550 --> 00:23:20,450 That's right, hint drop. 390 00:23:20,450 --> 00:23:24,650 Hint drops automatically, this go around, which is a nice bit of automation. 391 00:23:25,390 --> 00:23:29,510 We're not completely beyond the setting pieces of paper down in front of the competitors. 392 00:23:29,510 --> 00:23:32,210 That is how they connect to the challenge server, yeah. 393 00:23:34,330 --> 00:23:35,870 But going through... 394 00:23:35,870 --> 00:23:42,830 Okay, so blue water is going through making sure they're on the right path, or are they looking for another vector? 395 00:23:43,350 --> 00:23:45,390 Or are they just checking offsets? 396 00:23:45,950 --> 00:23:47,030 Well, they... 397 00:23:47,030 --> 00:23:49,910 And I saw both competitors look at the hint. 398 00:23:51,190 --> 00:23:52,830 And it says it's an old school bug. 399 00:23:52,830 --> 00:23:54,130 They've got a stack buffer overflow. 400 00:23:54,130 --> 00:23:58,630 I think that they're just trying to break down, how do I get to my shellcode at this point? 401 00:23:58,990 --> 00:24:00,210 Yep, looking at gadgets. 402 00:24:00,210 --> 00:24:01,490 Yeah, oh my. 403 00:24:01,910 --> 00:24:05,290 Yeah, that's some ANSI color sequences there. 404 00:24:05,530 --> 00:24:07,070 Yeah, see, that made me ANSI. 405 00:24:10,270 --> 00:24:13,130 Okay, so we're looking for sub-RSPs, right? 406 00:24:13,310 --> 00:24:14,510 Okay, that's the road they're going. 407 00:24:14,510 --> 00:24:17,770 I think that there is a call register. 408 00:24:17,770 --> 00:24:21,310 There is a pop EDI call EDI or something, RDI. 409 00:24:21,310 --> 00:24:22,810 It's not that old school. 410 00:24:22,890 --> 00:24:24,430 Trying to make it easier. 411 00:24:24,430 --> 00:24:32,590 And so if you have that kind of tool, and you're grepping for a call or a jump gadget, it should just pop out at you. 412 00:24:32,590 --> 00:24:35,910 Well, absolutely, but he's looking for what he knows. 413 00:24:36,110 --> 00:24:38,050 He's looking for classic... 414 00:24:38,050 --> 00:24:39,270 That's right. 415 00:24:39,270 --> 00:24:45,150 And if you're used to working on modern exploitation challenges, they're not this easy. 416 00:24:45,150 --> 00:24:47,130 You have to do a little more. 417 00:24:47,230 --> 00:24:51,950 And so they're probably not expecting it as easy of a challenge. 418 00:24:51,950 --> 00:24:56,190 So hopefully as the tournament goes on, we'll see a little bit of that. 419 00:24:56,190 --> 00:24:59,030 Okay, check for the easy thing first, and then maybe... 420 00:24:59,030 --> 00:25:00,390 Yeah, this is a live CTF. 421 00:25:00,390 --> 00:25:01,810 We do want you to solve it. 422 00:25:02,770 --> 00:25:05,030 We really want you to solve it. 423 00:25:06,910 --> 00:25:08,970 Alright, so it looks like... 424 00:25:09,930 --> 00:25:17,290 just building a manual payload here instead of using PwnTool's shellcraft. 425 00:25:18,030 --> 00:25:18,970 Or maybe he'll still use it. 426 00:25:18,970 --> 00:25:20,870 I think it looks like he's... 427 00:25:20,870 --> 00:25:22,530 Oh, he's just figuring out the offsets again. 428 00:25:22,930 --> 00:25:26,810 Playing with the padding, trying to understand what exactly... 429 00:25:26,810 --> 00:25:28,530 Maybe looking for a leak. 430 00:25:30,870 --> 00:25:31,750 Yeah? 431 00:25:34,050 --> 00:25:37,270 They're looking at the output there, seeing what the server sent them. 432 00:25:37,270 --> 00:25:38,530 There's a lot of junk. 433 00:25:39,230 --> 00:25:40,530 It's all randomized. 434 00:25:40,530 --> 00:25:49,090 Again, this challenge was built to be run in a different environment where randomization was handled differently. 435 00:25:49,570 --> 00:25:51,050 These were automated competitors. 436 00:25:51,050 --> 00:25:52,430 They're not reading the output. 437 00:25:52,450 --> 00:25:53,330 No. 438 00:25:53,330 --> 00:25:54,250 It is garbage. 439 00:25:54,250 --> 00:25:58,410 It threw me off a little bit when I was parsing output, and I just got random strings back. 440 00:25:58,410 --> 00:26:00,150 And I'm like, am I parsing this right? 441 00:26:00,150 --> 00:26:02,050 Is it like 7-bit UTF? 442 00:26:02,970 --> 00:26:05,590 But no, it's just completely random strings. 443 00:26:06,530 --> 00:26:07,410 Printable strings. 444 00:26:07,410 --> 00:26:08,470 That's important. 445 00:26:08,670 --> 00:26:09,490 Right, right. 446 00:26:09,490 --> 00:26:12,150 Yeah, that would be mean if we just throw a null byte in there. 447 00:26:12,150 --> 00:26:13,810 They parse it out and early. 448 00:26:14,410 --> 00:26:15,530 Let's switch over to Undefined. 449 00:26:15,530 --> 00:26:16,430 It looks like they... 450 00:26:16,430 --> 00:26:20,510 I have to imagine that's their overflow that they're playing with, with all those A's. 451 00:26:20,510 --> 00:26:24,350 Yeah, it looks like they're stepping through, figuring out where in all those A's they are. 452 00:26:24,810 --> 00:26:29,490 And I gotta say, I'm loving their debugger setup here. 453 00:26:31,690 --> 00:26:34,530 So they're in parse query, it looks like. 454 00:26:34,530 --> 00:26:36,290 Not stepped fully into the query one. 455 00:26:36,290 --> 00:26:38,470 Oh no, parse query has a strcpy, doesn't it? 456 00:26:38,470 --> 00:26:39,630 Or is it in query one? 457 00:26:39,630 --> 00:26:40,330 I forget. 458 00:26:40,450 --> 00:26:41,990 I believe it's query one. 459 00:26:41,990 --> 00:26:45,470 In parse query, I think they're looking at the string handling to try to... 460 00:26:45,470 --> 00:26:50,070 They've got an idea that this is an overflow, so that hint looks like it did give them a little bit of an idea. 461 00:26:50,070 --> 00:26:51,510 Yeah , okay, it was a good hint. 462 00:26:51,530 --> 00:27:01,670 They're looking for overflows, seeing some comments go down, tracking, hey, what are the maximum lengths that can be sent in different places? 463 00:27:01,730 --> 00:27:10,150 And so what that was, that was the parse query, which populates a larger buffer, and then the query one buffer is a stack buffer, which is smaller. 464 00:27:10,150 --> 00:27:12,530 So they're on the right path. 465 00:27:13,090 --> 00:27:14,320 They're looking for that... 466 00:27:14,830 --> 00:27:16,830 Oh, now we see them looking at a strcpy. 467 00:27:16,830 --> 00:27:17,510 Oh. 468 00:27:17,510 --> 00:27:22,990 So they're thinking, hey, is this a strcpy bug, stack overflow? 469 00:27:22,990 --> 00:27:24,450 Right, kind of thinking. 470 00:27:24,650 --> 00:27:25,690 The wrong strcpy. 471 00:27:25,690 --> 00:27:28,090 That strcpy there is an innocuous one. 472 00:27:28,090 --> 00:27:28,490 Yeah. 473 00:27:28,490 --> 00:27:33,770 You can totally use it safely with enough checks or static string buffers. 474 00:27:33,770 --> 00:27:39,990 But if they were to look at the cross references on strcpy, that would drop them right in the right spot. 475 00:27:39,990 --> 00:27:41,090 They would. 476 00:27:41,550 --> 00:27:44,650 So let's see, going into... 477 00:27:44,650 --> 00:27:53,630 So this is the receive until, so just helpful wrappers around the receive function. 478 00:27:53,750 --> 00:27:55,730 Again, this was built in the CGC. 479 00:27:55,730 --> 00:27:59,830 There's a fair bit of scaffolding in play that they had. 480 00:27:59,830 --> 00:28:01,650 They had their own libc. 481 00:28:01,650 --> 00:28:10,790 So the challenge authors then built familiar wrappers commonly to make the challenges look like what we'd expect. 482 00:28:11,270 --> 00:28:17,130 But this is, I think, the competitor trying to understand, okay, what are the limits? 483 00:28:17,530 --> 00:28:19,690 How much exactly is going to be written in that buffer? 484 00:28:19,690 --> 00:28:21,410 Okay, we see the buffer label. 485 00:28:21,410 --> 00:28:23,150 The size is right next to it. 486 00:28:23,150 --> 00:28:30,210 But over on BlueWater, they have rbp414141. 487 00:28:30,210 --> 00:28:32,930 All right, so when we see register control, we know we're close. 488 00:28:32,930 --> 00:28:38,110 Because really, in this case, building a stack buffer overflow, there's only a few steps, right? 489 00:28:38,110 --> 00:28:38,830 Yeah. 490 00:28:38,830 --> 00:28:40,990 So you've got your overflow. 491 00:28:40,990 --> 00:28:43,730 You understand, okay, what registers do I control? 492 00:28:43,810 --> 00:28:46,710 What are the offsets to control those registers? 493 00:28:46,890 --> 00:28:50,090 And then what should I put in each of those? 494 00:28:50,090 --> 00:28:53,670 And what's going to be the easiest way to get shellcode running? 495 00:28:53,670 --> 00:29:00,930 Now, what I'm worried about with BlueWater is they were returning, I think, to the receive buffer, which I think is in BSS. 496 00:29:01,790 --> 00:29:02,650 Oh. 497 00:29:02,650 --> 00:29:08,210 So I'm not sure that that's executable, unless you unprotect it. 498 00:29:08,390 --> 00:29:12,830 That might have just been where they're putting their return address and they pop it and read to stack. 499 00:29:12,910 --> 00:29:14,250 I'm not 100%. 500 00:29:14,970 --> 00:29:18,350 I did see them looking at the virtual memory map. 501 00:29:18,350 --> 00:29:23,970 So they were looking at permissions for readable, writable, etc. 502 00:29:23,970 --> 00:29:25,270 Hopefully, yeah. 503 00:29:26,590 --> 00:29:28,490 I mean, we don't know what's going through their heads. 504 00:29:28,490 --> 00:29:30,290 They could be thinking anything right now. 505 00:29:30,330 --> 00:29:34,470 You could be thinking, man, this would just be so much easier if I can get a UAF in here. 506 00:29:34,870 --> 00:29:35,750 Yeah, yeah. 507 00:29:37,350 --> 00:29:40,410 Their mind may still be on the DEF CON CTF finals, right? 508 00:29:40,410 --> 00:29:45,450 Maybe they've been working on another challenge and this is just total whiplash in terms of... 509 00:29:45,450 --> 00:29:51,450 Yeah, BlueWater sat down and asked, can I unplug from HDMI so I can keep working on the challenge I was working on? 510 00:29:51,450 --> 00:29:52,430 Love that dedication. 511 00:29:52,430 --> 00:29:53,190 Yeah, go for it. 512 00:29:53,190 --> 00:29:54,370 We're going live in a couple minutes. 513 00:29:54,370 --> 00:29:56,670 And he's like, unplug, keep working on the challenge. 514 00:29:56,670 --> 00:29:58,850 I go over and I'm like, we're going live soon. 515 00:29:58,850 --> 00:30:03,310 He's like, okay, cool, plug it back in, close everything down so no other team can see what's going on. 516 00:30:03,310 --> 00:30:03,630 Awesome. 517 00:30:03,630 --> 00:30:11,250 We don't want to leak any DEF CON CTF challenge solution progress, anything about that. 518 00:30:12,250 --> 00:30:18,270 Yeah, it's definitely the case where the competitors know that their screens are being streamed. 519 00:30:18,270 --> 00:30:21,630 Yes, we are very explicit telling them that. 520 00:30:21,630 --> 00:30:23,290 We don't want anyone leaking anything. 521 00:30:23,290 --> 00:30:25,850 No password managers pulled up and they're like, oh yeah, what's my password again? 522 00:30:25,850 --> 00:30:26,930 Pull it up on screen. 523 00:30:27,830 --> 00:30:30,290 RBP, oh, okay, so it looks like he is the offset, right? 524 00:30:30,290 --> 00:30:31,590 RBP is bees now. 525 00:30:32,170 --> 00:30:33,170 Okay, yep. 526 00:30:33,430 --> 00:30:40,210 So he's nailed that offset and now just determining, okay, where do I go from here? 527 00:30:40,210 --> 00:30:41,830 What's the gadget I want? 528 00:30:41,830 --> 00:30:43,610 Can I do something with RBP? 529 00:30:43,610 --> 00:30:48,530 Man, it sure would be great if I had a DRFRSP plus 32 call. 530 00:30:48,870 --> 00:30:54,150 I'm just waiting for him to go back to his gadgets file and look for some friendlier gadgets. 531 00:30:54,150 --> 00:31:00,790 Yeah, you can make do with what he's found so far, but it is not going to be fast. 532 00:31:01,190 --> 00:31:06,070 You need that nice gadget to just kind of expedite the entire process. 533 00:31:06,410 --> 00:31:12,190 Or maybe he'll jump back, you know, call some puts, call printf and get a stack leak, do it that way. 534 00:31:12,270 --> 00:31:14,810 Yeah, and I never count these competitors out. 535 00:31:14,810 --> 00:31:20,630 I fully expect when I write a challenge like this that they are going to come up with some way to solve it that I didn't expect. 536 00:31:20,730 --> 00:31:21,610 Absolutely. 537 00:31:21,610 --> 00:31:24,930 I mean, we've seen that in a couple challenges yesterday. 538 00:31:24,930 --> 00:31:31,730 They were close to intended, but they did, you know, they diverged from the path that we kind of cut for them, that we put in place for them. 539 00:31:31,850 --> 00:31:37,010 And I think that really says that these competitors are all experts in the field. 540 00:31:37,310 --> 00:31:41,130 You know, they understand these things so well that they can go around. 541 00:31:41,130 --> 00:31:43,830 They don't need to walk the path that we kind of laid out for them. 542 00:31:43,830 --> 00:31:49,890 They see something off to the side, traverse that, and it might end up being faster, might end up being slower, but it'll work in the end. 543 00:31:49,890 --> 00:31:52,870 As I say that they're experts. 544 00:31:52,870 --> 00:31:54,570 What does the leave instruction do? 545 00:31:55,730 --> 00:31:57,030 But this is real. 546 00:31:57,030 --> 00:31:58,450 Honestly, it's totally fair. 547 00:31:58,450 --> 00:32:00,510 Every expert uses Stack Overflow. 548 00:32:00,630 --> 00:32:01,810 Tell me you don't. 549 00:32:01,810 --> 00:32:02,770 Tell me you don't, Josh. 550 00:32:02,770 --> 00:32:03,730 I can't. 551 00:32:03,730 --> 00:32:04,270 Well, I could. 552 00:32:04,270 --> 00:32:05,170 I'd be lying. 553 00:32:05,710 --> 00:32:13,050 No, we saw yesterday we had man7.org and Stack Overflow, and I don't know which one is better as far as describing what things do. 554 00:32:13,830 --> 00:32:14,490 Let's take a look. 555 00:32:14,490 --> 00:32:19,490 I think on the undefined side here, he's in the right function. 556 00:32:19,490 --> 00:32:21,130 He's got his cursor on strcpy. 557 00:32:21,130 --> 00:32:25,370 I think that we're watching him live understand. 558 00:32:25,490 --> 00:32:30,230 So he's got the instance buffer, the stack buffer labeled as instance. 559 00:32:30,230 --> 00:32:32,150 He's highlighting the strcpy. 560 00:32:32,150 --> 00:32:34,290 He's like, how big can this be again? 561 00:32:35,290 --> 00:32:38,050 Wait, this is such a small buffer. 562 00:32:38,050 --> 00:32:39,910 Oh, he walked over it. 563 00:32:41,110 --> 00:32:49,370 I'm not sure if he just counted out because there was an innocuous one earlier, and it just kind of blends into the background. 564 00:32:49,370 --> 00:32:53,590 Or if he saw it, and he's just marking stuff around it so he knows what's going on after. 565 00:32:53,650 --> 00:33:03,150 Yeah, perhaps looking for something afterwards that might modify or otherwise change the environment. 566 00:33:03,290 --> 00:33:19,430 But the query being the argument to the query1 function, that is a little bit of a hint that, hey, if he can go back and understand what part of that structure he controls, I mean, he's looking right at it. 567 00:33:19,430 --> 00:33:22,010 So I think we're seeing... 568 00:33:22,010 --> 00:33:24,790 Yeah, rewriting to use the query1, it looks like. 569 00:33:24,790 --> 00:33:34,130 So this competitor is understanding, okay, we've got structures in terms of server name, instance name, and then on the right path. 570 00:33:34,130 --> 00:33:35,810 You know what I'm seeing a lack of? 571 00:33:35,910 --> 00:33:37,750 Type hints in their solve scripts. 572 00:33:37,830 --> 00:33:39,650 It is honestly underrated. 573 00:33:39,650 --> 00:33:48,730 The number of times I pass a string to a function that takes bytes and the encoding gets messed up, or it passes and PwnTools throws a warning that I'm not aware of, UTF fucks everything up. 574 00:33:49,090 --> 00:33:54,070 Like, really, type hints and exploit scripts have saved me so many debugging steps. 575 00:33:54,110 --> 00:34:02,350 Oh, yeah, I mean, the only time in the past year or two that I've written Python without type hints was writing a challenge for this. 576 00:34:02,350 --> 00:34:03,010 Yeah. 577 00:34:03,390 --> 00:34:05,810 Because I didn't want people to figure it out too quickly. 578 00:34:05,810 --> 00:34:07,170 Yeah, yeah. 579 00:34:07,670 --> 00:34:11,470 All right, let's take a look and switch over to Bluewater. 580 00:34:11,470 --> 00:34:12,990 All right, Bluewater. 581 00:34:12,990 --> 00:34:17,430 Looks like they're going in the parse query, looking at the calloc lengths. 582 00:34:20,710 --> 00:34:25,950 I think they haven't seen the nice gadget yet. 583 00:34:26,550 --> 00:34:28,450 Yep, I agree. 584 00:34:28,450 --> 00:34:30,410 I think that there's a... 585 00:34:32,150 --> 00:34:34,750 They might have a technique in mind. 586 00:34:36,970 --> 00:34:38,310 Yeah, so it's hanging. 587 00:34:38,310 --> 00:34:43,230 I wonder if they're just going to run it against and wait for the stack to line up at some nice boundary or something. 588 00:34:43,230 --> 00:34:44,790 I'm not 100% sure. 589 00:34:44,790 --> 00:34:47,390 It looks like they're exploring the other functionality in there. 590 00:34:47,630 --> 00:34:48,070 Interesting. 591 00:34:48,070 --> 00:34:53,530 If I recall, there's only three or four different things you can get the target to do. 592 00:34:53,530 --> 00:34:55,150 Yeah, it's a smaller surface. 593 00:34:55,330 --> 00:35:03,710 Perhaps there's something hidden in the other functions that he wants to use or thinks that might be helpful in terms of... 594 00:35:03,710 --> 00:35:04,450 Yeah. 595 00:35:04,450 --> 00:35:10,610 Now, looking at decompilation, you're not going to see those nice gadgets hidden in there because they're just going to be optimized out in some cases. 596 00:35:10,610 --> 00:35:11,510 They could be dead code. 597 00:35:11,510 --> 00:35:13,690 They could be just unoptimized. 598 00:35:13,830 --> 00:35:16,690 Decompiler throws them away because it's an if-false. 599 00:35:17,150 --> 00:35:18,090 Right, exactly. 600 00:35:18,090 --> 00:35:20,530 And I think that that's the case with this specific gadget. 601 00:35:20,530 --> 00:35:26,290 It was inserted to make life easier, but it's really not in the hot path. 602 00:35:26,290 --> 00:35:29,430 It's not something that you're going to run into just running the binary. 603 00:35:29,670 --> 00:35:43,970 Yeah, and that kind of brings up one of the major downsides of only looking at decompilation is you're looking at this output where all these heuristics, especially in IDA, all these heuristics were being applied that removes things you're not interested in for actual functionality. 604 00:35:44,190 --> 00:35:55,190 But when you're getting down to the actual creation of an exploit, you really need to look at the fine-grained, you know, I have a sub-RSP 32 call. 605 00:35:55,370 --> 00:35:59,250 Like, I have all of these things in dead paths that I can use. 606 00:35:59,250 --> 00:36:03,190 And we saw him looking at ROP gadgets for, you know, a minute maybe. 607 00:36:03,490 --> 00:36:06,410 But he was just searching through for sub-ESPs. 608 00:36:07,190 --> 00:36:12,810 Yeah, yeah, I think that there's a tendency to go with what you know. 609 00:36:12,810 --> 00:36:17,330 And I don't think that Magic Gadget is going to work on this one, right? 610 00:36:17,330 --> 00:36:20,130 So it's like, all right, what's the fallback here? 611 00:36:20,130 --> 00:36:24,510 And that can be challenging if, you know, you're not prepared for it. 612 00:36:24,510 --> 00:36:25,730 You're not expecting it. 613 00:36:25,810 --> 00:36:31,530 I'm wondering if now he's trying to get a libc leak or something and like, oh, just one gadget it, something like that. 614 00:36:31,530 --> 00:36:33,170 But just as easily, there's no NX. 615 00:36:33,170 --> 00:36:34,910 You can get a stack leak and jump to it. 616 00:36:35,650 --> 00:36:40,910 Yeah, I think that at this point, there's... 617 00:36:42,650 --> 00:36:51,190 It's just, it feels like this is one of those parts in the pattern of writing an exploit that automation would help, you know? 618 00:36:51,230 --> 00:36:53,770 Like, suggest a few things. 619 00:36:53,770 --> 00:36:56,510 Because as you said, there's a lot of trust in the tools. 620 00:36:56,510 --> 00:36:58,110 Decompilation, a great example. 621 00:36:59,710 --> 00:37:03,290 You're counting on the tool to show you exactly what's there. 622 00:37:03,290 --> 00:37:14,670 And I think that walking that line of using tools to make you faster and make things that are hard easier is something that I only expect to see more of in the future. 623 00:37:14,670 --> 00:37:19,290 And we see over on Blue Water, they just highlighted the RWX stack. 624 00:37:19,610 --> 00:37:20,690 I don't think they noticed. 625 00:37:20,690 --> 00:37:21,490 Oh, we're back. 626 00:37:21,490 --> 00:37:23,150 We're back in the gadgets. 627 00:37:23,430 --> 00:37:27,650 But at the same time, Undefined was writing their solve script too. 628 00:37:27,650 --> 00:37:30,550 In their solve script, they have hard-coded binary data. 629 00:37:30,550 --> 00:37:32,290 So it looks like they're just fine-tuning. 630 00:37:32,290 --> 00:37:34,930 They're going through with a fine comb now, figuring out where it goes wrong. 631 00:37:34,970 --> 00:37:37,290 Oh, they have a threat to... 632 00:37:37,810 --> 00:37:38,830 Is that a controlled address? 633 00:37:38,830 --> 00:37:39,890 I can't see that far. 634 00:37:39,890 --> 00:37:40,810 Yeah, we've got RSP. 635 00:37:40,810 --> 00:37:41,630 They control RSP. 636 00:37:41,630 --> 00:37:47,150 And you can see the cyclic pattern is going to allow them to calculate exactly what the offset is. 637 00:37:47,210 --> 00:37:48,130 Oh, that's what that was. 638 00:37:48,130 --> 00:37:49,950 They were just pasting cyclic output, maybe. 639 00:37:50,730 --> 00:37:53,610 Yeah, so now they're going through and actually... 640 00:37:53,610 --> 00:37:56,270 And so this is a clever point because even... 641 00:37:56,270 --> 00:38:01,730 It's not just, hey, okay, so you can see that they're putting a known value that's going to go in the return address. 642 00:38:01,730 --> 00:38:06,170 But then after that, seeing, okay, which of these other values ends up in other registers. 643 00:38:06,170 --> 00:38:11,490 So you can understand, hey, each register that I control, this is exactly the offset that's going into it. 644 00:38:11,490 --> 00:38:12,430 Oh, yeah. 645 00:38:13,030 --> 00:38:15,310 And it looks like... Is that dead beef I see over there? 646 00:38:15,450 --> 00:38:19,350 So they've definitely landed the return address overwrite. 647 00:38:19,570 --> 00:38:23,550 And now let's see what their strategy to get execution is. 648 00:38:23,830 --> 00:38:25,650 All right, so are they going to look through gadgets? 649 00:38:25,650 --> 00:38:29,750 Are they going to see any nice leak there? 650 00:38:30,890 --> 00:38:31,770 Not 100%. 651 00:38:31,770 --> 00:38:32,950 It's never guaranteed. 652 00:38:32,950 --> 00:38:39,010 You can be so close to the solution and then overlook one thing, one nice gadget, one win function. 653 00:38:40,570 --> 00:38:42,590 And a hint, too, just came out. 654 00:38:42,670 --> 00:38:48,550 Yeah, I saw somebody checking the live CTF page to see if that hint had dropped. 655 00:38:49,010 --> 00:38:54,550 And I think that we added a timer today so that competitors could see exactly how close they were to getting a hint. 656 00:38:55,190 --> 00:38:59,590 That, I was told, was not 100% not going to break the infra. 657 00:38:59,590 --> 00:39:02,790 So I did not deploy it for first match. 658 00:39:03,070 --> 00:39:07,310 But I told them in person, you know, check back at this time and this time. 659 00:39:07,330 --> 00:39:08,390 There will be hints. 660 00:39:08,390 --> 00:39:09,470 Refresh the page. 661 00:39:09,890 --> 00:39:12,110 But they might be a little too focused on this. 662 00:39:12,110 --> 00:39:13,090 They might not notice it. 663 00:39:13,130 --> 00:39:13,650 Outstanding. 664 00:39:13,650 --> 00:39:16,570 Yeah, the priority is that the infrastructure actually works. 665 00:39:16,730 --> 00:39:17,250 Yes. 666 00:39:17,250 --> 00:39:21,990 I was not about... I waited in line for breakfast, came over here a couple minutes before. 667 00:39:21,990 --> 00:39:22,750 Plug everything in. 668 00:39:22,750 --> 00:39:23,490 Please work, please work. 669 00:39:23,490 --> 00:39:25,570 IP tables routed everything properly. 670 00:39:25,710 --> 00:39:26,590 Container started. 671 00:39:26,590 --> 00:39:27,530 I'm like, yes! 672 00:39:28,810 --> 00:39:31,110 So, undefined. 673 00:39:31,450 --> 00:39:33,450 Hang on, no arch presence. 674 00:39:33,670 --> 00:39:34,750 Are they? 675 00:39:36,170 --> 00:39:37,070 Oh. 676 00:39:38,310 --> 00:39:42,190 I think we're seeing a... Yeah, we're seeing a ret to the receive buffer again. 677 00:39:44,390 --> 00:39:46,730 And so, they're working through. 678 00:39:46,730 --> 00:39:47,950 They've got the overwrite. 679 00:39:47,950 --> 00:39:50,750 They know that they've got the bug. 680 00:39:50,750 --> 00:39:53,250 They're just trying to finish out. 681 00:39:53,250 --> 00:39:57,170 And honestly, BlueWater, if we flip over them, they're looking through gadgets. 682 00:39:57,170 --> 00:40:00,650 They know that they've been closed for a long time. 683 00:40:00,650 --> 00:40:03,870 They see that pop RVP ret, which is pretty nice. 684 00:40:04,030 --> 00:40:04,390 Yep. 685 00:40:04,390 --> 00:40:06,470 But that doesn't give them the stack offset. 686 00:40:06,910 --> 00:40:07,550 Yep. 687 00:40:07,550 --> 00:40:08,930 Yeah, so at this point... 688 00:40:08,930 --> 00:40:10,650 They're just going with full ROP chain. 689 00:40:10,950 --> 00:40:12,750 Well, and that's an option. 690 00:40:14,150 --> 00:40:16,070 I don't know if it is. 691 00:40:16,210 --> 00:40:18,610 Because there's no system call in this. 692 00:40:18,690 --> 00:40:20,490 There's no, like... 693 00:40:20,490 --> 00:40:24,010 Like, I guess if you get lucky and find the syscall ret, right? 694 00:40:24,070 --> 00:40:25,410 That's what it comes down to. 695 00:40:25,410 --> 00:40:27,450 But I don't know if there are any raw syscalls in this. 696 00:40:29,070 --> 00:40:29,910 Good point. 697 00:40:29,910 --> 00:40:31,530 I think... 698 00:40:31,530 --> 00:40:33,690 You know, but it's... 699 00:40:35,350 --> 00:40:38,610 With an overwrite like this, there's... 700 00:40:38,610 --> 00:40:40,770 There's a few things you can do. 701 00:40:40,770 --> 00:40:42,530 If I recall... 702 00:40:42,530 --> 00:40:45,550 It's not null terminated, so you can write... 703 00:40:45,550 --> 00:40:46,250 Oh! 704 00:40:47,750 --> 00:40:49,150 It's... I want to say it's new... 705 00:40:49,150 --> 00:40:49,770 That's pretty nice. 706 00:40:49,770 --> 00:40:51,210 No , it's a strcpy, so it is... 707 00:40:51,210 --> 00:40:52,330 Oh, yeah, yeah, yeah. 708 00:40:52,370 --> 00:40:55,290 Okay, but you can have null-free shellcode pretty easily. 709 00:40:55,290 --> 00:40:57,190 That's not too bad of a constraint. 710 00:40:59,930 --> 00:41:00,510 Let's see. 711 00:41:00,510 --> 00:41:02,430 So they're getting the offset right. 712 00:41:02,430 --> 00:41:04,750 Oh, no, you don't... 713 00:41:05,270 --> 00:41:05,890 No. 714 00:41:05,890 --> 00:41:14,970 I mean, if they're writing a ROP chain, you can just fully ROP to it and probably build binsh that way because you have address of the receive buffer. 715 00:41:14,970 --> 00:41:16,650 You can just send binsh in it. 716 00:41:16,950 --> 00:41:17,330 That's right. 717 00:41:17,330 --> 00:41:19,730 You've got a larger buffer that you can stage stuff. 718 00:41:20,250 --> 00:41:22,150 So they actually... 719 00:41:22,150 --> 00:41:24,390 And it looks like that's what they're trying to do. 720 00:41:25,290 --> 00:41:26,330 Oh , I hope so. 721 00:41:26,850 --> 00:41:28,190 Where is that? 722 00:41:29,730 --> 00:41:33,110 Yeah, so they have padded shellcode on there. 723 00:41:33,110 --> 00:41:37,690 They're putting ROP gadgets after, which are going to be on top of the stack and hopefully RET to it. 724 00:41:37,730 --> 00:41:40,150 And that makes sense with the other... 725 00:41:40,150 --> 00:41:49,910 When they were looking at the other functions, I think that they might have been trying to send data to get it staged somewhere else and then maybe look for references to that data later. 726 00:41:49,910 --> 00:41:58,030 Yeah, but it looks like also that they're sending 7 A's instead of 8, so they still have that leading FD on top of the stack. 727 00:41:58,470 --> 00:42:01,470 So I'm not sure if they see that or if they just see the A's at the end. 728 00:42:01,470 --> 00:42:02,050 Okay, cool. 729 00:42:02,050 --> 00:42:03,190 I'm overriding everything. 730 00:42:06,270 --> 00:42:08,690 Yeah, they see a REX.B. 731 00:42:08,690 --> 00:42:10,470 I don't think that's part of their shellcode. 732 00:42:10,990 --> 00:42:17,590 I just wanted to point out Undefined pulling out the checksec, understanding that there's no mitigations in play. 733 00:42:19,710 --> 00:42:21,470 They're looking for... 734 00:42:21,470 --> 00:42:23,850 How do I get execution? 735 00:42:23,850 --> 00:42:25,250 I've got the strcpy. 736 00:42:25,250 --> 00:42:26,350 They have strcpy. 737 00:42:26,350 --> 00:42:28,010 We saw them get RIP. 738 00:42:28,310 --> 00:42:30,630 They got RIP once at deadbeef. 739 00:42:30,630 --> 00:42:36,710 Okay, so what we're seeing here is looking at ROP gadgets. 740 00:42:36,910 --> 00:42:37,570 Oh, yeah. 741 00:42:37,830 --> 00:42:40,090 And they're looking for RSP gadgets. 742 00:42:40,090 --> 00:42:40,850 Yep. 743 00:42:41,090 --> 00:42:43,230 Which is on the right path. 744 00:42:43,230 --> 00:42:44,350 It's close. 745 00:42:46,710 --> 00:42:52,130 Yeah, you know, parsing these outputs, that wall of text, it's always tough for me. 746 00:42:52,190 --> 00:42:53,990 I always feel like there's got to be a better way. 747 00:42:55,150 --> 00:42:58,510 Oh, this is a tool I haven't seen before on Bluewater. 748 00:42:58,910 --> 00:43:02,070 Disasm.will.gl Oh, this is nice. 749 00:43:02,070 --> 00:43:04,790 It's like a nicer Diffuse CA, honestly. 750 00:43:04,810 --> 00:43:08,830 Diffuse CA is something I go to for just like in-browser disassembly-assembly. 751 00:43:08,830 --> 00:43:10,890 You know, I just want to copy a bunch of bytes out. 752 00:43:11,750 --> 00:43:14,170 Yeah, having little tools like that is... 753 00:43:16,270 --> 00:43:17,230 It's really helpful. 754 00:43:17,230 --> 00:43:22,570 And in competitions like this, really having a number of tools to go to is helpful. 755 00:43:22,570 --> 00:43:28,190 You want to have all the tools in your toolbox that you could possibly need because you never know what's going to come up for a challenge. 756 00:43:29,030 --> 00:43:30,830 Oh, and it looks like... 757 00:43:30,830 --> 00:43:33,270 Okay, so he's looking now. 758 00:43:33,590 --> 00:43:39,670 What opcodes can I use that start with 0x3, the command code in the packet, to get to this path? 759 00:43:42,400 --> 00:43:43,880 Oh, they're both so close. 760 00:43:43,880 --> 00:43:45,960 I just heard mumbles of sudden death. 761 00:43:46,380 --> 00:43:50,400 I'm not sure when we're getting there, but I imagine we're getting close. 762 00:43:50,940 --> 00:43:52,320 Ten minutes? 763 00:43:52,940 --> 00:43:53,600 Eight. 764 00:43:53,600 --> 00:43:55,620 Eight minutes to sudden death. 765 00:43:55,620 --> 00:43:55,960 Wow. 766 00:43:55,960 --> 00:43:59,500 Sudden death, an easier challenge, should be solved fairly quickly. 767 00:43:59,840 --> 00:44:04,600 We did not write all of them last night, but I verified all of them and they work. 768 00:44:04,600 --> 00:44:06,160 Very easy challenges. 769 00:44:06,160 --> 00:44:07,000 Very fast. 770 00:44:07,000 --> 00:44:12,290 Does not require this level of either reverse engineering or this kind of... 771 00:44:13,580 --> 00:44:16,400 these exploitation chops, I guess. 772 00:44:17,140 --> 00:44:23,100 Yeah, and, you know, really hoping to see a solve for this, especially because I feel for the competitors. 773 00:44:23,100 --> 00:44:24,100 Been there. 774 00:44:24,100 --> 00:44:31,480 You know you're so close and you hate to go into sudden death when you know you're just minutes away from a solve. 775 00:44:31,500 --> 00:44:42,720 Yeah, but it looks like over on Blue Water, they're trying to read from an invalid address and that really looks like just random data on the stack. 776 00:44:42,980 --> 00:44:45,320 They're reading to what's in their RBP. 777 00:44:45,320 --> 00:44:47,200 Oh, they're scrolling so fast. 778 00:44:48,840 --> 00:44:51,680 Oh, RBP is argv0. 779 00:44:52,200 --> 00:44:53,780 Or a pointer to argv0. 780 00:44:53,780 --> 00:44:55,820 So they're too far down the stack. 781 00:44:58,060 --> 00:44:58,700 Okay. 782 00:44:58,700 --> 00:45:03,740 Sometimes it just becomes a challenge to follow the thought process because these competitors are so fast. 783 00:45:03,740 --> 00:45:06,240 Oh, and they have five different threads going at once. 784 00:45:06,240 --> 00:45:10,100 Yep, they're trying different ideas, seeing what sticks. 785 00:45:10,480 --> 00:45:11,320 Yeah. 786 00:45:11,320 --> 00:45:17,200 And really, we give a general category of what the challenge is. 787 00:45:17,200 --> 00:45:20,560 So I think this one was old school Pwn as the hint or something like that. 788 00:45:20,560 --> 00:45:23,040 Or as the category we give the competitors. 789 00:45:23,360 --> 00:45:26,180 So outside of that, they don't have anything. 790 00:45:26,180 --> 00:45:32,840 They don't know whether to send, you know, the guy that wrote House of Blue 42 or whatever. 791 00:45:33,160 --> 00:45:46,600 Yeah, there's we try to set them up this go around with information at least categorical so that they can say, hey, you're better at heap challenges, you're better at stack challenges. 792 00:45:47,200 --> 00:45:49,920 And we see that second... 793 00:45:49,920 --> 00:45:53,660 Second hint, query 1 uses strcpy was the hint. 794 00:45:53,660 --> 00:45:55,320 Both competitors already there. 795 00:45:55,320 --> 00:45:56,280 Already knew that, yeah. 796 00:45:56,280 --> 00:45:58,920 So I don't think hint 2 is going to be that helpful. 797 00:45:58,920 --> 00:46:01,600 I mean, really, at this point, they have everything they need. 798 00:46:01,980 --> 00:46:06,520 You know, we're not going to say, oh yeah, this gadget is at this offset. 799 00:46:06,760 --> 00:46:08,160 That's so incredibly free. 800 00:46:08,160 --> 00:46:09,580 They need to know what they're looking for. 801 00:46:09,580 --> 00:46:12,840 They need to have an idea of what they need next in the exploit chain. 802 00:46:13,760 --> 00:46:19,220 But it looks like they're getting hung up on kind of how do I get a leak? 803 00:46:19,540 --> 00:46:20,340 True, true. 804 00:46:20,340 --> 00:46:25,940 I mean, yes, we could have put the hint as maybe this gadget would be helpful. 805 00:46:25,940 --> 00:46:29,400 And I think that both of these competitors honestly would really appreciate that right now. 806 00:46:29,400 --> 00:46:33,100 Then it would just be a race to see who can type in that address faster. 807 00:46:33,100 --> 00:46:35,100 It's just monkey type at that point. 808 00:46:36,560 --> 00:46:45,960 I think on the undefined side, we're seeing some PwnTools use that they're resolving symbols to get those addresses automatically. 809 00:46:46,360 --> 00:46:57,180 I think that that's I'd love to see the power users of libraries, frameworks, tools and see how they can make their lives easier. 810 00:46:57,180 --> 00:47:00,440 Because I really feel like that should be faster. 811 00:47:00,440 --> 00:47:03,860 Oh yeah, PwnTools has a lot of great bells and whistles on it. 812 00:47:03,860 --> 00:47:07,380 It has a lot of great functionality for mundane tasks. 813 00:47:07,860 --> 00:47:09,980 Like calculating offsets, working from a base . 814 00:47:09,980 --> 00:47:12,560 You don't need to have some libc base variable in there. 815 00:47:12,560 --> 00:47:16,760 You can just load the elf setBaseAddress once and then work relative to that with symbols. 816 00:47:16,760 --> 00:47:17,880 It's really nice. 817 00:47:18,740 --> 00:47:26,080 Yeah, and this this RobGadget interaction that they're doing is very cool. 818 00:47:26,080 --> 00:47:27,680 I don't think I've seen this tool. 819 00:47:27,920 --> 00:47:30,180 Yeah, so what tool are they using? 820 00:47:30,180 --> 00:47:31,400 I can't read there. 821 00:47:32,260 --> 00:47:35,280 RpLin64 could be a custom tool. 822 00:47:35,280 --> 00:47:36,060 Oh, it could be. 823 00:47:36,100 --> 00:47:37,680 I'm a fan of like Ropper. 824 00:47:37,680 --> 00:47:39,200 RopGadget is a classic. 825 00:47:39,200 --> 00:47:58,600 Well, I think actually what we were seeing was a grep output that they could scroll through and highlight lines, which was... Yeah, we have or we had in RPiSec a tool called Grepper, g-r-e-p-r that would do RopGadget search and then provide a nice live filterable view of all the gadgets and you can use like regexes in there. 826 00:47:58,600 --> 00:47:59,700 It's really nice. 827 00:47:59,700 --> 00:48:01,740 Yeah, stuff like that. 828 00:48:01,740 --> 00:48:12,640 I mean, it seems simple but you put enough of these simple tools put them together and it makes your life easier, which equates to faster solve. 829 00:48:13,100 --> 00:48:19,940 Hopefully it does because we see so close we see blue... 830 00:48:19,940 --> 00:48:20,980 Oh, wait. 831 00:48:21,880 --> 00:48:24,340 Alright, so they're looking for pops still. 832 00:48:24,840 --> 00:48:32,480 Over on blue water we also saw them looking at that pop rbp ret call or gadget again. 833 00:48:32,620 --> 00:48:34,980 Yeah, they're both looking for that. 834 00:48:35,020 --> 00:48:46,740 Yeah, but because they've got control over rbp That's going to put them maybe in some random invalid address because there's just data after that before their buffer. 835 00:48:46,740 --> 00:48:52,840 They really need that that stack ink or deck I forget which one it is. 836 00:48:52,840 --> 00:48:53,900 I think it's ink. 837 00:48:56,850 --> 00:49:08,630 Yeah, and this is this is tough because you never know what exactly is going to be the gadget that's going to do it for you going in and everything's easy to look at in retrospect, right? 838 00:49:08,630 --> 00:49:09,350 Oh, yeah. 839 00:49:09,350 --> 00:49:11,970 No, CTF is a lot about making do with what you have. 840 00:49:11,970 --> 00:49:16,730 And you can easily accept that all you have are the gadgets and the binary. 841 00:49:16,730 --> 00:49:18,190 There aren't any nice ones there. 842 00:49:18,190 --> 00:49:20,710 But at least take a cursory look. 843 00:49:21,150 --> 00:49:21,630 Oh! 844 00:49:21,630 --> 00:49:23,290 Move racks rsb. 845 00:49:23,290 --> 00:49:24,470 Add racks. 846 00:49:24,670 --> 00:49:25,450 Oh! 847 00:49:25,450 --> 00:49:28,050 Okay, he found the nice gadget. 848 00:49:28,590 --> 00:49:29,270 4019fd. 849 00:49:29,270 --> 00:49:30,770 My favorite address. 850 00:49:31,530 --> 00:49:32,970 It's up there in me. 851 00:49:32,970 --> 00:49:37,070 It's like it's in the top 4 billion, I want to say. 852 00:49:37,070 --> 00:49:37,510 Yeah. 853 00:49:37,670 --> 00:49:38,550 Roughly. 854 00:49:40,770 --> 00:49:42,610 At least the 32 bit. 855 00:49:43,410 --> 00:49:45,770 So this is exactly what we talked about. 856 00:49:46,370 --> 00:49:53,590 They're going back to the gadgets, finding the thing that's going to make their life easier and I think at this point it's just a matter of time. 857 00:49:53,590 --> 00:49:54,530 Oh yeah. 858 00:49:54,530 --> 00:49:57,750 So it looks like BlueWater found the nice gadget they're working through. 859 00:49:57,810 --> 00:50:01,830 That pop is going to take them exactly to the beginning of their overflow. 860 00:50:01,990 --> 00:50:05,430 So it should just be as simple as inserting shellcode after that. 861 00:50:05,430 --> 00:50:07,110 Almost like it was made that way. 862 00:50:07,330 --> 00:50:08,290 Imagine. 863 00:50:08,370 --> 00:50:10,470 Alright, let's take a look at Undefined. 864 00:50:11,090 --> 00:50:13,310 Looking through stack addresses here. 865 00:50:13,310 --> 00:50:15,850 Trying to understand what they control. 866 00:50:15,850 --> 00:50:18,090 What this pointer specifically is looking at. 867 00:50:18,090 --> 00:50:21,430 You know, the pop, rut kind of gadgets. 868 00:50:22,670 --> 00:50:24,810 They're looking to see if that's useful for them. 869 00:50:25,170 --> 00:50:25,650 They are. 870 00:50:25,650 --> 00:50:28,990 And then over on BlueWater, they're on the stack. 871 00:50:29,310 --> 00:50:30,530 And I see that syscall instruction. 872 00:50:30,530 --> 00:50:32,210 I see push0x3b syscall. 873 00:50:32,210 --> 00:50:32,990 They walk through it. 874 00:50:32,990 --> 00:50:35,190 They just have registers set up wrong it looks like. 875 00:50:35,190 --> 00:50:36,670 I couldn't see quite in time. 876 00:50:39,110 --> 00:50:41,810 So they might just have offset 1. 877 00:50:41,810 --> 00:50:44,090 Might be missing the first instruction in that chain. 878 00:50:44,090 --> 00:50:46,970 Could just be a XOR of like RCX or something. 879 00:50:47,050 --> 00:50:50,390 Yeah, I saw that they were using the PwnTools built-in shellcode. 880 00:50:50,430 --> 00:50:52,810 So probably not any mistakes there. 881 00:50:52,810 --> 00:50:54,550 No , it's very thorough. 882 00:50:54,550 --> 00:50:55,410 It's verbose. 883 00:50:55,410 --> 00:51:03,230 But making sure that that came through untouched, you know, completely valid, that looks like what they're doing there. 884 00:51:03,230 --> 00:51:06,890 Yeah, I don't know if PwnTools shellcode actually has nullbytes in it. 885 00:51:07,330 --> 00:51:08,990 It might have nullbytes. 886 00:51:10,390 --> 00:51:13,690 Which would really break this flow here. 887 00:51:13,690 --> 00:51:14,930 Because it would stop reading the string. 888 00:51:14,930 --> 00:51:16,630 But no, it got to the syscall. 889 00:51:16,630 --> 00:51:18,150 So it can't have nullbytes in there. 890 00:51:18,150 --> 00:51:19,290 So there's the call. 891 00:51:19,290 --> 00:51:21,730 He's looking at this. 892 00:51:21,730 --> 00:51:22,470 Alright. 893 00:51:22,470 --> 00:51:24,630 Oh yeah, that's... 894 00:51:26,050 --> 00:51:27,390 ESPDI REF RSP. 895 00:51:27,390 --> 00:51:29,850 Probably doesn't want that at the beginning of his shellcode. 896 00:51:30,190 --> 00:51:31,210 Does he? 897 00:51:32,150 --> 00:51:33,930 I don't know. 898 00:51:33,930 --> 00:51:36,510 Oh, and I just got word that we're heading to sudden death. 899 00:51:36,510 --> 00:51:38,330 We're heading to sudden death? 900 00:51:40,870 --> 00:51:41,750 No! 901 00:51:42,570 --> 00:51:44,410 He's on his shellcode! 902 00:51:46,630 --> 00:51:47,510 Oh my gosh. 903 00:51:47,930 --> 00:51:49,050 No! 904 00:51:49,410 --> 00:51:50,850 Oh, don't save the database. 905 00:51:50,850 --> 00:51:52,130 You can feel it. 906 00:51:52,130 --> 00:51:53,650 That's so upsetting. 907 00:51:53,930 --> 00:51:56,330 Oh, he's deleting the challenge. 908 00:51:57,170 --> 00:51:58,930 Oh, that's so sad. 909 00:51:58,930 --> 00:52:01,430 He was walking through his shellcode. 910 00:52:02,950 --> 00:52:04,430 But we mentioned... 911 00:52:04,430 --> 00:52:06,270 I made sure to mention 50 minutes. 912 00:52:06,270 --> 00:52:07,830 We're going to sudden death. 913 00:52:07,830 --> 00:52:10,330 That is so sad. 914 00:52:10,330 --> 00:52:16,450 So we're having some technical difficulties with the camera here on our end, but... 915 00:52:16,970 --> 00:52:20,150 Oh, so we're just going to stay on bracket view for a bit. 916 00:52:20,670 --> 00:52:22,830 I don't know which way this is going to go. 917 00:52:23,090 --> 00:52:24,870 Undefined was working slowly through it. 918 00:52:24,870 --> 00:52:26,750 They were about to find the gadget, I'm sure. 919 00:52:26,790 --> 00:52:28,350 BlueWater just found it. 920 00:52:28,350 --> 00:52:30,530 Yep, they were just looking through gadgets again. 921 00:52:30,530 --> 00:52:31,410 Oh man. 922 00:52:32,610 --> 00:52:34,450 Oh, that's... 923 00:52:36,190 --> 00:52:37,550 You know that... 924 00:52:37,550 --> 00:52:43,010 It wasn't guaranteed to go one way or another because BlueWater was just starting to debug where they were jumping to. 925 00:52:43,010 --> 00:52:44,510 I think that they were very close. 926 00:52:44,510 --> 00:52:48,450 You saw them highlighting the first instruction in their payload and it was just... 927 00:52:49,830 --> 00:52:52,690 As far as I know, bad. 928 00:52:52,690 --> 00:52:54,130 It was just a bad instruction. 929 00:52:54,530 --> 00:52:57,370 Well, not bad instruction, but it was bad instruction to have in your payload. 930 00:52:57,470 --> 00:52:59,270 It wasn't the right instruction.