[00:00.000 --> 00:13.710] Hello, everyone. Welcome back to live CTF. We are on the third round of the second day. [00:14.030 --> 00:17.410] My name is Zita2, or Carl, and I'm here with Vy. [00:17.410 --> 00:23.610] Hi, I'm Vy Weiss. Yeah, excited to be here. Scorpio Sun. So, let's go. [00:23.610 --> 00:30.690] Nice. So, we have a match here between Shellfish and Pigbuttsad, and we're just going to get the match started [00:30.690 --> 00:34.750] and we will talk more about the teams and the challenge they are solving. [00:34.750 --> 00:37.690] So, I'm just going to check a quick OK there. Yes? [00:37.690 --> 00:45.190] So, we'll start the match. Let's do a countdown in 5, 4, 3, 2, 1. Let's go. [00:45.350 --> 00:48.670] Awesome. So, we are off to the races. [00:49.290 --> 00:55.730] So, yeah, the first thing that will happen is that the teams download the challenge and start looking at it. [00:56.560 --> 01:01.270] Well, it's going to be interesting to see what various tools they will be using. [01:01.870 --> 01:07.410] We have here, as I said, Pigbuttsad and Shellfish. [01:08.070 --> 01:17.830] Although, we just learned before the match started that the player from Pigbuttsad is at... is it ASU? [01:17.950 --> 01:20.890] Yes, ASU, where Shellfish is from. [01:20.890 --> 01:24.610] Right, so it's kind of like, you know, internal battle. [01:25.890 --> 01:32.570] And, yeah, let's switch over to just look at Pigbuttsad's screen. [01:32.690 --> 01:35.890] OK, they're interacting with the challenge, just seeing what it is. [01:35.890 --> 01:40.430] Already opened in IDA, finding the right function right now. [01:40.430 --> 01:40.950] Right. [01:40.950 --> 01:43.590] It looks like a string format, possibly. [01:44.010 --> 01:44.890] Right. [01:44.890 --> 01:45.890] OK, so... [01:45.890 --> 01:50.150] So we have a classic, like, pawn challenge with, like, a menu. [01:50.210 --> 01:52.330] You can choose various options. [01:52.770 --> 01:57.730] You can see them highlighting these, like, core functions here, like the delete message, edit message. [01:57.730 --> 02:01.770] OK, there's a const char star being casted there. [02:01.870 --> 02:07.750] OK, so for more details, it's a messaging type of menu, so there'll be some user input, it looks like. [02:09.270 --> 02:10.010] Yeah. [02:10.150 --> 02:12.830] We can have a look at Shellfish. [02:12.830 --> 02:18.530] So on their side, we also see IDA also doing, like, the initial reversing. [02:18.750 --> 02:28.330] Looks like they're looking at a little bit of a different part of the code, just tidying up the types, which are a bit messy initially. [02:29.310 --> 02:31.050] Yeah, so... [02:31.050 --> 02:40.850] They're finding the size of the buffer over here at Pigbuttsad, doing initial reconnaissance to find the inputs for any type of function writing to it. [02:40.850 --> 02:48.590] Right. So we see both the teams going for a pretty... starting out with the static analysis, doing, like, the decompilation and so on. [02:48.590 --> 02:55.730] And we've seen throughout the event, you know, the amount of time people spend on the initial, like, static analysis [02:55.730 --> 02:59.610] before they go to kind of, like, the dynamic analysis differs quite a lot. [02:59.610 --> 03:04.390] Like, some people like to do quite a lot of reversing before they start trying exploiting, [03:04.390 --> 03:08.950] and some people just do, like, a very cursory look before they, you know, bring out, like, a debugger and so on. [03:08.950 --> 03:12.350] Oh, that's interesting. So, you know, both teams just went to static analysis first. [03:12.350 --> 03:12.650] Right. [03:12.650 --> 03:13.890] Like, spending a few minutes here. [03:13.890 --> 03:17.470] Yeah. And I mean, I think most of them do that, like, initially. [03:17.470 --> 03:17.630] Yeah. [03:17.630 --> 03:22.190] But we'll see how long they stay here before they start writing some exploits code. [03:22.190 --> 03:22.850] Yeah. [03:24.030 --> 03:32.290] Pigbuttsad is very fast with searching, finding, getting the function pointers, focusing on... [03:32.290 --> 03:38.450] Right. So we have some kind of structure here being defined. [03:38.450 --> 03:44.630] Kind of, like, reconstructing this. Is it, like, a message struct, I think? [03:44.630 --> 03:52.670] Yeah. It looks like there might be different fields to a message, a message head area. We'll see what they can do with that. [03:52.670 --> 04:03.690] Right. And it's a little bit interesting with the... Okay, there it looks starting to look a bit better once you start defining these types. [04:03.690 --> 04:09.450] And, you know, this helps you get a clear, you know, understanding of what's going on. [04:09.630 --> 04:10.350] Yeah. [04:10.490 --> 04:13.770] We can switch over to Shellfish. [04:13.770 --> 04:17.750] Interesting. So Shellfish is actually putting comments in their IDA output. [04:17.750 --> 04:27.870] And you can see they wrote overflow there. So it seems like they have, well, potentially found the bug. [04:27.950 --> 04:28.170] Yeah. [04:28.830 --> 04:32.930] And, you know, now they're trying maybe to figure out how do you get there. [04:32.930 --> 04:36.850] Yes. Yeah. Did you see where they had overflow? Which function? [04:36.850 --> 04:39.670] I think it was the same function that we were looking at before. [04:39.670 --> 04:46.410] Yes. But I'm not entirely sure. You can see there, like, they called something like a maybe next. [04:46.850 --> 04:50.790] Which is, I think, a good strategy. Like, sometimes, you know, you're not completely sure. [04:50.930 --> 04:54.690] You write something, but you make a note to make sure that, like, you know, don't trust this too much. [04:55.910 --> 05:02.870] Yeah. In a limited time, you just keep going. Pigbuttsad instead of comments, just renaming variables, cleaning up everything. [05:03.170 --> 05:03.750] Right. [05:05.090 --> 05:10.330] Yeah. So they're looking at the string compares right now. [05:10.330 --> 05:18.610] Okay. So there's bad words. So it seems in this challenge, it's a message one, but it seems like there's going to be certain words you can't say as the bad word. [05:18.610 --> 05:23.990] And so that might be kind of where we'll want to put any type of payload or bypass there. [05:24.290 --> 05:28.670] So it'll be interesting to see what the bad words are as well as we go through the challenge. [05:28.670 --> 05:35.230] So you can see that big hex constant there. It looked very much in the printable ASCII range. [05:35.230 --> 05:40.070] So there was probably a string that was incorrectly interpreted as a number. [05:40.210 --> 05:43.130] And now we can see some interaction with the binary again. [05:43.130 --> 05:45.830] To be honest, this is how I know that they're kind of competent. [05:45.830 --> 05:49.630] Like, I would just spam the binary. I would just be interacting with it at first. [05:49.850 --> 05:52.290] They're really trying to be more methodical. [05:53.050 --> 06:00.450] And yeah, it's over three minutes in, and they haven't really interacted much with the binary, just spending time. [06:00.450 --> 06:08.670] Yeah, taking their time. It's a big challenge, the kind of meta game or the strategy here. [06:11.150 --> 06:18.250] Because you want to go quick, but if you rush it too much, you might get tangled up in these go-downs. [06:18.250 --> 06:21.590] It might become very messy, and you might actually lose time in the end. [06:21.590 --> 06:23.550] Yeah, for sure. [06:24.490 --> 06:32.490] Okay, so Pigbuttsad is figuring out where the pointers are going to, where the function pointers are going to. [06:32.630 --> 06:35.510] How is Shellfish doing over there? [06:35.510 --> 06:38.970] Right, so here we actually start seeing some exploits. [06:38.970 --> 06:39.410] Oh, they start writing. [06:39.410 --> 06:43.750] Yeah, so you can see here they're using Python with PwnTools. [06:43.750 --> 06:45.650] You know, the popular choice. [06:45.650 --> 06:45.830] Very standard. [06:45.830 --> 06:54.810] And they are kind of defining a new, I guess this is like a new message, this whole interaction with the program. [06:54.810 --> 06:59.210] They're writing these helper functions to make it easy to write these things. [06:59.970 --> 07:05.950] So it looks like they are, you can see there they put hack is probably a bad word. [07:05.950 --> 07:06.290] Yes. [07:07.190 --> 07:08.150] Controversial. [07:09.090 --> 07:10.830] Hacking is not a crime. [07:10.830 --> 07:16.450] But yeah, so it looks like, you know, they already have their string initially being constructed. [07:16.450 --> 07:19.190] They're going to start sending a payload over. [07:19.190 --> 07:23.990] Maybe they're going to send it a few times and try and debug it that way, see what the response is. [07:23.990 --> 07:26.730] But it's interesting that Shellfish is already doing that. [07:26.730 --> 07:34.850] Meanwhile, this team is, they're doing a great job, like really commenting everything, knowing what pointer is doing what. [07:35.370 --> 07:38.870] And so this is clean, very clean what they're doing. [07:38.870 --> 07:41.870] Yeah, so this is kind of what we were talking about. [07:42.830 --> 07:46.510] Shellfish went for starting writing the exploit a bit faster. [07:46.510 --> 07:50.630] And then it's like, was it the right timing or was it too fast? [07:50.630 --> 07:54.770] And will it end up costing them or is it going to give them the win? [07:54.770 --> 07:55.610] Absolutely. [07:55.630 --> 07:59.710] Versus going through the binary more thoroughly. [08:02.070 --> 08:08.090] So this seems like a very basic string sanitization type of bug. [08:09.930 --> 08:15.510] So this seems like a really good beginner CTF if anyone's watching and wants to take notes. [08:15.510 --> 08:23.390] We should actually point that out, that all of the challenges that we run here throughout the event, we will be publishing them. [08:23.390 --> 08:30.430] So if you want to try these things out, we will actually also post all the times that the participants had. [08:30.430 --> 08:37.970] So if you want to try to benchmark yourselves against these very, very good players, there will be a possibility to do so as well. [08:39.270 --> 08:44.370] So right now, Pigbuttsad's focusing on the delete message function here. [08:44.830 --> 08:47.470] What's Shellfish looking at right now? [08:47.470 --> 08:51.470] Switching over to Shellfish, I see that... [08:51.470 --> 08:53.630] Yeah, so you can see that it was very quick. [08:53.630 --> 08:58.150] But in their solve script, they have this thing to create a new message. [08:58.150 --> 08:59.570] And they put in these bad words. [08:59.570 --> 09:03.030] And this is actually the exact right way to go. [09:03.730 --> 09:07.910] Because if I remember correctly, maybe you looked into this more. [09:07.910 --> 09:15.710] The point is that when a bad word gets filtered, it gets replaced by something that's longer. [09:15.710 --> 09:24.030] So it will expand the size of your message, which will eventually overflow the buffer that it's located in. [09:24.570 --> 09:30.030] And you can see that they're concatenating... [09:30.030 --> 09:32.050] Sorry, my eyes are bad. [09:32.690 --> 09:35.110] Yeah, so they're creating new messages. [09:35.110 --> 09:39.270] Those messages don't have any bad words, those are just big sequences of A's and B's. [09:39.270 --> 09:47.130] Yeah, getting padding in to try and make it the right size already without having to have that penalty for writing the bad word. [09:47.130 --> 09:53.330] Exactly. But the interesting thing is that it seems like they're listing out the messages. [09:53.330 --> 09:57.090] And you can see that long sequence of B's, but there were some garbage characters at the end. [09:57.090 --> 10:01.490] So that would kind of suggest that that is a leak. [10:01.490 --> 10:04.970] So maybe they need that for the exportation part. [10:04.970 --> 10:10.550] Are there any Unicode characters or any type of certain interesting characters or just random ones? [10:10.550 --> 10:12.010] Yeah, it looked just like random. [10:12.010 --> 10:19.830] So I suspect this is like you make a message that's just the right amount and then it will print out stuff afterwards. [10:20.530 --> 10:22.770] So a very simple stack overflow there. [10:22.770 --> 10:23.370] Yeah. [10:23.370 --> 10:29.330] And so, oh wow, we have some very nice Python happening over here with pigbuttsad. [10:29.330 --> 10:32.410] Yeah, so they have these templates for their script. [10:32.410 --> 10:35.290] And this is actually kind of cool, you can see that the teams are prepared, right? [10:35.290 --> 10:43.270] Because you have these short two, three-letter functions that are used to just make it faster to type these scripts. [10:44.070 --> 10:45.850] That's very methodical. [10:47.650 --> 10:50.370] They're just encoding the strings to send over to... [10:51.630 --> 10:55.850] There's a GDB attach function that they'll be filling out soon. [10:55.850 --> 10:56.370] Right. [10:57.770 --> 11:01.590] I think it's really cool, they come prepared with these kind of templates. [11:01.590 --> 11:05.590] And I've even heard some teams have been practicing. [11:05.670 --> 11:12.610] They took the challenges from last year and used it as a way to train their speed-pwning abilities. [11:12.610 --> 11:14.650] So teams are definitely taking it seriously. [11:14.650 --> 11:21.490] Here you can see, you hack using one of the bad words and posting just a lot of these bad words. [11:21.490 --> 11:28.030] Yeah, and that's interesting. Instead of doing random characters for getting the padding before a hack, it's just using hack the whole time. [11:29.430 --> 11:32.650] So this means that... [11:33.650 --> 11:40.330] I would say that it seems a little bit like pigbuttsad kind of caught up to Shellfish here with this. [11:40.330 --> 11:41.190] Very quickly. [11:41.190 --> 11:44.630] Yeah, so I think it's a very, very close race. [11:44.650 --> 11:48.890] You can see they're grabbing some offsets from Ida. [11:50.690 --> 11:55.010] And I actually don't know what that command was in GDB. [11:56.170 --> 11:58.910] But that's going to be interesting to see. [11:59.870 --> 12:03.530] And now they are running this with the debugger. [12:03.950 --> 12:05.870] They're just checking the breakpoints. [12:05.870 --> 12:06.850] Yeah. [12:08.770 --> 12:16.530] And that's interesting, the offset he found so quickly in Ida, really doing some nice static analysis paid off there. [12:16.530 --> 12:25.170] Yeah, just putting a breakpoint there to be able to analyze the exploit here. [12:25.170 --> 12:28.310] And you can see those hack, hack, hack messages. [12:29.870 --> 12:34.730] Yeah, so it's a pretty close race here, I would say. [12:37.870 --> 12:40.350] It's not sure exactly what they're doing right now. [12:40.350 --> 12:44.730] But if we look here again at Shellfish, I think they have a very clean exploit script here. [12:44.730 --> 12:49.950] You can see these helper functions for, I think it's like a new message, edit message, delete message. [12:49.950 --> 12:50.670] Yeah, right. [12:50.850 --> 12:54.330] And using these to interact. [12:54.330 --> 12:57.230] So here you can see, it's very nice because it's easy to follow. [12:57.230 --> 13:00.130] Like, oh, they're creating two new messages, deleting one, editing one. [13:00.130 --> 13:02.330] There's some sequence of operation there. [13:02.330 --> 13:03.210] It's nice to follow. [13:03.210 --> 13:05.450] So I appreciate that as a commentator here. [13:05.450 --> 13:07.830] Yeah, absolutely. It's very clean. [13:08.190 --> 13:11.710] And they were able to really quickly find the sanitization function. [13:11.710 --> 13:14.670] They were able to do this very quickly. [13:14.870 --> 13:15.550] Yeah. [13:16.790 --> 13:22.770] And if we go back to Pig again, still doing some debugging. [13:23.070 --> 13:27.490] It looks like now they are in some... [13:27.490 --> 13:33.330] Yeah, I was trying to see where they were doing the break, but I couldn't quite make it out. [13:33.330 --> 13:35.450] Yeah, it's kind of going fast there. [13:35.450 --> 13:36.750] It's going very fast. [13:37.230 --> 13:40.430] So the players, they sit behind us here, behind a wall. [13:40.430 --> 13:47.530] And I've seen some of the matches, like the speed at which they are just typing the stuff is insane. [13:53.090 --> 13:57.610] Oh, so there we can see, on the right side there, you saw the deleted. [13:57.610 --> 13:58.730] The words being removed. [13:58.730 --> 14:05.950] Yes, and then since the string deleted is longer than the string hack, this is what causes the bug. [14:09.430 --> 14:13.190] And they are stepping through the sanitize function. [14:14.630 --> 14:17.510] A lot of stepping to get to the right place. [14:17.510 --> 14:19.050] Yeah, just tapping the button. [14:19.050 --> 14:22.230] Yeah, that's... [14:25.890 --> 14:32.250] We have, if we switch over to Shellfish again, you can see that they run the check sec thing. [14:32.310 --> 14:36.390] And they highlight, I saw the player highlighting the NX enabled. [14:37.370 --> 14:38.650] Oh, here you can see... [14:38.650 --> 14:43.710] You can see the 41, so you can see their payload, the padding for the A's starting. [14:43.710 --> 14:50.510] And trying to maybe figure out the various addresses and offsets, just checking that what ends up in memory [14:50.510 --> 14:54.650] corresponds to what they would expect from their exploits. [14:55.290 --> 14:57.230] This is really classic debugging. [15:00.610 --> 15:03.710] Pigbuttsat is going back and checking... [15:06.680 --> 15:08.920] Right, so it looks like they have... [15:08.920 --> 15:13.440] I'm just trying to see where they are putting their breakpoints. [15:13.440 --> 15:17.000] Because you saw that they were analyzing some contents of the memory there. [15:17.040 --> 15:20.280] But I couldn't quite make out where that was. [15:20.280 --> 15:23.240] It was like in the string comparison stuff. [15:25.420 --> 15:31.960] Oh, at first I thought the word was misspelled, but it's just backwards. [15:32.060 --> 15:33.860] The endian miss. [15:35.920 --> 15:39.000] The deleted endian is backwards, it's great actually. [15:39.000 --> 15:41.100] That's a good team name, Dateled. [15:41.100 --> 15:44.600] If you want to join, we're looking for members. [15:45.840 --> 15:49.360] Have you played any CTFs recently? [15:49.360 --> 15:53.220] Oh man, we did a Hack the Box CTF recently at work. [15:53.220 --> 15:54.600] It was really wholesome. [15:55.060 --> 15:57.460] That's a very good CTF. [15:57.460 --> 16:01.740] It was like a VM reversing challenge, which was nice. [16:02.160 --> 16:05.140] I recommend that as just a really relaxing one too. [16:05.140 --> 16:06.260] What about you? [16:07.260 --> 16:11.220] I'm mostly retired from playing. [16:11.220 --> 16:12.540] I organize a bunch of stuff. [16:12.540 --> 16:15.920] I do every year play the Flareon group. [16:16.560 --> 16:20.080] Hopefully that one should be coming up right now in a few weeks. [16:20.080 --> 16:21.460] I'm looking forward to that. [16:21.460 --> 16:23.000] Hopefully that happens. [16:23.880 --> 16:28.040] Other than that, I've been more organizing than playing the competitions. [16:28.040 --> 16:30.100] When was the last Defcon CTF you played? [16:30.280 --> 16:31.600] Village or main? [16:31.600 --> 16:38.920] I founded NorseCode in 2019. [16:39.200 --> 16:42.960] I played the two COVID years of the Defcon CTF. [16:42.960 --> 16:45.800] I've never played the Defcon CTF on site. [16:46.840 --> 16:50.520] I think it was Defcon 2018. [16:51.480 --> 16:55.480] There was an RMV8x86 polyglot. [16:55.480 --> 16:58.980] Some of the challenges in 2018 were pretty nasty. [16:58.980 --> 17:02.380] It must have been 20 and 21 that I played. [17:02.380 --> 17:04.420] Those were the COVID years. [17:05.300 --> 17:11.360] We can check in with PigBatSat again. [17:13.380 --> 17:15.200] NorseCode is here playing. [17:18.220 --> 17:22.960] That's a good segue to mention that we are running two matches in parallel. [17:23.660 --> 17:27.980] We are commentating this one between Shellfish and PigBatSat. [17:27.980 --> 17:32.980] We also have a match between BlueWater and NorseCode. [17:33.340 --> 17:37.880] They are playing the same challenge, but off-stream. [17:40.280 --> 17:43.440] We have some more debugging action going on here. [17:45.660 --> 17:51.040] Just making sure that the start of the payload is being put in the right place. [17:51.980 --> 17:59.720] He is using hexadecimal 6-2s to figure out where he needs to... [17:59.720 --> 18:02.540] He is left-adjusting the padding. [18:02.540 --> 18:05.220] I love seeing an L-adjust and a right-adjust. [18:07.840 --> 18:11.080] Using every single convenience function. [18:11.080 --> 18:12.860] The built-in Python ones. [18:12.860 --> 18:14.780] To your fullest advantage. [18:16.120 --> 18:16.760] And... [18:17.600 --> 18:19.280] Yeah, it's... [18:19.960 --> 18:22.220] Also here looking at... [18:22.220 --> 18:28.080] Double-checking the memory mappings to find offsets. [18:30.820 --> 18:32.780] Yeah, it's... [18:34.660 --> 18:36.020] Switching things up. [18:36.020 --> 18:39.860] They got rid of the hack words for now. [18:39.860 --> 18:44.420] Maybe they needed to take a step back and check some of their assumptions. [18:44.420 --> 18:47.180] Where things are located. [18:47.180 --> 18:50.560] He is writing another function here for just editing the message. [18:50.560 --> 18:51.700] Okay, yeah. [18:52.040 --> 18:56.620] Similar to what Shellfish did over here. [18:56.940 --> 19:01.220] You have these helper functions for managing your messages. [19:01.220 --> 19:08.460] To not have to repeat so many things in the exploits. [19:09.280 --> 19:15.880] I feel like the Shellfish exploit code looks very similar to... [19:16.580 --> 19:20.780] Not much has changed, I feel, since we looked at it a moment ago. [19:20.780 --> 19:22.400] But hopefully they've been gathering some... [19:23.320 --> 19:26.840] Debugging, looking at GDB, setting breakpoints as well. [19:27.800 --> 19:30.020] So they've written GDB attached to... [19:30.020 --> 19:32.420] That was part of the template that sadbutpig had. [19:32.420 --> 19:34.740] Yeah, definitely they came prepared. [19:37.140 --> 19:40.820] So pigbuttsad is going back to hack and using the word hack. [19:40.820 --> 19:42.960] But now they just have it in their payload. [19:42.980 --> 19:49.200] So to simplify it, they made their payload just be the hack bytes. [19:51.780 --> 19:53.380] Sending that over. [19:54.400 --> 19:55.740] Right, now there's... [19:56.560 --> 19:59.520] Yeah, I think something went wrong there. [19:59.520 --> 20:03.300] Maybe there was a very large amount of outputs. [20:03.300 --> 20:08.320] Yeah, it might be on the size for the 100 hexadecimal. [20:08.360 --> 20:12.280] What size of A's and B's are they sending over there? [20:12.280 --> 20:13.080] Also 100? [20:13.080 --> 20:15.440] Yeah, so Shellfish, I think it was... [20:15.440 --> 20:17.300] I've seen various things in their code. [20:17.300 --> 20:19.320] Let's see if they switch back to it. [20:19.500 --> 20:22.040] I've seen 100, 200... [20:22.040 --> 20:28.220] But you can see there's a read call there, reading hex 100 characters. [20:28.640 --> 20:32.360] And that's what they're sending there in their two new calls. [20:32.360 --> 20:34.340] So, you know, the size is down. [20:34.340 --> 20:36.480] It seems like the verbiage is down. [20:36.480 --> 20:40.060] It's just really getting the right hexadecimal values in the right places. [20:40.160 --> 20:42.140] Which is all CTF. [20:42.800 --> 20:46.520] You put the hex in the right memory addresses and then you get it. [20:46.600 --> 20:48.560] You know, the good bytes, the bad bytes. [20:48.880 --> 20:51.480] The medium bytes, they're all here. [20:53.140 --> 20:55.720] But yeah, let's go back to... [20:55.720 --> 20:57.880] So, yeah, Pigmetat is still debugging. [20:57.880 --> 21:00.260] A lot of A's, a lot of B's we're seeing. [21:02.860 --> 21:05.560] I wish I knew the hexadecimal for hack. [21:05.560 --> 21:07.400] That would make this a lot helpful. [21:07.540 --> 21:09.800] Do you have YouTube comments? [21:10.140 --> 21:11.640] Oh, yeah, we should have. [21:11.640 --> 21:13.460] If someone knows hack... [21:14.420 --> 21:16.000] 69, maybe? [21:16.000 --> 21:18.360] Yeah, so 69, 41... [21:19.200 --> 21:21.060] No, 41 is the capital. [21:21.160 --> 21:22.440] So it's 61. [21:22.440 --> 21:24.100] Oh, true, 61, yeah. [21:26.400 --> 21:29.540] We know how to do the alphabet really easily. [21:29.800 --> 21:30.380] 68. [21:31.020 --> 21:33.360] 68, 61, I think, would be the start. [21:33.360 --> 21:34.340] And then 63. [21:34.340 --> 21:37.140] Wow, great reverse engineering. [21:37.440 --> 21:40.000] I feel like this is like a hexadecimal class. [21:40.000 --> 21:41.220] Like an intro comp sci. [21:41.220 --> 21:42.280] You have to convert. [21:42.280 --> 21:45.300] Hello, kids, today we're learning about hexadecimal. [21:47.980 --> 21:49.740] We'll go to decimal next. [21:49.740 --> 21:51.620] So make sure everyone knows 1 to 10. [21:51.620 --> 21:53.380] Or 0 to 9, really. [21:53.880 --> 21:56.220] And then next week is binary. [21:56.980 --> 21:58.460] Or homework, maybe. [21:58.460 --> 21:59.640] We'll give homework. [21:59.640 --> 22:01.180] That's what this is. You can do this at home. [22:01.180 --> 22:02.540] The challenges are in GitHub. [22:03.300 --> 22:05.780] They will be on GitHub. [22:11.620 --> 22:13.820] A lot of single-stepping again. [22:15.600 --> 22:18.460] So hack is going... [22:19.700 --> 22:22.060] Copying and pasting the offsets from Ida. [22:22.120 --> 22:23.900] Putting the breakpoint there. [22:26.100 --> 22:27.080] All right. [22:27.080 --> 22:28.800] So now... [22:28.800 --> 22:31.500] They stopped right at the return instructions. [22:31.500 --> 22:33.580] Maybe they were looking at the stack layout. [22:33.580 --> 22:36.680] At the point of executing the return. [22:36.680 --> 22:36.900] Yeah. [22:37.680 --> 22:40.300] They're right by RBP, RSP. [22:43.060 --> 22:44.260] Yeah. [22:45.800 --> 22:46.400] It's... [22:46.400 --> 22:50.400] I really feel like both the teams are kind of on to it. [22:50.400 --> 22:52.540] They have the pieces. [22:52.540 --> 22:53.660] But then, like you said, [22:54.500 --> 22:55.860] doing this fiddling [22:55.860 --> 22:57.860] and getting things just right [22:57.860 --> 23:00.940] can be a big challenge. [23:00.940 --> 23:04.360] And especially in this stressful context. [23:04.360 --> 23:05.540] And that's so realistic. [23:05.540 --> 23:07.520] Because I feel like when you have a code base, [23:07.520 --> 23:08.700] finding the bug is easy. [23:08.700 --> 23:11.420] Exploiting is way more difficult sometimes. [23:12.280 --> 23:12.820] So... [23:12.820 --> 23:14.980] Yeah, this is really realistic, I think, [23:14.980 --> 23:17.660] of anyone doing a sanitized [23:18.780 --> 23:19.720] string buffer [23:19.720 --> 23:22.300] overflow situation here. [23:22.300 --> 23:23.340] Yeah. [23:23.400 --> 23:26.140] I do have a notification [23:26.140 --> 23:28.300] here that NorseCode... [23:29.080 --> 23:29.980] Let me just [23:29.980 --> 23:31.880] confirm this. [23:32.540 --> 23:33.760] This is breaking news. [23:34.260 --> 23:36.140] We're getting messages. [23:37.200 --> 23:38.200] So NorseCode [23:38.200 --> 23:40.060] did win the match that [23:40.060 --> 23:41.560] we are not commentating. [23:41.560 --> 23:43.200] The other match that's running in parallel. [23:43.260 --> 23:45.020] Great job to them. [23:45.800 --> 23:47.300] Do you feel like a father to the team? [23:47.300 --> 23:48.520] Because you found it? [23:49.100 --> 23:49.620] It's... [23:49.620 --> 23:52.380] You know, father sounds [23:52.380 --> 23:53.980] maybe a bit important. [23:53.980 --> 23:56.340] Maybe it's like the drunk uncle. [23:57.500 --> 23:58.220] Something like this. [23:58.740 --> 24:00.040] Every CTF team. [24:00.040 --> 24:01.740] Or like the old grandpa [24:01.740 --> 24:04.180] who still thinks they're relevant. [24:05.420 --> 24:07.040] That's why we're here. [24:07.380 --> 24:07.900] Yeah. [24:08.600 --> 24:10.520] Like, well, back in my day... [24:11.260 --> 24:11.940] Yeah. [24:13.400 --> 24:14.140] Something like that. [24:14.140 --> 24:16.420] No, but I have some good friends in the team. [24:16.420 --> 24:17.820] For example, the guy [24:18.260 --> 24:20.240] who did play the match for NorseCode. [24:20.620 --> 24:21.500] Yeah, a close friend of mine. [24:21.500 --> 24:24.100] So, of course, I'm very happy for them doing well [24:24.100 --> 24:26.260] in this CTF. [24:26.680 --> 24:28.300] Yeah, definitely cheering for them. [24:28.380 --> 24:30.400] Although I have some colleagues from work [24:30.400 --> 24:32.220] in some of the other teams as well. [24:32.300 --> 24:34.080] Oh, so it's like you're [24:34.080 --> 24:36.040] conflicted. How's that doing for you? [24:36.040 --> 24:38.620] Is that why you're the drunk uncle and not just the uncle? [24:38.620 --> 24:40.080] You have, like, the children. [24:40.380 --> 24:42.880] Your nephew's over there. Your niece is there. [24:43.400 --> 24:43.560] Oh, yeah. [24:43.560 --> 24:45.000] No, it's like... [24:45.000 --> 24:47.540] I mean, I like the people [24:47.540 --> 24:48.120] in NorseCode. [24:49.580 --> 24:51.680] I was not expecting them to... [24:51.680 --> 24:53.940] I was expecting them to do okay. [24:53.940 --> 24:55.440] But then suddenly they're [24:55.440 --> 24:57.340] performing pretty well and they're in fifth place [24:57.340 --> 24:58.700] in the overall main event. [24:58.700 --> 25:01.280] So now I have to actually cheer for them. [25:02.100 --> 25:03.620] So that's super cool to see. [25:03.620 --> 25:05.200] Set your expectations low. [25:05.200 --> 25:06.720] I think that's kind of moral. [25:07.600 --> 25:09.220] Tip of the day. [25:10.500 --> 25:11.100] Yeah. [25:11.100 --> 25:12.460] I know your alphabet. [25:14.260 --> 25:15.480] Yep. [25:15.480 --> 25:17.760] Let's check in with Shellfish here. [25:17.760 --> 25:19.220] They are going [25:19.220 --> 25:20.820] back and forth a bit [25:20.820 --> 25:23.080] with AIDA and [25:23.080 --> 25:24.960] the debugger. Looks like [25:24.960 --> 25:27.100] they are trying [25:27.960 --> 25:29.120] to... I'm not sure [25:29.120 --> 25:30.960] looking at the sizes of these buffers [25:30.960 --> 25:33.140] or something. I don't quite [25:33.140 --> 25:34.740] understand the code that's going. [25:34.740 --> 25:37.080] They just got the address for [25:37.080 --> 25:39.080] where the return happens. [25:39.080 --> 25:40.840] I think they're going to put a breakpoint there. [25:40.840 --> 25:42.660] That's definitely what's happening. [25:42.720 --> 25:45.120] This is really cool over with PigButtSAD. [25:45.320 --> 25:47.240] Using GDB, they've [25:47.240 --> 25:48.620] got the offsets. [25:48.940 --> 25:51.000] They saw where strcpy is getting [25:51.000 --> 25:52.880] called, where puts is being called. [25:52.880 --> 25:53.700] And now they're just putting [25:55.320 --> 25:55.840] that [25:57.420 --> 25:58.480] value that ends with [25:59.080 --> 26:00.880] 4028 into RDI. [26:01.380 --> 26:02.700] So now we're finally seeing [26:02.700 --> 26:04.840] some registers be called in their [26:04.840 --> 26:05.900] Python scripts. [26:05.900 --> 26:07.760] A small ROP chain being put [26:07.760 --> 26:08.700] together here, which [26:09.680 --> 26:11.440] could indicate that they are [26:11.440 --> 26:12.640] close. [26:12.960 --> 26:15.900] Let's see who gets ripped first. [26:16.400 --> 26:17.800] This is exciting, actually. [26:17.800 --> 26:18.740] Look what you have. [26:19.320 --> 26:21.840] There was a bunch of nullbytes on the stack [26:21.840 --> 26:23.720] there, I think. Yeah, right at the RET instruction. [26:23.720 --> 26:25.840] So there's something that's slightly off [26:25.840 --> 26:27.740] because they got a nullbyte at [26:27.740 --> 26:29.720] the RET location. [26:29.760 --> 26:31.520] And now there are only two... [26:31.520 --> 26:33.600] Well, there's only one nullbyte before there were three. [26:33.600 --> 26:35.700] So they're slowly adjusting... [26:35.700 --> 26:37.560] I think it's the number of bad words or [26:37.560 --> 26:39.760] something. So I feel like they are [26:40.700 --> 26:41.400] close. [26:41.500 --> 26:42.960] So he called searchmem [26:43.440 --> 26:45.240] to see... [26:45.240 --> 26:46.720] That went too fast. [26:47.620 --> 26:49.160] Okay, so... [26:50.880 --> 26:51.640] Okay, and so [26:51.640 --> 26:53.620] they have the bitmask in the payload [26:53.620 --> 26:55.380] too. They're [26:55.380 --> 26:58.300] trying to make sure everything lands in the right place. [27:01.000 --> 27:01.560] So... [27:01.560 --> 27:02.380] They're getting the length [27:02.380 --> 27:04.200] of the payload. I'm starting to get excited [27:04.200 --> 27:06.500] here now. I feel like [27:06.500 --> 27:07.900] they could be [27:07.900 --> 27:10.320] one small step [27:10.320 --> 27:12.000] away from... [27:12.000 --> 27:14.180] They're close to popRDI here. [27:14.400 --> 27:15.520] Yeah. [27:16.220 --> 27:18.140] Let's see. They're doing some small [27:18.140 --> 27:20.320] adjustments. You see some subtracting [27:20.320 --> 27:23.240] some stuff from the payloads. [27:23.920 --> 27:24.840] So, yeah. [27:24.840 --> 27:25.900] Cool, simple wrap [27:25.900 --> 27:27.540] chain based [27:27.540 --> 27:29.760] exploit for this. This would be a really cool [27:29.760 --> 27:31.920] wrap chain beginner on GitHub if anyone [27:31.920 --> 27:33.480] wants to do this. I think [27:34.160 --> 27:35.620] for a lot of these challenges, because [27:35.620 --> 27:37.720] we wanted to be able to solve it within the [27:37.720 --> 27:39.740] 15 minutes we have, I think we [27:39.740 --> 27:41.700] have been fairly generous. Sometimes we put [27:41.700 --> 27:44.160] some very useful gadgets. [27:44.460 --> 27:45.900] Yeah, so they calculated a little bit [27:45.900 --> 27:47.660] of an offset there. Yeah. [27:47.660 --> 27:48.700] They got the base address [27:49.580 --> 27:51.900] going. Oh, they weren't sure [27:51.900 --> 27:54.000] if it was going to be a plus or minus, I think. [27:54.000 --> 27:56.600] So, yeah. [27:56.600 --> 27:56.780] It's [27:59.500 --> 28:00.060] very [28:00.060 --> 28:00.760] close. [28:01.740 --> 28:03.300] How's Shellfish doing? [28:03.300 --> 28:05.920] Let's go back at Shellfish. This is so [28:05.920 --> 28:08.160] exciting. Pigbuttsat is almost [28:08.160 --> 28:10.080] getting it. We'll have to have one eye over on that screen. [28:10.080 --> 28:11.820] Okay, you do that. [28:14.420 --> 28:15.920] It seems like [28:15.920 --> 28:18.080] the Shellfish player is flailing around [28:18.200 --> 28:20.080] a little bit with a bunch of typos in the terminal. [28:20.080 --> 28:22.200] Maybe the stress is getting... [28:22.200 --> 28:23.720] Oh, right. He's running RopGadget. [28:23.720 --> 28:26.200] He's trying to find some convenient [28:27.780 --> 28:28.580] RopGadget. [28:28.580 --> 28:30.580] He dumped that out. [28:34.480 --> 28:35.980] That would suggest [28:35.980 --> 28:38.040] that they're about to [28:38.040 --> 28:39.040] put [28:39.660 --> 28:41.620] some RopChain together. [28:41.880 --> 28:43.820] In Pigbuttsat, they have [28:43.820 --> 28:46.220] 0xDeadBeef right now in their RopChain. [28:46.220 --> 28:48.520] Oh, so they're using this as a [28:48.520 --> 28:49.920] marker thing to make sure [28:49.920 --> 28:51.320] that they know [28:52.220 --> 28:53.940] that if they put this somewhere [28:53.940 --> 28:55.780] in memory and they find where it ends up in memory [28:55.780 --> 28:56.420] and then they can [28:57.840 --> 28:59.520] use this as a marker. [28:59.920 --> 29:00.780] That's where the SearchMem [29:01.800 --> 29:03.360] command is super helpful. [29:04.460 --> 29:05.860] I think they're doing a great job [29:05.860 --> 29:07.820] manually backtracing and [29:07.820 --> 29:09.900] figuring out... [29:09.900 --> 29:11.860] You could see that they were close, but it was something [29:11.860 --> 29:13.960] that was a little bit off. You have to backtrack [29:14.140 --> 29:14.860] a little bit. [29:15.560 --> 29:18.140] This is like a blog post [29:18.140 --> 29:20.080] of they already edited everything. [29:20.080 --> 29:22.380] They know exactly what they're doing. No mistakes. [29:22.380 --> 29:24.120] I haven't seen any typos. [29:24.120 --> 29:26.100] I feel bad for you. If typos are [29:27.560 --> 29:28.080] happening... [29:28.080 --> 29:29.700] Someone should get him a lemonade. [29:29.800 --> 29:31.200] Maybe we should. [29:31.680 --> 29:32.460] Yeah. [29:34.660 --> 29:35.700] And still [29:37.220 --> 29:38.080] there's the null [29:38.080 --> 29:39.840] byte there when they're at the red instruction. [29:39.840 --> 29:40.440] Something is [29:42.100 --> 29:43.820] misaligned or something with their [29:43.820 --> 29:45.160] exploits. [29:45.160 --> 29:47.340] It must be very stressful [29:47.340 --> 29:48.900] knowing that you are this close. [29:48.900 --> 29:51.060] You don't know how far along the other [29:51.060 --> 29:52.580] player is. [29:53.740 --> 29:55.020] But it seems like everything [29:55.020 --> 29:56.860] is so smart, right? [29:56.860 --> 29:58.940] It's not like there's that much lag time. [29:58.940 --> 30:01.160] There's constant typing for him. [30:01.480 --> 30:02.820] With Shellfish, [30:02.820 --> 30:04.780] let's spend some more time here. [30:04.780 --> 30:06.480] I feel like we've spent so much time with PigBot 7. [30:06.920 --> 30:08.900] They are now putting together the [30:08.900 --> 30:10.800] ROP chain here. They used [30:10.800 --> 30:12.940] ROP Gadget before, which is a tool to find [30:13.960 --> 30:14.900] ROP Gadgets [30:14.900 --> 30:16.980] in a binary. They dumped it to a text file. [30:16.980 --> 30:18.820] Looking through this and picking [30:18.820 --> 30:21.100] and choosing the various things you can see here. [30:21.100 --> 30:22.740] They're using this one [30:23.400 --> 30:24.460] PopRDI RET [30:24.460 --> 30:26.900] Gadget here. They're building up this [30:26.900 --> 30:28.360] ROP Chain. [30:28.800 --> 30:31.040] You can see a few lines below. [30:31.040 --> 30:33.080] They have the start of the payload [30:33.080 --> 30:34.920] to trigger the [30:34.920 --> 30:35.840] vulnerability. [30:36.340 --> 30:38.580] Then they add on [30:38.580 --> 30:39.920] the ROP Chain [30:39.920 --> 30:41.800] at the end there. [30:43.100 --> 30:43.540] Very [30:44.860 --> 30:46.180] methodical here. [30:46.620 --> 30:47.940] Great comments too. I like how [30:47.940 --> 30:50.160] they have PopRDI RET [30:50.160 --> 30:51.460] for what they're looking at. [30:52.340 --> 30:53.940] Not just making the Gadget, [30:53.940 --> 30:55.860] they're showing exactly what instructions they [30:55.860 --> 30:58.060] want to start using for their ROP Chain. [30:58.200 --> 30:59.940] I think this is really cool to see. [31:00.540 --> 31:02.180] A moment ago, I felt [31:02.180 --> 31:04.120] like PigBot 7 was a little bit behind [31:04.120 --> 31:05.820] with the ROP Chain and stuff. But then [31:05.820 --> 31:08.120] something went wrong and they had to debug this. [31:08.120 --> 31:09.820] Now, Shellfish is [31:09.820 --> 31:10.800] writing this. [31:10.920 --> 31:13.540] If they can land this without [31:14.120 --> 31:15.940] too big of an issue, [31:15.940 --> 31:17.720] they might be able to catch up [31:17.720 --> 31:19.700] and overtake them again. [31:19.700 --> 31:22.180] It's a really, really close race here. [31:28.340 --> 31:30.600] At PigBot 7, they're still using [31:30.600 --> 31:32.540] 0xDeadBeef to find where in [31:32.540 --> 31:34.640] memory they're at right now. [31:34.640 --> 31:36.380] They're so close to getting the [31:36.380 --> 31:37.380] right return address [31:37.380 --> 31:39.840] and being put [31:39.840 --> 31:41.080] in the right place. [31:45.120 --> 31:47.720] To recap a little bit for the listeners, [31:47.720 --> 31:49.420] the idea here is that you have [31:49.540 --> 31:51.400] a message and you put bad words [31:51.400 --> 31:53.420] into it. The bad words [31:53.420 --> 31:55.640] can be short and they get replaced by a [31:55.640 --> 31:57.880] longer word, which expands [31:57.880 --> 32:00.200] your message and pushes the end. [32:00.200 --> 32:02.560] Eventually, it will overflow a buffer. [32:02.560 --> 32:03.520] The approach would be [32:03.520 --> 32:04.980] you put a bunch of bad words [32:04.980 --> 32:06.940] and then an appropriate amount [32:06.940 --> 32:08.980] of padding to align everything, [32:08.980 --> 32:10.540] and then your ROP chain. [32:10.540 --> 32:12.720] You have to align this up so that [32:12.720 --> 32:14.380] the thing expands [32:14.740 --> 32:16.440] just the right amount of [32:17.620 --> 32:18.260] bytes [32:19.360 --> 32:20.840] to put your [32:20.840 --> 32:22.960] ROP chain in the correct place. [32:27.600 --> 32:32.720] We can see there's definitely something going wrong. [32:32.720 --> 32:33.160] You can see here, [32:33.160 --> 32:35.800] now they have aligned it. [32:35.800 --> 32:37.360] You can see they are at the RET instruction [32:37.360 --> 32:40.760] and the top is one of their gadgets, [32:40.760 --> 32:42.160] I believe. [32:43.460 --> 32:44.500] That's very [32:45.180 --> 32:46.220] significant. [32:47.040 --> 32:48.840] PopRDI is a great gadget [32:48.840 --> 32:50.340] to start using there. [32:53.720 --> 32:56.000] This is so close. [32:56.000 --> 32:56.540] Really? [32:56.620 --> 32:58.320] If we switch over to Shellfish... [32:58.320 --> 33:00.420] They are typing the same words, basically. [33:00.720 --> 33:02.740] I like how with Shellfish [33:02.740 --> 33:05.140] you can see the way they are naming it. [33:05.140 --> 33:07.520] They are getting the base address of the library. [33:07.520 --> 33:09.000] This is a very academic [33:09.000 --> 33:10.920] tutorial way to write it. [33:10.920 --> 33:13.060] This is export code [33:13.680 --> 33:15.560] that I really like. [33:16.200 --> 33:17.120] Not too [33:17.120 --> 33:18.740] different from how [33:18.740 --> 33:20.140] I like to write it. [33:20.140 --> 33:22.220] You have some [33:22.220 --> 33:23.920] log statements, proper variable [33:23.920 --> 33:25.580] names, the whole thing. [33:25.580 --> 33:28.040] Of course, that might not necessarily be [33:28.040 --> 33:29.860] the most efficient way in a speed [33:29.860 --> 33:31.620] pwning setting like this. [33:31.620 --> 33:34.500] On the other hand, [33:34.500 --> 33:36.180] doing a methodical [33:36.180 --> 33:38.080] approach and making sure you do everything right [33:38.080 --> 33:39.900] can save you costly [33:39.900 --> 33:40.960] mistakes. [33:41.980 --> 33:43.960] There's something to be said. You want to be [33:43.960 --> 33:46.080] super careful with subtracting [33:46.080 --> 33:48.080] the right base address to the function [33:48.080 --> 33:50.120] address that you're looking for. [33:50.120 --> 33:50.840] Right. [33:51.980 --> 33:53.080] Yeah. [33:53.340 --> 33:56.180] They have BNSH already written. [33:56.200 --> 33:57.320] Yes. [33:58.700 --> 34:00.000] I think [34:00.000 --> 34:01.640] they could... [34:01.640 --> 34:03.960] It's so close here. [34:04.120 --> 34:05.860] They're doing maybe some final debugging. [34:05.860 --> 34:07.060] Could we possibly see [34:07.860 --> 34:09.860] this working? I want to [34:09.860 --> 34:12.120] just look at them for a short [34:12.120 --> 34:13.800] moment more here [34:13.800 --> 34:16.080] to see if things [34:16.080 --> 34:17.720] are... Oh, look. [34:17.720 --> 34:18.860] You have the RET [34:18.860 --> 34:22.120] that was pointing at the [34:22.120 --> 34:23.720] ROP address. Sorry. [34:23.720 --> 34:26.040] The ROP chain was on the [34:26.040 --> 34:27.660] stack at the RET address. [34:27.660 --> 34:30.420] It really looks like they are right there. [34:30.420 --> 34:31.420] Yeah. [34:33.400 --> 34:35.460] Oh, and now they are [34:36.080 --> 34:38.160] duplicating the... [34:38.160 --> 34:39.680] Interesting. [34:39.920 --> 34:42.440] They're duplicating getting their shell. [34:43.060 --> 34:43.900] They have [34:43.900 --> 34:45.180] the SHN system. [34:45.520 --> 34:46.960] Oh, actually, that was [34:47.560 --> 34:49.740] very interesting. The first ROP [34:49.740 --> 34:51.640] chain goes [34:51.640 --> 34:52.960] back to main. [34:53.500 --> 34:55.480] Wow, this is pretty... [34:56.240 --> 34:57.500] It looks like they're doing [34:57.500 --> 34:59.320] one ROP chain... To overwrite [35:00.700 --> 35:01.700] the entry point [35:01.700 --> 35:02.700] of the message? [35:04.920 --> 35:05.720] I don't know. [35:05.720 --> 35:07.340] Because that first ROP chain [35:07.340 --> 35:09.280] ends with the main symbol, so it would [35:09.280 --> 35:10.980] jump back to main and essentially [35:10.980 --> 35:13.600] restart the program. [35:13.720 --> 35:14.120] And then [35:14.940 --> 35:17.460] Ewing is doing some kind of leak. [35:17.720 --> 35:19.100] And then... Oh, I think this [35:19.860 --> 35:21.020] is... I mean, [35:21.020 --> 35:22.840] this might absolutely be a solution, but [35:22.840 --> 35:23.680] it looks [35:24.760 --> 35:26.460] way more complex [35:26.980 --> 35:29.460] than our reference solution. [35:29.620 --> 35:31.200] Pigbuttsad is also looking at it. [35:31.200 --> 35:31.920] Yeah, yeah, yeah. [35:32.460 --> 35:35.120] But, I mean, in the end, a flag [35:35.120 --> 35:36.040] is a flag. [35:36.820 --> 35:37.740] A win is a win. [35:37.740 --> 35:38.360] Yeah. [35:39.240 --> 35:41.640] If you took a long detour and still got there [35:41.640 --> 35:43.900] faster, then good on you. [35:44.560 --> 35:45.280] Okay, so they're putting [35:45.280 --> 35:47.380] agent now into their payload for [35:47.380 --> 35:48.340] debugging. [35:51.880 --> 35:52.740] Okay, so [35:54.160 --> 35:55.600] they're unpacking. [35:55.680 --> 35:56.720] They have U64 [35:57.280 --> 35:59.340] being called for unpacking. [35:59.500 --> 36:01.620] So they did a small leak. [36:04.120 --> 36:05.080] And then... [36:06.080 --> 36:07.060] Okay, and there they [36:07.060 --> 36:08.700] have the libc address [36:08.700 --> 36:10.140] as well. [36:11.160 --> 36:12.680] Did we... Yeah, okay. [36:16.380 --> 36:18.660] It's getting the [36:18.660 --> 36:21.120] base text. Okay, so this is just basic [36:21.120 --> 36:23.120] calculating the base. Meanwhile, [36:23.120 --> 36:24.860] it's interesting. Shellfish is already [36:24.860 --> 36:26.920] writing, like, a second prop [36:26.920 --> 36:28.980] chain. And we're just over [36:28.980 --> 36:31.040] here still getting... Not that it's bad. I really [36:31.040 --> 36:33.120] like how methodical Pigbuttsad is. [36:33.120 --> 36:35.100] But it's interesting to see that [36:35.100 --> 36:36.620] Shellfish is basically just [36:37.840 --> 36:38.800] brute-forcing [36:38.800 --> 36:41.120] the second prop chain. Yeah, it's actually interesting [36:41.120 --> 36:43.080] if you look at the screen here. They're kind [36:43.080 --> 36:45.120] of debugging here. You can see they are at the ret instruction [36:45.120 --> 36:46.820] in the debugger. And then you have this 41 [36:46.820 --> 36:49.060] string at the top of [36:49.060 --> 36:51.120] the stack. So [36:51.640 --> 36:53.120] I think they are using that [36:53.120 --> 36:54.860] to double-check that the prop [36:54.860 --> 36:57.220] chain is being [36:57.220 --> 36:59.260] put in the proper location [36:59.260 --> 37:01.000] in memory. [37:01.000 --> 37:02.680] So they could be [37:04.000 --> 37:05.180] close. And now [37:05.820 --> 37:06.780] they are [37:06.780 --> 37:09.000] copying some data from the top of the [37:09.000 --> 37:11.040] stack. Oh, they're using the cyclic. [37:11.040 --> 37:13.140] Yeah, that's cool. So Shellfish is using [37:13.260 --> 37:14.920] a lot more, like, tooling. [37:15.640 --> 37:17.200] So the cyclic function [37:17.200 --> 37:19.160] it generates a [37:19.940 --> 37:21.140] sequence which you can then [37:21.680 --> 37:23.340] input into your program. And then [37:23.340 --> 37:25.200] you can take a very small substring [37:25.200 --> 37:27.500] of that sequence and then [37:27.500 --> 37:28.840] calculate back the index. So this can [37:28.840 --> 37:30.640] really help you figure out what [37:30.640 --> 37:32.700] offset, you know... [37:32.700 --> 37:34.780] That's interesting. We have more manual offset [37:34.780 --> 37:36.760] calculation here. Yeah, a lot [37:36.760 --> 37:38.800] less commands happening. Right. [37:40.800 --> 37:41.280] It's... [37:41.280 --> 37:42.280] Oh! [37:42.900 --> 37:44.840] There was a shell here. [37:44.920 --> 37:46.540] Oh, we have a shell. Yeah, yeah, yeah. [37:46.540 --> 37:48.080] I saw the execve. [37:48.160 --> 37:51.080] So they have execve being called. [37:51.140 --> 37:52.820] They're switching to the remote. You see [37:52.820 --> 37:54.640] instead of process, they're switching to remote. [37:54.640 --> 37:55.860] Oh, they might have something there. [37:55.860 --> 37:57.300] Yeah, yeah. So this is going to be [37:57.940 --> 37:59.360] a solve. They're putting in the host [37:59.360 --> 38:01.980] and the port name. [38:02.500 --> 38:03.820] And let's see. [38:03.820 --> 38:05.060] They're running it. [38:06.120 --> 38:07.780] Pigbuttsad hasn't even... [38:07.780 --> 38:09.540] Oh, right. They removed the db. [38:09.800 --> 38:12.240] And they have... Yeah. Okay, let's see. [38:13.040 --> 38:13.780] They got it. [38:13.780 --> 38:15.600] They got it. Wow. They got it. [38:15.620 --> 38:17.820] Congratulations. Really [38:17.820 --> 38:20.100] nice. Really nice. Congrats to shellfish. [38:20.100 --> 38:21.260] Yeah, shellfish. [38:21.680 --> 38:23.540] Advancing in the tournament. [38:23.540 --> 38:25.580] Unfortunately, Pigbuttsad [38:25.580 --> 38:27.480] are knocked out of the [38:27.480 --> 38:30.020] live CTF tournament, but they had a [38:30.020 --> 38:33.260] great run. Really well played. [38:33.260 --> 38:34.060] That was excellent. [38:34.060 --> 38:35.700] Seeing the template that they brought, too. [38:35.700 --> 38:37.690] You could tell this team really is [38:38.280 --> 38:39.600] sophisticated, knows what they're doing. [38:39.600 --> 38:42.200] Good luck to them throughout the entire [38:42.200 --> 38:44.000] CTF, too. Right. [38:44.000 --> 38:47.460] And shellfish, this was great. Seeing the [38:47.460 --> 38:48.340] second attempt for [38:48.340 --> 38:49.780] roping there. [38:49.780 --> 38:50.940] Yeah, it's really, really cool. [38:51.440 --> 38:53.080] So that means they will advance [38:53.080 --> 38:54.540] on to the next round. [38:55.240 --> 38:57.080] Yeah, this was super fun. [38:57.080 --> 38:58.980] This was great, yeah. Yeah, thanks for [38:58.980 --> 39:01.120] coming on as a commentator. Thanks for commentating. [39:01.180 --> 39:03.000] And we will go [39:03.000 --> 39:04.920] to a short break. [39:04.920 --> 39:06.480] We will be back. [39:06.760 --> 39:09.160] I'm 0xSleep on Twitter. If anyone [39:09.160 --> 39:10.740] wants to talk, I'm [39:11.540 --> 39:13.260] Vee on BlueSky. [39:13.260 --> 39:15.040] If anyone's on BlueSky. So [39:15.040 --> 39:16.700] see ya. Have a good one. [39:17.080 --> 39:19.100] Before I sign off here, just take a [39:19.100 --> 39:21.020] quick look at the bracket. As I said, [39:21.020 --> 39:22.840] we had PigBotSAD will be facing [39:22.840 --> 39:24.780] Shellfish in the next one. And then [39:27.020 --> 39:28.860] no, sorry, that was just what happened. [39:28.860 --> 39:31.300] Shellfish won against PigBotSAD. [39:31.460 --> 39:32.700] And NorseCode won their match. So it's [39:32.700 --> 39:35.040] Shellfish versus NorseCode? No, so what's happening [39:35.040 --> 39:37.040] is this is the lower bracket. So you have [39:37.040 --> 39:39.020] the upper bracket here. You have Macaroni [39:39.020 --> 39:40.980] versus Hypeboy. And then you have MMM [39:40.980 --> 39:42.600] versus StrawHat. And the [39:42.600 --> 39:45.140] respective losers of those matches will face [39:45.140 --> 39:47.400] against Shellfish or NorseCode. [39:47.400 --> 39:49.920] Okay. So that's it. [39:50.600 --> 39:51.560] Shout out to StrawHat. [39:51.560 --> 39:53.720] Great team name. Big One Piece fan. [39:53.720 --> 39:55.380] So love to see it. So who [39:55.380 --> 39:57.300] is the next one coming up? I think we have [39:57.300 --> 39:59.480] it's both of those two matches. Macaroni and Hypeboy [39:59.480 --> 40:01.440] and MMM and StrawHat. I don't remember [40:01.440 --> 40:03.360] which one of those we are commentating. But we [40:03.360 --> 40:05.780] will be back here soon. [40:06.220 --> 40:07.620] And yeah. [40:07.620 --> 40:08.700] Have a nice day. Bye.