WEBVTT 00:00.000 --> 00:04.580 Hello, 00:07.770 --> 00:08.390 everyone. 00:08.390 --> 00:10.970 Welcome back to live CTF. 00:10.970 --> 00:13.710 We are on the third round of the second day. 00:14.030 --> 00:17.410 My name is Zita2, or Carl, and I'm here with Vy. 00:17.410 --> 00:19.130 Hi, I'm Vy Weiss. 00:19.570 --> 00:21.410 Yeah, excited to be here. 00:21.410 --> 00:22.470 Scorpio Sun. 00:22.470 --> 00:23.610 So, let's go. 00:23.610 --> 00:24.030 Nice. 00:24.030 --> 00:34.750 So, we have a match here between Shellfish and Pigbuttsad, and we're just going to get the match started and we will talk more about the teams and the challenge they are solving. 00:34.750 --> 00:37.250 So, I'm just going to check a quick OK there. 00:37.250 --> 00:37.690 Yes? 00:37.690 --> 00:38.850 So, we'll start the match. 00:38.850 --> 00:44.230 Let's do a countdown in 5, 4, 3, 2, 1. 00:44.230 --> 00:45.190 Let's go. 00:45.350 --> 00:46.210 Awesome. 00:46.570 --> 00:48.670 So, we are off to the races. 00:49.290 --> 00:55.730 So, yeah, the first thing that will happen is that the teams download the challenge and start looking at it. 00:56.560 --> 01:01.270 Well, it's going to be interesting to see what various tools they will be using. 01:01.870 --> 01:07.410 We have here, as I said, Pigbuttsad and Shellfish. 01:08.070 --> 01:17.830 Although, we just learned before the match started that the player from Pigbuttsad is at... is it ASU? 01:17.950 --> 01:20.890 Yes, ASU, where Shellfish is from. 01:20.890 --> 01:24.610 Right, so it's kind of like, you know, internal battle. 01:25.890 --> 01:32.570 And, yeah, let's switch over to just look at Pigbuttsad's screen. 01:32.690 --> 01:35.890 OK, they're interacting with the challenge, just seeing what it is. 01:35.890 --> 01:40.430 Already opened in IDA, finding the right function right now. 01:40.430 --> 01:40.950 Right. 01:40.950 --> 01:43.590 It looks like a string format, possibly. 01:44.010 --> 01:44.890 Right. 01:44.890 --> 01:45.890 OK, so... 01:45.890 --> 01:50.150 So we have a classic, like, pawn challenge with, like, a menu. 01:50.210 --> 01:52.330 You can choose various options. 01:52.770 --> 01:57.730 You can see them highlighting these, like, core functions here, like the delete message, edit message. 01:57.730 --> 02:01.770 OK, there's a const char star being casted there. 02:01.870 --> 02:07.750 OK, so for more details, it's a messaging type of menu, so there'll be some user input, it looks like. 02:09.270 --> 02:10.010 Yeah. 02:10.150 --> 02:12.830 We can have a look at Shellfish. 02:12.830 --> 02:18.530 So on their side, we also see IDA also doing, like, the initial reversing. 02:18.750 --> 02:28.330 Looks like they're looking at a little bit of a different part of the code, just tidying up the types, which are a bit messy initially. 02:29.310 --> 02:31.050 Yeah, so... 02:31.050 --> 02:40.850 They're finding the size of the buffer over here at Pigbuttsad, doing initial reconnaissance to find the inputs for any type of function writing to it. 02:40.850 --> 02:41.410 Right. 02:41.450 --> 02:48.590 So we see both the teams going for a pretty... starting out with the static analysis, doing, like, the decompilation and so on. 02:48.590 --> 02:59.610 And we've seen throughout the event, you know, the amount of time people spend on the initial, like, static analysis before they go to kind of, like, the dynamic analysis differs quite a lot. 02:59.610 --> 03:08.950 Like, some people like to do quite a lot of reversing before they start trying exploiting, and some people just do, like, a very cursory look before they, you know, bring out, like, a debugger and so on. 03:08.950 --> 03:09.970 Oh, that's interesting. 03:09.970 --> 03:12.350 So, you know, both teams just went to static analysis first. 03:12.350 --> 03:12.650 Right. 03:12.650 --> 03:13.890 Like, spending a few minutes here. 03:13.890 --> 03:14.210 Yeah. 03:14.210 --> 03:17.470 And I mean, I think most of them do that, like, initially. 03:17.470 --> 03:17.630 Yeah. 03:17.630 --> 03:22.190 But we'll see how long they stay here before they start writing some exploits code. 03:22.190 --> 03:22.850 Yeah. 03:24.030 --> 03:32.290 Pigbuttsad is very fast with searching, finding, getting the function pointers, focusing on... 03:32.290 --> 03:32.990 Right. 03:32.990 --> 03:38.450 So we have some kind of structure here being defined. 03:38.450 --> 03:40.630 Kind of, like, reconstructing this. 03:41.770 --> 03:44.630 Is it, like, a message struct, I think? 03:44.630 --> 03:44.990 Yeah. 03:44.990 --> 03:49.450 It looks like there might be different fields to a message, a message head area. 03:50.790 --> 03:52.670 We'll see what they can do with that. 03:52.670 --> 03:53.450 Right. 03:54.470 --> 04:03.690 And it's a little bit interesting with the... Okay, there it looks starting to look a bit better once you start defining these types. 04:03.690 --> 04:09.450 And , you know, this helps you get a clear, you know, understanding of what's going on. 04:09.630 --> 04:10.350 Yeah. 04:10.490 --> 04:13.770 We can switch over to Shellfish. 04:13.770 --> 04:14.090 Interesting . 04:14.090 --> 04:17.750 So Shellfish is actually putting comments in their IDA output. 04:17.750 --> 04:21.290 And you can see they wrote overflow there. 04:21.290 --> 04:27.870 So it seems like they have, well, potentially found the bug. 04:27.950 --> 04:28.170 Yeah . 04:28.830 --> 04:32.930 And, you know, now they're trying maybe to figure out how do you get there. 04:32.930 --> 04:33.370 Yes. 04:33.370 --> 04:33.910 Yeah. 04:33.910 --> 04:35.950 Did you see where they had overflow? 04:35.950 --> 04:36.850 Which function? 04:36.850 --> 04:39.670 I think it was the same function that we were looking at before. 04:39.670 --> 04:40.450 Yes. 04:40.450 --> 04:42.190 But I'm not entirely sure. 04:42.870 --> 04:46.410 You can see there, like, they called something like a maybe next. 04:46.850 --> 04:48.350 Which is, I think, a good strategy. 04:48.350 --> 04:50.790 Like, sometimes, you know, you're not completely sure. 04:50.930 --> 04:54.690 You write something, but you make a note to make sure that, like, you know, don't trust this too much. 04:55.910 --> 04:56.250 Yeah. 04:56.470 --> 04:58.570 In a limited time, you just keep going. 04:59.090 --> 05:02.870 Pigbuttsad instead of comments, just renaming variables, cleaning up everything. 05:03.170 --> 05:03.750 Right. 05:05.090 --> 05:05.930 Yeah. 05:06.150 --> 05:10.330 So they're looking at the string compares right now. 05:10.330 --> 05:10.550 Okay. 05:10.550 --> 05:11.630 So there's bad words. 05:11.630 --> 05:18.610 So it seems in this challenge, it's a message one, but it seems like there's going to be certain words you can't say as the bad word. 05:18.610 --> 05:23.990 And so that might be kind of where we'll want to put any type of payload or bypass there. 05:24.290 --> 05:28.670 So it'll be interesting to see what the bad words are as well as we go through the challenge. 05:28.670 --> 05:31.430 So you can see that big hex constant there. 05:31.430 --> 05:35.230 It looked very much in the printable ASCII range. 05:35.230 --> 05:40.070 So there was probably a string that was incorrectly interpreted as a number. 05:40.210 --> 05:43.130 And now we can see some interaction with the binary again. 05:43.130 --> 05:45.830 To be honest, this is how I know that they're kind of competent. 05:45.830 --> 05:47.790 Like, I would just spam the binary. 05:47.790 --> 05:49.630 I would just be interacting with it at first. 05:49.850 --> 05:52.290 They're really trying to be more methodical. 05:53.050 --> 06:00.450 And yeah, it's over three minutes in, and they haven't really interacted much with the binary, just spending time. 06:00.450 --> 06:01.750 Yeah, taking their time. 06:02.050 --> 06:08.670 It's a big challenge, the kind of meta game or the strategy here. 06:11.150 --> 06:18.250 Because you want to go quick, but if you rush it too much, you might get tangled up in these go-downs. 06:18.250 --> 06:21.590 It might become very messy, and you might actually lose time in the end. 06:21.590 --> 06:23.550 Yeah, for sure. 06:24.490 --> 06:32.490 Okay, so Pigbuttsad is figuring out where the pointers are going to, where the function pointers are going to. 06:32.630 --> 06:35.510 How is Shellfish doing over there? 06:35.510 --> 06:38.970 Right , so here we actually start seeing some exploits. 06:38.970 --> 06:39.410 Oh , they start writing. 06:39.410 --> 06:43.750 Yeah, so you can see here they're using Python with PwnTools. 06:43.750 --> 06:45.650 You know, the popular choice. 06:45.650 --> 06:45.830 Very standard . 06:45.830 --> 06:54.810 And they are kind of defining a new, I guess this is like a new message, this whole interaction with the program. 06:54.810 --> 06:59.210 They're writing these helper functions to make it easy to write these things. 06:59.970 --> 07:05.950 So it looks like they are, you can see there they put hack is probably a bad word. 07:05.950 --> 07:06.290 Yes . 07:07.190 --> 07:08.150 Controversial. 07:09.090 --> 07:10.830 Hacking is not a crime. 07:10.830 --> 07:16.450 But yeah, so it looks like, you know, they already have their string initially being constructed. 07:16.450 --> 07:19.190 They're going to start sending a payload over. 07:19.190 --> 07:23.990 Maybe they're going to send it a few times and try and debug it that way, see what the response is. 07:23.990 --> 07:26.730 But it's interesting that Shellfish is already doing that. 07:26.730 --> 07:34.850 Meanwhile, this team is, they're doing a great job, like really commenting everything, knowing what pointer is doing what. 07:35.370 --> 07:38.870 And so this is clean, very clean what they're doing. 07:38.870 --> 07:41.870 Yeah, so this is kind of what we were talking about. 07:42.830 --> 07:46.510 Shellfish went for starting writing the exploit a bit faster. 07:46.510 --> 07:50.630 And then it's like, was it the right timing or was it too fast? 07:50.630 --> 07:54.770 And will it end up costing them or is it going to give them the win? 07:54.770 --> 07:55.610 Absolutely. 07:55.630 --> 07:59.710 Versus going through the binary more thoroughly. 08:02.070 --> 08:08.090 So this seems like a very basic string sanitization type of bug. 08:09.930 --> 08:15.510 So this seems like a really good beginner CTF if anyone's watching and wants to take notes. 08:15.510 --> 08:23.390 We should actually point that out, that all of the challenges that we run here throughout the event, we will be publishing them. 08:23.390 --> 08:30.430 So if you want to try these things out, we will actually also post all the times that the participants had. 08:30.430 --> 08:37.970 So if you want to try to benchmark yourselves against these very, very good players, there will be a possibility to do so as well. 08:39.270 --> 08:44.370 So right now, Pigbuttsad's focusing on the delete message function here. 08:44.830 --> 08:47.470 What's Shellfish looking at right now? 08:47.470 --> 08:51.470 Switching over to Shellfish, I see that... 08:51.470 --> 08:53.630 Yeah, so you can see that it was very quick. 08:53.630 --> 08:58.150 But in their solve script, they have this thing to create a new message. 08:58.150 --> 08:59.570 And they put in these bad words. 08:59.570 --> 09:03.030 And this is actually the exact right way to go. 09:03.730 --> 09:07.910 Because if I remember correctly, maybe you looked into this more. 09:07.910 --> 09:15.710 The point is that when a bad word gets filtered, it gets replaced by something that's longer. 09:15.710 --> 09:24.030 So it will expand the size of your message, which will eventually overflow the buffer that it's located in. 09:24.570 --> 09:30.030 And you can see that they're concatenating... 09:30.030 --> 09:32.050 Sorry, my eyes are bad. 09:32.690 --> 09:35.110 Yeah, so they're creating new messages. 09:35.110 --> 09:39.270 Those messages don't have any bad words, those are just big sequences of A's and B's. 09:39.270 --> 09:47.130 Yeah, getting padding in to try and make it the right size already without having to have that penalty for writing the bad word. 09:47.130 --> 09:47.790 Exactly. 09:47.790 --> 09:53.330 But the interesting thing is that it seems like they're listing out the messages. 09:53.330 --> 09:57.090 And you can see that long sequence of B's, but there were some garbage characters at the end. 09:57.090 --> 10:01.490 So that would kind of suggest that that is a leak. 10:01.490 --> 10:04.970 So maybe they need that for the exportation part. 10:04.970 --> 10:10.550 Are there any Unicode characters or any type of certain interesting characters or just random ones? 10:10.550 --> 10:12.010 Yeah, it looked just like random. 10:12.010 --> 10:19.830 So I suspect this is like you make a message that's just the right amount and then it will print out stuff afterwards. 10:20.530 --> 10:22.770 So a very simple stack overflow there. 10:22.770 --> 10:23.370 Yeah . 10:23.370 --> 10:29.330 And so, oh wow, we have some very nice Python happening over here with pigbuttsad. 10:29.330 --> 10:32.410 Yeah, so they have these templates for their script. 10:32.410 --> 10:35.290 And this is actually kind of cool, you can see that the teams are prepared, right? 10:35.290 --> 10:43.270 Because you have these short two, three-letter functions that are used to just make it faster to type these scripts. 10:44.070 --> 10:45.850 That's very methodical. 10:47.650 --> 10:50.370 They're just encoding the strings to send over to... 10:51.630 --> 10:55.850 There's a GDB attach function that they'll be filling out soon. 10:55.850 --> 10:56.370 Right . 10:57.770 --> 11:01.590 I think it's really cool, they come prepared with these kind of templates. 11:01.590 --> 11:05.590 And I've even heard some teams have been practicing. 11:05.670 --> 11:12.610 They took the challenges from last year and used it as a way to train their speed-pwning abilities. 11:12.610 --> 11:14.650 So teams are definitely taking it seriously. 11:14.650 --> 11:21.490 Here you can see, you hack using one of the bad words and posting just a lot of these bad words. 11:21.490 --> 11:22.390 Yeah, and that's interesting. 11:22.390 --> 11:28.030 Instead of doing random characters for getting the padding before a hack, it's just using hack the whole time. 11:29.430 --> 11:32.650 So this means that... 11:33.650 --> 11:40.330 I would say that it seems a little bit like pigbuttsad kind of caught up to Shellfish here with this. 11:40.330 --> 11:41.190 Very quickly. 11:41.190 --> 11:44.630 Yeah, so I think it's a very, very close race. 11:44.650 --> 11:48.890 You can see they're grabbing some offsets from Ida. 11:50.690 --> 11:55.010 And I actually don't know what that command was in GDB. 11:56.170 --> 11:58.910 But that's going to be interesting to see. 11:59.870 --> 12:03.530 And now they are running this with the debugger. 12:03.950 --> 12:05.870 They're just checking the breakpoints. 12:05.870 --> 12:06.850 Yeah. 12:08.770 --> 12:16.530 And that's interesting, the offset he found so quickly in Ida, really doing some nice static analysis paid off there. 12:16.530 --> 12:25.170 Yeah, just putting a breakpoint there to be able to analyze the exploit here. 12:25.170 --> 12:28.310 And you can see those hack, hack, hack messages. 12:29.870 --> 12:34.730 Yeah, so it's a pretty close race here, I would say. 12:37.870 --> 12:40.350 It's not sure exactly what they're doing right now. 12:40.350 --> 12:44.730 But if we look here again at Shellfish, I think they have a very clean exploit script here. 12:44.730 --> 12:49.950 You can see these helper functions for, I think it's like a new message, edit message, delete message. 12:49.950 --> 12:50.670 Yeah, right. 12:50.850 --> 12:54.330 And using these to interact. 12:54.330 --> 12:57.230 So here you can see, it's very nice because it's easy to follow. 12:57.230 --> 13:00.130 Like, oh, they're creating two new messages, deleting one, editing one. 13:00.130 --> 13:02.330 There's some sequence of operation there. 13:02.330 --> 13:03.210 It's nice to follow. 13:03.210 --> 13:05.450 So I appreciate that as a commentator here. 13:05.450 --> 13:06.670 Yeah, absolutely. 13:06.670 --> 13:07.830 It's very clean. 13:08.190 --> 13:11.710 And they were able to really quickly find the sanitization function. 13:11.710 --> 13:14.670 They were able to do this very quickly. 13:14.870 --> 13:15.550 Yeah. 13:16.790 --> 13:22.770 And if we go back to Pig again, still doing some debugging. 13:23.070 --> 13:27.490 It looks like now they are in some... 13:27.490 --> 13:33.330 Yeah, I was trying to see where they were doing the break, but I couldn't quite make it out. 13:33.330 --> 13:35.450 Yeah, it's kind of going fast there. 13:35.450 --> 13:36.750 It's going very fast. 13:37.230 --> 13:40.430 So the players, they sit behind us here, behind a wall. 13:40.430 --> 13:47.530 And I've seen some of the matches, like the speed at which they are just typing the stuff is insane. 13:53.090 --> 13:57.610 Oh, so there we can see, on the right side there, you saw the deleted. 13:57.610 --> 13:58.730 The words being removed. 13:58.730 --> 14:05.950 Yes, and then since the string deleted is longer than the string hack, this is what causes the bug. 14:09.430 --> 14:13.190 And they are stepping through the sanitize function. 14:14.630 --> 14:17.510 A lot of stepping to get to the right place. 14:17.510 --> 14:19.050 Yeah, just tapping the button. 14:19.050 --> 14:22.230 Yeah, that's... 14:25.890 --> 14:32.250 We have, if we switch over to Shellfish again, you can see that they run the check sec thing. 14:32.310 --> 14:36.390 And they highlight, I saw the player highlighting the NX enabled. 14:37.370 --> 14:38.650 Oh, here you can see... 14:38.650 --> 14:43.710 You can see the 41, so you can see their payload, the padding for the A's starting. 14:43.710 --> 14:54.650 And trying to maybe figure out the various addresses and offsets, just checking that what ends up in memory corresponds to what they would expect from their exploits. 14:55.290 --> 14:57.230 This is really classic debugging. 15:00.610 --> 15:03.710 Pigbuttsat is going back and checking... 15:06.680 --> 15:08.920 Right, so it looks like they have... 15:08.920 --> 15:13.440 I'm just trying to see where they are putting their breakpoints. 15:13.440 --> 15:17.000 Because you saw that they were analyzing some contents of the memory there. 15:17.040 --> 15:20.280 But I couldn't quite make out where that was. 15:20.280 --> 15:23.240 It was like in the string comparison stuff. 15:25.420 --> 15:31.960 Oh, at first I thought the word was misspelled, but it's just backwards. 15:32.060 --> 15:33.860 The endian miss. 15:35.920 --> 15:39.000 The deleted endian is backwards, it's great actually. 15:39.000 --> 15:41.100 That's a good team name, Dateled. 15:41.100 --> 15:44.600 If you want to join, we're looking for members. 15:45.840 --> 15:49.360 Have you played any CTFs recently? 15:49.360 --> 15:53.220 Oh man, we did a Hack the Box CTF recently at work. 15:53.220 --> 15:54.600 It was really wholesome. 15:55.060 --> 15:57.460 That's a very good CTF. 15:57.460 --> 16:01.740 It was like a VM reversing challenge, which was nice. 16:02.160 --> 16:05.140 I recommend that as just a really relaxing one too. 16:05.140 --> 16:06.260 What about you? 16:07.260 --> 16:11.220 I'm mostly retired from playing. 16:11.220 --> 16:12.540 I organize a bunch of stuff. 16:12.540 --> 16:15.920 I do every year play the Flareon group. 16:16.560 --> 16:20.080 Hopefully that one should be coming up right now in a few weeks. 16:20.080 --> 16:21.460 I'm looking forward to that. 16:21.460 --> 16:23.000 Hopefully that happens. 16:23.880 --> 16:28.040 Other than that, I've been more organizing than playing the competitions. 16:28.040 --> 16:30.100 When was the last Defcon CTF you played? 16:30.280 --> 16:31.600 Village or main? 16:31.600 --> 16:38.920 I founded NorseCode in 2019. 16:39.200 --> 16:42.960 I played the two COVID years of the Defcon CTF. 16:42.960 --> 16:45.800 I've never played the Defcon CTF on site. 16:46.840 --> 16:50.520 I think it was Defcon 2018. 16:51.480 --> 16:55.480 There was an RMV8x86 polyglot. 16:55.480 --> 16:58.980 Some of the challenges in 2018 were pretty nasty. 16:58.980 --> 17:02.380 It must have been 20 and 21 that I played. 17:02.380 --> 17:04.420 Those were the COVID years. 17:05.300 --> 17:11.360 We can check in with PigBatSat again. 17:13.380 --> 17:15.200 NorseCode is here playing. 17:18.220 --> 17:22.960 That's a good segue to mention that we are running two matches in parallel. 17:23.660 --> 17:27.980 We are commentating this one between Shellfish and PigBatSat. 17:27.980 --> 17:32.980 We also have a match between BlueWater and NorseCode. 17:33.340 --> 17:37.880 They are playing the same challenge, but off-stream. 17:40.280 --> 17:43.440 We have some more debugging action going on here. 17:45.660 --> 17:51.040 Just making sure that the start of the payload is being put in the right place. 17:51.980 --> 17:59.720 He is using hexadecimal 6-2s to figure out where he needs to... 17:59.720 --> 18:02.540 He is left-adjusting the padding. 18:02.540 --> 18:05.220 I love seeing an L-adjust and a right-adjust. 18:07.840 --> 18:11.080 Using every single convenience function. 18:11.080 --> 18:12.860 The built-in Python ones. 18:12.860 --> 18:14.780 To your fullest advantage. 18:16.120 --> 18:16.760 And... 18:17.600 --> 18:19.280 Yeah, it's... 18:19.960 --> 18:22.220 Also here looking at... 18:22.220 --> 18:28.080 Double-checking the memory mappings to find offsets. 18:30.820 --> 18:32.780 Yeah, it's... 18:34.660 --> 18:36.020 Switching things up. 18:36.020 --> 18:39.860 They got rid of the hack words for now. 18:39.860 --> 18:44.420 Maybe they needed to take a step back and check some of their assumptions. 18:44.420 --> 18:47.180 Where things are located. 18:47.180 --> 18:50.560 He is writing another function here for just editing the message. 18:50.560 --> 18:51.700 Okay, yeah. 18:52.040 --> 18:56.620 Similar to what Shellfish did over here. 18:56.940 --> 19:01.220 You have these helper functions for managing your messages. 19:01.220 --> 19:08.460 To not have to repeat so many things in the exploits. 19:09.280 --> 19:15.880 I feel like the Shellfish exploit code looks very similar to... 19:16.580 --> 19:20.780 Not much has changed, I feel, since we looked at it a moment ago. 19:20.780 --> 19:22.400 But hopefully they've been gathering some... 19:23.320 --> 19:26.840 Debugging, looking at GDB, setting breakpoints as well. 19:27.800 --> 19:30.020 So they've written GDB attached to... 19:30.020 --> 19:32.420 That was part of the template that sadbutpig had. 19:32.420 --> 19:34.740 Yeah, definitely they came prepared. 19:37.140 --> 19:40.820 So pigbuttsad is going back to hack and using the word hack. 19:40.820 --> 19:42.960 But now they just have it in their payload. 19:42.980 --> 19:49.200 So to simplify it, they made their payload just be the hack bytes. 19:51.780 --> 19:53.380 Sending that over. 19:54.400 --> 19:55.740 Right, now there's... 19:56.560 --> 19:59.520 Yeah, I think something went wrong there. 19:59.520 --> 20:03.300 Maybe there was a very large amount of outputs. 20:03.300 --> 20:08.320 Yeah, it might be on the size for the 100 hexadecimal. 20:08.360 --> 20:12.280 What size of A's and B's are they sending over there? 20:12.280 --> 20:13.080 Also 100? 20:13.080 --> 20:15.440 Yeah, so Shellfish, I think it was... 20:15.440 --> 20:17.300 I've seen various things in their code. 20:17.300 --> 20:19.320 Let's see if they switch back to it. 20:19.500 --> 20:22.040 I've seen 100, 200... 20:22.040 --> 20:28.220 But you can see there's a read call there, reading hex 100 characters. 20:28.640 --> 20:32.360 And that's what they're sending there in their two new calls. 20:32.360 --> 20:34.340 So, you know, the size is down. 20:34.340 --> 20:36.480 It seems like the verbiage is down. 20:36.480 --> 20:40.060 It's just really getting the right hexadecimal values in the right places. 20:40.160 --> 20:42.140 Which is all CTF. 20:42.800 --> 20:46.520 You put the hex in the right memory addresses and then you get it. 20:46.600 --> 20:48.560 You know, the good bytes, the bad bytes. 20:48.880 --> 20:51.480 The medium bytes, they're all here. 20:53.140 --> 20:55.720 But yeah, let's go back to... 20:55.720 --> 20:57.880 So , yeah, Pigmetat is still debugging. 20:57.880 --> 21:00.260 A lot of A's, a lot of B's we're seeing. 21:02.860 --> 21:05.560 I wish I knew the hexadecimal for hack. 21:05.560 --> 21:07.400 That would make this a lot helpful. 21:07.540 --> 21:09.800 Do you have YouTube comments? 21:10.140 --> 21:11.640 Oh, yeah, we should have. 21:11.640 --> 21:13.460 If someone knows hack... 21:14.420 --> 21:16.000 69, maybe? 21:16.000 --> 21:18.360 Yeah, so 69, 41... 21:19.200 --> 21:21.060 No, 41 is the capital. 21:21.160 --> 21:22.440 So it's 61. 21:22.440 --> 21:24.100 Oh, true, 61, yeah. 21:26.400 --> 21:29.540 We know how to do the alphabet really easily. 21:29.800 --> 21:30.380 68. 21:31.020 --> 21:33.360 68, 61, I think, would be the start. 21:33.360 --> 21:34.340 And then 63. 21:34.340 --> 21:37.140 Wow, great reverse engineering. 21:37.440 --> 21:40.000 I feel like this is like a hexadecimal class. 21:40.000 --> 21:41.220 Like an intro comp sci. 21:41.220 --> 21:42.280 You have to convert. 21:42.280 --> 21:45.300 Hello, kids, today we're learning about hexadecimal. 21:47.980 --> 21:49.740 We'll go to decimal next. 21:49.740 --> 21:51.620 So make sure everyone knows 1 to 10. 21:51.620 --> 21:53.380 Or 0 to 9, really. 21:53.880 --> 21:56.220 And then next week is binary. 21:56.980 --> 21:58.460 Or homework, maybe. 21:58.460 --> 21:59.640 We'll give homework. 21:59.640 --> 22:00.340 That's what this is. 22:00.340 --> 22:01.180 You can do this at home. 22:01.180 --> 22:02.540 The challenges are in GitHub. 22:03.300 --> 22:05.780 They will be on GitHub. 22:11.620 --> 22:13.820 A lot of single-stepping again. 22:15.600 --> 22:18.460 So hack is going... 22:19.700 --> 22:22.060 Copying and pasting the offsets from Ida. 22:22.120 --> 22:23.900 Putting the breakpoint there. 22:26.100 --> 22:27.080 All right. 22:27.080 --> 22:28.800 So now... 22:28.800 --> 22:31.500 They stopped right at the return instructions. 22:31.500 --> 22:33.580 Maybe they were looking at the stack layout. 22:33.580 --> 22:36.680 At the point of executing the return. 22:36.680 --> 22:36.900 Yeah. 22:37.680 --> 22:40.300 They're right by RBP, RSP. 22:43.060 --> 22:44.260 Yeah. 22:45.800 --> 22:46.400 It's... 22:46.400 --> 22:50.400 I really feel like both the teams are kind of on to it. 22:50.400 --> 22:52.540 They have the pieces. 22:52.540 --> 23:00.940 But then, like you said, doing this fiddling and getting things just right can be a big challenge. 23:00.940 --> 23:04.360 And especially in this stressful context. 23:04.360 --> 23:05.540 And that's so realistic. 23:05.540 --> 23:08.700 Because I feel like when you have a code base, finding the bug is easy. 23:08.700 --> 23:11.420 Exploiting is way more difficult sometimes. 23:12.280 --> 23:12.820 So... 23:12.820 --> 23:22.300 Yeah, this is really realistic, I think, of anyone doing a sanitized string buffer overflow situation here. 23:22.300 --> 23:23.340 Yeah. 23:23.400 --> 23:28.300 I do have a notification here that NorseCode... 23:29.080 --> 23:31.880 Let me just confirm this. 23:32.540 --> 23:33.760 This is breaking news. 23:34.260 --> 23:36.140 We're getting messages. 23:37.200 --> 23:41.560 So NorseCode did win the match that we are not commentating. 23:41.560 --> 23:43.200 The other match that's running in parallel. 23:43.260 --> 23:45.020 Great job to them. 23:45.800 --> 23:47.300 Do you feel like a father to the team? 23:47.300 --> 23:48.520 Because you found it? 23:49.100 --> 23:49.620 It's... 23:49.620 --> 23:53.980 You know, father sounds maybe a bit important. 23:53.980 --> 23:56.340 Maybe it's like the drunk uncle. 23:57.500 --> 23:58.220 Something like this. 23:58.740 --> 24:00.040 Every CTF team. 24:00.040 --> 24:04.180 Or like the old grandpa who still thinks they're relevant. 24:05.420 --> 24:07.040 That's why we're here. 24:07.380 --> 24:07.900 Yeah . 24:08.600 --> 24:10.520 Like, well, back in my day... 24:11.260 --> 24:11.940 Yeah. 24:13.400 --> 24:14.140 Something like that. 24:14.140 --> 24:16.420 No, but I have some good friends in the team. 24:16.420 --> 24:20.240 For example, the guy who did play the match for NorseCode. 24:20.620 --> 24:21.500 Yeah, a close friend of mine. 24:21.500 --> 24:26.260 So, of course, I'm very happy for them doing well in this CTF. 24:26.680 --> 24:28.300 Yeah, definitely cheering for them. 24:28.380 --> 24:32.220 Although I have some colleagues from work in some of the other teams as well. 24:32.300 --> 24:34.880 Oh , so it's like you're conflicted. 24:34.880 --> 24:36.040 How's that doing for you? 24:36.040 --> 24:38.620 Is that why you're the drunk uncle and not just the uncle? 24:38.620 --> 24:40.080 You have, like, the children. 24:40.380 --> 24:41.600 Your nephew's over there. 24:41.600 --> 24:42.880 Your niece is there. 24:43.400 --> 24:43.560 Oh, yeah. 24:43.560 --> 24:45.000 No, it's like... 24:45.000 --> 24:48.120 I mean, I like the people in NorseCode. 24:49.580 --> 24:51.680 I was not expecting them to... 24:51.680 --> 24:53.940 I was expecting them to do okay. 24:53.940 --> 24:58.700 But then suddenly they're performing pretty well and they're in fifth place in the overall main event. 24:58.700 --> 25:01.280 So now I have to actually cheer for them. 25:02.100 --> 25:03.620 So that's super cool to see. 25:03.620 --> 25:05.200 Set your expectations low. 25:05.200 --> 25:06.720 I think that's kind of moral. 25:07.600 --> 25:09.220 Tip of the day. 25:10.500 --> 25:11.100 Yeah. 25:11.100 --> 25:12.460 I know your alphabet. 25:14.260 --> 25:15.480 Yep. 25:15.480 --> 25:17.760 Let's check in with Shellfish here. 25:17.760 --> 25:24.360 They are going back and forth a bit with AIDA and the debugger. 25:24.360 --> 25:32.100 Looks like they are trying to... I'm not sure looking at the sizes of these buffers or something. 25:32.100 --> 25:34.740 I don't quite understand the code that's going. 25:34.740 --> 25:39.080 They just got the address for where the return happens. 25:39.080 --> 25:40.840 I think they're going to put a breakpoint there. 25:40.840 --> 25:42.660 That's definitely what's happening. 25:42.720 --> 25:45.120 This is really cool over with PigButtSAD. 25:45.320 --> 25:48.620 Using GDB, they've got the offsets. 25:48.940 --> 25:52.880 They saw where strcpy is getting called, where puts is being called. 25:52.880 --> 26:00.880 And now they're just putting that value that ends with 4028 into RDI. 26:01.380 --> 26:05.900 So now we're finally seeing some registers be called in their Python scripts. 26:05.900 --> 26:12.640 A small ROP chain being put together here, which could indicate that they are close. 26:12.960 --> 26:15.900 Let's see who gets ripped first. 26:16.400 --> 26:17.800 This is exciting, actually. 26:17.800 --> 26:18.740 Look what you have. 26:19.320 --> 26:22.400 There was a bunch of nullbytes on the stack there, I think. 26:22.400 --> 26:23.720 Yeah, right at the RET instruction. 26:23.720 --> 26:29.720 So there's something that's slightly off because they got a nullbyte at the RET location. 26:29.760 --> 26:31.520 And now there are only two... 26:31.520 --> 26:33.600 Well, there's only one nullbyte before there were three. 26:33.600 --> 26:35.700 So they're slowly adjusting... 26:35.700 --> 26:38.280 I think it's the number of bad words or something. 26:38.480 --> 26:41.400 So I feel like they are close. 26:41.500 --> 26:45.240 So he called searchmem to see... 26:45.240 --> 26:46.720 That went too fast. 26:47.620 --> 26:49.160 Okay, so... 26:50.880 --> 26:54.440 Okay, and so they have the bitmask in the payload too. 26:54.940 --> 26:58.300 They're trying to make sure everything lands in the right place. 27:01.000 --> 27:01.560 So... 27:01.560 --> 27:03.060 They're getting the length of the payload. 27:03.060 --> 27:04.900 I'm starting to get excited here now. 27:04.900 --> 27:12.000 I feel like they could be one small step away from... 27:12.000 --> 27:14.180 They're close to popRDI here. 27:14.400 --> 27:15.520 Yeah. 27:16.220 --> 27:16.980 Let's see. 27:16.980 --> 27:18.800 They're doing some small adjustments. 27:18.800 --> 27:23.240 You see some subtracting some stuff from the payloads. 27:23.920 --> 27:24.840 So, yeah. 27:24.840 --> 27:28.800 Cool, simple wrap chain based exploit for this. 27:28.800 --> 27:32.920 This would be a really cool wrap chain beginner on GitHub if anyone wants to do this. 27:32.920 --> 27:40.940 I think for a lot of these challenges, because we wanted to be able to solve it within the 15 minutes we have, I think we have been fairly generous. 27:40.940 --> 27:44.160 Sometimes we put some very useful gadgets. 27:44.460 --> 27:47.240 Yeah, so they calculated a little bit of an offset there. 27:47.240 --> 27:47.660 Yeah. 27:47.660 --> 27:50.380 They got the base address going. 27:50.700 --> 27:54.000 Oh, they weren't sure if it was going to be a plus or minus, I think. 27:54.000 --> 27:56.600 So, yeah. 27:56.600 --> 28:00.760 It's very close. 28:01.740 --> 28:03.300 How's Shellfish doing? 28:03.300 --> 28:05.320 Let's go back at Shellfish. 28:05.420 --> 28:06.880 This is so exciting. 28:07.120 --> 28:08.580 Pigbuttsat is almost getting it. 28:08.580 --> 28:10.080 We'll have to have one eye over on that screen. 28:10.080 --> 28:11.820 Okay, you do that. 28:14.420 --> 28:20.080 It seems like the Shellfish player is flailing around a little bit with a bunch of typos in the terminal. 28:20.080 --> 28:22.200 Maybe the stress is getting... 28:22.200 --> 28:22.600 Oh, right. 28:22.600 --> 28:23.720 He's running RopGadget. 28:23.720 --> 28:28.580 He's trying to find some convenient RopGadget. 28:28.580 --> 28:30.580 He dumped that out. 28:34.480 --> 28:41.620 That would suggest that they're about to put some RopChain together. 28:41.880 --> 28:46.220 In Pigbuttsat, they have 0xDeadBeef right now in their RopChain. 28:46.220 --> 28:59.520 Oh, so they're using this as a marker thing to make sure that they know that if they put this somewhere in memory and they find where it ends up in memory and then they can use this as a marker. 28:59.920 --> 29:03.360 That's where the SearchMem command is super helpful. 29:04.460 --> 29:09.900 I think they're doing a great job manually backtracing and figuring out... 29:09.900 --> 29:13.140 You could see that they were close, but it was something that was a little bit off. 29:13.140 --> 29:14.860 You have to backtrack a little bit. 29:15.560 --> 29:20.080 This is like a blog post of they already edited everything. 29:20.080 --> 29:21.420 They know exactly what they're doing. 29:21.420 --> 29:22.380 No mistakes. 29:22.380 --> 29:24.120 I haven't seen any typos. 29:24.120 --> 29:25.260 I feel bad for you. 29:25.260 --> 29:28.080 If typos are happening... 29:28.080 --> 29:29.700 Someone should get him a lemonade. 29:29.800 --> 29:31.200 Maybe we should. 29:31.680 --> 29:32.460 Yeah. 29:34.660 --> 29:39.840 And still there's the null byte there when they're at the red instruction. 29:39.840 --> 29:45.160 Something is misaligned or something with their exploits. 29:45.160 --> 29:48.900 It must be very stressful knowing that you are this close. 29:48.900 --> 29:52.580 You don't know how far along the other player is. 29:53.740 --> 29:56.860 But it seems like everything is so smart, right? 29:56.860 --> 29:58.940 It's not like there's that much lag time. 29:58.940 --> 30:01.160 There's constant typing for him. 30:01.480 --> 30:04.780 With Shellfish, let's spend some more time here. 30:04.780 --> 30:06.480 I feel like we've spent so much time with PigBot 7. 30:06.920 --> 30:10.100 They are now putting together the ROP chain here. 30:10.100 --> 30:15.780 They used ROP Gadget before, which is a tool to find ROP Gadgets in a binary. 30:15.780 --> 30:16.980 They dumped it to a text file. 30:16.980 --> 30:21.100 Looking through this and picking and choosing the various things you can see here. 30:21.100 --> 30:25.820 They're using this one PopRDI RET Gadget here. 30:25.820 --> 30:28.360 They're building up this ROP Chain. 30:28.800 --> 30:31.040 You can see a few lines below. 30:31.040 --> 30:35.840 They have the start of the payload to trigger the vulnerability. 30:36.340 --> 30:41.800 Then they add on the ROP Chain at the end there. 30:43.100 --> 30:46.180 Very methodical here. 30:46.620 --> 30:47.660 Great comments too. 30:47.660 --> 30:51.460 I like how they have PopRDI RET for what they're looking at. 30:52.340 --> 30:58.060 Not just making the Gadget, they're showing exactly what instructions they want to start using for their ROP Chain. 30:58.200 --> 30:59.940 I think this is really cool to see. 31:00.540 --> 31:05.500 A moment ago, I felt like PigBot 7 was a little bit behind with the ROP Chain and stuff. 31:05.500 --> 31:08.120 But then something went wrong and they had to debug this. 31:08.120 --> 31:10.800 Now, Shellfish is writing this. 31:10.920 --> 31:19.700 If they can land this without too big of an issue, they might be able to catch up and overtake them again. 31:19.700 --> 31:22.180 It's a really, really close race here. 31:28.340 --> 31:34.640 At PigBot 7, they're still using 0xDeadBeef to find where in memory they're at right now. 31:34.640 --> 31:41.080 They're so close to getting the right return address and being put in the right place. 31:45.120 --> 31:52.280 To recap a little bit for the listeners, the idea here is that you have a message and you put bad words into it. 31:52.380 --> 31:59.740 The bad words can be short and they get replaced by a longer word, which expands your message and pushes the end. 31:59.740 --> 32:01.920 Eventually , it will overflow a buffer. 32:02.000 --> 32:10.540 The approach would be you put a bunch of bad words and then an appropriate amount of padding to align everything, and then your ROP chain. 32:10.540 --> 32:22.960 You have to align this up so that the thing expands just the right amount of bytes to put your ROP chain in the correct place. 32:27.600 --> 32:32.720 We can see there's definitely something going wrong. 32:32.720 --> 32:35.800 You can see here, now they have aligned it. 32:35.800 --> 32:42.160 You can see they are at the RET instruction and the top is one of their gadgets, I believe. 32:43.460 --> 32:46.220 That's very significant. 32:47.040 --> 32:50.340 PopRDI is a great gadget to start using there. 32:53.720 --> 32:56.000 This is so close. 32:56.000 --> 32:56.540 Really? 32:56.620 --> 32:58.320 If we switch over to Shellfish... 32:58.320 --> 33:00.420 They are typing the same words, basically. 33:00.720 --> 33:05.140 I like how with Shellfish you can see the way they are naming it. 33:05.140 --> 33:07.520 They are getting the base address of the library. 33:07.520 --> 33:10.920 This is a very academic tutorial way to write it. 33:10.920 --> 33:15.560 This is export code that I really like. 33:16.200 --> 33:20.140 Not too different from how I like to write it. 33:20.140 --> 33:25.580 You have some log statements, proper variable names, the whole thing. 33:25.580 --> 33:31.620 Of course, that might not necessarily be the most efficient way in a speed pwning setting like this. 33:31.620 --> 33:40.960 On the other hand, doing a methodical approach and making sure you do everything right can save you costly mistakes. 33:41.980 --> 33:43.580 There's something to be said. 33:43.580 --> 33:50.120 You want to be super careful with subtracting the right base address to the function address that you're looking for. 33:50.120 --> 33:50.840 Right . 33:51.980 --> 33:53.080 Yeah. 33:53.340 --> 33:56.180 They have BNSH already written. 33:56.200 --> 33:57.320 Yes. 33:58.700 --> 34:01.640 I think they could... 34:01.640 --> 34:03.960 It's so close here. 34:04.120 --> 34:05.860 They're doing maybe some final debugging. 34:05.860 --> 34:09.340 Could we possibly see this working? 34:09.340 --> 34:17.720 I want to just look at them for a short moment more here to see if things are... Oh, look. 34:17.720 --> 34:23.100 You have the RET that was pointing at the ROP address. 34:23.100 --> 34:23.720 Sorry. 34:23.720 --> 34:27.660 The ROP chain was on the stack at the RET address. 34:27.660 --> 34:30.420 It really looks like they are right there. 34:30.420 --> 34:31.420 Yeah. 34:33.400 --> 34:38.160 Oh, and now they are duplicating the... 34:38.160 --> 34:39.680 Interesting. 34:39.920 --> 34:42.440 They're duplicating getting their shell. 34:43.060 --> 34:45.180 They have the SHN system. 34:45.520 --> 34:48.660 Oh, actually, that was very interesting. 34:48.660 --> 34:52.960 The first ROP chain goes back to main. 34:53.500 --> 34:55.480 Wow, this is pretty... 34:56.240 --> 35:02.700 It looks like they're doing one ROP chain... To overwrite the entry point of the message? 35:04.920 --> 35:05.720 I don't know. 35:05.720 --> 35:13.600 Because that first ROP chain ends with the main symbol, so it would jump back to main and essentially restart the program. 35:13.720 --> 35:17.460 And then Ewing is doing some kind of leak. 35:17.720 --> 35:29.460 And then... Oh, I think this is... I mean, this might absolutely be a solution, but it looks way more complex than our reference solution. 35:29.620 --> 35:31.200 Pigbuttsad is also looking at it. 35:31.200 --> 35:31.920 Yeah , yeah, yeah. 35:32.460 --> 35:36.040 But, I mean, in the end, a flag is a flag. 35:36.820 --> 35:37.740 A win is a win. 35:37.740 --> 35:38.360 Yeah. 35:39.240 --> 35:43.900 If you took a long detour and still got there faster, then good on you. 35:44.560 --> 35:48.340 Okay, so they're putting agent now into their payload for debugging. 35:51.880 --> 35:55.600 Okay, so they're unpacking. 35:55.680 --> 35:59.340 They have U64 being called for unpacking. 35:59.500 --> 36:01.620 So they did a small leak. 36:04.120 --> 36:05.080 And then... 36:06.080 --> 36:10.140 Okay, and there they have the libc address as well. 36:11.160 --> 36:12.680 Did we... Yeah, okay. 36:16.380 --> 36:19.840 It's getting the base text. 36:19.840 --> 36:22.640 Okay, so this is just basic calculating the base. 36:22.640 --> 36:23.820 Meanwhile, it's interesting. 36:23.820 --> 36:27.680 Shellfish is already writing, like, a second prop chain. 36:27.740 --> 36:30.560 And we're just over here still getting... Not that it's bad. 36:30.560 --> 36:33.120 I really like how methodical Pigbuttsad is. 36:33.120 --> 36:40.420 But it's interesting to see that Shellfish is basically just brute-forcing the second prop chain. 36:40.420 --> 36:42.600 Yeah, it's actually interesting if you look at the screen here. 36:42.600 --> 36:43.760 They're kind of debugging here. 36:43.760 --> 36:45.960 You can see they are at the ret instruction in the debugger. 36:45.960 --> 36:50.700 And then you have this 41 string at the top of the stack. 36:50.880 --> 37:01.000 So I think they are using that to double-check that the prop chain is being put in the proper location in memory. 37:01.000 --> 37:04.740 So they could be close. 37:04.740 --> 37:09.860 And now they are copying some data from the top of the stack. 37:09.860 --> 37:11.040 Oh, they're using the cyclic. 37:11.040 --> 37:11.900 Yeah, that's cool. 37:11.900 --> 37:14.920 So Shellfish is using a lot more, like, tooling. 37:15.640 --> 37:22.680 So the cyclic function it generates a sequence which you can then input into your program. 37:22.680 --> 37:28.480 And then you can take a very small substring of that sequence and then calculate back the index. 37:28.480 --> 37:32.700 So this can really help you figure out what offset, you know... 37:32.700 --> 37:33.560 That's interesting. 37:33.560 --> 37:36.200 We have more manual offset calculation here. 37:36.200 --> 37:38.120 Yeah, a lot less commands happening. 37:38.120 --> 37:38.800 Right. 37:40.800 --> 37:41.280 It's... 37:41.280 --> 37:42.280 Oh! 37:42.900 --> 37:44.840 There was a shell here. 37:44.920 --> 37:46.060 Oh, we have a shell. 37:46.060 --> 37:46.540 Yeah, yeah, yeah. 37:46.540 --> 37:48.080 I saw the execve. 37:48.160 --> 37:51.080 So they have execve being called. 37:51.140 --> 37:52.600 They're switching to the remote. 37:52.600 --> 37:54.640 You see instead of process, they're switching to remote. 37:54.640 --> 37:55.860 Oh, they might have something there. 37:55.860 --> 37:56.300 Yeah, yeah. 37:56.300 --> 37:58.340 So this is going to be a solve. 37:58.340 --> 38:01.980 They're putting in the host and the port name. 38:02.500 --> 38:03.820 And let's see. 38:03.820 --> 38:05.060 They're running it. 38:06.120 --> 38:07.780 Pigbuttsad hasn't even... 38:07.780 --> 38:08.440 Oh, right. 38:08.440 --> 38:09.540 They removed the db. 38:09.800 --> 38:11.240 And they have... Yeah. 38:11.240 --> 38:12.240 Okay, let's see. 38:13.040 --> 38:13.780 They got it. 38:13.780 --> 38:14.260 They got it. 38:14.260 --> 38:15.000 Wow. 38:15.100 --> 38:15.600 They got it. 38:15.620 --> 38:16.620 Congratulations. 38:17.320 --> 38:18.720 Really nice. 38:18.720 --> 38:19.660 Really nice. 38:19.660 --> 38:20.100 Congrats to shellfish. 38:20.100 --> 38:21.260 Yeah, shellfish. 38:21.680 --> 38:23.540 Advancing in the tournament. 38:23.540 --> 38:30.320 Unfortunately, Pigbuttsad are knocked out of the live CTF tournament, but they had a great run. 38:30.320 --> 38:32.180 Really well played. 38:33.140 --> 38:33.940 That was excellent. 38:33.940 --> 38:35.580 Seeing the template that they brought, too. 38:35.580 --> 38:39.460 You could tell this team really is sophisticated , knows what they're doing. 38:39.460 --> 38:42.880 Good luck to them throughout the entire CTF , too. 38:42.880 --> 38:43.460 Right. 38:43.460 --> 38:44.800 And shellfish , this was great. 38:44.800 --> 38:48.840 Seeing the second attempt for roping there . 38:49.160 --> 38:50.940 Yeah, it's really, really cool. 38:51.440 --> 38:54.540 So that means they will advance on to the next round. 38:55.240 --> 38:57.080 Yeah, this was super fun. 38:57.080 --> 38:58.100 This was great, yeah. 38:58.100 --> 39:00.400 Yeah, thanks for coming on as a commentator. 39:00.400 --> 39:01.120 Thanks for commentating. 39:01.180 --> 39:04.920 And we will go to a short break. 39:04.920 --> 39:06.480 We will be back. 39:06.760 --> 39:08.640 I'm 0xSleep on Twitter. 39:08.640 --> 39:13.260 If anyone wants to talk, I'm Vee on BlueSky. 39:13.260 --> 39:14.780 If anyone's on BlueSky. 39:14.780 --> 39:15.700 So see ya. 39:15.700 --> 39:16.700 Have a good one. 39:17.080 --> 39:20.380 Before I sign off here, just take a quick look at the bracket. 39:20.380 --> 39:24.380 As I said, we had PigBotSAD will be facing Shellfish in the next one. 39:24.380 --> 39:28.860 And then no, sorry, that was just what happened. 39:28.860 --> 39:31.300 Shellfish won against PigBotSAD. 39:31.460 --> 39:32.360 And NorseCode won their match. 39:32.360 --> 39:34.100 So it's Shellfish versus NorseCode? 39:34.100 --> 39:36.220 No, so what's happening is this is the lower bracket. 39:36.220 --> 39:38.020 So you have the upper bracket here. 39:38.020 --> 39:40.020 You have Macaroni versus Hypeboy. 39:40.020 --> 39:42.180 And then you have MMM versus StrawHat. 39:42.180 --> 39:47.400 And the respective losers of those matches will face against Shellfish or NorseCode. 39:47.400 --> 39:48.020 Okay. 39:48.360 --> 39:49.920 So that's it. 39:50.600 --> 39:51.560 Shout out to StrawHat. 39:51.560 --> 39:52.580 Great team name. 39:52.580 --> 39:53.720 Big One Piece fan. 39:53.720 --> 39:55.100 So love to see it. 39:55.100 --> 39:56.540 So who is the next one coming up? 39:56.540 --> 39:58.640 I think we have it's both of those two matches. 39:58.640 --> 40:00.780 Macaroni and Hypeboy and MMM and StrawHat. 40:00.780 --> 40:03.020 I don't remember which one of those we are commentating. 40:03.020 --> 40:05.780 But we will be back here soon. 40:06.220 --> 40:07.620 And yeah. 40:07.620 --> 40:08.220 Have a nice day. 40:08.220 --> 40:08.700 Bye.