1
00:00:11,300 --> 00:00:12,800
Hello and welcome back everybody.

2
00:00:12,800 --> 00:00:14,940
We're here for our last round of the day.

3
00:00:14,940 --> 00:00:15,840
Day 2.

4
00:00:15,880 --> 00:00:16,900
I'm Cyber Protection Jordan.

5
00:00:16,900 --> 00:00:18,360
You just saw me with Brandon and...

6
00:00:18,360 --> 00:00:21,880
I'm Josh Negasora and you saw me three casts ago.

7
00:00:21,880 --> 00:00:22,760
It's been a long day, Jordan.

8
00:00:22,840 --> 00:00:23,680
It has been a long day.

9
00:00:23,680 --> 00:00:25,140
How many streams have you had today?

10
00:00:25,140 --> 00:00:26,100
Today, this is my second.

11
00:00:26,100 --> 00:00:28,640
Okay, yeah, so I had two in a row as well, minus the end of the day.

12
00:00:28,660 --> 00:00:30,600
I was over at Hackistat for the earlier part of the day.

13
00:00:30,600 --> 00:00:31,560
It's been a busy day.

14
00:00:31,560 --> 00:00:32,760
Yeah , I tried to go over there and catch you on it.

15
00:00:32,760 --> 00:00:33,280
I didn't see you.

16
00:00:33,280 --> 00:00:34,720
We crossed paths apparently.

17
00:00:34,760 --> 00:00:36,720
Yeah, you were looking for me when I was coming here.

18
00:00:36,720 --> 00:00:40,860
Okay, before we talk too much, let's go ahead and get the teams all queued up...

19
00:00:40,860 --> 00:00:42,160
because I know they're ready to go.

20
00:00:42,160 --> 00:00:43,500
So it looks like we're getting the thumbs up.

21
00:00:43,500 --> 00:00:44,520
So let's do the countdown.

22
00:00:44,520 --> 00:00:45,080
You ready?

23
00:00:45,420 --> 00:00:49,400
5, 4, 3, 2, 1.

24
00:00:49,980 --> 00:00:50,700
Lift off.

25
00:00:50,700 --> 00:00:51,560
Wrong one, sorry.

26
00:00:51,560 --> 00:00:52,720
Refresh, refresh.

27
00:00:52,720 --> 00:00:53,260
And they're going.

28
00:00:53,260 --> 00:00:55,040
Okay, so we're watching them go.

29
00:00:55,420 --> 00:00:56,200
Alright.

30
00:00:56,380 --> 00:00:56,960
Perfect.

31
00:00:56,960 --> 00:00:57,980
So let's pull up.

32
00:00:57,980 --> 00:00:58,960
Who do we want to look at?

33
00:00:58,960 --> 00:01:03,480
Let's look at NorseCode because MMM is dealing with VMware file systems right now.

34
00:01:03,480 --> 00:01:04,040
Oh, no.

35
00:01:04,040 --> 00:01:05,100
Yeah, did they mount it?

36
00:01:05,100 --> 00:01:06,600
Yeah, they're bringing that in there.

37
00:01:07,100 --> 00:01:09,060
Alright, so NorseCode's got it.

38
00:01:10,060 --> 00:01:15,040
We've got a standard libc, LD, and then the challenge binary itself.

39
00:01:15,700 --> 00:01:19,420
Are both these guys working Windows in VMs and Windows?

40
00:01:19,420 --> 00:01:20,420
It looks like it, yeah.

41
00:01:20,420 --> 00:01:22,800
We've both got native...

42
00:01:22,800 --> 00:01:23,900
Wait, no, no, no, no.

43
00:01:23,900 --> 00:01:24,960
Is that native Windows?

44
00:01:24,960 --> 00:01:26,160
That doesn't look like native Windows.

45
00:01:26,160 --> 00:01:26,640
This?

46
00:01:26,660 --> 00:01:27,900
This one over here in Norse.

47
00:01:27,900 --> 00:01:28,600
That's not native Windows launcher.

48
00:01:28,600 --> 00:01:29,960
Oh, that might be Windows in a VM.

49
00:01:29,960 --> 00:01:30,840
No, that's in Ubuntu.

50
00:01:30,840 --> 00:01:31,760
Oh, it is.

51
00:01:31,760 --> 00:01:32,500
Good call.

52
00:01:32,500 --> 00:01:35,420
I don't know what the launcher they're using at the bottom, though.

53
00:01:35,680 --> 00:01:37,040
Alright, so we're in IDA.

54
00:01:37,040 --> 00:01:38,240
They're pulling up the challenge.

55
00:01:38,660 --> 00:01:40,460
We've got Bob's Cheap Flights.

56
00:01:40,460 --> 00:01:41,720
Oh, did you actually talk about this?

57
00:01:41,720 --> 00:01:42,740
This is Mark's challenge, right?

58
00:01:42,740 --> 00:01:43,880
Oh, yeah, this is Mark's challenge.

59
00:01:43,880 --> 00:01:44,800
It's called Cheap Flight.

60
00:01:44,800 --> 00:01:46,040
Okay, I haven't actually seen it.

61
00:01:46,320 --> 00:01:48,780
And the gist of it is...

62
00:01:48,780 --> 00:01:50,360
Well, the team's can't hear us, so it's fine.

63
00:01:50,500 --> 00:01:54,720
The gist of it is that you have shellcode, but you only have a certain number of bytes in it.

64
00:01:54,840 --> 00:01:55,560
Cheap flights.

65
00:01:55,560 --> 00:01:56,680
You've got to keep it very cheap.

66
00:01:56,680 --> 00:02:00,920
Okay, real quick, I just want to point out, very nice of them to have two different color schemes for us.

67
00:02:00,920 --> 00:02:02,400
We have the light theme and the dark theme.

68
00:02:02,460 --> 00:02:04,660
Even the IDAs were light theme and dark theme.

69
00:02:04,660 --> 00:02:05,780
Oh , not number of bytes.

70
00:02:05,780 --> 00:02:07,360
The sum of the bytes.

71
00:02:07,360 --> 00:02:08,360
Oh, the sum of the values.

72
00:02:08,360 --> 00:02:11,080
The sum of the bytes in the shellcode has to be under a certain value.

73
00:02:11,080 --> 00:02:11,840
Interesting.

74
00:02:11,860 --> 00:02:13,920
So it's shellcode where you have to have lower...

75
00:02:14,720 --> 00:02:16,000
Low opcode shellcode.

76
00:02:16,000 --> 00:02:16,640
Interesting.

77
00:02:16,640 --> 00:02:17,200
Okay.

78
00:02:17,200 --> 00:02:24,600
Or, you know, jump earlier and put your shellcode in a place where before it, you have bytes that sort stuff out.

79
00:02:24,720 --> 00:02:25,040
Interesting.

80
00:02:25,040 --> 00:02:28,020
Yeah, that makes it do kind of a stager approach.

81
00:02:28,080 --> 00:02:29,720
And then swap it over.

82
00:02:29,720 --> 00:02:34,120
All right, so let's go ahead and switch over to...

83
00:02:34,580 --> 00:02:35,360
Where are we?

84
00:02:35,360 --> 00:02:36,820
Maple Mallard Parliament.

85
00:02:36,820 --> 00:02:39,680
Maple Parliament Ducks of Bacon.

86
00:02:39,880 --> 00:02:42,560
I don't... Yeah, MPD.

87
00:02:42,600 --> 00:02:44,780
Yeah, I call them the Mighty Ducks.

88
00:02:44,780 --> 00:02:45,240
The Mighty Ducks.

89
00:02:45,240 --> 00:02:46,200
I like the Mighty Ducks.

90
00:02:46,580 --> 00:02:47,960
They don't even have ducks in the name anymore.

91
00:02:48,020 --> 00:02:54,500
Yeah, we're already working on our... Oh, and also, we've had different players from MMM come up in the past.

92
00:02:54,500 --> 00:02:56,180
Do we know the player?

93
00:02:56,180 --> 00:02:57,260
I don't know the player.

94
00:02:57,260 --> 00:02:59,300
It's his first time doing live CTF.

95
00:02:59,300 --> 00:03:00,280
I know it's a new player.

96
00:03:00,280 --> 00:03:01,340
A new player at CTF.

97
00:03:01,580 --> 00:03:02,220
And live CTF.

98
00:03:02,220 --> 00:03:03,080
That's fantastic.

99
00:03:03,180 --> 00:03:06,080
Yeah, and also for Norse code.

100
00:03:06,820 --> 00:03:09,640
Yeah, the normal guy came in and dropped this guy off.

101
00:03:09,640 --> 00:03:10,980
And I look at this guy, I'm like, you're not playing?

102
00:03:10,980 --> 00:03:12,660
He's like, hi, I'm the shellcode guy.

103
00:03:13,100 --> 00:03:14,860
Oh, very nice.

104
00:03:14,900 --> 00:03:16,580
I hope he lives up to the title.

105
00:03:16,580 --> 00:03:17,840
Okay, that makes a ton of sense.

106
00:03:17,840 --> 00:03:23,220
So we did tell, again, we tell teams the category, and so they knew this is a shellcoding challenge, right?

107
00:03:23,220 --> 00:03:26,140
We just said, I think x64 shellcode probably is what we put in there?

108
00:03:26,140 --> 00:03:28,520
Yeah, x64 shellcode I think was the exact category.

109
00:03:28,520 --> 00:03:31,800
But yeah, we like to put the architecture in just so they know there's nothing crazy or tricky.

110
00:03:31,800 --> 00:03:35,500
Yeah , we're not doing arm shellcoding because that would be a rude wakeup.

111
00:03:35,500 --> 00:03:37,720
We just don't want to deal with the infrastructure.

112
00:03:37,760 --> 00:03:40,220
We did do an arm challenge last year.

113
00:03:40,540 --> 00:03:41,800
Oh, we did.

114
00:03:43,100 --> 00:03:43,900
We'll see.

115
00:03:43,900 --> 00:03:46,140
It may be a little while before we do that again.

116
00:03:46,140 --> 00:03:47,940
All right, so Maple is working back.

117
00:03:47,940 --> 00:03:49,340
We've already got our PwnTools.

118
00:03:50,240 --> 00:03:51,120
They've got their shell.

119
00:03:51,120 --> 00:03:52,020
So they're just pulling up Shellcraft.

120
00:03:52,040 --> 00:03:54,820
They're just going through Shellcraft SH.

121
00:03:54,820 --> 00:03:56,600
They're just going to try the simplest one.

122
00:03:56,600 --> 00:03:58,500
I wasn't the one that verified this.

123
00:03:58,500 --> 00:03:59,600
I don't know if this will work.

124
00:03:59,600 --> 00:04:01,780
If this works, I'll be sorely disappointed.

125
00:04:02,000 --> 00:04:03,840
Yeah, that means we didn't do a very good job.

126
00:04:03,840 --> 00:04:04,640
I don't think it will.

127
00:04:04,640 --> 00:04:05,440
Oh, Shinmo.

128
00:04:06,400 --> 00:04:08,620
Oh, then Shinmo's done my CTF before.

129
00:04:08,620 --> 00:04:09,740
Maybe not yet this year.

130
00:04:09,740 --> 00:04:11,660
No, I mean this roundabout.

131
00:04:12,420 --> 00:04:13,740
But it's too expensive.

132
00:04:13,740 --> 00:04:14,660
We'll just implode instead.

133
00:04:14,700 --> 00:04:15,360
Yikes.

134
00:04:15,360 --> 00:04:17,040
Okay, so that's what we're seeing.

135
00:04:17,340 --> 00:04:20,660
So this challenge is not really much of a reversing challenge.

136
00:04:20,660 --> 00:04:21,720
It's not a Pwnable challenge.

137
00:04:21,720 --> 00:04:23,380
We will literally run their shellcode.

138
00:04:23,380 --> 00:04:26,920
We just have to make sure all the bytes, when you add up, are a small value.

139
00:04:26,920 --> 00:04:28,000
Or less than some amount.

140
00:04:28,000 --> 00:04:29,740
We can go over to Norse code right now.

141
00:04:29,740 --> 00:04:30,920
They might be in the function.

142
00:04:31,460 --> 00:04:32,400
They are in IDA.

143
00:04:32,400 --> 00:04:33,980
Let's take a look at what they're looking at.

144
00:04:33,980 --> 00:04:36,660
And we've even got symbols right here on the...

145
00:04:36,660 --> 00:04:37,880
Here we go.

146
00:04:39,240 --> 00:04:43,300
Oh, and it looks like it just gives you what you've sent it so far.

147
00:04:45,880 --> 00:04:47,440
Number of airports.

148
00:04:48,420 --> 00:04:50,140
Oh, so it's just the number of stops.

149
00:04:50,140 --> 00:04:54,320
But I think the total cost is what really gets it.

150
00:04:54,320 --> 00:04:55,140
Yeah, here we go.

151
00:04:56,440 --> 00:04:59,060
So, it needs to be less than 2,000.

152
00:04:59,060 --> 00:05:00,660
Less than or equal to 2,000.

153
00:05:00,780 --> 00:05:01,700
If you add up all the bytes.

154
00:05:01,700 --> 00:05:04,040
The sum of all of the bytes that is in the shellcode.

155
00:05:04,040 --> 00:05:04,820
So what is that?

156
00:05:04,880 --> 00:05:08,360
Normal, Finesse shellcode is like 27 bytes for verbose.

157
00:05:08,360 --> 00:05:10,640
Yeah, but again, what are the values of those bytes?

158
00:05:10,640 --> 00:05:12,440
If any of them were FFs, for example.

159
00:05:12,820 --> 00:05:13,500
Oh , yeah.

160
00:05:13,500 --> 00:05:14,960
Then you might want to FF.

161
00:05:15,040 --> 00:05:16,240
Like a negative one.

162
00:05:18,140 --> 00:05:18,920
Yeah, so just some...

163
00:05:18,920 --> 00:05:19,860
You know what, I'm actually surprised.

164
00:05:19,860 --> 00:05:25,460
Again, we saw that the shellcraft kind of come up really quickly.

165
00:05:25,700 --> 00:05:28,720
But I think that you would expect that not to be the solution.

166
00:05:28,720 --> 00:05:31,600
No , that's a sudden death solution right there.

167
00:05:31,600 --> 00:05:33,600
We actually saw that one in sudden death.

168
00:05:33,600 --> 00:05:34,120
Yeah.

169
00:05:34,960 --> 00:05:35,740
Oh, there we go.

170
00:05:35,740 --> 00:05:36,780
So we're debugging it.

171
00:05:36,780 --> 00:05:37,560
Yeehaw, it's time for a trip.

172
00:05:37,560 --> 00:05:38,720
Wait, was that it?

173
00:05:38,720 --> 00:05:40,180
Are we that quick on MMM?

174
00:05:40,780 --> 00:05:42,140
There's no way.

175
00:05:42,620 --> 00:05:45,140
This might be our fastest solve ever here.

176
00:05:45,140 --> 00:05:46,480
Wait, there's no way.

177
00:05:50,230 --> 00:05:51,970
So their initial payload...

178
00:05:51,970 --> 00:05:54,650
So that is the payload.

179
00:05:54,650 --> 00:05:57,050
This might be the fastest solve yet here.

180
00:05:57,050 --> 00:05:58,730
This might be the quickest.

181
00:05:59,270 --> 00:06:00,470
Oh my goodness.

182
00:06:00,470 --> 00:06:02,670
That was amazing.

183
00:06:02,670 --> 00:06:03,810
Look at that.

184
00:06:04,010 --> 00:06:05,530
They're going to throw it live.

185
00:06:05,530 --> 00:06:07,210
That is a blowout.

186
00:06:07,210 --> 00:06:09,050
What a fast solve.

187
00:06:09,770 --> 00:06:11,690
They lived up to their reputation.

188
00:06:12,570 --> 00:06:13,970
It's Jimmo.

189
00:06:13,970 --> 00:06:14,590
Yeah.

190
00:06:17,150 --> 00:06:18,870
Fantastic speedrun.

191
00:06:18,870 --> 00:06:22,130
A true speedrun from Jimmo for MMM.

192
00:06:22,290 --> 00:06:24,770
We've got a solve in record time.

193
00:06:24,770 --> 00:06:25,970
How fast was that?

194
00:06:25,970 --> 00:06:27,510
Seven or eight minute solve.

195
00:06:27,730 --> 00:06:28,530
That was fantastic.

196
00:06:28,530 --> 00:06:29,870
I can find out right now.

197
00:06:29,870 --> 00:06:32,770
We have debug prints from all of the interactions here.

198
00:06:32,770 --> 00:06:36,250
We'll pull up and see what the actual solve time was.

199
00:06:36,250 --> 00:06:37,750
Yeah, poor Norse code.

200
00:06:37,970 --> 00:06:40,690
Trying to compete with that is rough.

201
00:06:40,810 --> 00:06:41,830
What a quick one.

202
00:06:42,230 --> 00:06:45,790
Honestly, we debate internally a lot about how hard things should or shouldn't be.

203
00:06:45,790 --> 00:06:48,810
If every one of our challenges was that fast, they'd all be sudden deaths.

204
00:06:49,170 --> 00:06:50,210
Very quick.

205
00:06:50,210 --> 00:06:51,350
Quick to the solution.

206
00:06:51,350 --> 00:06:53,310
Just a quick pop XOR.

207
00:06:53,730 --> 00:06:55,710
Move constants.

208
00:06:55,830 --> 00:06:56,650
XOR syscall.

209
00:06:57,610 --> 00:06:59,430
They're just calling into receive, aren't they?

210
00:06:59,430 --> 00:07:00,770
I bet they're just calling into receive.

211
00:07:00,770 --> 00:07:01,790
They're calling into receive, yeah.

212
00:07:03,130 --> 00:07:04,190
Well done.

213
00:07:05,170 --> 00:07:07,530
That's absolutely a completely valid solution.

214
00:07:07,530 --> 00:07:08,470
Perfectly valid.

215
00:07:08,550 --> 00:07:09,570
Very cool.

216
00:07:10,010 --> 00:07:12,710
I'm happy we get a longer break now.

217
00:07:12,890 --> 00:07:13,710
Yeah, longer break.

218
00:07:13,710 --> 00:07:14,910
This is the last one of the day.

219
00:07:15,350 --> 00:07:16,730
Other matches still running.

220
00:07:16,810 --> 00:07:19,250
Everyone different, depending on how you're watching this.

221
00:07:19,250 --> 00:07:22,330
If you're there on YouTube, go up to our channel and look at the other live ones.

222
00:07:22,350 --> 00:07:25,070
You can watch the other two teams that are going, which right now is...

223
00:07:26,430 --> 00:07:27,610
Shellfish and Mhacaroni, right?

224
00:07:27,610 --> 00:07:29,910
Shellfish and Mhacaroni, who've both been doing very well.

225
00:07:29,910 --> 00:07:32,770
Honestly, before their losses, they both were doing very, very well.

226
00:07:32,770 --> 00:07:34,370
I expect that to be a good match as well.

227
00:07:34,370 --> 00:07:36,290
Mhacaroni is in a killer run right now.

228
00:07:36,290 --> 00:07:37,770
They've knocked out some big teams.

229
00:07:37,770 --> 00:07:45,070
But they also, just in the last round, back-to-back just got knocked out in that very close race that I casted with Fall.

230
00:07:45,930 --> 00:07:47,870
I mean, it was seconds apart.

231
00:07:47,870 --> 00:07:49,210
So they were really, really close.

232
00:07:50,070 --> 00:07:52,290
That was stressful, I'm sure, for them.

233
00:07:52,290 --> 00:07:53,650
But hopefully they do well.

234
00:07:53,650 --> 00:07:55,170
Go ahead and check out the other streams.

235
00:07:55,570 --> 00:07:57,870
Keep an eye out on the channel, because we'll be back.

236
00:07:57,990 --> 00:07:59,390
We'll be back tomorrow.

237
00:07:59,530 --> 00:08:01,830
Tomorrow morning at 11?

238
00:08:01,990 --> 00:08:02,690
I think 11.

239
00:08:03,590 --> 00:08:05,630
Actually, yeah, we can look on our schedule.

240
00:08:05,630 --> 00:08:06,110
11 a.m.

241
00:08:06,130 --> 00:08:09,650
tomorrow, we've got four matches tomorrow, I believe.

242
00:08:09,650 --> 00:08:10,590
Tomorrow at 10.

243
00:08:10,590 --> 00:08:11,810
No, our first match is 10.

244
00:08:11,810 --> 00:08:15,490
We have a 10-11, a 1 and a 2.

245
00:08:15,710 --> 00:08:18,270
So our final match will be 2-3.

246
00:08:19,010 --> 00:08:19,730
And that'll...

247
00:08:19,730 --> 00:08:20,770
We're getting to the top of the top.

248
00:08:20,770 --> 00:08:24,610
Every one of the matches tomorrow, we're done with our off-stream streams.

249
00:08:24,610 --> 00:08:25,930
So there's only going to be one stream.

250
00:08:25,930 --> 00:08:28,150
It's just going to be us here.

251
00:08:28,150 --> 00:08:31,210
And you'll be able to see what the teams are doing through that.

252
00:08:31,870 --> 00:08:36,430
Our last two lower bracket challenges, and then we're going to move into the upper ones as well.

253
00:08:36,430 --> 00:08:37,930
Only five teams left.

254
00:08:37,930 --> 00:08:40,170
It's going to go pretty quick.

255
00:08:40,390 --> 00:08:42,330
Oh, it's going to be close races.

256
00:08:42,510 --> 00:08:47,230
So as a reminder, every team, they're playing for a bunch of points in the main DEF CON CTF.

257
00:08:47,230 --> 00:08:53,750
And so for context, right now, the main DEF CON CTF goes anywhere from 3,700 to about 2,600 points.

258
00:08:54,750 --> 00:08:59,810
Between first to last, I guess it's about 2,000 points to almost 4,000 points.

259
00:08:59,810 --> 00:09:00,710
There's a light blinding me.

260
00:09:00,710 --> 00:09:01,350
I can't see the screen.

261
00:09:01,490 --> 00:09:04,830
There is 1337 points going to first place.

262
00:09:04,890 --> 00:09:05,430
No!

263
00:09:05,430 --> 00:09:06,870
Last place gets 500 points.

264
00:09:06,870 --> 00:09:09,290
So it's actually only a difference of about 800 points.

265
00:09:09,490 --> 00:09:13,570
800 points is half the split from first to last.

266
00:09:13,570 --> 00:09:14,430
Well , no, no.

267
00:09:14,430 --> 00:09:19,490
So the way that the spread is, 800 points would take, for example, somebody from maybe third to first.

268
00:09:19,490 --> 00:09:23,110
Oh, Jordan, while we're talking about this, actually... What's this?

269
00:09:24,330 --> 00:09:25,410
Mhacaroni won.

270
00:09:25,410 --> 00:09:25,890
Did they?

271
00:09:25,890 --> 00:09:26,750
Just now.

272
00:09:26,750 --> 00:09:27,510
Fantastic.

273
00:09:27,510 --> 00:09:29,270
So, again, another quick match.

274
00:09:29,270 --> 00:09:29,930
Wow.

275
00:09:30,030 --> 00:09:31,130
Very fast match.

276
00:09:31,390 --> 00:09:36,170
She's been knocked out of the competition, but Mhacaroni... That was three minutes after MMM.

277
00:09:36,170 --> 00:09:37,070
Yeah, pretty quick.

278
00:09:37,070 --> 00:09:38,230
Oh my goodness.

279
00:09:38,230 --> 00:09:41,110
So all of our games, all of our challenges are done for the day today.

280
00:09:41,110 --> 00:09:43,250
We've got, like I said, those four more tomorrow.

281
00:09:43,250 --> 00:09:46,550
We'll see the final few matches, and we'll be back then.

282
00:09:46,550 --> 00:09:47,510
We'll see you back.

283
00:09:47,510 --> 00:09:48,070
Cheers.

284
00:09:48,070 --> 00:09:48,810
Have fun.