start	end	text
11300	14940	Hello and welcome back everybody. We're here for our last round of the day.
14940	18360	Day 2. I'm Cyber Protection Jordan. You just saw me with Brandon and...
18360	22760	I'm Josh Negasora and you saw me three casts ago. It's been a long day, Jordan.
22840	25140	It has been a long day. How many streams have you had today?
25140	26100	Today, this is my second.
26100	28640	Okay, yeah, so I had two in a row as well, minus the end of the day.
28660	31560	I was over at Hackistat for the earlier part of the day. It's been a busy day.
31560	34720	Yeah, I tried to go over there and catch you on it. I didn't see you. We crossed paths apparently.
34760	36720	Yeah, you were looking for me when I was coming here.
36720	40860	Okay, before we talk too much, let's go ahead and get the teams all queued up...
40860	43500	because I know they're ready to go. So it looks like we're getting the thumbs up.
43500	45080	So let's do the countdown. You ready?
45420	49400	5, 4, 3, 2, 1.
49980	51560	Lift off. Wrong one, sorry.
51560	55040	Refresh, refresh. And they're going. Okay, so we're watching them go.
55420	56200	Alright.
56380	58960	Perfect. So let's pull up. Who do we want to look at?
58960	63480	Let's look at NorseCode because MMM is dealing with VMware file systems right now.
63480	66600	Oh, no. Yeah, did they mount it? Yeah, they're bringing that in there.
67100	69060	Alright, so NorseCode's got it.
70060	75040	We've got a standard libc, LD, and then the challenge binary itself.
75700	79420	Are both these guys working Windows in VMs and Windows?
79420	82800	It looks like it, yeah. We've both got native...
82800	86160	Wait, no, no, no, no. Is that native Windows? That doesn't look like native Windows.
86160	86640	This?
86660	88600	This one over here in Norse. That's not native Windows launcher.
88600	89960	Oh, that might be Windows in a VM.
89960	90840	No, that's in Ubuntu.
90840	92500	Oh, it is. Good call.
92500	95420	I don't know what the launcher they're using at the bottom, though.
95680	98240	Alright, so we're in IDA. They're pulling up the challenge.
98660	100460	We've got Bob's Cheap Flights.
100460	102740	Oh, did you actually talk about this? This is Mark's challenge, right?
102740	104800	Oh, yeah, this is Mark's challenge. It's called Cheap Flight.
104800	106040	Okay, I haven't actually seen it.
106320	108780	And the gist of it is...
108780	110360	Well, the team's can't hear us, so it's fine.
110500	114720	The gist of it is that you have shellcode, but you only have a certain number of bytes in it.
114840	116680	Cheap flights. You've got to keep it very cheap.
116680	118720	Okay, real quick, I just want to point out,
118720	120920	very nice of them to have two different color schemes for us.
120920	122400	We have the light theme and the dark theme.
122460	124660	Even the IDAs were light theme and dark theme.
124660	127360	Oh, not number of bytes. The sum of the bytes.
127360	128360	Oh, the sum of the values.
128360	131080	The sum of the bytes in the shellcode has to be under a certain value.
131080	133920	Interesting. So it's shellcode where you have to have lower...
134720	136000	Low opcode shellcode.
136000	137200	Interesting. Okay.
137200	142280	Or, you know, jump earlier and put your shellcode in a place where before it,
142280	144600	you have bytes that sort stuff out.
144720	148020	Interesting. Yeah, that makes it do kind of a stager approach.
148080	149720	And then swap it over.
149720	154120	All right, so let's go ahead and switch over to...
154580	156820	Where are we? Maple Mallard Parliament.
156820	159680	Maple Parliament Ducks of Bacon.
159880	162560	I don't... Yeah, MPD.
162600	164780	Yeah, I call them the Mighty Ducks.
164780	166200	The Mighty Ducks. I like the Mighty Ducks.
166580	167960	They don't even have ducks in the name anymore.
168020	170200	Yeah, we're already working on our... Oh, and also,
170720	174500	we've had different players from MMM come up in the past.
174500	176180	Do we know the player?
176180	179300	I don't know the player. It's his first time doing live CTF.
179300	181340	I know it's a new player. A new player at CTF.
181580	183080	And live CTF. That's fantastic.
183180	186080	Yeah, and also for Norse code.
186820	189640	Yeah, the normal guy came in and dropped this guy off.
189640	190980	And I look at this guy, I'm like, you're not playing?
190980	192660	He's like, hi, I'm the shellcode guy.
193100	194860	Oh, very nice.
194900	196580	I hope he lives up to the title.
196580	198640	Okay, that makes a ton of sense. So we did tell, again,
198640	200820	we tell teams the category, and so they knew
201180	203220	this is a shellcoding challenge, right?
203220	206140	We just said, I think x64 shellcode probably is what we put in there?
206140	208520	Yeah, x64 shellcode I think was the exact category.
208520	210320	But yeah, we like to put the architecture in
210320	211800	just so they know there's nothing crazy or tricky.
211800	215500	Yeah, we're not doing arm shellcoding because that would be a rude wakeup.
215500	217720	We just don't want to deal with the infrastructure.
217760	220220	We did do an arm challenge last year.
220540	221800	Oh, we did.
223100	223900	We'll see.
223900	226140	It may be a little while before we do that again.
226140	227940	All right, so Maple is working back.
227940	229340	We've already got our PwnTools.
230240	231120	They've got their shell.
231120	232020	So they're just pulling up Shellcraft.
232040	234820	They're just going through Shellcraft SH.
234820	236600	They're just going to try the simplest one.
236600	238500	I wasn't the one that verified this.
238500	239600	I don't know if this will work.
239600	241780	If this works, I'll be sorely disappointed.
242000	243840	Yeah, that means we didn't do a very good job.
243840	244640	I don't think it will.
244640	245440	Oh, Shinmo.
246400	248620	Oh, then Shinmo's done my CTF before.
248620	249740	Maybe not yet this year.
249740	251660	No, I mean this roundabout.
252420	255360	But it's too expensive. We'll just implode instead. Yikes.
255360	257040	Okay, so that's what we're seeing.
257340	260660	So this challenge is not really much of a reversing challenge.
260660	261720	It's not a Pwnable challenge.
261720	263380	We will literally run their shellcode.
263380	264940	We just have to make sure all the bytes,
264940	266920	when you add up, are a small value.
266920	268000	Or less than some amount.
268000	269740	We can go over to Norse code right now.
269740	270920	They might be in the function.
271460	273980	They are in IDA. Let's take a look at what they're looking at.
273980	276660	And we've even got symbols right here on the...
276660	277880	Here we go.
279240	280520	Oh, and it looks like it just
281380	283300	gives you what you've sent it so far.
285880	287440	Number of airports.
288420	290140	Oh, so it's just the number of stops.
290140	291580	But I think the total cost
291580	294320	is what really gets it.
294320	295140	Yeah, here we go.
296440	299060	So, it needs to be less than 2,000.
299060	300660	Less than or equal to 2,000.
300780	301700	If you add up all the bytes.
301700	304040	The sum of all of the bytes that is in the shellcode.
304040	305360	So what is that? Normal,
305360	308360	Finesse shellcode is like 27 bytes for verbose.
308360	310640	Yeah, but again, what are the values of those bytes?
310640	312440	If any of them were FFs, for example.
312820	313500	Oh, yeah.
313500	314960	Then you might want to FF.
315040	316240	Like a negative one.
318140	318920	Yeah, so just some...
318920	319860	You know what, I'm actually surprised.
319860	321380	Again, we saw that
322640	325460	the shellcraft kind of come up really quickly.
325700	326500	But I think that
326500	328720	you would expect that not to be the solution.
328720	331600	No, that's a sudden death solution right there.
331600	333600	We actually saw that one in sudden death.
333600	334120	Yeah.
334960	336780	Oh, there we go. So we're debugging it.
336780	338720	Yeehaw, it's time for a trip. Wait, was that it?
338720	340180	Are we that quick on MMM?
340780	342140	There's no way.
342620	345140	This might be our fastest solve ever here.
345140	346480	Wait, there's no way.
350230	351970	So their initial payload...
351970	354650	So that is the payload.
354650	357050	This might be the fastest solve yet here.
357050	358730	This might be the quickest.
359270	360470	Oh my goodness.
360470	362670	That was amazing.
362670	363810	Look at that.
364010	365530	They're going to throw it live.
365530	367210	That is a blowout.
367210	369050	What a fast solve.
369770	371690	They lived up to their reputation.
372570	373970	It's Jimmo.
373970	374590	Yeah.
377150	378870	Fantastic speedrun.
378870	382130	A true speedrun from Jimmo for MMM.
382290	384770	We've got a solve in record time.
384770	385970	How fast was that?
385970	387510	Seven or eight minute solve.
387730	388530	That was fantastic.
388530	389870	I can find out right now.
389870	392770	We have debug prints from all of the interactions here.
392770	396250	We'll pull up and see what the actual solve time was.
396250	397750	Yeah, poor Norse code.
397970	400690	Trying to compete with that is rough.
400810	401830	What a quick one.
402230	405790	Honestly, we debate internally a lot about how hard things should or shouldn't be.
405790	407430	If every one of our challenges was that fast,
407430	408810	they'd all be sudden deaths.
409170	411350	Very quick. Quick to the solution.
411350	413310	Just a quick pop XOR.
413730	415710	Move constants.
415830	416650	XOR syscall.
417610	419430	They're just calling into receive, aren't they?
419430	420770	I bet they're just calling into receive.
420770	421790	They're calling into receive, yeah.
423130	424190	Well done.
425170	427530	That's absolutely a completely valid solution.
427530	428470	Perfectly valid.
428550	429570	Very cool.
430010	432710	I'm happy we get a longer break now.
432890	434910	Yeah, longer break. This is the last one of the day.
435350	436730	Other matches still running.
436810	439250	Everyone different, depending on how you're watching this.
439250	440910	If you're there on YouTube, go up to our channel
440910	442330	and look at the other live ones.
442350	445070	You can watch the other two teams that are going, which right now is...
446430	447610	Shellfish and Mhacaroni, right?
447610	449910	Shellfish and Mhacaroni, who've both been doing very well.
449910	451430	Honestly, before their losses,
451430	452770	they both were doing very, very well.
452770	454370	I expect that to be a good match as well.
454370	456290	Mhacaroni is in a killer run right now.
456290	457770	They've knocked out some big teams.
457770	460590	But they also, just in the last round,
460590	461790	back-to-back just got knocked out
461790	463690	in that very close race
463690	465070	that I casted with Fall.
465930	467870	I mean, it was seconds apart.
467870	469210	So they were really, really close.
470070	472290	That was stressful, I'm sure, for them.
472290	473650	But hopefully they do well.
473650	475170	Go ahead and check out the other streams.
475570	477870	Keep an eye out on the channel, because we'll be back.
477990	479390	We'll be back tomorrow.
479530	481830	Tomorrow morning at 11?
481990	482690	I think 11.
483590	485630	Actually, yeah, we can look on our schedule.
485630	487410	11 a.m. tomorrow, we've got
487410	489650	four matches tomorrow, I believe.
489650	491810	Tomorrow at 10. No, our first match is 10.
491810	492950	We have a 10-11,
494250	495490	a 1 and a 2.
495710	498270	So our final match will be 2-3.
499010	499730	And that'll...
499730	500770	We're getting to the top of the top.
500770	503250	Every one of the matches tomorrow, we're done with our
503250	505930	off-stream streams. So there's only going to be one stream.
505930	508150	It's just going to be us here.
508150	509490	And you'll be able to see what
509490	511210	the teams are doing through that.
511870	513710	Our last two lower bracket
513710	515670	challenges, and then we're going to move into the
515670	517930	upper ones as well. Only five teams left.
517930	520170	It's going to go pretty quick.
520390	522330	Oh, it's going to be close races.
522510	524030	So as a reminder, every team,
524030	525950	they're playing for a bunch of points
525950	528350	in the main DEF CON CTF. And so for context,
528350	530270	right now, the main DEF CON CTF
530270	531750	goes anywhere from 3,700
531750	533750	to about 2,600 points.
534750	536010	Between first to last,
536010	537530	I guess it's about 2,000 points to
538610	539810	almost 4,000 points.
539810	541350	There's a light blinding me. I can't see the screen.
541490	543970	There is 1337 points going
543970	545430	to first place. No!
545430	547290	Last place gets 500 points. So it's actually
547290	549290	only a difference of about 800 points.
549490	550490	800 points is
551250	553570	half the split from first to last.
553570	555050	Well, no, no. So the way that
555050	557590	the spread is, 800 points would take, for example,
557590	559490	somebody from maybe third to first.
559490	561350	Oh, Jordan, while we're talking about
561350	563110	this, actually... What's this?
564330	565410	Mhacaroni won.
565410	567510	Did they? Just now. Fantastic.
567510	569270	So, again, another quick match.
569270	571130	Wow. Very fast match.
571390	573270	She's been knocked out of the competition, but
573750	575230	Mhacaroni... That was three minutes
575230	577070	after MMM. Yeah, pretty quick.
577070	579270	Oh my goodness. So all of our games,
579270	581110	all of our challenges are done for the day today.
581110	583250	We've got, like I said, those four more tomorrow.
583250	585350	We'll see the final few matches, and
585350	587510	we'll be back then. We'll see you back.
587510	588810	Cheers. Have fun.