1
00:00:11,110 --> 00:00:15,450
Hello and welcome back to the final day of live CTF at DEF CON Finals.

2
00:00:15,790 --> 00:00:17,770
This has been a day.

3
00:00:17,970 --> 00:00:21,070
We're starting late, so without further ado, let's just kick it off.

4
00:00:21,070 --> 00:00:22,330
Final thumbs up?

5
00:00:22,330 --> 00:00:23,090
Let's roll.

6
00:00:23,090 --> 00:00:23,850
All right.

7
00:00:23,950 --> 00:00:27,970
Five, four, three, two, one.

8
00:00:27,990 --> 00:00:29,170
Let's go.

9
00:00:29,290 --> 00:00:33,250
All right, so first off, we're gonna be taking a look at Macaroni.

10
00:00:33,250 --> 00:00:36,810
Yeah, so we've got Macaroni versus MMM.

11
00:00:37,190 --> 00:00:40,590
At this point, we're looking at the lower bracket.

12
00:00:40,750 --> 00:00:41,810
They're fighting to survive.

13
00:00:41,810 --> 00:00:42,690
They still have a chance.

14
00:00:42,690 --> 00:00:44,270
They're very close to the finals at this point.

15
00:00:44,270 --> 00:00:47,210
Both of these teams have only lost one match on their runs.

16
00:00:47,570 --> 00:00:50,230
So, it's double elimination bracket.

17
00:00:50,310 --> 00:00:54,470
Whichever team loses this is out in, what is this, fourth place?

18
00:00:55,290 --> 00:00:56,430
Fifth place?

19
00:00:57,350 --> 00:00:58,090
One of those.

20
00:00:58,250 --> 00:00:59,310
Something like that.

21
00:01:00,010 --> 00:01:01,090
They had a good run.

22
00:01:01,090 --> 00:01:02,090
They're in the top half.

23
00:01:02,090 --> 00:01:03,250
We know that for sure.

24
00:01:03,310 --> 00:01:03,830
Definitely.

25
00:01:03,830 --> 00:01:05,730
You've had to win a lot to get this far.

26
00:01:05,730 --> 00:01:06,190
Yeah.

27
00:01:06,190 --> 00:01:16,130
So going into this challenge, is uleb4096 written by our very own Glenn, who's been running production for a large part of us?

28
00:01:16,870 --> 00:01:19,510
This is a pretty straightforward challenge.

29
00:01:19,510 --> 00:01:20,470
It's a challenge.

30
00:01:20,670 --> 00:01:23,590
In terms of the construction, right?

31
00:01:23,590 --> 00:01:27,450
It presents and says, give me some decoded shellcode.

32
00:01:27,450 --> 00:01:28,050
Yeah .

33
00:01:28,110 --> 00:01:34,030
And so the uleb is a reference to the unsigned little endian byte encoding.

34
00:01:34,030 --> 00:01:34,550
Yeah.

35
00:01:34,550 --> 00:01:40,510
Which is a pretty simple encoding, but it's something that I had never seen before I looked at this challenge.

36
00:01:40,530 --> 00:01:40,890
Same.

37
00:01:40,890 --> 00:01:48,610
But I mentioned it to our resident Mac and iOS expert, and she was just like, she took one look at the function, she's like, oh, this is web.

38
00:01:48,730 --> 00:01:49,090
Wow.

39
00:01:49,090 --> 00:01:50,410
I'm like, are you kidding me?

40
00:01:50,410 --> 00:01:51,330
I could have asked you.

41
00:01:51,330 --> 00:01:53,170
I was trying to verify this thing for so long.

42
00:01:54,570 --> 00:01:54,990
Yeah.

43
00:01:55,070 --> 00:01:57,630
So apparently some people know it very well.

44
00:01:57,630 --> 00:01:59,490
So let's hope the competitors do.

45
00:01:59,630 --> 00:02:00,610
At least one.

46
00:02:00,630 --> 00:02:00,970
Yeah.

47
00:02:00,970 --> 00:02:03,590
Well, I mean, so the good news is, is it's just encoding.

48
00:02:03,590 --> 00:02:04,410
It's not encryption.

49
00:02:04,410 --> 00:02:05,490
It's not crazy.

50
00:02:05,490 --> 00:02:09,810
So even if you aren't familiar with it, which I wasn't, you know, you can Google this.

51
00:02:09,810 --> 00:02:14,510
There are functions online in Stack Overflow that talk about how to use this.

52
00:02:14,950 --> 00:02:20,190
Heck, you can ask ChatGPT to write a functional ULIB decoder and it can do that.

53
00:02:20,190 --> 00:02:20,710
Really?

54
00:02:20,710 --> 00:02:20,970
Yep.

55
00:02:20,970 --> 00:02:21,670
Did you try that?

56
00:02:21,670 --> 00:02:22,230
I did.

57
00:02:22,230 --> 00:02:22,570
Oh my goodness.

58
00:02:22,570 --> 00:02:23,570
I'm not ashamed to say it.

59
00:02:23,570 --> 00:02:27,090
I installed the Python lev128 package.

60
00:02:27,090 --> 00:02:28,570
Which was the right thing to do.

61
00:02:28,570 --> 00:02:36,570
I did that too, but then I fell back to the ChatGPT function because I had made a mistake and it wasn't working.

62
00:02:36,910 --> 00:02:42,310
So we see over on MMM, PPP, ducks.

63
00:02:42,850 --> 00:02:44,310
They've had a lot of names.

64
00:02:44,310 --> 00:02:45,570
They've had so many names.

65
00:02:45,570 --> 00:02:46,730
They're going through.

66
00:02:46,770 --> 00:02:52,290
He's running just straight, you know, shellcraft-sh-shellcode, seeing what happens to it.

67
00:02:52,490 --> 00:02:57,250
And then going back into S-tray, seeing what the actual calls are, wondering like, did my registers get messed up?

68
00:02:57,250 --> 00:02:58,330
What's going on?

69
00:02:58,790 --> 00:03:01,890
No, this actually changes the encoding.

70
00:03:01,890 --> 00:03:04,630
Or I guess decoding?

71
00:03:04,630 --> 00:03:05,050
Right.

72
00:03:05,050 --> 00:03:11,950
This is a little bit of a weird challenge to think about because normally you'd think, oh, I've got my bytes.

73
00:03:11,950 --> 00:03:14,950
I want to encode them into some sort of encoding.

74
00:03:15,930 --> 00:03:18,730
But this is actually asking for decoded.

75
00:03:18,870 --> 00:03:24,830
And so you're kind of having to do the mental math of saying, okay, how do I go from decoded to encoded?

76
00:03:24,830 --> 00:03:28,950
Because what gets encoded is what's going to be run as shellcode.

77
00:03:28,950 --> 00:03:29,650
Yeah.

78
00:03:29,810 --> 00:03:35,910
So it's kind of reminiscent of like a targeted plain text attack.

79
00:03:36,250 --> 00:03:38,730
Like, it's really weird.

80
00:03:38,730 --> 00:03:40,130
It's mental gymnastics to get around.

81
00:03:40,130 --> 00:03:46,470
And actually, over on Macaroni, they're looking at the Leb128 Python package we were just talking about.

82
00:03:46,470 --> 00:03:47,390
It's just a matter of time.

83
00:03:47,390 --> 00:03:48,830
And I was thinking about that.

84
00:03:48,830 --> 00:03:53,010
I was interested to see how long would they look at the challenge before looking at the encoding?

85
00:03:53,110 --> 00:04:04,350
Because it's definitely necessary to look at the encoding in this one because the encoding itself enforces a constraint that's actually very difficult for shellcode and really I think is the crux of this problem.

86
00:04:04,470 --> 00:04:04,870
Yeah .

87
00:04:05,030 --> 00:04:11,410
And honestly, one thing I'm learning from this is we can make people install whatever package we want just by making a challenge around it.

88
00:04:11,490 --> 00:04:21,930
You know, I want to say that CTS was the one who famously had said you can use a CTF problem to get people to do work for you.

89
00:04:21,930 --> 00:04:22,950
Oh, it's so true.

90
00:04:23,110 --> 00:04:27,490
We were talking about like, oh, what if we have a challenge where it's please fix our CMake config?

91
00:04:27,670 --> 00:04:28,990
Yeah, exactly.

92
00:04:29,050 --> 00:04:34,490
You know, we can get some of the best hackers in the world to look at it for 48 hours for free.

93
00:04:34,950 --> 00:04:37,290
Imagine, we just need to give them fake points.

94
00:04:37,550 --> 00:04:39,430
People will do anything for internet points.

95
00:04:39,430 --> 00:04:45,610
Honestly, I've stayed up 48 hours straight CTFs just for like a couple of 500 point challenges.

96
00:04:46,550 --> 00:04:54,690
So over on MMM, we see them walking through and they're just trying to get a normal like push A rep.

97
00:04:55,270 --> 00:04:56,150
Right.

98
00:04:56,230 --> 00:04:59,850
So I think what they're doing here is that they're exploring the constraint.

99
00:04:59,850 --> 00:05:02,290
And if I recall, the constraint is that...

100
00:05:04,070 --> 00:05:14,330
So ULAB 128 is the actual encoding decoding going on here, which is to say you can take 128 bits and pack them into bytes is kind of how it ends up.

101
00:05:15,070 --> 00:05:20,890
And so what that means is you don't get the high bit to use as your shellcode.

102
00:05:20,890 --> 00:05:24,190
And that really limits the instructions you can use for your shellcode here.

103
00:05:25,170 --> 00:05:29,090
Now, is it that you don't get the high bit or that it sets the high bit for you?

104
00:05:29,090 --> 00:05:31,210
So you need to pass.

105
00:05:31,210 --> 00:05:32,410
Can you only use...

106
00:05:32,410 --> 00:05:35,610
You can only use instructions that have the high bit set.

107
00:05:35,610 --> 00:05:36,450
Yes, you're correct.

108
00:05:36,450 --> 00:05:36,950
Sorry.

109
00:05:36,950 --> 00:05:44,750
I'm just making sure here because like I said, mental gymnastics, looking at this thing, like trying to verify after casting and running offs all day.

110
00:05:44,750 --> 00:05:47,130
It's been a lot, man.

111
00:05:47,130 --> 00:05:47,770
It's been a lot.

112
00:05:47,770 --> 00:05:52,890
I think Carl was saying that our bingo card is getting full for things that can go wrong.

113
00:05:52,890 --> 00:05:53,330
Absolutely .

114
00:05:53,770 --> 00:05:55,490
We had hardware failure.

115
00:05:55,490 --> 00:05:59,790
We had just at the venue, there was a suspicious package that kicked everyone out.

116
00:05:59,790 --> 00:06:00,190
That's right.

117
00:06:00,190 --> 00:06:01,410
They kicked everyone out for it.

118
00:06:01,410 --> 00:06:03,570
We, this morning, had capture card failures.

119
00:06:03,570 --> 00:06:06,090
We had network problems.

120
00:06:06,210 --> 00:06:08,170
We had proxy issues.

121
00:06:08,190 --> 00:06:09,770
It was, oh, okay.

122
00:06:09,770 --> 00:06:14,150
Now we see MMM finding the same Leb128, PwnedToolsLeb128.

123
00:06:14,210 --> 00:06:15,570
I wish.

124
00:06:15,610 --> 00:06:17,190
That would have made my life easier.

125
00:06:17,190 --> 00:06:18,570
But they have a lot of things.

126
00:06:18,570 --> 00:06:19,890
They don't have everything.

127
00:06:20,490 --> 00:06:28,790
But looking at that same Leb128 crate over on Macaroni, they were just looking at usage docs for it.

128
00:06:28,790 --> 00:06:31,230
I think they're going to, yep, they're doing it.

129
00:06:32,090 --> 00:06:34,790
They're going to plug in the code to chat GPT.

130
00:06:35,590 --> 00:06:36,250
See?

131
00:06:36,250 --> 00:06:38,310
Can you explain this function?

132
00:06:38,310 --> 00:06:39,750
Great minds think alike.

133
00:06:39,750 --> 00:06:40,970
I love it.

134
00:06:40,970 --> 00:06:43,450
You know, but this is a real thing, right?

135
00:06:43,450 --> 00:06:44,470
AI is here.

136
00:06:44,470 --> 00:06:49,130
These LLMs are extremely powerful, can help with a lot of varied things.

137
00:06:49,810 --> 00:06:55,250
You know that it might be showing you some things that are incorrect, right?

138
00:06:55,330 --> 00:06:59,590
But it's still better than nothing, especially when you're pressed for time.

139
00:06:59,590 --> 00:07:01,450
This could give you a little bit of a leg up.

140
00:07:01,450 --> 00:07:02,150
Oh, absolutely.

141
00:07:02,150 --> 00:07:09,990
That forward training and just throwing a question at such a large, like, well, LLM, way better than MLM.

142
00:07:09,990 --> 00:07:15,910
And I only got to see the response there for a second, but it did seem to have recognized it as uleb.

143
00:07:15,910 --> 00:07:16,350
It did.

144
00:07:16,350 --> 00:07:20,650
I'm wondering if that's just from the name and if it's going to give information that might lead him down a rabbit hole.

145
00:07:20,650 --> 00:07:21,130
Good point.

146
00:07:21,130 --> 00:07:23,930
Yeah, you can't trust those AIs.

147
00:07:23,930 --> 00:07:25,990
Just like my grandmother always said.

148
00:07:26,830 --> 00:07:32,570
Over on MMM, we don't see any LLMs, which is surprising because it just rolls off the tongue.

149
00:07:32,670 --> 00:07:43,410
We saw him staring for a second just at the code, trying to get a mental model of what's going on and understanding, OK, so it transforms my code, but my code also needs to match a certain set of constraints.

150
00:07:44,310 --> 00:07:59,670
Yeah, and like I said, this encoding, if you're not familiar with it, which I don't think that either of these players are based on what we've seen in terms of them looking at packages and asking questions about what can this do, what does this do, the constraints aren't clear.

151
00:07:59,670 --> 00:08:03,170
If you read the Wikipedia page on this encoding, the constraint isn't clear.

152
00:08:03,170 --> 00:08:08,810
And so what I think we're seeing on the MMM side is that sort of interactive exploration.

153
00:08:08,810 --> 00:08:20,050
So he had a push instruction, I believe it was a push of a 64-bit register, which all of those instructions are going to have the high bit not set.

154
00:08:20,310 --> 00:08:29,330
And so, like I said, this forcing the high bit actually puts you in a weird spot with the x86 instruction set.

155
00:08:29,810 --> 00:08:39,610
Oh yeah, no, and I mean, unless these guys know off the top of their head, you know, the instruction space blocks and the distribution of them, I think this is going to take them some work.

156
00:08:39,630 --> 00:08:50,130
Yeah, I was asking around on our team for the other folks that had looked at this problem, how did you go about trying to figure out what instructions you had available given that constraint?

157
00:08:50,130 --> 00:08:51,770
Because it's kind of a weird thing to ask.

158
00:08:51,770 --> 00:08:52,950
Oh , it's super weird.

159
00:08:53,050 --> 00:08:59,850
And I think that Jordan's answer was, well, you just go straight to the Intel manual and start reading, right?

160
00:08:59,850 --> 00:09:00,910
Which is valid.

161
00:09:00,910 --> 00:09:01,670
Oh, very, yeah.

162
00:09:02,030 --> 00:09:16,930
And Glenn said, oh, there's a table linked from Stack Overflow somewhere that actually has a pretty decent, oh, here's your leading byte, and then it sort of broke down by the value of the leading byte, what instruction categories you could get, which was pretty helpful.

163
00:09:17,070 --> 00:09:18,370
That's really nice.

164
00:09:18,370 --> 00:09:21,830
And honestly, Stack Overflow is a great resource we've seen used earlier today.

165
00:09:21,830 --> 00:09:27,050
It's had some misleading information that led people down side paths and rabbit holes for a bit.

166
00:09:27,090 --> 00:09:30,790
But for weird knowledge like this, it's kind of invaluable.

167
00:09:30,810 --> 00:09:32,090
Yeah, yeah, definitely.

168
00:09:32,090 --> 00:09:43,730
And while it is definitely within the realm of CTF tricks to point people to resources that aren't quite correct, we're not going to be playing those games here.

169
00:09:43,730 --> 00:09:45,250
No , definitely not.

170
00:09:45,550 --> 00:09:50,370
Everything you need for the challenge is laid out in front of you, and if you just experiment with it, you can get it.

171
00:09:50,510 --> 00:09:54,810
Yeah, and we want the competitors to be able to solve this speed challenge.

172
00:09:54,810 --> 00:09:58,390
We know that this is challenging, and we are getting down to the finals here, right?

173
00:09:58,390 --> 00:10:06,230
So we know that these players are the very best, and we want it to be challenging, but we also want it to be solvable.

174
00:10:06,230 --> 00:10:12,010
And I think that the hints for this challenge, we did address that and try to give some good hints.

175
00:10:12,010 --> 00:10:16,050
Yeah, the hints are definitely explaining a lot of the theory behind it.

176
00:10:16,210 --> 00:10:20,250
And if they're off in wrong directions, push them back to the right one.

177
00:10:20,330 --> 00:10:26,090
Right, which if I recall, I think the first hint sort of lays out the constraint that you have to deal with.

178
00:10:26,090 --> 00:10:29,390
The first hint does the chat GPT, can you please explain this code to me?

179
00:10:29,730 --> 00:10:31,990
But a little nicer because it's from the author.

180
00:10:32,010 --> 00:10:40,830
And we saw over on MMM actually, experimenting with different size mobs, or mob of different size registers, and kind of looking at the first byte result of those.

181
00:10:41,230 --> 00:10:47,810
So I'm curious if he's figured this out, and he's just writing the constraints now, what he needs to end up with.

182
00:10:48,170 --> 00:10:48,930
Very interesting.

183
00:10:48,930 --> 00:10:52,970
Yeah, and I think that that experimentation is exactly what I would expect.

184
00:10:53,090 --> 00:10:59,110
You can see he's sort of laying out what he needs and what the constraints are.

185
00:11:00,370 --> 00:11:11,990
So the real kicker with that constraint, and I think that Glenn designed it this way, is that you can't get 64-bit instructions for a lot of the ones that you're going to want.

186
00:11:12,410 --> 00:11:12,810
Yeah .

187
00:11:13,830 --> 00:11:23,150
And so moving the shellcode around, or your shellcode has to be able to read or write memory typically.

188
00:11:23,190 --> 00:11:27,950
It's harder when you don't have the full-width registers, which you would be expecting to use.

189
00:11:27,950 --> 00:11:28,910
You have to find some alternatives.

190
00:11:28,970 --> 00:11:29,830
Absolutely, yeah.

191
00:11:29,830 --> 00:11:48,810
And move of the lower half register, so EAX, EBX, et cetera, operations on low-byte registers, POPs of the low four-byte registers, clears out top four bytes, which is going to be really nice when you end up needing, like, OX3, BNREX.

192
00:11:49,070 --> 00:11:51,810
Oh, and now we see it on the MMSI.

193
00:11:51,810 --> 00:11:55,390
They're looking for that opcode table, and that's exactly the table that I was referencing.

194
00:11:55,390 --> 00:11:56,070
Awesome.

195
00:11:56,070 --> 00:11:56,510
Oh, my.

196
00:11:56,670 --> 00:11:58,570
This table terrifies me, honestly.

197
00:11:58,570 --> 00:12:01,790
They are reading it very fast.

198
00:12:01,790 --> 00:12:03,470
I love BOP code.

199
00:12:03,590 --> 00:12:05,090
That was a challenge recently, wasn't it?

200
00:12:05,090 --> 00:12:05,710
Was it?

201
00:12:05,710 --> 00:12:07,490
I thought it was a DEF CON CTF.

202
00:12:07,490 --> 00:12:08,470
Oh, I don't know.

203
00:12:08,470 --> 00:12:09,730
I'm not sure.

204
00:12:09,910 --> 00:12:10,770
Anyhoo.

205
00:12:11,770 --> 00:12:13,290
Okay, but let's see.

206
00:12:13,950 --> 00:12:17,190
So, I honestly have no idea what he's writing in this.

207
00:12:17,190 --> 00:12:22,310
I don't know what that syscall equals OX05 CD88 question mark, like...

208
00:12:22,310 --> 00:12:28,170
I believe that he's laying out what the bytes are for the syscall opcode.

209
00:12:29,090 --> 00:12:29,630
Okay.

210
00:12:29,630 --> 00:12:32,630
I think OX05 is syscall.

211
00:12:33,230 --> 00:12:33,950
Okay.

212
00:12:34,570 --> 00:12:38,290
Well, honestly, oh, man.

213
00:12:38,590 --> 00:12:40,650
I don't look at bytes for disassembly anymore.

214
00:12:40,670 --> 00:12:48,410
We have, like, on trips to CTFs, done just kind of, like, back and forth trivia of, like, who can name more opcodes to bytes.

215
00:12:49,530 --> 00:12:51,350
Or, like, instructions to bytes.

216
00:12:51,510 --> 00:12:55,970
In RPI's sake, we did this, you know, when we were taking the train to and from Seesaw and stuff like that.

217
00:12:55,970 --> 00:13:07,890
Oh, and see, this experimentation is exactly what I think you're going to see on both sides, is how do I do clever little things where I can set the bytes just right or at least get that high bit set?

218
00:13:07,890 --> 00:13:16,090
What can I do to have equivalent operations or at least get the primitives that I need to shape a shellcode without breaking the constraint?

219
00:13:16,250 --> 00:13:16,850
Yeah, absolutely.

220
00:13:16,850 --> 00:13:20,970
And it looks like he's finding some really funky instructions to work with here.

221
00:13:20,970 --> 00:13:26,690
Over on Macaroni, we see experimenting in the same sort a little more targeted.

222
00:13:26,690 --> 00:13:32,870
It looks like they're trying to get generic control of written bytes.

223
00:13:32,870 --> 00:13:41,230
Instead of targeting exactly what they need, they're trying to come up with just a system for writing arbitrary bytes.

224
00:13:41,230 --> 00:13:48,730
I got stuck on this for a long time because I didn't focus on writing, you know, just one instruction at a time, get the state closer and closer and closer.

225
00:13:48,730 --> 00:13:54,390
I tried to make a function to just decode.

226
00:13:54,390 --> 00:13:55,490
That's so weird to say.

227
00:13:55,490 --> 00:13:59,690
Decode my shellcode into the right form and then push it to the server.

228
00:13:59,690 --> 00:14:03,330
So I'm hoping Macaroni does that here.

229
00:14:03,330 --> 00:14:06,810
They have, oh, it looks like just a PwnTemplate thing.

230
00:14:07,910 --> 00:14:17,030
Yeah, well, that's really the two approaches I think is that I would expect to see on this challenge is on one hand, just start experimenting and see what makes it through.

231
00:14:17,030 --> 00:14:27,990
And then the other side is the more static approach, which is let me understand the encoding really well and then I can write a function that will allow me to pass whatever I want through unscathed.

232
00:14:27,990 --> 00:14:45,030
Yeah, but understanding the encoding that deeply, you know, it sounds fairly simple, but looking at the code, your brain gets kind of jumbled because it's just so much bit shifting, oring and spacing that it's easy to lose track of where you are and what byte you're working on.

233
00:14:45,030 --> 00:14:50,490
Yeah, we see here, it looks simple, but if you actually trace through the path, it's funky.

234
00:14:50,490 --> 00:15:00,210
Yeah, it's simple enough, but when you're under this kind of time pressure, you really do feel like, man, how much time do I have to sit and think about this and really understand it?

235
00:15:00,210 --> 00:15:01,390
Yeah, exactly.

236
00:15:01,390 --> 00:15:04,490
And I think, yeah, we see anger coming out.

237
00:15:04,530 --> 00:15:06,910
Oh, now that is an interesting idea.

238
00:15:06,910 --> 00:15:08,570
That's a very interesting idea.

239
00:15:08,570 --> 00:15:10,710
None of us tried that as far as I know.

240
00:15:10,810 --> 00:15:16,370
No, and it's just encoding, so there's nothing that should really stop anger from working.

241
00:15:16,370 --> 00:15:17,630
It should be able to solve right through that.

242
00:15:17,630 --> 00:15:25,270
But the question is, you still have to have some shellcode that's going to run unscathed.

243
00:15:25,270 --> 00:15:29,830
You do, but I'm wondering if this is going to be able to find a way to write arbitrary bytes.

244
00:15:30,350 --> 00:15:37,210
Because if you can just use the shellcraft-sh and it'll write arbitrary bytes for you, who knows?

245
00:15:37,210 --> 00:15:39,590
Well, you won't be able to use the shellcraft-sh, actually.

246
00:15:39,590 --> 00:15:44,730
It'll probably return that there's no path available.

247
00:15:46,170 --> 00:15:46,970
Right, right.

248
00:15:46,970 --> 00:15:57,590
I think if you were trying to push things that aren't going to be possible with the constraint through, anger is just going to come back and say it's unsat, it's not solved.

249
00:15:57,590 --> 00:16:00,850
Yeah , and actually, Z3 would be pretty good for this, too.

250
00:16:01,010 --> 00:16:04,690
Well, we'll see how that works out for them.

251
00:16:05,910 --> 00:16:10,150
Over on the MMM side, we're looking at the encoder.

252
00:16:10,150 --> 00:16:23,830
This is definitely what the reference solution sort of did, which was understand, can I have a limited set of operations that allow me to write out or encode, decode?

253
00:16:23,830 --> 00:16:26,430
I think they're going to be self-modifying shellcode.

254
00:16:28,870 --> 00:16:29,430
Yeah, definitely.

255
00:16:29,430 --> 00:16:30,890
I think that's the approach they're doing.

256
00:16:30,890 --> 00:16:35,110
Because they're looking up PwnTools, Zortools.

257
00:16:35,890 --> 00:16:37,170
Yeah, and that would totally work.

258
00:16:37,170 --> 00:16:43,450
If you can write a short decoder stub that stays within the constraint, then that's a great solution.

259
00:16:43,450 --> 00:16:44,770
That's super smart.

260
00:16:44,770 --> 00:16:45,290
Yeah.

261
00:16:46,030 --> 00:16:52,930
Or even if you get an off-by-one instruction, then you just ink RIP.

262
00:16:55,900 --> 00:16:56,880
Yeah, I want to say...

263
00:16:56,880 --> 00:16:57,960
Ink RIP and not.

264
00:16:59,300 --> 00:17:00,960
Add RIP, too.

265
00:17:04,980 --> 00:17:06,900
Oh, and so now we see that he's...

266
00:17:06,900 --> 00:17:10,100
So this is a key insight that we're looking over on the MMM side.

267
00:17:10,100 --> 00:17:17,320
He's realized that he doesn't have access to RSI, RAX, but he does have access to EDX, ESI within the constraint.

268
00:17:17,320 --> 00:17:18,000
That's right.

269
00:17:18,000 --> 00:17:18,940
Key insight.

270
00:17:20,280 --> 00:17:22,200
So this is great progress.

271
00:17:22,240 --> 00:17:26,020
I'm trying to mix and match, see what the different first byte turns out to be.

272
00:17:26,020 --> 00:17:35,060
Right, and he's using sub as the operation, subtract instead of move, because maybe you want to fix up by using...

273
00:17:35,060 --> 00:17:37,540
or write bytes by subtracting constants.

274
00:17:37,800 --> 00:17:39,980
There's a lot of different ways to do this.

275
00:17:40,440 --> 00:17:41,620
Oh, there are so many different ways.

276
00:17:41,620 --> 00:17:44,460
I mean, as far as I know, x86 is turning complete.

277
00:17:47,320 --> 00:17:49,000
I was really waiting there.

278
00:17:49,000 --> 00:17:51,620
I'm like, oh, God, no, that one fell really flat.

279
00:17:53,300 --> 00:17:54,780
Okay, so we see...

280
00:17:54,780 --> 00:17:57,400
I think in that shellcode there was still a V.

281
00:17:57,520 --> 00:17:59,760
Where would that be?

282
00:17:59,760 --> 00:18:02,360
No, that has upper bit set.

283
00:18:03,480 --> 00:18:07,760
I remember looking at the load string instructions.

284
00:18:07,760 --> 00:18:09,500
That was definitely something that I explored.

285
00:18:10,200 --> 00:18:12,440
No, V is 0x70 something.

286
00:18:15,340 --> 00:18:18,700
It's before 0x7F, so it doesn't have upper bit set.

287
00:18:18,700 --> 00:18:19,600
That's right.

288
00:18:21,320 --> 00:18:23,280
That good old 7-bit ASCII.

289
00:18:26,270 --> 00:18:29,430
Good old ASCII should never belong in the same sentence, honestly.

290
00:18:30,310 --> 00:18:32,250
Let's switch to UTF-16 for everything.

291
00:18:32,250 --> 00:18:33,750
That's a way better encoding, right?

292
00:18:35,610 --> 00:18:40,010
I prefer that every byte needs two bytes, and the second byte is a null.

293
00:18:44,950 --> 00:18:50,690
Having written a Unicode decoder, this entire thing is bringing back some PTSD.

294
00:18:52,770 --> 00:18:57,370
I think encoding has to be one of the least favorite topics of most hackers.

295
00:18:57,370 --> 00:18:59,510
I don't know anybody that really loves encoding.

296
00:18:59,530 --> 00:19:04,690
Take this concept, transform it into an entirely new space, and then operate on that.

297
00:19:04,690 --> 00:19:05,550
It's easy, right?

298
00:19:05,550 --> 00:19:08,450
Every programmer wants to needlessly complicate things.

299
00:19:08,790 --> 00:19:10,970
Everyone has the best new encoding.

300
00:19:11,090 --> 00:19:11,850
That's true.

301
00:19:11,850 --> 00:19:14,590
There should be a standard.

302
00:19:15,130 --> 00:19:16,190
Who can make a standard?

303
00:19:16,190 --> 00:19:18,390
You need some sort of consortium for that.

304
00:19:19,270 --> 00:19:21,430
This is how we end up with new standards.

305
00:19:24,210 --> 00:19:26,990
So how is Macaroni doing?

306
00:19:27,330 --> 00:19:32,210
Macaroni, looking through, making sure they have a solid understanding of the code here.

307
00:19:32,250 --> 00:19:36,170
In IDA dark theme, this makes it really easy for us to keep track of, because we have light theme versus dark theme.

308
00:19:36,170 --> 00:19:37,270
I do appreciate that.

309
00:19:37,270 --> 00:19:39,030
Light side versus dark side.

310
00:19:39,110 --> 00:19:41,310
I'm not taking sides by saying that.

311
00:19:41,870 --> 00:19:46,310
But looking through, leaning back in the chair, understanding, okay.

312
00:19:46,630 --> 00:19:49,650
So it's seven bits per byte.

313
00:19:50,170 --> 00:19:52,270
But you encode it.

314
00:19:52,450 --> 00:19:58,770
So you need to pass a normal byte, and it only takes seven bits from that, and sets the top bit.

315
00:19:58,930 --> 00:19:59,850
That's right.

316
00:20:00,110 --> 00:20:00,930
That's right.

317
00:20:00,930 --> 00:20:02,070
And this is...

318
00:20:02,650 --> 00:20:06,470
The encoding itself is actually for arbitrarily sized numbers.

319
00:20:06,470 --> 00:20:07,070
And so even...

320
00:20:08,110 --> 00:20:13,310
Just the idea of like, this isn't a, oh yeah, you just provide your bytes, and it encodes, decodes.

321
00:20:13,310 --> 00:20:17,230
Base 64, for example, right?

322
00:20:17,230 --> 00:20:17,990
This is...

323
00:20:17,990 --> 00:20:19,330
No, it's for integers.

324
00:20:19,330 --> 00:20:24,050
It's for integers, which definitely was a little confusing for me when I was reading through it.

325
00:20:24,050 --> 00:20:24,370
Oh , yeah.

326
00:20:24,370 --> 00:20:27,750
No, that library does not work nicely for it.

327
00:20:27,890 --> 00:20:30,370
Does not work nicely for arbitrary bytes, rather.

328
00:20:30,370 --> 00:20:36,130
And the decode method just returns an int, so you should see like, where is it?

329
00:20:36,150 --> 00:20:39,570
Like bytes to hex in these people's solve scripts.

330
00:20:39,570 --> 00:20:42,550
And we saw a macaroni a second ago, checking for the hint.

331
00:20:42,550 --> 00:20:46,070
First hint was coming out in 20 seconds, so it should be out now.

332
00:20:46,070 --> 00:20:48,210
We don't see either team looking at it.

333
00:20:49,450 --> 00:20:52,750
Which is interesting, but we see mhacaroni.

334
00:20:53,230 --> 00:20:54,170
Yeah.

335
00:20:55,290 --> 00:20:55,810
Encoding...

336
00:20:56,690 --> 00:20:57,210
7...

337
00:20:57,210 --> 00:20:59,710
Oh, 7 bits from binary output.

338
00:20:59,810 --> 00:21:07,470
Yeah, I think that they're trying to graphically print out what their bytes have.

339
00:21:07,470 --> 00:21:10,450
I think this is exploring the constraint.

340
00:21:10,450 --> 00:21:11,430
Oh, it absolutely is.

341
00:21:11,430 --> 00:21:14,950
I'm wondering if this is going to work, because this looks very similar to my script.

342
00:21:14,950 --> 00:21:16,450
Or it's starting to, at least.

343
00:21:17,090 --> 00:21:18,430
But I don't think...

344
00:21:19,530 --> 00:21:22,350
Yeah, shabcd, so those are all the 0x40 range.

345
00:21:22,350 --> 00:21:26,250
Those are going to get transformed, and you might be confused by that.

346
00:21:26,670 --> 00:21:27,830
But we'll check back.

347
00:21:27,830 --> 00:21:29,710
Yeah, there's that long to bytes we saw.

348
00:21:32,150 --> 00:21:37,310
Actually, let's see what the script does here before we switch back over to MMM.

349
00:21:37,670 --> 00:21:39,070
To send not defined.

350
00:21:39,470 --> 00:21:40,510
Yeah, that would help.

351
00:21:42,110 --> 00:21:47,190
Do you think that we're going to see the classic, all right, I'm going to look at what I'm sending into the decoder.

352
00:21:47,730 --> 00:21:53,710
uleb128 breaks up the input, like base64, into 7-bit blocks, did it say?

353
00:21:53,710 --> 00:21:54,070
Yep.

354
00:21:54,070 --> 00:21:58,030
So kind of explaining the function to them in English.

355
00:21:59,030 --> 00:21:59,590
Right.

356
00:21:59,590 --> 00:22:02,750
I think that MMM has an understanding of that.

357
00:22:02,750 --> 00:22:03,790
We'll see if that changes.

358
00:22:03,790 --> 00:22:10,830
And actually, Macaroni just saw that their 0x41, 0x42, 0x43, 0x44 got transformed to C1, C2, C3, C4.

359
00:22:10,830 --> 00:22:11,290
Bingo.

360
00:22:11,290 --> 00:22:14,350
So I think they're starting to really understand it.

361
00:22:14,350 --> 00:22:15,270
Yep, here we go.

362
00:22:15,890 --> 00:22:18,750
And now they're looking for a similar table.

363
00:22:18,750 --> 00:22:21,110
Oh, wait, they're one click off.

364
00:22:22,010 --> 00:22:24,710
Oh, no, look, over on the right, it has first bytes.

365
00:22:24,710 --> 00:22:25,790
Oh, that's helpful.

366
00:22:25,790 --> 00:22:26,570
That's so nice.

367
00:22:26,570 --> 00:22:27,390
It's not an order, though.

368
00:22:27,390 --> 00:22:28,890
It's an alphabetical order.

369
00:22:28,890 --> 00:22:37,730
Well, it allows you to reference, if you know what instruction you want, you can check what the opcode ends up being.

370
00:22:37,730 --> 00:22:46,010
And here we see Macaroni going to be doing very similar things over to what MMM was just doing in their Python terminal here.

371
00:22:46,010 --> 00:22:49,790
And it looks like they're doing the same 7-bit encoding, not using any nice Python helper, though.

372
00:22:49,790 --> 00:22:52,570
So they're going to have to write the helper themselves, which is prone to errors.

373
00:22:53,050 --> 00:22:53,770
Definitely.

374
00:22:53,770 --> 00:22:59,990
If you can download a library and have it do the work for you, you should, right?

375
00:22:59,990 --> 00:23:03,930
It's not about writing stuff you don't have to.

376
00:23:03,970 --> 00:23:04,730
Absolutely.

377
00:23:04,730 --> 00:23:07,470
It's about minimum work, maximum flags.

378
00:23:07,870 --> 00:23:09,350
That is the goal.

379
00:23:09,350 --> 00:23:12,090
And that's what players are really used to doing here.

380
00:23:12,090 --> 00:23:15,210
And it looks like he's just going to be rewriting his helper.

381
00:23:15,250 --> 00:23:18,010
So rewriting his unpacker?

382
00:23:18,730 --> 00:23:19,870
It's so weird to say.

383
00:23:19,870 --> 00:23:23,270
Yeah, okay, this is literally what my script looks like.

384
00:23:24,790 --> 00:23:27,470
Except I had, like, a mod in the...

385
00:23:27,470 --> 00:23:30,450
Yeah, wait, is he going to do times len mod 2?

386
00:23:30,510 --> 00:23:34,490
Because if he does times len mod 2, that is my script.

387
00:23:34,690 --> 00:23:35,430
Oh, wow.

388
00:23:37,390 --> 00:23:40,270
Okay, so going to be reading through the code again over on MMM.

389
00:23:40,730 --> 00:23:46,610
mHackaroni, they just switched, but mHackaroni was just going through PwnTools asm various opcodes.

390
00:23:47,390 --> 00:23:49,590
Main has unknown type casted to declare type.

391
00:23:49,590 --> 00:23:50,450
Is this true?

392
00:23:50,710 --> 00:23:53,750
No, no, you can do this as main here.

393
00:23:55,330 --> 00:23:55,970
Weird.

394
00:23:56,770 --> 00:23:58,390
I don't know why it failed to disassemble them.

395
00:23:58,390 --> 00:23:58,770
Yeah.

396
00:23:59,890 --> 00:24:03,130
So they're going to be breaking on the call and trying to understand what's going on there.

397
00:24:03,290 --> 00:24:09,270
Yeah, because if you look at the disassembly of main, you see that it basically ends in a call to a register, and so everything's set up.

398
00:24:09,270 --> 00:24:13,430
It's just putting the shellcode into a buffer and jumping to that buffer.

399
00:24:13,430 --> 00:24:15,050
Yeah, there are no complicated states to get there.

400
00:24:15,050 --> 00:24:16,250
You're going to have the same register state.

401
00:24:16,250 --> 00:24:17,150
There's no randomness.

402
00:24:17,150 --> 00:24:21,270
Well, there's randomness in ASLR and stuff, but you have fixed register entry state.

403
00:24:21,270 --> 00:24:30,810
And now we see Macaroni really doing exactly the same thing we saw MMM do, which is let me see what the bytes are for a bunch of instructions that I'm going to want to use.

404
00:24:30,810 --> 00:24:31,330
Absolutely.

405
00:24:31,330 --> 00:24:33,050
And they're going to be going through that for a bit.

406
00:24:33,050 --> 00:24:37,230
Over on MMM, you see he finished writing the repacker.

407
00:24:37,610 --> 00:24:39,890
Ah, re-unpacker.

408
00:24:39,890 --> 00:24:40,770
The un-repacker?

409
00:24:42,590 --> 00:24:45,970
And he's going to be going through, finding the right instructions to put there.

410
00:24:45,970 --> 00:24:49,610
His shellcode is not assembled instructions.

411
00:24:50,110 --> 00:24:50,930
It's just bytes.

412
00:24:50,930 --> 00:25:02,010
He's just writing the raw bytes, which honestly makes sense, because that way you don't have to go back from assemble shellcode to integer back and forth and try and keep a mental model of it.

413
00:25:02,010 --> 00:25:03,970
It's just laid out clearly for you.

414
00:25:04,570 --> 00:25:09,310
Yeah, that was something as I was working on this, I definitely had...

415
00:25:09,310 --> 00:25:11,150
I wanted to see the mnemonic.

416
00:25:11,150 --> 00:25:12,670
I wanted to see the opcodes.

417
00:25:13,150 --> 00:25:13,930
It was...

418
00:25:14,490 --> 00:25:18,170
There's not really a good tool for that that I can think of.

419
00:25:18,650 --> 00:25:19,230
I don't know.

420
00:25:19,230 --> 00:25:22,930
I'm sure there's one out there, but I haven't used one as far as I know.

421
00:25:22,930 --> 00:25:28,850
I mean, I did some work in Binja, just assembling stuff in and then doing show opcode bytes.

422
00:25:28,850 --> 00:25:29,030
Yeah.

423
00:25:29,030 --> 00:25:32,270
And then that was my play for a little bit.

424
00:25:32,270 --> 00:25:35,330
But this is not an easy thing to do.

425
00:25:35,330 --> 00:25:47,450
Yeah, I was working with Disasm.pro in the browser, just because I'm a browser tool kind of guy, and just typing stuff in, seeing what top byte is, moving stuff around, similar to what we saw these players doing earlier.

426
00:25:48,970 --> 00:25:51,830
And it looks like...

427
00:25:51,830 --> 00:25:54,870
Okay, MMM just getting calls right.

428
00:25:55,010 --> 00:25:57,870
Yeah, passing bytes of int.

429
00:25:57,870 --> 00:26:02,110
I mean, the speed at which that they're putting these things together is really impressive.

430
00:26:02,150 --> 00:26:17,430
And I mean, there definitely is an argument here, because the encoding is not really complicated, that maybe writing your own keeps you from having to deal with maybe an API issue if you don't like what the module is presenting.

431
00:26:17,950 --> 00:26:25,970
We talked about you have to figure out your big integer, so to speak, and then hex encoding it, and figuring out that stuff.

432
00:26:26,150 --> 00:26:37,010
Yeah, and it's very much like the ease of use of using that package, that API, versus understanding the internals and making sure that you have access to intermediate states.

433
00:26:37,370 --> 00:26:42,810
And kind of the overhead of learning a new thing versus writing your own thing is really something you have to weigh out.

434
00:26:42,810 --> 00:26:51,710
And going back and changing your approach to do the other from either is going to be a decent-sized lift, and you're going to be making mistakes on assumptions that don't exist anymore.

435
00:26:51,710 --> 00:26:57,130
Exactly, and that's what I was going to bring up, is that when you're using a library, you're limited to the assumptions that they made.

436
00:26:57,130 --> 00:27:07,690
Whereas if you're just looking at the assembly and you see exactly what this is doing, does it really matter if it's truly encoding the way it's supposed to be?

437
00:27:07,870 --> 00:27:09,550
Because the assembly is the truth.

438
00:27:09,550 --> 00:27:14,470
Yeah, I mean, that's really all that matters in the end, is what your state is when you get to that call racks.

439
00:27:14,470 --> 00:27:15,030
Exactly.

440
00:27:16,450 --> 00:27:19,290
And actually, call racks, you're going to have the...

441
00:27:19,290 --> 00:27:25,850
you could do self-modifying there, because you have racks equal to what your current rip is.

442
00:27:26,030 --> 00:27:28,170
Right, you do have a register that points...

443
00:27:28,170 --> 00:27:31,090
you have a register that points right to the beginning of your shellcode.

444
00:27:31,690 --> 00:27:33,970
If I recall, the register state's not that bad.

445
00:27:33,970 --> 00:27:36,690
We see MMM going into their debugger.

446
00:27:36,690 --> 00:27:45,390
I actually really love to see the debugger integrated with your disassembly, decompiler, RE framework, in this case IDA.

447
00:27:45,390 --> 00:27:50,650
I think that's a really powerful move, because I hate switching between windows.

448
00:27:50,650 --> 00:27:57,330
And if you've got a script, a debugger, a decompiler, you're flipping between these three things.

449
00:27:57,330 --> 00:27:59,590
It's just easier when you've got everything in one view.

450
00:27:59,990 --> 00:28:09,110
Yeah, and over on Macaroni, we see them printing out every instruction that matches the constraint that they were given.

451
00:28:09,610 --> 00:28:11,290
And lots of new lines.

452
00:28:12,070 --> 00:28:14,370
Yep, looks like there's an extra new line in there.

453
00:28:14,370 --> 00:28:16,230
Yeah , check if the string is empty, continue.

454
00:28:16,670 --> 00:28:18,410
Grep one line, or I'll filter that out for you.

455
00:28:18,410 --> 00:28:19,670
Oh, yeah, just grep.

456
00:28:20,750 --> 00:28:24,310
Oh, yeah, because they're printing one line in between instead of one line after every valid one.

457
00:28:24,850 --> 00:28:25,670
Oh, man.

458
00:28:26,090 --> 00:28:28,310
Yeah, I mean, this is CTF code, through and through.

459
00:28:28,310 --> 00:28:30,070
This is what we would expect to see.

460
00:28:30,070 --> 00:28:31,590
And honestly, this is...

461
00:28:31,590 --> 00:28:41,110
if you've got something that prints things out exactly the way you see, that can be a lot more useful than a Wikipedia page, which somebody else put together, probably for people doing sane things instead of CTF.

462
00:28:41,750 --> 00:28:42,890
CTF is sane?

463
00:28:42,890 --> 00:28:43,490
What are you talking about?

464
00:28:43,490 --> 00:28:48,810
It's just writing shellcode and 7-bit unpacking for an integer encoding.

465
00:28:49,410 --> 00:28:50,290
Exactly.

466
00:28:50,290 --> 00:28:51,630
Oh, I get your point.

467
00:28:53,110 --> 00:29:05,590
You know, I started off in CTF, reversing, all of that stuff, and I didn't realize how weird it was until I started dealing with real software people.

468
00:29:05,590 --> 00:29:06,350
Oh, yeah.

469
00:29:06,350 --> 00:29:12,430
No, I was talking with, once again, the iOS, macOS cat who's helping us behind the scenes.

470
00:29:13,450 --> 00:29:17,470
And we were staring at this problem, and she was just like, wait, no, this doesn't make any sense.

471
00:29:17,470 --> 00:29:18,410
This is so stupid.

472
00:29:18,410 --> 00:29:21,150
And we were staring at this thing for like 30, 40 minutes.

473
00:29:22,050 --> 00:29:24,010
And she'd never played a CTF before.

474
00:29:24,190 --> 00:29:27,410
And I turned to her and I'm like, congrats, this is what playing a CTF feels like.

475
00:29:27,410 --> 00:29:28,950
And she's like, oh, no.

476
00:29:29,190 --> 00:29:30,230
This doesn't make sense.

477
00:29:30,230 --> 00:29:31,110
This is so stupid.

478
00:29:31,110 --> 00:29:32,370
Yep, that sounds like CTF.

479
00:29:32,390 --> 00:29:33,030
Exactly.

480
00:29:33,070 --> 00:29:36,570
You either solve it or you look at the solution and you're like, wow, yeah.

481
00:29:36,650 --> 00:29:51,250
Yeah, not to date myself too much here, but when Python 3 came out and they made it a little bit more difficult to deal with bytes because you had to worry about strings versus bytes, I argued vehemently about why Python 2 had gotten it right.

482
00:29:51,250 --> 00:29:55,310
And all of the hackers that I knew were like, yeah, no, it's a lot easier to deal with.

483
00:29:55,310 --> 00:29:58,030
But everybody else in the world was like, you're crazy.

484
00:29:58,330 --> 00:29:59,850
Have you heard of internationalization?

485
00:29:59,850 --> 00:30:01,330
No, absolutely the same thing.

486
00:30:01,330 --> 00:30:02,870
I argued completely against it.

487
00:30:03,730 --> 00:30:06,910
RPISec's internal tools, I believe, still use Python 2.

488
00:30:06,990 --> 00:30:07,630
Oh, my gosh.

489
00:30:07,630 --> 00:30:08,210
Some of them.

490
00:30:09,470 --> 00:30:10,710
Hey, look, OK.

491
00:30:10,710 --> 00:30:11,950
At this point, that's cruel.

492
00:30:12,570 --> 00:30:15,910
RPISec, you know, we haven't really been playing CTFs much in the past couple of years.

493
00:30:17,670 --> 00:30:19,310
But, yeah, I argued completely against it.

494
00:30:19,310 --> 00:30:22,290
And now I'm, like, strong Python 3.

495
00:30:22,930 --> 00:30:23,830
Me too.

496
00:30:23,830 --> 00:30:24,370
Yeah.

497
00:30:24,370 --> 00:30:25,010
Me too.

498
00:30:25,010 --> 00:30:29,310
Now when I see tools that are still written for Python 2, it's like, hey, man.

499
00:30:29,330 --> 00:30:30,490
Yeah, it's kind of like, come on.

500
00:30:30,490 --> 00:30:31,750
I had to switch my code over.

501
00:30:32,370 --> 00:30:34,050
Python 2 was EOL.

502
00:30:34,110 --> 00:30:35,390
It's been EOL for a while.

503
00:30:35,390 --> 00:30:35,850
It's true .

504
00:30:37,190 --> 00:30:47,730
So getting back to it, we're looking at Macaroni, still looking through the tables, finding the opcodes that they can use, giving the constraints.

505
00:30:48,310 --> 00:30:50,170
Oh, going into XMM registers.

506
00:30:50,170 --> 00:30:51,110
Wait a minute.

507
00:30:51,510 --> 00:30:52,410
Oh, clever.

508
00:30:52,410 --> 00:30:54,070
You know, I wondered about that.

509
00:30:54,250 --> 00:30:54,730
Oh.

510
00:30:54,730 --> 00:30:56,190
I didn't explore that myself.

511
00:30:56,190 --> 00:30:56,690
Gosh.

512
00:30:56,690 --> 00:31:00,870
But I thought maybe, you know, you could use these extended registers.

513
00:31:00,870 --> 00:31:04,270
To move things around, you know?

514
00:31:04,270 --> 00:31:06,710
I'm wondering if they're going to go into, like, AVX 512.

515
00:31:06,710 --> 00:31:08,310
And I'm like, does my CPU support it?

516
00:31:08,310 --> 00:31:09,210
Yeah, okay, good.

517
00:31:09,210 --> 00:31:09,890
We're good.

518
00:31:09,890 --> 00:31:10,550
Oh, man.

519
00:31:10,550 --> 00:31:15,670
How much of a heartbreaker would that be if you write this beautiful shellcode and then it just doesn't support those extensions?

520
00:31:15,670 --> 00:31:16,350
Yeah.

521
00:31:16,590 --> 00:31:17,270
No.

522
00:31:18,010 --> 00:31:20,530
New CPU, supports just about everything.

523
00:31:21,550 --> 00:31:23,130
Really hope they're not going to do the...

524
00:31:24,010 --> 00:31:24,810
What's the new one?

525
00:31:24,930 --> 00:31:26,250
Zenbleed downfall?

526
00:31:26,550 --> 00:31:27,210
Oh.

527
00:31:27,250 --> 00:31:29,510
Which one was the AMD one again?

528
00:31:29,510 --> 00:31:31,510
Well, I know Zenbleed was, but...

529
00:31:33,590 --> 00:31:34,970
What are they looking at here?

530
00:31:34,970 --> 00:31:35,930
Is this Python codecs?

531
00:31:35,930 --> 00:31:36,790
Yeah, it's Python codecs.

532
00:31:36,790 --> 00:31:37,410
All right.

533
00:31:38,430 --> 00:31:44,970
So, switching back over to the MMM side, you can see they've got their interactive debugger within IDA.

534
00:31:44,970 --> 00:31:46,330
They're flipping back and forth.

535
00:31:46,330 --> 00:31:51,450
I really feel like this is the right view, or at least a view that is very helpful.

536
00:31:51,930 --> 00:31:53,810
Because it allows you to see, hey, this is the memory.

537
00:31:53,810 --> 00:31:56,470
He's got that hex view with the bytes of memory.

538
00:31:56,570 --> 00:32:02,790
You can see the disassembly, swap back and forth, the decompilation, and the registers all in one window.

539
00:32:02,790 --> 00:32:04,350
I think that helps you move faster.

540
00:32:04,490 --> 00:32:05,710
Yeah, absolutely.

541
00:32:05,710 --> 00:32:09,370
It gives you kind of the full context in one view, which is really nice.

542
00:32:09,370 --> 00:32:11,010
At the end of the day, we're only people.

543
00:32:11,010 --> 00:32:13,270
We only have like max one set of eyes.

544
00:32:13,670 --> 00:32:18,770
So, keeping track of all these different things, we're going to have that context switch overhead.

545
00:32:20,170 --> 00:32:25,910
Right, and as I said, you like to have it as much as you can in one view, but now he's got...

546
00:32:27,250 --> 00:32:30,290
He's got his IDE that has a script and two terminal windows open.

547
00:32:30,290 --> 00:32:32,450
He's got flipping back and forth to the...

548
00:32:32,450 --> 00:32:32,870
The big table.

549
00:32:32,870 --> 00:32:34,870
The browser, yeah, with the table.

550
00:32:35,170 --> 00:32:36,030
This is a lot.

551
00:32:36,030 --> 00:32:38,490
You've got to cross-reference a lot of information here.

552
00:32:38,490 --> 00:32:39,530
Oh, absolutely.

553
00:32:39,530 --> 00:32:41,150
Be able to organize it in your head.

554
00:32:41,150 --> 00:32:53,130
I really like in CTFs having like a dual monitor setup, a little external monitor, because you can have your reference up there, you can have a chat up there if you're talking back and forth to someone, or just like a notepad to keep track of.

555
00:32:53,130 --> 00:32:56,790
But live CTF, you do need a mirror screen, so it is...

556
00:32:57,630 --> 00:32:59,870
So it is harder.

557
00:32:59,870 --> 00:33:01,810
And we see...

558
00:33:01,810 --> 00:33:08,110
I don't want to leak Mhacaroni's file system there, but they were searching their file system and funny files came up.

559
00:33:08,110 --> 00:33:11,430
It was like, challenges to hack and code better.

560
00:33:13,510 --> 00:33:18,170
Well, you know, I've got some friends that are really interested in starting a school, you know, for...

561
00:33:18,170 --> 00:33:20,670
School of hacking for kids that want to learn to...

562
00:33:20,670 --> 00:33:23,430
Kids that want to learn to hack and be good.

563
00:33:23,430 --> 00:33:24,330
Hack good.

564
00:33:24,330 --> 00:33:25,390
Hack good.

565
00:33:25,450 --> 00:33:26,410
Yeah.

566
00:33:27,270 --> 00:33:32,330
Okay, well, I'm going to switch over to Mhacaroni, because they're looking for...

567
00:33:34,270 --> 00:33:37,170
Maple CTF CPO 37 write-up.

568
00:33:37,170 --> 00:33:42,050
Oh, I think that they're looking for a reference solution to another challenge that might mirror this one.

569
00:33:42,050 --> 00:33:44,070
Car set constraint shellcode.

570
00:33:44,110 --> 00:33:44,910
Another challenge.

571
00:33:44,910 --> 00:33:49,290
And I think they're hoping that they can just plug the constraints in.

572
00:33:49,790 --> 00:33:51,130
CPO 37 not found.

573
00:33:51,130 --> 00:33:51,890
Oh, yeah, look.

574
00:33:51,890 --> 00:33:55,230
They're like, I solved this challenge before, right?

575
00:33:55,330 --> 00:33:56,590
Like I solved one very similar.

576
00:33:56,590 --> 00:34:02,210
So they're trying to find their own solution on GitHub because they couldn't find it on a file system.

577
00:34:02,570 --> 00:34:07,930
That's pretty good when you have that kind of flashback and you're like, wait a minute, I've been here.

578
00:34:08,350 --> 00:34:15,970
And I think that that's really a thing in the CTF community is that if you have played a lot of CTF, you kind of have that knowledge bank.

579
00:34:15,990 --> 00:34:24,210
You've got an understanding of what are the kinds of problems that people ask you, and you can pull different pieces, even if it wasn't exactly the same challenge.

580
00:34:24,210 --> 00:34:29,190
Maybe you can pull like a real slick encoder or a bit of shellcode to do a very specific thing.

581
00:34:29,190 --> 00:34:31,270
Oh, yeah, or a Z3 script would be gold.

582
00:34:31,270 --> 00:34:32,090
Exactly.

583
00:34:32,230 --> 00:34:32,670
Yeah .

584
00:34:33,730 --> 00:34:34,850
But going through...

585
00:34:35,590 --> 00:34:37,910
Yeah, no, I mean, I know personally my CTF folder.

586
00:34:37,910 --> 00:34:40,390
I have some of my CTF solutions uploaded to GitHub.

587
00:34:40,390 --> 00:34:42,990
The other ones are too gross for me to upload.

588
00:34:42,990 --> 00:34:45,650
And I think that folder is like five gigs now.

589
00:34:45,650 --> 00:34:46,710
It's giant.

590
00:34:48,550 --> 00:34:51,450
Oh, no.

591
00:34:51,490 --> 00:34:58,650
I thought I saw, you know, a controlled exit there, like setting racks properly.

592
00:34:58,770 --> 00:35:00,870
But it looks like it was just...

593
00:35:01,290 --> 00:35:02,970
Yeah, exit zero.

594
00:35:03,770 --> 00:35:08,910
Oh, but it looks like they might have code then if they like got a proper ret.

595
00:35:10,530 --> 00:35:12,070
Yeah, looking at what they're doing...

596
00:35:12,070 --> 00:35:12,830
Oh , no, I'm sorry.

597
00:35:12,830 --> 00:35:14,030
This is their own code.

598
00:35:14,030 --> 00:35:14,370
Right.

599
00:35:14,370 --> 00:35:20,410
I was thinking they might be compiling something and then ripping out the bytes for it.

600
00:35:21,030 --> 00:35:26,670
Oh, they could, but they still need to either jump to a read or...

601
00:35:26,670 --> 00:35:27,730
Well, yeah, wait.

602
00:35:27,730 --> 00:35:36,490
No, because they'd need a move racks RDI and then they'd need to unset other args and then they'd need a read.

603
00:35:37,470 --> 00:35:38,650
I think once you've got...

604
00:35:38,650 --> 00:35:42,330
If it's only register manipulation, that's not so bad.

605
00:35:42,330 --> 00:35:56,950
But I think that the tricky part here was trying to get the code that you need, sort of your final shellcode that you're going to execute, getting that written to memory cleanly was really the difficulty.

606
00:35:56,950 --> 00:36:02,010
And it looks like here, over on Macaroni, they're working with CL now.

607
00:36:02,010 --> 00:36:06,130
So that's the lower byte in any register.

608
00:36:06,810 --> 00:36:12,830
And I think they found out that that meets the constraint that they can change that low byte, which is going to be BIN.

609
00:36:12,990 --> 00:36:14,050
Yeah, and that's what I...

610
00:36:14,050 --> 00:36:17,130
We see them writing BINSH now, which is going to be living in their input.

611
00:36:17,470 --> 00:36:20,250
So they know they have RIP in racks.

612
00:36:20,470 --> 00:36:21,550
Well, they have RIP and RIP also.

613
00:36:21,550 --> 00:36:22,690
They have access to every register.

614
00:36:22,870 --> 00:36:25,990
So they know relative offset of their BINSH string.

615
00:36:26,110 --> 00:36:28,450
You can control lower byte writes.

616
00:36:28,630 --> 00:36:32,550
And I believe also second byte writes.

617
00:36:33,270 --> 00:36:34,570
Not 100% on that one.

618
00:36:34,570 --> 00:36:37,730
I think you can get a 16-bit register right.

619
00:36:37,950 --> 00:36:40,670
You can get 16-bit register right, or do you have to do AL and AH?

620
00:36:42,590 --> 00:36:44,550
Look, I'm not the Intel manual.

621
00:36:44,550 --> 00:36:45,370
I don't know.

622
00:36:45,450 --> 00:36:46,570
Believe it or not.

623
00:36:47,390 --> 00:36:49,390
Yeah, I definitely had a similar approach.

624
00:36:49,390 --> 00:36:55,350
I was using the sort of one-byte register with instructions.

625
00:36:55,730 --> 00:37:00,210
And so there's really, at this point, I think two different ways you could be going.

626
00:37:00,210 --> 00:37:02,070
You could be looking at the encoder style.

627
00:37:02,070 --> 00:37:06,830
Hey, just write an encoder stub, and then decode my shellcode and jump to it.

628
00:37:06,830 --> 00:37:22,110
Or you could do sort of a byte or a chunk at a time where you have essentially a mini-decoder stub, where it's more like a writer stub that writes the byte that you want to a targeted area in memory and then jump to that.

629
00:37:22,210 --> 00:37:22,890
Yeah, absolutely.

630
00:37:22,890 --> 00:37:25,470
Because where you are, it's RWX, I believe.

631
00:37:25,510 --> 00:37:26,190
Oh, here we go.

632
00:37:26,190 --> 00:37:27,230
And you're not limited.

633
00:37:27,230 --> 00:37:30,890
Use 16 and 8-bit RWOFs to get a real write primitive and write a second-stage payload with real shellcode.

634
00:37:30,890 --> 00:37:31,950
Exactly what you were saying.

635
00:37:31,950 --> 00:37:33,010
Exactly, right.

636
00:37:33,070 --> 00:37:36,990
And that works in this case because you're not really limited on size.

637
00:37:36,990 --> 00:37:42,310
You're just really limited by this constraint that's really tricky to get around.

638
00:37:42,390 --> 00:37:47,490
And with this hint now, we see...

639
00:37:47,490 --> 00:37:49,730
Oh, we still can't operate on RAC.

640
00:37:49,730 --> 00:37:51,010
Oh, no, RACCL.

641
00:37:51,010 --> 00:37:51,450
Yeah.

642
00:37:51,450 --> 00:37:52,010
Exactly.

643
00:37:52,010 --> 00:37:56,270
So this is where that's exactly the instruction that they need.

644
00:37:56,270 --> 00:38:04,210
But the hint there, the 16-bit or 8-bit read-write ops, you can't use RAX there because it's going to violate that constraint.

645
00:38:04,210 --> 00:38:09,450
But you can use things like EAX.

646
00:38:09,490 --> 00:38:16,710
The 4-bit width, 4-byte width operations for writing to memory should work.

647
00:38:16,730 --> 00:38:20,290
Can you use EAX or do you have to use AX?

648
00:38:20,710 --> 00:38:28,470
I believe you can use something like MOV, dereference, EDX.

649
00:38:28,470 --> 00:38:29,510
Oh, okay.

650
00:38:29,510 --> 00:38:31,610
So the deref might...

651
00:38:31,610 --> 00:38:32,230
You're right.

652
00:38:32,230 --> 00:38:36,370
I'm going to trust you on this because, once again, I'm not a disassembler.

653
00:38:39,530 --> 00:38:39,970
But...

654
00:38:39,970 --> 00:38:41,110
We still love you anyways, Josh.

655
00:38:41,110 --> 00:38:43,090
Oh, thank you so much, guys.

656
00:38:43,150 --> 00:38:47,030
Even though I don't have 8,000 pages and so many mistakes.

657
00:38:47,030 --> 00:38:49,090
Some of my best friends are manuals.

658
00:38:50,030 --> 00:38:51,410
I have a friend named manual.

659
00:38:54,690 --> 00:38:56,230
MOV, byte point, okay.

660
00:38:56,230 --> 00:38:57,830
So therefore my string is broken.

661
00:38:58,950 --> 00:39:01,690
So they need to add brackets around the J.

662
00:39:01,690 --> 00:39:04,350
So we'll see them figure that out eventually.

663
00:39:04,350 --> 00:39:05,750
There's a lot of experimentation.

664
00:39:05,750 --> 00:39:08,230
It's so much easier being a commentator, honestly.

665
00:39:08,690 --> 00:39:11,270
I mean, I definitely banged my head on this challenge for a bit.

666
00:39:11,270 --> 00:39:12,910
Oh my gosh, same.

667
00:39:12,990 --> 00:39:16,710
So the hints are released at 20 minutes in and 35 minutes in.

668
00:39:16,710 --> 00:39:20,910
So that means we are max, like, 15 minutes away from sudden death.

669
00:39:20,910 --> 00:39:21,590
That's right.

670
00:39:21,590 --> 00:39:24,230
Yeah, we are getting near the end.

671
00:39:24,230 --> 00:39:26,070
We knew that these challenges are hard.

672
00:39:26,070 --> 00:39:31,470
Sudden death was sort of always on our minds as it might come down to that.

673
00:39:31,470 --> 00:39:33,250
I'm hoping that that's not going to be the case.

674
00:39:33,630 --> 00:39:35,890
I have faith in our competitors here.

675
00:39:35,890 --> 00:39:37,870
I think that they're going to figure this one out.

676
00:39:38,130 --> 00:39:38,910
I think they are.

677
00:39:38,910 --> 00:39:44,050
I think they're both making really good progress towards the final goal of setting up that second stage payload.

678
00:39:44,050 --> 00:39:45,110
Well, final goal.

679
00:39:45,590 --> 00:39:49,010
Towards the intermediate goal of making that second stage payload.

680
00:39:49,170 --> 00:39:49,690
Right.

681
00:39:49,690 --> 00:39:54,630
You know, I think that MMM, they kind of got to the idea pretty quick.

682
00:39:54,930 --> 00:40:00,430
They have been spending a bit of time now working through how to get things lined up.

683
00:40:00,430 --> 00:40:03,150
I think that they're on the right track.

684
00:40:03,530 --> 00:40:06,250
Yeah, well, I see a lot of Zord D-word pointers.

685
00:40:06,430 --> 00:40:11,990
You know, RSP plus 0x7B89, like, these random offsets.

686
00:40:12,050 --> 00:40:21,690
So, I think they're getting close, but they might get hung up on some small details of, like, I have a null byte in the middle of my shellcode somewhere that I just missed.

687
00:40:21,950 --> 00:40:28,670
Yeah, it's always something that you can just have the littlest thing mess you up.

688
00:40:28,670 --> 00:40:33,850
You don't catch it, or you've got, like, 99% of the solution, right?

689
00:40:33,850 --> 00:40:35,930
It totally happens in CTF.

690
00:40:35,930 --> 00:40:38,790
Absolutely, in this challenge, those mistakes are cascading.

691
00:40:38,790 --> 00:40:41,330
They will mess up everything after them.

692
00:40:41,350 --> 00:40:44,650
You know, potentially around them, like on either side, too.

693
00:40:45,650 --> 00:40:51,390
So, catching one is going to be hard, and you might just think to yourself, like, I'm messing all this up.

694
00:40:51,390 --> 00:40:58,130
What I really liked doing in this challenge was setting up a known good beginning write that was just garbage.

695
00:40:58,130 --> 00:40:59,590
You know, it was a bunch of nops.

696
00:40:59,590 --> 00:41:01,510
It was just a bunch of A's, whatever.

697
00:41:01,510 --> 00:41:04,410
Just to make sure that my write primitive still works.

698
00:41:04,410 --> 00:41:06,770
Like, I can still write that first stage shellcode.

699
00:41:07,790 --> 00:41:10,430
Yeah, I think that there's a lot of...

700
00:41:11,190 --> 00:41:13,890
This is one of those challenges where you want to have those sanity checks.

701
00:41:13,890 --> 00:41:17,470
I definitely was printing out my disassembly.

702
00:41:17,470 --> 00:41:19,550
I was checking the hex dump every time I ran it.

703
00:41:19,550 --> 00:41:23,370
So, if something did change, I would at least be able to see, oh, the pattern changed there.

704
00:41:23,370 --> 00:41:24,490
Something went wrong.

705
00:41:24,490 --> 00:41:25,550
I've got to go back and fix that.

706
00:41:25,550 --> 00:41:29,670
Yeah, like I'm doing stir of bytes instead of dot decode or dot encode.

707
00:41:29,670 --> 00:41:31,210
God, now this has me backwards.

708
00:41:33,610 --> 00:41:42,550
Again, this is a challenge that on the face of it seems simple, but is actually really kind of a mind bender and a weird constraint that...

709
00:41:43,090 --> 00:41:46,090
It's a simple concept with really hard execution.

710
00:41:46,150 --> 00:41:46,530
Right.

711
00:41:46,530 --> 00:41:56,570
And I think all of Glenn's challenges kind of follow the same principle of, you know, it's this kind of a little away from normal idea.

712
00:41:56,570 --> 00:41:58,470
And you're like, oh, that's close enough.

713
00:41:58,470 --> 00:41:59,310
I can just do this.

714
00:41:59,310 --> 00:42:04,050
And then you get to actually implementing a solution for it, and you're like, oh, my God, I know nothing about computers.

715
00:42:04,230 --> 00:42:05,270
These were a mistake.

716
00:42:06,250 --> 00:42:12,050
Yeah, I think that this is one of those challenges where it's like, I know what I want to do, but I just can't do it.

717
00:42:12,050 --> 00:42:14,410
And that's how I felt when I was working on this.

718
00:42:14,410 --> 00:42:16,870
Yeah, no, absolutely same.

719
00:42:16,870 --> 00:42:25,890
I really had the layout down, but actually writing, like, that first stage payload was not a good time.

720
00:42:25,890 --> 00:42:28,230
And it took me way longer than it probably should have.

721
00:42:28,950 --> 00:42:34,650
So it looks like MMM debugging their writes not working out quite right.

722
00:42:35,010 --> 00:42:43,030
And, okay, so here over on Macaroni, we see them using debug assembly, which is a great feature of Puntles.

723
00:42:43,030 --> 00:42:46,250
And just trying to figure out, they have a move racks.

724
00:42:46,270 --> 00:42:50,810
Oh, they're trying to figure out what's the, they're trying to make a stack frame via enter.

725
00:42:50,990 --> 00:42:52,570
Oh, that's clever.

726
00:42:52,570 --> 00:43:04,610
Yeah, I wonder, I mean, you could SROP here, SIGROP, but I'm not 100% sure if that's what they're going to go for.

727
00:43:04,610 --> 00:43:07,030
That seems a little overkill in my opinion.

728
00:43:07,030 --> 00:43:13,610
Well, you know, I never count the competitors out for coming up with clever solutions that we didn't expect.

729
00:43:13,610 --> 00:43:14,550
Exactly, yeah.

730
00:43:14,550 --> 00:43:16,330
And it could be easier for them.

731
00:43:16,410 --> 00:43:18,830
Like, they might be, like, SIGROP masters or something.

732
00:43:18,830 --> 00:43:19,190
Sure.

733
00:43:19,190 --> 00:43:22,170
And they're just like, I don't know how to write shellcode math.

734
00:43:22,490 --> 00:43:24,770
Yeah, they could be like, no, I invented this technique.

735
00:43:24,770 --> 00:43:26,150
Yeah, really, really.

736
00:43:26,350 --> 00:43:29,850
Well, I mean, we have Jinmo on MMM right now, and we were talking about it.

737
00:43:29,850 --> 00:43:32,650
He had a solution yesterday that was, I think, eight minutes.

738
00:43:32,970 --> 00:43:36,170
And we're looking at each other, and we're just kind of like, did this happen?

739
00:43:36,170 --> 00:43:39,490
And we look at the username on the screen that says Jinmo, and we're like, oh, yeah.

740
00:43:39,770 --> 00:43:41,110
Okay, that explains it.

741
00:43:41,270 --> 00:43:43,570
Yeah, we've got some truly impressive competitors here.

742
00:43:43,570 --> 00:43:44,250
Absolutely.

743
00:43:44,430 --> 00:43:48,970
Anybody who has won against this many other competitors at this level.

744
00:43:49,090 --> 00:43:49,690
Yeah.

745
00:43:49,690 --> 00:43:50,610
Top tier.

746
00:43:50,670 --> 00:43:51,510
Exactly.

747
00:43:51,510 --> 00:43:54,470
No, these are all fantastic hackers.

748
00:43:54,470 --> 00:43:59,530
We need to point that out, that these challenges, they have little to no time to get acquainted with them.

749
00:43:59,530 --> 00:44:05,910
Their mind is still on, you know, the challenge they've been staring at for the past 12 hours in DEF CON CTF.

750
00:44:05,910 --> 00:44:07,430
You know, the non-live version.

751
00:44:09,050 --> 00:44:11,670
And just they have so much going on in their mind.

752
00:44:11,670 --> 00:44:15,030
They have someone sitting directly across from them that they're hacking against.

753
00:44:15,350 --> 00:44:17,310
And even that adds its own stress.

754
00:44:17,310 --> 00:44:18,190
They're on stream.

755
00:44:18,190 --> 00:44:19,670
That adds more stress.

756
00:44:20,090 --> 00:44:22,110
It's a foreign concept, you know.

757
00:44:22,190 --> 00:44:24,070
They don't have tools set up for this.

758
00:44:24,070 --> 00:44:28,270
They don't know that, like, oh, yeah, this is normally like a Pwn CTF, like DEF CON finals usually is.

759
00:44:28,890 --> 00:44:30,670
It's new territory for them.

760
00:44:30,670 --> 00:44:32,270
And I think that can be really daunting.

761
00:44:32,270 --> 00:44:35,150
And the first step in this isn't getting acquainted with the program.

762
00:44:35,150 --> 00:44:42,950
It's kind of getting your bearings and resetting, you know, getting focused on what you need to do and the order you need to do it.

763
00:44:43,110 --> 00:44:49,070
Yeah, DEF CON CTF really could include challenges in any weird area.

764
00:44:49,070 --> 00:44:56,090
I mean, I think we had a competitor ask us, hey, can you specify what architecture this is on?

765
00:44:56,090 --> 00:44:58,350
And so far we've only seen x86.

766
00:44:59,270 --> 00:45:02,110
But with the finals, anything goes.

767
00:45:02,110 --> 00:45:05,370
Well, we had your Python shellcode challenge, too.

768
00:45:05,650 --> 00:45:11,270
That's true, that's true, which, you know, technically you didn't need to care about the native implementation.

769
00:45:11,310 --> 00:45:12,750
We had people walk up to us.

770
00:45:12,750 --> 00:45:15,150
I don't know if you know this, but we had people walk up to us.

771
00:45:15,230 --> 00:45:19,570
And the category we gave them was Python, I think Python shellcode.

772
00:45:19,910 --> 00:45:22,610
And they walk up to us and they're like, hey, can you be more specific?

773
00:45:22,610 --> 00:45:23,430
What exactly does that mean?

774
00:45:23,430 --> 00:45:24,790
And we're like, what do you mean more specific?

775
00:45:24,790 --> 00:45:28,030
And it's like, well, like, is it Python written to shellcode?

776
00:45:28,030 --> 00:45:30,170
Is it like shellcode that has to be valid Python?

777
00:45:30,170 --> 00:45:32,850
And we're like, dude, you have an hour for these challenges.

778
00:45:33,450 --> 00:45:36,550
It's not going to be like Python bytecode that's also valid shellcode.

779
00:45:38,070 --> 00:45:39,570
Oh, was it?

780
00:45:39,570 --> 00:45:41,950
No, it would be interesting to try something like that.

781
00:45:41,950 --> 00:45:44,030
I'm like, did we do that?

782
00:45:44,590 --> 00:45:45,570
No, no.

783
00:45:45,570 --> 00:45:49,410
So in that challenge, you didn't need to go low level.

784
00:45:49,410 --> 00:45:51,810
You could just ask Python to compile the bytecode for you.

785
00:45:51,810 --> 00:45:53,230
Yeah, OK, OK.

786
00:45:53,290 --> 00:45:57,270
No, I didn't think we'd have them, you know, do a polyglot challenge like that.

787
00:45:58,470 --> 00:46:01,370
See, and coming up with stuff is hard.

788
00:46:01,490 --> 00:46:12,210
So having a challenge that involves the topics that you're interested in, that you think will be fun for competitors, but also, you know, reasonable for the time frame.

789
00:46:12,290 --> 00:46:13,690
Yeah, it's not always easy.

790
00:46:13,690 --> 00:46:18,730
Well, we were talking, just organizing this, that I think writing the challenges is easy.

791
00:46:18,730 --> 00:46:20,470
Coming up with the ideas is hard.

792
00:46:20,670 --> 00:46:25,030
And then talking with Glenn and Carl, I think, they said, oh, the ideas are easy.

793
00:46:25,030 --> 00:46:26,010
Writing the challenges are hard.

794
00:46:26,010 --> 00:46:27,270
And I'm like, wait a minute.

795
00:46:27,270 --> 00:46:30,890
It's very much like, you've got chocolate on my peanut butter, you've got peanut butter on my chocolate.

796
00:46:31,230 --> 00:46:34,550
It's the perfect team that works out.

797
00:46:34,650 --> 00:46:37,730
And that's why it's great to have people that think differently on your team.

798
00:46:37,730 --> 00:46:38,190
Oh, yeah.

799
00:46:38,190 --> 00:46:50,590
And if we switch back to the MMM side, it looks like what they're doing is having a handwritten decoder there that's just decoding a D word at a time via XOR.

800
00:46:50,590 --> 00:46:53,430
Oh, they're just, wait, but they're just XORing.

801
00:46:53,430 --> 00:46:57,650
So they're just only using shell code that doesn't have top bit set.

802
00:46:57,710 --> 00:47:02,470
Which is definitely easier because when I tried to solve this, that's what I thought the constraint was at first.

803
00:47:02,470 --> 00:47:04,270
And so I wrote this nice shell code.

804
00:47:04,530 --> 00:47:05,610
No top bit set.

805
00:47:05,610 --> 00:47:06,210
But it's working.

806
00:47:06,210 --> 00:47:07,350
They have a syscall.

807
00:47:07,690 --> 00:47:08,930
They have syscall.

808
00:47:08,930 --> 00:47:10,570
They don't have bin sh.

809
00:47:10,690 --> 00:47:12,770
So they probably just determined...

810
00:47:12,770 --> 00:47:13,730
Error no 14.

811
00:47:14,330 --> 00:47:16,050
I love how they search error no 14.

812
00:47:16,050 --> 00:47:18,330
It says, oh, yeah, HTTP error 404.

813
00:47:21,210 --> 00:47:21,730
Wow.

814
00:47:21,730 --> 00:47:23,730
So that's a really clever idea.

815
00:47:23,730 --> 00:47:29,050
And it looks like there might have been some corruption on their shell code.

816
00:47:29,050 --> 00:47:32,350
But other than that, they're looking like they're on the right track.

817
00:47:32,350 --> 00:47:33,930
I think they don't.

818
00:47:33,930 --> 00:47:36,450
So they've got a big NOP sled.

819
00:47:36,610 --> 00:47:40,750
They've got their payload that they're going to XOR back.

820
00:47:40,870 --> 00:47:42,950
And then...

821
00:47:42,950 --> 00:47:45,050
Which that's totally valid.

822
00:47:45,050 --> 00:47:46,130
Great idea.

823
00:47:46,270 --> 00:47:46,870
Yep.

824
00:47:47,070 --> 00:47:48,190
Got EOF reading and interactive.

825
00:47:48,190 --> 00:47:50,330
So NOP's going to have the top bit set.

826
00:47:50,330 --> 00:47:53,330
So your vanilla x86 NOP.

827
00:47:55,670 --> 00:47:58,510
Oh, yeah, yeah.

828
00:47:58,730 --> 00:48:02,830
So now he's just troubleshooting what went wrong with that, right?

829
00:48:03,250 --> 00:48:04,530
Is the shell code intact?

830
00:48:04,530 --> 00:48:08,990
Was the string reference the address of bin sh?

831
00:48:08,990 --> 00:48:11,750
Pop rdi, push rdx, pop rsi, syscall.

832
00:48:11,750 --> 00:48:13,710
Does he have bin sh on the stack?

833
00:48:14,250 --> 00:48:15,610
I think he forgot about bin sh.

834
00:48:15,610 --> 00:48:17,270
Oh, no, he's using shellcraft down there.

835
00:48:17,270 --> 00:48:20,910
Hidden under his two global area terminals.

836
00:48:21,770 --> 00:48:23,390
Okay, so it's just NOP.

837
00:48:23,630 --> 00:48:31,730
Do you recall if the shellcraft shellcode, if that just uses a move to push the string into a register and then out?

838
00:48:31,730 --> 00:48:33,070
I believe it does.

839
00:48:33,630 --> 00:48:37,390
And I think it also sets all the register states, so he should be good there.

840
00:48:37,390 --> 00:48:45,390
I was going to say that's one of the things that this is a little nonstandard, but every challenge you have to understand what your register states are.

841
00:48:45,390 --> 00:48:48,110
There may be some implicit assumptions in your shellcode.

842
00:48:48,110 --> 00:48:49,350
Yes, absolutely.

843
00:48:49,350 --> 00:48:59,070
But I think it's really nice that the path to your shellcode being executed is so simple that you don't really need to worry about any randomness outside of ASLR.

844
00:48:59,070 --> 00:49:02,530
Stack offset is already in a register.

845
00:49:02,730 --> 00:49:08,130
You have RAP in two different registers, so you have different possibilities for instructions there.

846
00:49:09,230 --> 00:49:11,550
Wow, I think that he's getting very close here.

847
00:49:11,550 --> 00:49:12,970
I think MMM is really close.

848
00:49:13,050 --> 00:49:14,090
Macaroni?

849
00:49:14,850 --> 00:49:15,410
Macaroni?

850
00:49:16,010 --> 00:49:16,610
Macaroni?

851
00:49:16,610 --> 00:49:17,590
Not sure.

852
00:49:17,590 --> 00:49:21,350
Still looking at instruction encodings, trying to figure out which one they can use.

853
00:49:21,350 --> 00:49:31,790
It looks like they're iterating through all the possible registers and figuring out what can encode correctly or what can encode and match the constraints.

854
00:49:32,130 --> 00:49:45,130
Yes, and like we mentioned, all of those R prefixes on those registers indicating the 64-bit width, pretty sure that those aren't going to be able to be used with this constraint.

855
00:49:45,130 --> 00:49:47,070
Oh, and it looks... oh my God.

856
00:49:47,290 --> 00:49:52,170
Wait, they just got immediately... MMM just immediately solved.

857
00:49:53,130 --> 00:49:54,610
Did they solve?

858
00:49:54,900 --> 00:49:56,230
They solved.

859
00:49:56,670 --> 00:49:59,510
40 seconds before sudden death we heard.

860
00:50:00,840 --> 00:50:02,630
Let's double check here.

861
00:50:02,970 --> 00:50:06,230
Yeah, Team 2 made... yeah, MMM won match 19.

862
00:50:06,230 --> 00:50:07,410
Wow, incredible.

863
00:50:07,630 --> 00:50:08,390
Incredible.

864
00:50:08,390 --> 00:50:09,470
Oh my goodness.

865
00:50:09,470 --> 00:50:14,190
Just an outstanding job throwing together this, getting it at the last moment.

866
00:50:14,190 --> 00:50:15,570
This is a tough challenge.

867
00:50:15,570 --> 00:50:21,510
We can see that Macaroni was also having a real hard time.

868
00:50:21,510 --> 00:50:26,010
This is, again, sound simple, hard challenge, excellent work.

869
00:50:26,010 --> 00:50:28,150
Very close for a long time there.

870
00:50:28,150 --> 00:50:40,510
And then MMM really had the idea of setting up their second stage payload using XOR, which top bit unset is going to be a lot easier in 64-bit x86.

871
00:50:40,510 --> 00:50:44,530
Yeah, I think they just did XOR negative 1 because negative 1 is going to have all the bits set.

872
00:50:44,530 --> 00:50:46,830
And then away you go.

873
00:50:46,830 --> 00:50:48,790
And then you just flip-flop everything.

874
00:50:49,550 --> 00:50:52,150
Yeah, they had 40 seconds left until sudden death.

875
00:50:52,150 --> 00:50:52,550
Wow.

876
00:50:52,610 --> 00:50:53,510
That's crazy.

877
00:50:53,510 --> 00:50:54,630
So that could have been really close.

878
00:50:54,630 --> 00:50:56,890
That could have been a big upset in sudden death too.

879
00:50:56,910 --> 00:50:58,530
Well, a great challenge.

880
00:50:59,530 --> 00:51:01,130
Outstanding job to our competitors.

881
00:51:01,530 --> 00:51:02,230
Absolutely.

882
00:51:02,230 --> 00:51:03,390
Difficult, came down to the wire.

883
00:51:03,390 --> 00:51:05,090
I'm glad we got to see that solved.

884
00:51:05,090 --> 00:51:10,710
And so MMM will be going into the finals of the lower bracket.

885
00:51:10,850 --> 00:51:14,890
So they'll have a chance to fight all the way back to the finals and maybe even win it.

886
00:51:14,890 --> 00:51:15,070
We'll see.

887
00:51:15,070 --> 00:51:21,130
Maybe see them in grand finals against one of Hypeboi and Strawhat coming up next.

888
00:51:21,130 --> 00:51:25,950
We're going to go ahead and get those teams swapped over and we'll see you back for the next match very shortly.

889
00:51:25,950 --> 00:51:26,670
Alright.