1
00:00:17,250 --> 00:00:19,290
Welcome back, CTF fans.

2
00:00:19,450 --> 00:00:21,050
I'm Mark and this is Josh.

3
00:00:21,150 --> 00:00:24,330
And we're back with the semifinals on the top bracket.

4
00:00:24,330 --> 00:00:25,430
Oh my goodness.

5
00:00:25,570 --> 00:00:26,350
It's been crazy.

6
00:00:26,350 --> 00:00:28,870
Both these teams undefeated so far.

7
00:00:29,170 --> 00:00:31,930
Yeah, really impressive given the level of competition that we've seen.

8
00:00:31,930 --> 00:00:33,970
We've got Hypeboy versus Straw Hat.

9
00:00:34,110 --> 00:00:35,330
I think this is going to be a good one.

10
00:00:35,330 --> 00:00:36,530
And you wrote this challenge, right?

11
00:00:36,530 --> 00:00:37,790
I wrote this challenge.

12
00:00:37,790 --> 00:00:40,570
It's my hardest challenge that I wrote.

13
00:00:40,570 --> 00:00:41,730
I'm allowed to say that.

14
00:00:42,370 --> 00:00:44,130
I think it's going to be really good though.

15
00:00:44,130 --> 00:00:46,210
Both these teams are fantastic.

16
00:00:46,210 --> 00:00:48,430
Alright, well I'm excited to see them get at it.

17
00:00:48,430 --> 00:00:49,270
So let's count it down.

18
00:00:49,270 --> 00:00:49,450
Ready?

19
00:00:49,450 --> 00:00:50,330
Let's do the countdown.

20
00:00:50,630 --> 00:00:56,050
In 5, 4, 3, 2, 1, go.

21
00:00:56,050 --> 00:00:57,130
Let's go.

22
00:00:58,690 --> 00:01:04,830
Alright, so we have on your top right, is that Straw Hat?

23
00:01:05,650 --> 00:01:06,110
Hypeboy.

24
00:01:06,110 --> 00:01:06,870
Did I get backwards?

25
00:01:06,910 --> 00:01:09,110
Ah, top right is Hypeboy, top left is Straw Hat.

26
00:01:09,110 --> 00:01:09,870
That's right.

27
00:01:10,430 --> 00:01:12,250
At this point it looks pretty similar, right?

28
00:01:12,250 --> 00:01:15,390
The first step of every challenge, download the challenge.

29
00:01:15,410 --> 00:01:19,690
Looks like we're having a little bit of a technical issue here.

30
00:01:19,690 --> 00:01:25,930
So we're going to take a look at what's going on with this.

31
00:01:27,330 --> 00:01:29,390
Okay, false start.

32
00:01:29,730 --> 00:01:33,950
You know, there's a lot of moving parts here and it takes a lot to get this going.

33
00:01:33,950 --> 00:01:39,790
It really is impressive to have a show running with everything that's going on here.

34
00:01:39,790 --> 00:01:41,370
A lot of moving pieces.

35
00:01:41,370 --> 00:01:45,450
I'm glad that we've had a lot of understanding on parts of Confedors.

36
00:01:47,470 --> 00:01:48,670
It's a challenge.

37
00:01:48,850 --> 00:01:51,530
It is a challenge, or it will be a challenge soon at least.

38
00:01:51,790 --> 00:01:53,670
Honestly, I blame the challenge author.

39
00:01:53,970 --> 00:01:57,310
You know, I said that going into this and here we are.

40
00:01:57,590 --> 00:02:00,810
Look, all my other ones work totally fine.

41
00:02:01,970 --> 00:02:05,450
Yeah, you know, but I think that it goes to show that...

42
00:02:05,990 --> 00:02:08,070
How many matches have we had so far?

43
00:02:08,070 --> 00:02:08,850
Oh my gosh.

44
00:02:08,850 --> 00:02:10,810
So we're in Grand Finals.

45
00:02:10,810 --> 00:02:12,810
We've had 10.

46
00:02:14,790 --> 00:02:18,510
So with that many challenges, you're bound to run into some bumps.

47
00:02:18,510 --> 00:02:27,610
And we've had a number of difficulties from infra, hardware, challenges needing to be updated on the fly.

48
00:02:27,610 --> 00:02:30,630
And there's so much work that goes on behind the scenes.

49
00:02:30,630 --> 00:02:33,450
We test everything as much as we can.

50
00:02:33,450 --> 00:02:36,290
We make sure that every challenge is solvable.

51
00:02:36,290 --> 00:02:39,610
Can somebody who's on the game network solve it?

52
00:02:39,610 --> 00:02:40,530
Is it reachable?

53
00:02:40,530 --> 00:02:41,150
Exactly.

54
00:02:41,150 --> 00:02:42,230
That's a big one.

55
00:02:42,230 --> 00:02:44,310
And there's just a lot of pieces.

56
00:02:44,310 --> 00:02:45,730
Yeah, there are a lot of pieces.

57
00:02:45,930 --> 00:02:47,950
And I think on this one...

58
00:02:49,090 --> 00:02:50,190
The what?

59
00:02:52,070 --> 00:02:53,270
Okay, so it sounds like...

60
00:02:53,270 --> 00:02:54,730
It's hyphens , not underscores.

61
00:02:57,730 --> 00:03:02,590
So I am the only person on the team that names things with underscores.

62
00:03:03,690 --> 00:03:05,070
Everyone else uses hyphens.

63
00:03:05,070 --> 00:03:06,950
And it looks like that caused the mix-up.

64
00:03:06,950 --> 00:03:10,450
So instead of the name of this challenge, we're allowed to say...

65
00:03:11,490 --> 00:03:12,750
We'll wait to say.

66
00:03:13,770 --> 00:03:14,150
But...

67
00:03:14,150 --> 00:03:15,990
Yeah, it's multiple words.

68
00:03:15,990 --> 00:03:17,350
I put underscores between them.

69
00:03:17,350 --> 00:03:18,210
It should be hyphens.

70
00:03:18,210 --> 00:03:19,710
Who's got time for a shift key?

71
00:03:20,510 --> 00:03:22,650
Honestly, who has time to not use a shift key?

72
00:03:22,750 --> 00:03:23,970
Why even use spaces?

73
00:03:23,970 --> 00:03:24,970
Yeah, I don't need numbers.

74
00:03:24,970 --> 00:03:25,950
I just need symbols.

75
00:03:27,070 --> 00:03:28,650
Why even use spaces?

76
00:03:28,790 --> 00:03:29,430
Yeah.

77
00:03:29,810 --> 00:03:31,530
Poland can use space.

78
00:03:31,750 --> 00:03:33,030
It's a hack-a-sack joke.

79
00:03:33,030 --> 00:03:33,650
Oh my gosh.

80
00:03:33,650 --> 00:03:35,290
Also another competition going on here.

81
00:03:35,290 --> 00:03:35,890
They're great.

82
00:03:35,890 --> 00:03:38,270
We have Jordan over there working on that right now.

83
00:03:38,910 --> 00:03:44,010
Yeah, it was a fierce rock-paper-scissors to see who was going to be able to commentate the finals.

84
00:03:44,010 --> 00:03:47,050
But Jordan, he is actually really good at rock-paper-scissors.

85
00:03:47,050 --> 00:03:48,770
Oh my gosh, a professional.

86
00:03:48,850 --> 00:03:49,850
I don't understand that.

87
00:03:49,850 --> 00:03:51,950
Well, he's doing rocket-paper-scissors right now.

88
00:03:51,950 --> 00:03:52,650
Oh my.

89
00:03:52,650 --> 00:03:53,370
Ha-ha!

90
00:03:53,470 --> 00:03:54,970
Oh, we have time before the challenge?

91
00:03:54,970 --> 00:03:56,250
We have time for bad jokes.

92
00:03:56,790 --> 00:03:58,030
I'll let you lead.

93
00:03:58,850 --> 00:03:59,510
Oh, I got nothing?

94
00:03:59,510 --> 00:04:00,290
That was my only one?

95
00:04:00,290 --> 00:04:01,130
Oh, okay.

96
00:04:01,130 --> 00:04:03,290
I guess now I'm the bad joke.

97
00:04:03,630 --> 00:04:04,490
Womp womp.

98
00:04:04,670 --> 00:04:12,570
You know, I see a lot of... you can't see this, but when we're looking out, what we're seeing is the DEF CON CTF finals floor.

99
00:04:12,570 --> 00:04:16,110
And it is a big dark room with a lot of people.

100
00:04:16,110 --> 00:04:18,570
And you know, I'm actually not seeing a lot of dual monitor use.

101
00:04:18,830 --> 00:04:25,550
You know there isn't, because a lot of being on the floor at DEF CON is just being able to pick up your laptop, go work wherever.

102
00:04:25,550 --> 00:04:27,530
Like, you're done being on the floor.

103
00:04:27,530 --> 00:04:28,890
You don't want to sit here anymore.

104
00:04:28,910 --> 00:04:30,070
You want to be the Chipotle guy.

105
00:04:30,070 --> 00:04:31,230
You want to go up to the suite.

106
00:04:31,230 --> 00:04:33,090
You want to, like, do anything else.

107
00:04:33,090 --> 00:04:38,290
You're tired of staring at this, like, stupid heap challenge.

108
00:04:38,770 --> 00:04:41,510
I, of course, not speaking from experience or anything.

109
00:04:42,010 --> 00:04:43,310
Yeah, well, I can relate.

110
00:04:43,310 --> 00:04:47,110
I'm very much a one screen guy because I just like to be able to set up wherever I am.

111
00:04:47,410 --> 00:04:49,070
Yeah, no, that's totally fair.

112
00:04:49,070 --> 00:04:54,810
And your awesome ergonomic setup, which, like, you set it down.

113
00:04:54,810 --> 00:04:56,670
You have a stand for your laptop.

114
00:04:56,670 --> 00:04:57,610
You have mouse.

115
00:04:57,610 --> 00:04:59,370
You have ergonomic keyboard and everything.

116
00:04:59,370 --> 00:05:01,650
I'm like, oh my gosh, this guy is a pro.

117
00:05:03,110 --> 00:05:07,810
I'm over here with my little laptop and my, like, 90 degree angled posture.

118
00:05:08,890 --> 00:05:12,010
It's just years of wrist rot, really.

119
00:05:12,010 --> 00:05:15,590
So it comes back to bite you if you don't take care of it up front.

120
00:05:15,590 --> 00:05:17,870
See, I don't get that because I don't use home rototype.

121
00:05:17,870 --> 00:05:20,650
I have my left hand on WASD and my right is just floating.

122
00:05:21,970 --> 00:05:24,210
I learned to type from playing video games.

123
00:05:24,210 --> 00:05:25,030
What can I say?

124
00:05:25,690 --> 00:05:27,430
Maybe speak and tell me how to type.

125
00:05:27,630 --> 00:05:28,270
What to?

126
00:05:29,010 --> 00:05:30,470
Old typing program.

127
00:05:30,470 --> 00:05:31,730
Oh, God.

128
00:05:31,730 --> 00:05:33,310
No, am I showing my age?

129
00:05:35,030 --> 00:05:36,870
And I think we're getting close here.

130
00:05:36,870 --> 00:05:38,550
We're getting close to ready here.

131
00:05:38,650 --> 00:05:41,370
But we're good to go?

132
00:05:43,270 --> 00:05:46,110
I think we're just making sure that the connectivity is up.

133
00:05:46,110 --> 00:05:46,130
All right.

134
00:05:46,130 --> 00:05:49,070
I think we're good to go with not a false start.

135
00:05:49,830 --> 00:05:50,410
Okay.

136
00:05:50,410 --> 00:05:53,410
So without further ado, for real this time, that was just a practice.

137
00:05:53,490 --> 00:05:57,810
In 5, 4, 3, 2, 1.

138
00:05:57,810 --> 00:05:58,150
Let's go.

139
00:05:58,150 --> 00:05:59,630
Let's go for real, please.

140
00:06:01,730 --> 00:06:02,370
Oh.

141
00:06:02,950 --> 00:06:03,430
Okay.

142
00:06:03,430 --> 00:06:04,610
They download the challenge.

143
00:06:04,610 --> 00:06:07,570
I see the happy bouncing box on the Mac.

144
00:06:09,790 --> 00:06:10,310
Yeah.

145
00:06:10,310 --> 00:06:11,370
They download the challenge file.

146
00:06:11,370 --> 00:06:12,390
I see something in IDA.

147
00:06:12,390 --> 00:06:15,590
If you just screen dash R or whatever, or I can take care of it.

148
00:06:15,790 --> 00:06:16,470
Okay.

149
00:06:17,130 --> 00:06:17,550
So...

150
00:06:17,550 --> 00:06:18,010
All right.

151
00:06:18,010 --> 00:06:21,190
Now we see that beautiful challenge name popping out there.

152
00:06:21,190 --> 00:06:22,310
We see the beautiful challenge.

153
00:06:22,310 --> 00:06:23,430
Oh, House of Barbie.

154
00:06:23,430 --> 00:06:25,530
I'm so proud of this challenge name.

155
00:06:25,530 --> 00:06:29,350
This came from another challenge name that Carl came up with originally.

156
00:06:29,350 --> 00:06:32,930
I made this as a follow-up joke, and I'm like, damn, I need to write that.

157
00:06:32,930 --> 00:06:36,750
So House of Barbie is a custom heap allocator challenge.

158
00:06:37,670 --> 00:06:41,810
Everyone's familiar with the, like, House of Spirit, House of Force, and all that.

159
00:06:42,370 --> 00:06:45,130
So House of Barbie was the natural follow-up.

160
00:06:46,290 --> 00:06:50,030
So this is, you know, in my book, a custom heap allocator.

161
00:06:50,030 --> 00:06:52,470
That doesn't sound like an easy challenge to me.

162
00:06:52,890 --> 00:06:53,950
It's simple.

163
00:06:53,950 --> 00:06:55,230
We don't do TCache.

164
00:06:55,230 --> 00:06:56,490
We don't do different bins.

165
00:06:56,490 --> 00:06:57,530
We throw everything.

166
00:06:57,530 --> 00:07:00,190
We use Sbreak, and we just send it.

167
00:07:00,190 --> 00:07:01,750
You know, everything is sequential.

168
00:07:01,750 --> 00:07:04,650
If it isn't sequential, oops, memory's bad.

169
00:07:05,690 --> 00:07:06,610
Well, you know what?

170
00:07:06,610 --> 00:07:08,370
Writing memory allocators is hard.

171
00:07:08,370 --> 00:07:08,670
Yeah.

172
00:07:08,670 --> 00:07:10,090
Who remembers how to do that?

173
00:07:11,930 --> 00:07:15,290
So let's jump in and take a look at our competitors here.

174
00:07:15,650 --> 00:07:18,750
So Hypoi launching into it first, going through.

175
00:07:18,750 --> 00:07:20,250
It's fairly simple.

176
00:07:20,250 --> 00:07:22,330
So what you have is you have a house.

177
00:07:22,770 --> 00:07:24,290
This is going to sound so weird.

178
00:07:24,290 --> 00:07:25,130
Keep going, Josh.

179
00:07:25,130 --> 00:07:26,190
You have a house.

180
00:07:26,190 --> 00:07:27,750
There are rooms in the house.

181
00:07:27,750 --> 00:07:29,070
There's furniture in the rooms.

182
00:07:29,070 --> 00:07:30,510
You make your dream house.

183
00:07:30,510 --> 00:07:40,810
I think the description of the challenge was, like, Stidlib Malik wasn't pink enough, so we implemented our own, which also the description.

184
00:07:41,270 --> 00:07:44,690
For those that haven't seen the Barbie movie, this is going to be totally over your head.

185
00:07:44,690 --> 00:07:47,170
But those that have, I really hope you're laughing.

186
00:07:49,370 --> 00:07:51,950
I heard a groan from production.

187
00:07:51,950 --> 00:07:56,970
So going through, we have very nice functions here.

188
00:07:56,970 --> 00:08:03,290
Print state, it was supposed to be behind debug, but that was actually a little hard, so I just commented out the debug condition.

189
00:08:03,330 --> 00:08:07,570
Print state prints each room in the house, each furniture item in the room, and why not?

190
00:08:07,570 --> 00:08:09,170
It prints all the heap chunks, too.

191
00:08:09,530 --> 00:08:15,770
Heap chunk printed with the address of it, the data address of it, size of it, whether it's free or not, and the next.

192
00:08:15,770 --> 00:08:20,770
So the heap here is a singly linked list, which we're going to see so much in CTFs.

193
00:08:20,770 --> 00:08:27,170
It's one of the most common data structures you see because that next pointer is just so valuable, especially in heap challenges.

194
00:08:27,170 --> 00:08:30,050
You might be able to get an arb right from it if you try hard enough.

195
00:08:30,330 --> 00:08:36,730
Yeah, so definitely when I was looking at this challenge, I was thinking, all right, what is the metadata that we're going to see in the chunks?

196
00:08:36,730 --> 00:08:38,430
How are these chunks laid out?

197
00:08:38,430 --> 00:08:50,850
The print function that you mentioned really does help you understand that, and I'm interested to see when the competitors stumble across that, and we'll be able to tell because there'll be some addresses being printed out.

198
00:08:50,850 --> 00:08:53,530
Yeah, no, it looks like Hypoi is doing that.

199
00:08:53,530 --> 00:08:57,030
They're not annotating with it quite yet, but Straw Hat is.

200
00:08:57,210 --> 00:09:04,910
Straw Hat has already gone through and annotated part of the heap struct, I believe, or maybe they're just in the furniture struct still.

201
00:09:04,910 --> 00:09:06,530
Yeah, so that's the globals.

202
00:09:06,530 --> 00:09:16,810
There's some global metadata that manages the heap as well as, I believe, the house structure.

203
00:09:16,810 --> 00:09:20,410
The house struct is in globals.

204
00:09:20,410 --> 00:09:20,850
Yep.

205
00:09:21,290 --> 00:09:22,870
So that's easy to keep track of.

206
00:09:22,870 --> 00:09:26,630
It's one less layer of indirection, one less allocation you need to keep track of on the heap.

207
00:09:27,670 --> 00:09:32,950
And both teams we're going to see going through just doing basic annotation of this.

208
00:09:32,950 --> 00:09:45,570
We talked about this earlier, but this is a really good way to just get your bearings in a challenge that has a couple layers to it because you have the house, you have rooms, and you have furniture, and all of those are different structs.

209
00:09:45,570 --> 00:09:55,090
Right, and correct me if I'm wrong here, Josh, but I think that the structs themselves, not in the binary, they're going to have to reconstruct that.

210
00:09:55,090 --> 00:10:05,070
They've got hints based on strings that are in it and the menu sort of saying add room, add furniture, but they're still going to do a little bit of struct reconstruction.

211
00:10:06,050 --> 00:10:07,010
Reconstruction, nice.

212
00:10:07,010 --> 00:10:08,030
Got it, got it.

213
00:10:08,910 --> 00:10:10,830
Yeah, they are reconstructionists.

214
00:10:10,830 --> 00:10:11,750
Yep, yep.

215
00:10:12,050 --> 00:10:17,230
And we've talked about this before, but again, common theme, we've got a menu here.

216
00:10:17,430 --> 00:10:25,590
We've got one competitor who looks like they're very static focused, so they're looking at each menu item, they're reading the function that gets called.

217
00:10:25,590 --> 00:10:29,930
The other competitor looked like they were exploring the menu via just sending stuff to it.

218
00:10:30,590 --> 00:10:40,690
Yeah, and it looks like they're just trying to get interaction down, and they're trying to print the state of the heap after each of those interactions.

219
00:10:40,690 --> 00:10:49,010
And what's really nice is these structs are, you know, I might have been a little nice here and made them divisible sizes.

220
00:10:49,430 --> 00:10:50,570
Always helpful.

221
00:10:50,890 --> 00:11:03,170
You might be able to just kind of shove a couple of one in the space of another, and the link list I might have forgotten to free, so you might have a couple free chunks here and there you can control.

222
00:11:04,590 --> 00:11:11,030
But really, this challenge was inspired by the name, obviously.

223
00:11:11,030 --> 00:11:14,630
And then when I started looking up, I was like, oh, what do people do for custom heap allocators?

224
00:11:14,630 --> 00:11:19,670
I looked through a bunch of GitHub repos, and all of them I found bugs.

225
00:11:19,870 --> 00:11:22,070
Every single one had a mistake.

226
00:11:22,070 --> 00:11:22,810
At least one.

227
00:11:23,010 --> 00:11:24,470
As I said, it's hard.

228
00:11:24,470 --> 00:11:25,710
Yeah, it is.

229
00:11:25,710 --> 00:11:29,670
So I kind of pulled the bug inspired by one of those.

230
00:11:29,670 --> 00:11:34,990
Not exactly the same, but kind of the idea of it because I'm like, wow, yeah, people can really make this mistake.

231
00:11:34,990 --> 00:11:36,770
This is kind of a real bug.

232
00:11:36,770 --> 00:11:48,270
Well, so it's interesting you say that because I think that a surprising number of the challenges that we've seen, both here and in other CTFs, are usually modeled after a real bug that someone else has found.

233
00:11:48,270 --> 00:11:52,990
And sometimes it is literally just, here's that software with this bug that I found in it.

234
00:11:52,990 --> 00:11:54,390
You find the bug too.

235
00:11:54,430 --> 00:11:54,730
Exactly.

236
00:11:54,730 --> 00:11:55,730
In some CTFs.

237
00:11:56,090 --> 00:12:04,250
Certainly some of the challenges that we've seen in this competition, I know at least one of the ones that I wrote was based on a real-world bug with a weird primitive.

238
00:12:04,510 --> 00:12:08,130
And I thought, hey, it would be really cool to see the challengers try their hands at this.

239
00:12:08,130 --> 00:12:09,390
Yeah, absolutely.

240
00:12:09,390 --> 00:12:13,490
And I remember I was playing in real-world CTF 20...

241
00:12:13,490 --> 00:12:14,730
Oh, the first one.

242
00:12:14,730 --> 00:12:15,930
Whenever that was.

243
00:12:16,750 --> 00:12:17,150
And...

244
00:12:17,150 --> 00:12:22,790
they had one challenge that was you know, recreate this ODE in Chrome.

245
00:12:22,790 --> 00:12:24,890
Oh, by the way, don't worry, we actually have it.

246
00:12:25,110 --> 00:12:26,390
You're not giving us an ODE.

247
00:12:26,390 --> 00:12:27,190
We already have it, guys.

248
00:12:27,190 --> 00:12:27,930
Trust us.

249
00:12:27,930 --> 00:12:35,150
And they had a video of them showing the ODE, which was just them running a script, then Chrome popped up, then Calc popped up, and I'm like, dude, that doesn't prove anything.

250
00:12:35,150 --> 00:12:36,830
You could just call Calc.

251
00:12:36,830 --> 00:12:39,670
Print random addresses and call Calc.

252
00:12:39,690 --> 00:12:43,830
So, there are definitely real-world bugs that try to be put in CTF.

253
00:12:43,830 --> 00:12:46,170
Sometimes, it's a little shadier than others.

254
00:12:46,170 --> 00:12:51,070
We decided to not do that challenge because we're like, we don't know how we feel about this.

255
00:12:51,370 --> 00:12:51,970
Right.

256
00:12:52,310 --> 00:12:58,430
Yeah, I mean, they're in good company in terms of the number of proof videos out there that just popped up.

257
00:12:58,870 --> 00:13:06,010
Where it's just, you know, a script that's called, like, exploit.py, and inside of it, all of us is like, subprocess.calc.exe.

258
00:13:06,010 --> 00:13:07,030
Great exploit.

259
00:13:07,030 --> 00:13:08,010
One of my favorites.

260
00:13:08,010 --> 00:13:20,950
So, if we switch over here to Hypeboi, we can see that they're printing out the this is the list of the chunks, and these are the different... Yeah, these are all the field values.

261
00:13:20,950 --> 00:13:22,530
The fields in the chunks.

262
00:13:22,590 --> 00:13:26,010
So, it looks like three... oh, gosh.

263
00:13:26,050 --> 00:13:28,450
So, they're going to be creating a room.

264
00:13:28,830 --> 00:13:32,290
Yeah, creating a room and adding items to it.

265
00:13:32,850 --> 00:13:46,990
I have to say, I really especially for a challenge like this, I think it's great to have stuff like that because for me, having heap structure stuff in my head, even with nice printouts like that, it's hard.

266
00:13:46,990 --> 00:13:48,530
It is hard, definitely.

267
00:13:48,530 --> 00:13:52,370
And unless you're really familiar with the structures, like, you can hold tcache info in your head.

268
00:13:52,370 --> 00:13:58,730
With a custom heap allocator, like, you need to change your understanding and you're going to be making mistakes because fields are at different places.

269
00:13:58,890 --> 00:14:00,110
Fields don't exist.

270
00:14:00,110 --> 00:14:02,870
They're different sizes, different everything.

271
00:14:02,870 --> 00:14:11,470
So, having that printout is really, really beneficial to just being able to do this challenge, period, let alone in the time they're given.

272
00:14:12,150 --> 00:14:30,810
Yeah, and I think that one of the things that is tricky with a new heap allocator is, as you were talking about, it's nice that they're at good widths because with heap stuff, typically what you're looking to do is you have these boxes, right, and you're trying to get maybe one overlaid over the other or a little bit further into them,

273
00:14:30,810 --> 00:14:38,310
but you have to know exactly what that structure is to know what's being overwritten or what's being placed on top of a value that used to be there.

274
00:14:38,590 --> 00:14:40,230
Yeah, absolutely.

275
00:14:40,230 --> 00:14:47,730
Like, if you have two structs of the same size, one with a function pointer at the offset of the size field of the other one, you know, that's really nice.

276
00:14:47,730 --> 00:15:07,250
You get arb call on size field, but if you have mismatched sizes, you know, you get , uh-oh, that function pointer is now like next pointer in the heap metadata, and it's just so like it's probably still possible, but you have to do so much heap manipulation to get there that it's just not feasible within an hour.

277
00:15:07,250 --> 00:15:12,130
I'm sure everybody at home has exactly the picture in their head of what Josh was just talking about.

278
00:15:12,130 --> 00:15:14,430
I know it's very easy.

279
00:15:14,630 --> 00:15:16,470
This is child's play, surely.

280
00:15:17,570 --> 00:15:18,530
Okay.

281
00:15:20,210 --> 00:15:24,390
Let's take a look here and see what Straw Hat has going on.

282
00:15:24,390 --> 00:15:28,470
So Straw Hat...

283
00:15:28,470 --> 00:15:30,250
So right now they're breaking down.

284
00:15:30,250 --> 00:15:31,310
So this is the free function.

285
00:15:31,310 --> 00:15:34,150
So the allocator, it's essentially only three functions, right?

286
00:15:34,150 --> 00:15:34,470
Yeah.

287
00:15:34,470 --> 00:15:35,890
It's, uh, what is it?

288
00:15:35,970 --> 00:15:39,270
Free, malloc, and realloc.

289
00:15:39,270 --> 00:15:39,950
Yep.

290
00:15:40,010 --> 00:15:46,430
And I think looking at this, you just skipped over the malloc function because you're just like, oh, it's just malloc.

291
00:15:46,430 --> 00:15:49,710
And you were looking for straight, like, stdlib heap bugs.

292
00:15:49,710 --> 00:15:50,390
Yeah.

293
00:15:50,890 --> 00:15:55,710
Because... Yeah, I'm like, uh, double click on malloc, and you're like, you bastard.

294
00:15:55,850 --> 00:15:56,350
Yeah.

295
00:15:56,350 --> 00:16:02,850
If you look on the left-hand side there, you can very clearly see that the malloc, free, and realloc functions don't have that pink background on them.

296
00:16:02,850 --> 00:16:04,610
So they're not imports.

297
00:16:04,790 --> 00:16:12,670
Um , so I missed that because I, you know, little detail like that, and I was looking for the bug and didn't see it.

298
00:16:12,670 --> 00:16:14,130
It's a really common oversight.

299
00:16:14,130 --> 00:16:29,130
Honestly, a big part of this is, you know, going through with a fine-tooth comb and understanding every step of the process because if you make assumptions like that, you're going to be skipping over potentially major parts of program logic and potentially where the bug is.

300
00:16:29,130 --> 00:16:29,430
Right.

301
00:16:29,430 --> 00:16:29,770
Who knows?

302
00:16:29,770 --> 00:16:30,070
Right.

303
00:16:30,070 --> 00:16:33,970
And so I'm glad to see that our competitors did not fall for that like I did.

304
00:16:33,970 --> 00:16:34,870
Oh, my god.

305
00:16:34,870 --> 00:16:41,030
I was honestly worried and I was debating renaming them, and then I'm just like, nah, I like using these names.

306
00:16:41,670 --> 00:16:42,090
Uh, yep.

307
00:16:42,090 --> 00:16:46,690
And we can see that both competitors looking at these heap implementations.

308
00:16:47,450 --> 00:16:47,610
Yeah.

309
00:16:47,610 --> 00:16:50,130
Hypeboi also looking at realloc and free.

310
00:16:50,210 --> 00:16:50,490
Yeah.

311
00:16:50,650 --> 00:17:01,290
Hypeboi probably knows that realloc is usually pretty buggy because you need to split chunks, you need to be able to shift them, join them, etc.

312
00:17:01,290 --> 00:17:04,290
You know, that's all this does but other heap allocators, absolutely.

313
00:17:04,810 --> 00:17:10,370
Um , but you might notice that splitting the chunk isn't the job of realloc.

314
00:17:10,370 --> 00:17:12,270
Splitting the chunk happens in malloc.

315
00:17:12,790 --> 00:17:20,670
Yeah, I was going to say that depending on how you want to write your heap allocator, you could end up with some of these being pretty simple.

316
00:17:20,670 --> 00:17:27,750
So, realloc really could just be a thin wrapper around malloc and free if you wanted to, like if you wanted to be lazy.

317
00:17:27,750 --> 00:17:28,930
It was originally.

318
00:17:28,930 --> 00:17:30,790
Um , and free.

319
00:17:31,290 --> 00:17:43,050
I think that if you wanted to be lazy about it, you could do basically all the work in free and have it do the consolidation of chunks and malloc just be real lazy and just, do I have a big enough free slot?

320
00:17:43,050 --> 00:17:44,610
If so, yep, just take it.

321
00:17:45,310 --> 00:17:46,610
Okay, well, look.

322
00:17:46,610 --> 00:17:47,150
Sorry.

323
00:17:48,770 --> 00:17:51,750
Shade being thrown this way because that's kind of what it does.

324
00:17:52,990 --> 00:17:54,570
I mean, but despite that, look.

325
00:17:54,870 --> 00:17:55,750
Yeah.

326
00:17:56,370 --> 00:17:57,230
What are we looking at?

327
00:17:57,230 --> 00:17:58,690
We're looking at Hypeboy here.

328
00:17:58,950 --> 00:18:01,150
Um , yeah.

329
00:18:01,330 --> 00:18:07,530
Looks like they're cross-referencing those heap functions.

330
00:18:07,550 --> 00:18:09,190
See those calls to free there.

331
00:18:09,190 --> 00:18:10,910
Trying to figure out what goes inside of them.

332
00:18:10,910 --> 00:18:11,390
Exactly.

333
00:18:11,390 --> 00:18:21,030
I think once you understand that, okay, there might be a bug in one of the three allocator functions, the next step is probably, okay, where do each of these functions get used?

334
00:18:21,030 --> 00:18:21,210
Yeah .

335
00:18:21,210 --> 00:18:26,390
As far as I'm aware, the only bug in this program is in the heap allocator.

336
00:18:26,390 --> 00:18:30,910
It's very possible that there's another bug somewhere, like, I'm not a perfect programmer.

337
00:18:31,390 --> 00:18:42,070
And I would be delighted to see it because I've been saying this whole tournament that I want to see a challenger come up with an unintended solution because I know it's a possibility.

338
00:18:42,070 --> 00:18:49,490
We've had a little off from intended solution but we haven't had, you know, fully just wrong place, not where we expected at all.

339
00:18:49,490 --> 00:18:50,950
We thought this was sound.

340
00:18:51,290 --> 00:18:54,210
Like, I want to see someone just tear apart my code.

341
00:18:55,170 --> 00:19:02,330
Yeah, and especially for this one, which I think the intended solution in this one is, it's not simple, right?

342
00:19:02,330 --> 00:19:04,030
This is a tough challenge.

343
00:19:04,090 --> 00:19:04,550
Yeah.

344
00:19:04,550 --> 00:19:08,090
This is, I want to say, the hardest challenge I wrote for this.

345
00:19:08,450 --> 00:19:09,530
Both very good teams.

346
00:19:09,530 --> 00:19:19,570
We were saving it for later because we were worried that when players were just getting used to this, when players were still very nervous about competing, that they wouldn't solve it in time.

347
00:19:19,570 --> 00:19:24,550
But we're pretty confident that this won't go into sudden death, obviously, otherwise we wouldn't have fielded it.

348
00:19:25,390 --> 00:19:30,790
Yeah, a lot of quality control on our side is really focused on, is this hard but solvable?

349
00:19:30,850 --> 00:19:32,310
Yes, absolutely.

350
00:19:32,310 --> 00:19:35,490
So we've got a couple of levers that we can pull in this regard.

351
00:19:35,490 --> 00:19:41,830
We've got hints, we can add symbols or have explanatory stuff sort of sprinkled in.

352
00:19:41,830 --> 00:19:49,690
Oh yeah, and we've nerfed challenges, we've added win functions, we added unoptimized gadgets in there.

353
00:19:50,770 --> 00:19:59,710
And I'll also say that the sudden death challenges that we've seen so far weren't necessarily the ones that we thought were going to be the ones that would go the distance.

354
00:19:59,710 --> 00:20:00,590
Absolutely.

355
00:20:00,590 --> 00:20:03,210
I honestly chalk that up to nerves.

356
00:20:03,470 --> 00:20:07,750
Yes, this is truly a difficult situation to try to succeed in.

357
00:20:08,470 --> 00:20:16,090
Yeah, it's a different situation than these teams have been in before because they've competed in countless CTFs.

358
00:20:16,090 --> 00:20:24,910
They got here, they're used to being here, you know, you work in your team, every team has a little, almost enclave where they work with their teammates.

359
00:20:25,070 --> 00:20:31,110
And then you get over here, you're alone, you're against another team that you don't know the person potentially.

360
00:20:31,210 --> 00:20:34,190
You're on unfamiliar challenge.

361
00:20:34,930 --> 00:20:38,790
You have to use tools that you might have installed, you might need to download them.

362
00:20:38,790 --> 00:20:44,470
We saw with the LEB128 package that you needed to download the tool because no one had that obviously.

363
00:20:44,470 --> 00:20:46,810
I think MMM didn't end up using it, right?

364
00:20:47,210 --> 00:20:48,170
Oh, you're right.

365
00:20:48,170 --> 00:20:49,810
No, they didn't end up using it at all.

366
00:20:50,610 --> 00:20:59,770
But it just goes to show, like, it's a very different situation and the amount that plays into it just can't be overstated.

367
00:20:59,850 --> 00:21:10,530
Yeah, it's a different game and I have been in the CTF scene for a long time and one of the things that I picked up on after the first few years of playing is that it's really a big morale game.

368
00:21:10,530 --> 00:21:11,630
It's a psychological game .

369
00:21:11,630 --> 00:21:13,050
Do you feel like you have momentum?

370
00:21:13,050 --> 00:21:14,590
Do you feel like you're making progress?

371
00:21:14,590 --> 00:21:16,350
And this is a different situation.

372
00:21:16,350 --> 00:21:19,390
You're just behind this wall and it's just them back there.

373
00:21:19,390 --> 00:21:29,590
They don't have their teammates to bounce ideas off of and all they have is another fierce competitor sitting across from them and they don't know how far that person's made it yet.

374
00:21:29,590 --> 00:21:38,770
A big, big part of CTF is social and interaction and, you know, rubber ducking, bouncing ideas, working together on an exploit.

375
00:21:38,770 --> 00:21:44,490
Because we're, as commentators, we've really found out how easy it is to see bugs in someone else's code.

376
00:21:44,510 --> 00:21:46,690
And we know this, obviously, from, like, work, too.

377
00:21:47,030 --> 00:21:55,910
It's so much easier to see bugs in someone else's code when they're just sitting there writing it and, like, they're saying their logic out loud and then they write something totally different and you're like, that's not what that does.

378
00:21:56,130 --> 00:21:57,770
They're like, oh, damn, you're right.

379
00:21:57,770 --> 00:22:02,610
Yeah, it is always easier when you're, you know, one step removed.

380
00:22:02,610 --> 00:22:08,790
Yeah, even a, was it, even a 10x programmer, 10x hacker needs someone to work with sometimes.

381
00:22:08,790 --> 00:22:10,050
Oh, I totally agree.

382
00:22:10,110 --> 00:22:17,330
And I think that when with this tournament in particular, we've seen a little bit of teammate rotation.

383
00:22:17,350 --> 00:22:18,050
Yes.

384
00:22:18,050 --> 00:22:23,990
But a lot of these challenges have been Pwn challenges and a lot of them have been the same competitors for... Absolutely.

385
00:22:23,990 --> 00:22:25,170
most of the challenges.

386
00:22:25,170 --> 00:22:25,650
Yeah.

387
00:22:25,650 --> 00:22:31,490
Or we've had people switch off because they're just like, you know, I, this isn't really my forte.

388
00:22:31,850 --> 00:22:34,050
I'm not doing well solo.

389
00:22:34,050 --> 00:22:36,250
I don't really want to be under that pressure.

390
00:22:36,250 --> 00:22:38,710
Or they're like, you'd be better at this.

391
00:22:38,710 --> 00:22:39,530
Like, go for it.

392
00:22:39,530 --> 00:22:44,630
These teammates all have major confidence and trust in each other because you're working on these challenges.

393
00:22:44,630 --> 00:22:52,150
You're spending, you know, 16 hours looking at one challenge and then you have to be able to comfortably hand off your script to someone else so you can sleep.

394
00:22:52,150 --> 00:22:52,650
Yeah.

395
00:22:52,650 --> 00:23:00,170
And trust them to not like burn it all down or ruin it or like waste those precious hours in the competition.

396
00:23:01,290 --> 00:23:02,290
Exactly.

397
00:23:02,390 --> 00:23:05,190
And we've seen that really...

398
00:23:05,190 --> 00:23:07,950
I think the best example was the Python challenge yesterday.

399
00:23:07,950 --> 00:23:18,230
We saw some fresh faces and one of the competitors was not the person who had played previously for their team but then they executed an extremely fast solve.

400
00:23:18,230 --> 00:23:20,530
So clearly they had a specialist on that team.

401
00:23:20,530 --> 00:23:23,950
They knew, hey, this is going to be your challenge and it worked out for them.

402
00:23:24,190 --> 00:23:24,910
Absolutely.

403
00:23:24,990 --> 00:23:35,970
And I think really working with these people for so long and working in these high-stress, you know, fast-paced environments, really you build knowledge of who can do what the fastest and who can do what the most consistently.

404
00:23:35,970 --> 00:23:37,870
Those aren't always the same person.

405
00:23:38,550 --> 00:23:38,990
Exactly.

406
00:23:38,990 --> 00:23:39,190
Yeah.

407
00:23:39,750 --> 00:23:47,010
And I've heard this from a number of my friends in the community and talking to them about what makes their team good.

408
00:23:47,010 --> 00:23:55,310
And I think a big part of it is really understanding your teammates' strengths and knowing, I'm really struggling with this.

409
00:23:55,310 --> 00:24:03,810
I'm going to turn it over to this person or go to this person because I know that they're good at this sort of thing or maybe they just look at it differently.

410
00:24:03,810 --> 00:24:05,130
We're both good but we look at it differently.

411
00:24:05,130 --> 00:24:10,090
Looking at it differently is major also because it's so easy to get rabbit hole and just like...

412
00:24:10,090 --> 00:24:10,790
Oh yeah.

413
00:24:11,090 --> 00:24:11,470
Oh yeah.

414
00:24:11,470 --> 00:24:15,770
And that's key when you've got a teammate to say like, I don't think that this is the way to go.

415
00:24:15,770 --> 00:24:16,810
Yeah, this is nit guys.

416
00:24:16,810 --> 00:24:18,470
This is memcopy.

417
00:24:18,470 --> 00:24:24,490
And it is fun to see the different approaches that people have and I mean different in every sense of it.

418
00:24:24,490 --> 00:24:35,090
I know one good friend of mine, he is a very fast hacker but he has another teammate who is also very fast and I said, so which one of you is faster?

419
00:24:35,090 --> 00:24:45,750
And they looked at each other and they said, well, he types faster but I have to delete my stuff less and go back and fix less.

420
00:24:45,750 --> 00:24:47,650
So we're probably about a head and a head.

421
00:24:48,130 --> 00:25:06,930
I worked with two really good friends all throughout college and RPI sec on like crypto challenges and some reversing some web and we all have different strengths and I remember specifically when Defcon qualls, we split off from the rest of our team, went into a different room and just like closed door,

422
00:25:06,930 --> 00:25:07,750
like locked.

423
00:25:07,750 --> 00:25:10,290
We just had a big whiteboard and we're like, okay.

424
00:25:10,290 --> 00:25:15,470
And we all took a different part of this crypto problem and at the end just like put them all together and we got this all.

425
00:25:15,670 --> 00:25:15,930
Wow.

426
00:25:15,930 --> 00:25:22,350
It was we all know our own specific domain and work together to make one beautiful solution script.

427
00:25:22,450 --> 00:25:23,490
Yeah, that's great.

428
00:25:23,490 --> 00:25:29,990
I mean in the divide and conquer approach really works, especially when you've got some of these finals problems are massive, right?

429
00:25:29,990 --> 00:25:37,870
Or they'll be, you know, a common sort of thread, but okay so here's the same mini problem but solve it a thousand times, right?

430
00:25:37,870 --> 00:25:38,750
Could be one problem.

431
00:25:38,750 --> 00:25:43,510
And finals, attack, defend, you need to submit patches for it too that don't break SLA.

432
00:25:43,510 --> 00:25:46,890
Like you need to be able to keep the service up but fix.

433
00:25:46,890 --> 00:25:55,690
And one of the challenges, Torque also written by Glenn because it's cursed but is Torque and it's it's Torque.

434
00:25:55,690 --> 00:26:03,730
You can pop a shell in 2,000 different ways but one of those ways is you know it's how the game runs.

435
00:26:03,730 --> 00:26:05,330
So you can't really disable it.

436
00:26:05,330 --> 00:26:07,170
You need to make mitigation somewhere else.

437
00:26:07,330 --> 00:26:11,650
So just knowing specific domains and knowing how to work together is crazy.

438
00:26:11,650 --> 00:26:15,250
Here alone it looks like Hypeboy has been making good progress.

439
00:26:15,250 --> 00:26:16,690
They've been writing interaction wrappers.

440
00:26:16,690 --> 00:26:20,550
They're checking the offset from heap base.

441
00:26:20,550 --> 00:26:24,510
If I want to be really nice I could have had fixed base but I'm not that nice.

442
00:26:25,110 --> 00:26:28,090
Well they do, they can print out the addresses whenever they want, right?

443
00:26:28,090 --> 00:26:31,010
Yeah but then you need to write a parser and it's like who wants to parse?

444
00:26:33,050 --> 00:26:37,910
It's not like I give them really nice output that helped me a lot in solving this.

445
00:26:37,910 --> 00:26:44,750
Yep, those info leaks they come in handy especially when you're in a speed challenge like this.

446
00:26:44,970 --> 00:26:45,810
Oh yeah.

447
00:26:46,130 --> 00:26:53,130
And what I haven't noticed yet is anyone highlighting the real bug here?

448
00:26:53,130 --> 00:26:54,610
What function are we in?

449
00:26:54,750 --> 00:26:56,230
We're in malloc here?

450
00:26:56,230 --> 00:26:56,890
Oh!

451
00:26:56,890 --> 00:26:57,990
Wait, hang on.

452
00:26:57,990 --> 00:26:58,950
He's reading the line.

453
00:26:58,950 --> 00:27:01,450
Line 52 where the bug is.

454
00:27:01,630 --> 00:27:03,270
He's walking through it.

455
00:27:03,270 --> 00:27:07,770
If he does size minus delta he's just checking size.

456
00:27:08,210 --> 00:27:10,250
So I did this exact same thing.

457
00:27:10,250 --> 00:27:13,530
I looked at that exact thing and I was like, huh, I wonder why he did that.

458
00:27:13,530 --> 00:27:16,330
And then I forgot to comment it and it just went out of my head.

459
00:27:16,330 --> 00:27:18,550
I really want to see the comment, this is the bug.

460
00:27:18,550 --> 00:27:20,450
You're like, he's thinking about it.

461
00:27:20,630 --> 00:27:21,310
Oh.

462
00:27:21,350 --> 00:27:32,670
So the bug here being that you're checking the wrong size field is bigger than twice the size, or sorry the size of the free chunk is bigger than twice the size of the size field.

463
00:27:32,670 --> 00:27:36,470
But the size field being checked is the requested size.

464
00:27:36,470 --> 00:27:37,710
I love that comment.

465
00:27:37,710 --> 00:27:39,250
Is the requested size.

466
00:27:39,250 --> 00:27:41,430
Not the allocated size.

467
00:27:41,430 --> 00:27:49,150
So you get a chunk that has the size of the heap metadata overwrite into the next chunks info.

468
00:27:49,850 --> 00:27:52,230
Which, you know, it's the entire thing.

469
00:27:52,230 --> 00:27:58,690
So you have arbitrary you can allocate basically a fake chunk.

470
00:27:58,690 --> 00:28:00,870
And then you get arbrite.

471
00:28:01,210 --> 00:28:02,290
Using the next pointer?

472
00:28:02,550 --> 00:28:04,510
Yeah, using next pointer.

473
00:28:04,810 --> 00:28:16,130
And it's what's going to be really important is the second part of this challenge which is finding an offset that they write to that doesn't cause a next pointer to be an invalid deref in crash.

474
00:28:16,130 --> 00:28:16,790
Ah, right.

475
00:28:16,790 --> 00:28:17,290
Yeah.

476
00:28:17,290 --> 00:28:18,570
So that's the second part of this challenge.

477
00:28:18,570 --> 00:28:19,630
There's a couple of pieces here.

478
00:28:19,630 --> 00:28:24,450
There are a couple of pieces, but Straw Hat finding the line with the bug is big.

479
00:28:24,450 --> 00:28:29,190
And they did go right into writing their script which, that's a good sign.

480
00:28:29,190 --> 00:28:36,570
Now, over on Hypoi, it looks like they're walking through the removal code.

481
00:28:36,570 --> 00:28:39,110
I really hope they've looked at malloc and everything.

482
00:28:39,110 --> 00:28:40,470
I think they have.

483
00:28:40,510 --> 00:28:43,950
We did see them exploring looking at the implementation.

484
00:28:43,950 --> 00:28:45,410
I don't think we saw them.

485
00:28:45,410 --> 00:28:46,950
So they know it's not standard.

486
00:28:46,990 --> 00:28:47,770
Right.

487
00:28:47,870 --> 00:28:51,430
And the category of this challenge we gave them was custom heap allocator.

488
00:28:51,690 --> 00:28:52,930
They came in knowing.

489
00:28:52,930 --> 00:28:54,870
They really should know.

490
00:28:54,870 --> 00:28:58,450
We made sure that they weren't going to just scan over it.

491
00:28:59,370 --> 00:29:00,810
But I really want to see.

492
00:29:00,810 --> 00:29:03,750
I think right now they're looking for double freeze.

493
00:29:03,810 --> 00:29:05,410
But they're noticing...

494
00:29:05,410 --> 00:29:08,330
No, they're not looking for double freeze because they're in add room remove room.

495
00:29:08,330 --> 00:29:12,610
So I think what they're trying to do is make room size mismatch.

496
00:29:12,950 --> 00:29:15,590
Which is close.

497
00:29:15,750 --> 00:29:25,030
Well, I'll say that if the category is custom heap allocator, that's still, you know, a number of bugs could be under that category, right?

498
00:29:25,030 --> 00:29:25,550
Yeah.

499
00:29:25,550 --> 00:29:30,390
When I was developing this, I was debating, like, oh, do we forget to set free in, like, a chunk split?

500
00:29:30,810 --> 00:29:37,810
Or do we forget to, like, update the data point or the next pointer and it points into your data?

501
00:29:37,950 --> 00:29:40,490
And it could be so many different things.

502
00:29:41,530 --> 00:29:49,590
But I think... Yeah , Hypo is going to be going through and trying to figure out, you know, a standard heap bug.

503
00:29:49,590 --> 00:29:50,350
Is it UAF?

504
00:29:50,350 --> 00:29:52,510
Is it a known house of besides House of Barbie?

505
00:29:52,510 --> 00:29:53,630
Yep.

506
00:29:53,630 --> 00:29:59,270
I mean, my immediate thought looking at this was, okay, are we looking at double free?

507
00:29:59,270 --> 00:30:04,130
Is this heap buffer overflow and some friendly metadata that can be smashed?

508
00:30:04,130 --> 00:30:04,550
Yeah.

509
00:30:04,550 --> 00:30:05,970
Is it some UAF?

510
00:30:05,970 --> 00:30:06,650
Exactly.

511
00:30:07,210 --> 00:30:08,470
You know, can I...

512
00:30:08,470 --> 00:30:11,290
There was a challenge I always wanted to write that I'm going to leak now.

513
00:30:11,290 --> 00:30:17,410
But is it, like, a heap meets stack kind of thing where you get... The classic love story.

514
00:30:17,410 --> 00:30:18,130
Yeah.

515
00:30:18,650 --> 00:30:20,430
Very boy meets world.

516
00:30:20,430 --> 00:30:22,650
The stack Topanga and the heap Cory Matthews.

517
00:30:22,650 --> 00:30:23,450
Oh my gosh.

518
00:30:23,450 --> 00:30:24,630
I remember those names.

519
00:30:24,630 --> 00:30:25,510
That's crazy.

520
00:30:25,530 --> 00:30:27,690
How could you forget a name like Topanga?

521
00:30:28,270 --> 00:30:29,530
Match made in heaven.

522
00:30:29,890 --> 00:30:39,490
But we saw Straw Hat just then revisiting the line, trying to figure out... It looks like trying to figure out what they can do with it, trying to figure out the right structs to use.

523
00:30:39,490 --> 00:30:54,790
If memory serves, which sometimes it doesn't, but in this challenge it does, you can grow the list of furniture in the room to be, you know, 32 bytes.

524
00:30:54,790 --> 00:30:59,650
And then the size of the furniture struct itself, 16 bytes.

525
00:31:01,010 --> 00:31:03,230
So, you get... What is it?

526
00:31:03,230 --> 00:31:09,710
The size of the header is 24 bytes plus 16 bytes.

527
00:31:09,710 --> 00:31:13,130
You get 16 byte overwrite into the next chunk.

528
00:31:13,130 --> 00:31:15,270
Okay, so we see that the first hint has dropped.

529
00:31:15,270 --> 00:31:16,720
Oh, the first hint dropped.

530
00:31:16,720 --> 00:31:18,940
Do all chunks have the correct size?

531
00:31:20,600 --> 00:31:27,400
Which is definitely going to be a helpful hint because at least the size field was called out in the printing, the debug printing function.

532
00:31:27,400 --> 00:31:28,420
So that's helpful.

533
00:31:28,980 --> 00:31:29,760
Absolutely.

534
00:31:29,760 --> 00:31:35,920
And I think that it will be most helpful for Hypeboy because Straw Hat, we think we've seen...

535
00:31:35,920 --> 00:31:37,300
They probably know that.

536
00:31:37,300 --> 00:31:38,880
They probably know.

537
00:31:38,880 --> 00:31:41,460
So this is going to push Hypeboy to catch up.

538
00:31:41,460 --> 00:31:41,720
Yep.

539
00:31:41,720 --> 00:31:43,600
So now they're looking in Realloc.

540
00:31:43,600 --> 00:31:44,880
They're walking through.

541
00:31:45,420 --> 00:31:46,900
One step off here.

542
00:31:46,900 --> 00:31:47,960
A minus 24.

543
00:31:47,960 --> 00:31:52,540
So the size of the chunk metadata is 24.

544
00:31:53,620 --> 00:31:55,720
They're going to be walking through and checking.

545
00:31:56,420 --> 00:31:59,960
Now, Realloc doesn't do the actual allocation itself.

546
00:31:59,960 --> 00:32:00,740
It calls out to malloc.

547
00:32:00,740 --> 00:32:06,820
So that should say to them, oh, the only place where the size is properly set is malloc.

548
00:32:06,820 --> 00:32:08,500
So I need to check the branches there.

549
00:32:11,730 --> 00:32:17,830
So they're going to be going through, stepping through, making sure that everything is the correct size.

550
00:32:18,090 --> 00:32:32,310
I'm a little bit worried that because they haven't gone too in-depth in the heap implementation, that they're going to be thinking that I'm, like, under-allocating for a struct, just automatically, which I'm not that nice.

551
00:32:33,050 --> 00:32:41,950
Well, I mean, especially when you're reversing, the size of the struct that's being allocated is usually a very strong hint because, you know, who's going to mess that up?

552
00:32:41,950 --> 00:32:44,650
But with the CTF challenge, you never know.

553
00:32:44,870 --> 00:32:45,130
True.

554
00:32:45,130 --> 00:32:46,990
But they should also be able to see.

555
00:32:46,990 --> 00:32:48,510
They have all the info printed out to them.

556
00:32:48,510 --> 00:32:56,610
They should do struct recovery, know the size of it, and just be able to immediately knock out, oh, this is 16, this is 32, this is also 16, and just say, oh, these are all correct.

557
00:32:56,610 --> 00:32:57,910
Mark them as correct and move on.

558
00:32:58,110 --> 00:32:58,450
Yeah.

559
00:32:58,450 --> 00:33:06,550
I know on one side I saw the player annotating structs, making sure that they had that in their decompilation.

560
00:33:06,550 --> 00:33:06,950
Yeah.

561
00:33:09,130 --> 00:33:12,490
I don't know if I saw that on the Hypebites side, but I might have just missed it.

562
00:33:12,630 --> 00:33:13,870
Not 100%.

563
00:33:13,870 --> 00:33:17,270
It looks like they're calculating offsets correctly.

564
00:33:17,590 --> 00:33:25,510
So, one other big hint here is if you get data minus address not equal to size, you know that chunk is wrong.

565
00:33:25,510 --> 00:33:26,730
That chunk has the wrong size.

566
00:33:26,730 --> 00:33:27,170
Right.

567
00:33:27,170 --> 00:33:30,130
Because the data of a chunk is just immediately after metadata.

568
00:33:30,850 --> 00:33:32,730
And they should see that.

569
00:33:33,210 --> 00:33:38,530
Well, so that's a little bit of a second order analysis here, which may not be immediately apparent.

570
00:33:39,350 --> 00:33:44,490
I mean, if you break in a debugger, if you change, the first step of this challenge is setting the name for the house.

571
00:33:44,630 --> 00:33:47,630
Or you can set the name for the house and get a simple allocation.

572
00:33:47,770 --> 00:33:56,190
If you set a debug breakpoint, print the address of the name of the house, and then print the address of the chunk, you should see oh, this is just immediately after.

573
00:33:56,870 --> 00:34:02,330
You know, it's a little thing that's taken for granted in standard lib heap.

574
00:34:03,030 --> 00:34:07,990
But you really need to get a good sense of what this does.

575
00:34:08,430 --> 00:34:10,330
Yeah, well, this is...

576
00:34:10,910 --> 00:34:15,310
I'm trying to think of the number of custom heap allocator challenges I've seen.

577
00:34:15,310 --> 00:34:19,670
I mean, this may be just kind of a weird thing to think about.

578
00:34:19,670 --> 00:34:21,510
And it's not necessarily easy.

579
00:34:21,730 --> 00:34:22,270
True.

580
00:34:22,270 --> 00:34:31,010
There have been... I was talking with Lightning and she did like a protected malloc, which was a custom heap allocator.

581
00:34:31,010 --> 00:34:32,410
It was almost a complete rewrite.

582
00:34:32,610 --> 00:34:36,810
But it was rewritten to use MD5 verification of chunk metadata.

583
00:34:37,130 --> 00:34:39,510
So definitely optimized for performance.

584
00:34:39,650 --> 00:34:40,530
Oh, yeah, totally.

585
00:34:40,530 --> 00:34:41,990
MD5 is the fastest.

586
00:34:42,810 --> 00:34:44,150
Oh, my gosh.

587
00:34:44,370 --> 00:34:46,510
Yeah, so I'm hoping the teams...

588
00:34:46,510 --> 00:34:48,410
Obviously, I'm hoping the teams solve this.

589
00:34:48,410 --> 00:34:53,470
It looks like over on Straw Hat, they're making consistent progress.

590
00:34:53,470 --> 00:34:56,330
They're trying to figure out can I overallocate?

591
00:34:56,330 --> 00:34:57,610
I'm making the size of the room.

592
00:34:57,610 --> 00:35:01,110
They're making the size of the room large enough here.

593
00:35:01,110 --> 00:35:04,370
It's important that each room has a size.

594
00:35:04,370 --> 00:35:05,810
Each furniture item has a size.

595
00:35:05,810 --> 00:35:10,770
And you can't put, you know, obviously too large furniture in a room.

596
00:35:10,770 --> 00:35:12,050
That doesn't make it a dream house.

597
00:35:12,050 --> 00:35:14,010
That makes it a nightmare house to get through the door.

598
00:35:14,290 --> 00:35:17,830
So, you know, let's just make them good sizes.

599
00:35:17,830 --> 00:35:23,910
It might also be, you know, a very convenient feel to have an arbitrary unsigned 64-bit integer in there.

600
00:35:23,910 --> 00:35:25,610
You know, that would be nice.

601
00:35:25,610 --> 00:35:26,230
Right, right.

602
00:35:26,230 --> 00:35:34,270
Yeah, I was thinking that one of the things that I'm thinking about looking at a heap challenge is what are the resizable things that I control?

603
00:35:34,270 --> 00:35:37,890
Or what arbitrary data can I stuff into it?

604
00:35:37,890 --> 00:35:49,210
So with, say, the names, for example, okay, so now I've got potentially a resizable amount of memory depending on how name allocation is handled.

605
00:35:49,910 --> 00:35:58,750
But as you said, if it can take an arbitrary unsigned integer as the size, well, now I'm thinking how is that going to be used for exploitation?

606
00:35:58,790 --> 00:36:00,930
Yeah, like, oh, I can write a pointer here.

607
00:36:00,930 --> 00:36:02,030
Where do I want to write it?

608
00:36:02,990 --> 00:36:05,410
And it's walking through that.

609
00:36:05,410 --> 00:36:09,470
So it looks like Straw Hat is writing just kind of a simple interaction wrapper.

610
00:36:09,530 --> 00:36:11,770
They only have add room and rename right now.

611
00:36:11,770 --> 00:36:13,450
Yeah, so they're working back from the bug, right?

612
00:36:13,530 --> 00:36:21,930
They're only writing the menu interaction that they think that they need not trying to have a wrapper function for everything in the menu.

613
00:36:21,930 --> 00:36:24,610
Yeah, and it might be possible to solve this with only rooms.

614
00:36:24,610 --> 00:36:29,530
My solution used rooms and furniture, but you could do it with only rooms, I'm sure.

615
00:36:29,530 --> 00:36:31,410
I mean, I think the structs are the same size.

616
00:36:31,430 --> 00:36:34,610
Well, the way you talk about dream houses, Josh, doesn't surprise me.

617
00:36:34,610 --> 00:36:37,150
How could you have a dream house with no furniture?

618
00:36:37,310 --> 00:36:38,210
It's so true.

619
00:36:38,210 --> 00:36:40,390
Well, I feel like it just makes the feng shui easier.

620
00:36:40,790 --> 00:36:43,810
You know, the flow of energy isn't interrupted by anything or redirected.

621
00:36:44,590 --> 00:36:47,230
Josh, that's the best heap feng shui joke I've heard all day.

622
00:36:47,230 --> 00:36:48,150
Thank you so much.

623
00:36:50,710 --> 00:36:52,070
Wait, all day?

624
00:36:52,070 --> 00:36:53,630
That was the first one.

625
00:36:57,170 --> 00:36:57,890
All right.

626
00:36:57,890 --> 00:37:01,530
So it looks like over on a high point, they're...

627
00:37:01,530 --> 00:37:03,030
Oh, so they have a room.

628
00:37:03,030 --> 00:37:04,730
They're adding furniture to a room.

629
00:37:04,850 --> 00:37:06,030
They're allocating it.

630
00:37:06,030 --> 00:37:07,070
You can over-allocate this.

631
00:37:07,070 --> 00:37:07,590
That's fine.

632
00:37:07,590 --> 00:37:08,590
Adding 50.

633
00:37:10,870 --> 00:37:11,310
And...

634
00:37:11,310 --> 00:37:14,610
Looks like they have an item with no name.

635
00:37:15,090 --> 00:37:16,710
That's because you used up the horse.

636
00:37:18,370 --> 00:37:20,450
I saw a hex stump coming out.

637
00:37:20,690 --> 00:37:21,870
Oh, there's a hex stump.

638
00:37:21,870 --> 00:37:23,110
There's a seg fault.

639
00:37:23,690 --> 00:37:25,190
Okay, that's a good sign.

640
00:37:25,190 --> 00:37:26,650
That's a great sign.

641
00:37:26,650 --> 00:37:28,450
So they just sped ahead here.

642
00:37:28,450 --> 00:37:32,750
And it looks like that their reallocation...

643
00:37:32,750 --> 00:37:35,790
They're going to find out very soon that reallocation is very busted.

644
00:37:35,790 --> 00:37:39,550
If they don't find out very soon, hint two will let them know because I think it's exactly that.

645
00:37:40,430 --> 00:37:43,350
Or no, I made it very clear that it's not in reallocation.

646
00:37:43,350 --> 00:37:44,630
It's in splitting.

647
00:37:44,850 --> 00:37:49,650
Yes , an earlier iteration of the hints led me astray.

648
00:37:50,710 --> 00:37:51,430
It was...

649
00:37:51,930 --> 00:37:53,970
Yeah, no, I can't defend it.

650
00:37:54,250 --> 00:37:55,190
It was.

651
00:37:57,430 --> 00:38:00,250
Some other sort of excitement going on in the room right now.

652
00:38:00,610 --> 00:38:05,110
It's hard to tell how much is making it through the microphones, but there is a lot of action in this big room.

653
00:38:05,110 --> 00:38:05,870
Yeah , there is a lot.

654
00:38:05,870 --> 00:38:08,970
Sounds like another competition just ended, had the countdown.

655
00:38:10,170 --> 00:38:11,690
I'm not sure which it was.

656
00:38:11,690 --> 00:38:14,950
I think it was Hackasad, actually, so we might be getting our Jordan back soon.

657
00:38:15,570 --> 00:38:16,190
Excellent.

658
00:38:16,190 --> 00:38:19,910
Well, the Hackasad, very cool competition for all of our viewers.

659
00:38:19,910 --> 00:38:22,570
If you haven't heard of it, very cool stuff.

660
00:38:22,850 --> 00:38:26,810
And, you know, they've got Jordan, so obviously they've got a pretty good commentator.

661
00:38:26,810 --> 00:38:28,650
Their production values through the roof.

662
00:38:28,650 --> 00:38:29,010
Oh, yeah.

663
00:38:29,010 --> 00:38:30,170
Really cool stuff.

664
00:38:30,250 --> 00:38:35,310
So it looks like over on Hypeboy, they're getting invalid furniture items.

665
00:38:35,310 --> 00:38:42,330
They're getting reallocation bugs because you're going back, your furniture list is increasing, increasing, increasing.

666
00:38:42,350 --> 00:38:45,010
Oh, and now they're fine tuning their offsets to get that.

667
00:38:45,010 --> 00:38:45,310
Nice.

668
00:38:45,310 --> 00:38:49,610
It's increasing so much, they have a leak in the size field now, and they see it here.

669
00:38:49,610 --> 00:38:52,490
So they know that the size field overlaps.

670
00:38:52,610 --> 00:38:59,450
The size field overlaps the next heap metadata size field, or next heap metadata next pointer.

671
00:38:59,450 --> 00:39:00,610
That's what I meant to say.

672
00:39:01,490 --> 00:39:02,730
It's so clear.

673
00:39:02,930 --> 00:39:11,250
And knowing that, creating new furniture, they know that they're going to be able to write to that next pointer.

674
00:39:11,390 --> 00:39:18,770
And if you write to a next pointer, point that up, writeable memory, and then allocate something else, you can get potentially an ARB write.

675
00:39:19,730 --> 00:39:21,910
Yeah, I think they're making great progress.

676
00:39:22,930 --> 00:39:23,950
Oh, yeah.

677
00:39:25,190 --> 00:39:33,410
I was trying to look and see in their chunk list there, in the debug prints, if we saw any pointers, it started to look like they had control.

678
00:39:33,410 --> 00:39:36,530
The problem is, they are over-allocating right now.

679
00:39:36,530 --> 00:39:42,230
So the debug print is going to print so many chunks that it's going to be hard to scroll through and find them.

680
00:39:42,970 --> 00:39:48,390
So I think you only need to add something like five, six furniture items max.

681
00:39:48,670 --> 00:39:51,490
And that's going to be a much more manageable like 20 chunks.

682
00:39:51,490 --> 00:39:53,190
I saw them printing out like 54.

683
00:39:54,090 --> 00:39:56,210
I think that this is the kind of problem.

684
00:39:56,210 --> 00:40:03,190
I'm a very visual guy, and for me, seeing a long list of tabular data, it's hard to visualize.

685
00:40:03,190 --> 00:40:06,990
And when I'm working on a challenge like this, I'm making a picture in my head.

686
00:40:06,990 --> 00:40:13,130
And if I can't make that picture, just due to the raw size of the data or the complexity of what I'm dealing with, it's hard.

687
00:40:13,290 --> 00:40:14,090
Yeah, absolutely.

688
00:40:14,090 --> 00:40:18,350
Honestly, it would have been really cute to write a visualization like...

689
00:40:18,350 --> 00:40:19,890
A Barbie house visualization?

690
00:40:19,890 --> 00:40:23,910
Yeah, where you can see, or like for the heap chunks just overlaps and stuff.

691
00:40:23,990 --> 00:40:25,190
What a missed opportunity.

692
00:40:26,050 --> 00:40:28,230
That code would have had so many bugs in it.

693
00:40:28,290 --> 00:40:30,190
Like, that sounds hard.

694
00:40:30,190 --> 00:40:37,570
Okay, and if we switch over to the raw hat side, we can see that they are examining their chunk list.

695
00:40:38,730 --> 00:40:41,890
They've got some large allocations going on.

696
00:40:42,190 --> 00:40:45,410
So that chunk size 2f is going to come up in the future.

697
00:40:46,770 --> 00:40:47,450
Yeah.

698
00:40:48,070 --> 00:40:50,230
That's actually pretty important.

699
00:40:50,230 --> 00:40:51,790
So what's...

700
00:40:51,790 --> 00:40:53,850
I don't want to give the solution away here.

701
00:40:54,690 --> 00:40:55,870
We'll see.

702
00:40:56,590 --> 00:40:58,650
How far are we to hint2, production?

703
00:41:03,080 --> 00:41:04,720
We're checking in now.

704
00:41:05,060 --> 00:41:06,180
Hint2 just came up.

705
00:41:06,180 --> 00:41:07,160
And hint2 just dropped.

706
00:41:07,160 --> 00:41:10,240
So the competitors, they have a timer that they can revisit.

707
00:41:10,500 --> 00:41:12,280
They may not be looking at...

708
00:41:12,280 --> 00:41:14,160
I'm guessing they're not looking at the clock.

709
00:41:14,220 --> 00:41:14,980
No, I don't think so.

710
00:41:16,300 --> 00:41:20,920
We will probably see one of them flip over and check to see if the hint has dropped here.

711
00:41:20,920 --> 00:41:25,220
But they're both kind of on a roll too, just judging by how quickly they're typing.

712
00:41:26,240 --> 00:41:28,520
It's definitely something that's not on the top of your mind.

713
00:41:28,520 --> 00:41:29,500
Hey, what's the next hint?

714
00:41:29,500 --> 00:41:30,540
Unless you're stuck.

715
00:41:30,540 --> 00:41:34,900
Yeah, I kind of want to have production go tell them hint2 dropped.

716
00:41:34,900 --> 00:41:37,620
But at the same time, I don't want to ruin their train of thought.

717
00:41:37,640 --> 00:41:38,920
I think we don't interrupt them.

718
00:41:38,920 --> 00:41:40,600
We told them when the hint was going to be at the beginning.

719
00:41:40,600 --> 00:41:42,320
No, and I think that that's...

720
00:41:43,520 --> 00:41:45,560
that's the way we've been running this competition.

721
00:41:45,560 --> 00:41:50,800
And as you said, both of these competitors seem to be on a roll, typing really fast.

722
00:41:50,800 --> 00:41:57,080
It's not like they just have a cursor hanging over idly , hovering things in IDA.

723
00:41:57,480 --> 00:41:59,720
They are moving towards the solution.

724
00:42:00,120 --> 00:42:02,000
Oh, got EOF.

725
00:42:02,320 --> 00:42:06,000
So it looks like they have next.

726
00:42:08,640 --> 00:42:11,500
So let's flip over to HypeBoy and take a look.

727
00:42:11,500 --> 00:42:12,100
Oh, thank you.

728
00:42:12,100 --> 00:42:12,720
Sorry.

729
00:42:15,420 --> 00:42:16,400
Next is null.

730
00:42:16,400 --> 00:42:17,520
Sending 50.

731
00:42:17,960 --> 00:42:20,100
Yeah, so it looks like they're getting...

732
00:42:20,100 --> 00:42:22,480
Oh, you just need to print the state of the crash here.

733
00:42:22,860 --> 00:42:23,960
You're so close.

734
00:42:26,400 --> 00:42:32,080
So once they get control on this, they overwrite a pointer.

735
00:42:32,080 --> 00:42:33,020
What's the next step?

736
00:42:33,020 --> 00:42:34,900
So you overwrite the next pointer.

737
00:42:34,900 --> 00:42:36,320
Where are you going to point it to?

738
00:42:36,900 --> 00:42:39,520
Right before the got is pretty nice.

739
00:42:39,840 --> 00:42:42,700
Because, you know, I think this is no rel row.

740
00:42:43,600 --> 00:42:45,980
You can push that right before the got.

741
00:42:46,360 --> 00:42:54,880
Right before the got, you know, if they look around there, you might notice, oh, there's a very convenient field of zeros with, you know, some other bytes in there.

742
00:42:55,100 --> 00:42:57,440
So you could point it right before.

743
00:42:58,820 --> 00:42:59,340
Let's see.

744
00:42:59,340 --> 00:43:01,560
Right before the got is going to be...

745
00:43:01,560 --> 00:43:03,360
Oh, I forget where it is in no rel row.

746
00:43:03,540 --> 00:43:04,380
It's been a minute.

747
00:43:04,580 --> 00:43:07,380
So what's the characteristics that we're looking at here?

748
00:43:07,380 --> 00:43:08,260
It's readable and writable?

749
00:43:08,260 --> 00:43:16,920
You're looking for something that'll have a big enough size, a size that you can put, you know, ideally the house name into.

750
00:43:17,000 --> 00:43:19,860
Because that's the easiest thing to control.

751
00:43:19,880 --> 00:43:23,140
You're looking for something that has a size field that matches that.

752
00:43:23,140 --> 00:43:25,320
You're looking for something that has free set.

753
00:43:25,360 --> 00:43:31,340
That's the most important thing, is you need to have the free field set in order for that chunk to be used by any new allocation.

754
00:43:31,540 --> 00:43:37,420
And then you want the next pointer to be either valid or not.

755
00:43:37,620 --> 00:43:45,860
And so in this case, what you're doing is you're setting up a portion of memory to look like a chunk so that you can use it.

756
00:43:46,260 --> 00:43:50,880
You're making a fake heap chunk in, like, program memory, in the BSS.

757
00:43:50,880 --> 00:43:51,320
Exactly.

758
00:43:51,320 --> 00:43:52,640
So fake heap chunk.

759
00:43:53,980 --> 00:43:55,320
And then from there, we're...

760
00:43:57,440 --> 00:44:01,440
I see some very active mouse work over here.

761
00:44:01,440 --> 00:44:05,180
I want to jump over to HypeBoy and see what they're looking at.

762
00:44:05,500 --> 00:44:06,420
There we go.

763
00:44:07,720 --> 00:44:10,500
Doing the math in their head, you could see it work out.

764
00:44:11,200 --> 00:44:15,660
Okay, so I see Straw Hat has picked up hint two.

765
00:44:15,660 --> 00:44:19,740
I didn't know hitting enter after an examine command would just, like, step forward.

766
00:44:19,740 --> 00:44:20,560
That's pretty nice.

767
00:44:20,560 --> 00:44:21,280
I didn't know that.

768
00:44:21,280 --> 00:44:22,660
I just always change the offset.

769
00:44:23,120 --> 00:44:24,940
Yeah, well, I mean, that's one of the things.

770
00:44:24,940 --> 00:44:34,660
I think if you are a competitor at this level, if you're not taking a look at some of the tricks that your competitors are doing, because this is all live, right?

771
00:44:36,140 --> 00:44:41,900
Everybody's aware that what they're going to do is going to be public, at least in that the stream is visible.

772
00:44:41,900 --> 00:44:44,740
So there's a lot of interesting techniques to be cleaned.

773
00:44:44,780 --> 00:44:45,500
Absolutely.

774
00:44:45,660 --> 00:44:50,140
And over on Straw Hat, we see them looking in the buggy check.

775
00:44:50,460 --> 00:44:52,340
Were they just looking at Malik?

776
00:44:53,720 --> 00:44:56,400
Or they're looking at where Malik is used.

777
00:44:58,300 --> 00:44:59,040
Weren't they?

778
00:44:59,060 --> 00:45:00,200
Oh, no, they weren't at furniture.

779
00:45:00,200 --> 00:45:00,980
I'm sorry.

780
00:45:01,040 --> 00:45:03,120
It just looked very similar.

781
00:45:03,120 --> 00:45:05,920
There was a size check greater than, but it said V2.

782
00:45:06,340 --> 00:45:10,740
And so we don't think that we've seen them have control yet.

783
00:45:10,740 --> 00:45:13,240
I don't believe they've gotten a crash yet.

784
00:45:13,860 --> 00:45:18,460
I'm not 100% on that, but I don't know.

785
00:45:18,460 --> 00:45:20,640
We'll keep an eye on them for sure.

786
00:45:21,200 --> 00:45:27,920
It looks like over on Hype Boy, they're going into remove furniture and figuring out what it does.

787
00:45:27,920 --> 00:45:31,340
It actually well, you know, we'll see here.

788
00:45:31,340 --> 00:45:42,420
It frees the name, it frees the struct, and it decreases the size of the furniture item linked list size count field, whatever that is.

789
00:45:42,420 --> 00:45:44,320
It's not really important.

790
00:45:44,380 --> 00:45:46,480
It's just like a linked list implementation.

791
00:45:48,920 --> 00:45:55,060
Yeah, so part of this is really just understanding exactly what you're supposed to do with the bug.

792
00:45:55,720 --> 00:46:01,840
Which as we've said a couple times now, a lot of different ways to go with heap.

793
00:46:02,440 --> 00:46:08,340
I think that they're packing a pointer, so they're just understanding.

794
00:46:09,800 --> 00:46:14,160
So if I'm mistaken, have they annotated that struct, or are they just looking at offsets?

795
00:46:14,160 --> 00:46:15,940
No, I was just thinking that.

796
00:46:15,940 --> 00:46:17,900
I would really annotate that struct.

797
00:46:17,900 --> 00:46:21,620
That would make stuff stand out a lot clearer.

798
00:46:22,080 --> 00:46:31,140
Well, with more than one struct, it's definitely something, like if it was only one struct, sure, maybe you can just think about the offsets, but with more than one in play, definitely that would help.

799
00:46:31,280 --> 00:46:33,780
Unless do they...

800
00:46:34,720 --> 00:46:36,720
are they going to return to it properly?

801
00:46:39,880 --> 00:46:44,100
Oh, come on, you need to print out the state, looking at debugger.

802
00:46:44,300 --> 00:46:46,020
Oh, there we go, up there.

803
00:46:47,720 --> 00:46:50,600
On the straw hat side, I just saw them double-clicking.

804
00:46:50,600 --> 00:46:58,740
They're looking at the debug heap prints, and I saw them double-clicking on the size2f.

805
00:46:59,140 --> 00:47:01,540
I think that they're...

806
00:47:02,140 --> 00:47:05,660
Okay, now that might be just standing out because that's like slash.

807
00:47:06,600 --> 00:47:09,220
And it might just be...

808
00:47:09,220 --> 00:47:11,060
Well, let's see here.

809
00:47:11,360 --> 00:47:14,820
Yeah, I'm curious if they're still sort of feeling around.

810
00:47:14,820 --> 00:47:19,120
Maybe they know something is wrong, but they can't quite isolate it.

811
00:47:19,280 --> 00:47:20,540
I'm not sure.

812
00:47:20,540 --> 00:47:22,980
Not 100%, they have more of a wrapper now.

813
00:47:23,400 --> 00:47:27,100
Yeah, they're getting their interaction sorted out here.

814
00:47:27,840 --> 00:47:32,140
And over on Hypo, we saw them double-clicking some addresses too.

815
00:47:32,880 --> 00:47:34,880
Figuring out what the offset is.

816
00:47:39,040 --> 00:47:40,120
Oh, they have...

817
00:47:40,120 --> 00:47:41,360
Yeah , they have a wrong size field.

818
00:47:41,360 --> 00:47:42,800
Size is 0x980.

819
00:47:42,800 --> 00:47:44,380
That's super wrong.

820
00:47:45,140 --> 00:47:48,020
So I think they have a write into the size field.

821
00:47:48,020 --> 00:47:50,120
They need to shift it one...

822
00:47:50,920 --> 00:47:55,240
Or I guess eight bytes forward to get an overwrite into the next field.

823
00:47:55,480 --> 00:47:59,960
They are eight A's in their payload away from getting next overwrite.

824
00:48:03,260 --> 00:48:05,320
And if they had the stroke, they'd know.

825
00:48:06,880 --> 00:48:07,960
How long?

826
00:48:09,620 --> 00:48:11,380
Eight minutes to sudden death.

827
00:48:13,360 --> 00:48:14,140
Wow, yep.

828
00:48:14,140 --> 00:48:15,800
We knew this was going to be a hard one.

829
00:48:15,800 --> 00:48:17,400
It is going to come down to the wire here.

830
00:48:17,400 --> 00:48:18,940
Wow, it really is.

831
00:48:19,720 --> 00:48:22,520
And if we have to go into sudden death, that's what we'll do.

832
00:48:23,000 --> 00:48:26,240
We're already running a little bit behind due to some technical difficulties.

833
00:48:26,240 --> 00:48:27,340
We are, yeah.

834
00:48:27,340 --> 00:48:29,780
We're cutting into our lunch break here, that's for sure.

835
00:48:29,960 --> 00:48:32,300
We do that for you.

836
00:48:33,660 --> 00:48:34,760
For the love of the game.

837
00:48:34,760 --> 00:48:36,040
Isn't that some slogan?

838
00:48:37,720 --> 00:48:38,520
Sounds familiar.

839
00:48:38,520 --> 00:48:39,600
It does, yeah.

840
00:48:40,420 --> 00:48:42,160
Oh, oh, oh.

841
00:48:42,160 --> 00:48:44,840
Item 0x7f something.

842
00:48:44,880 --> 00:48:48,020
We're seeing some corruption go down in that debug print.

843
00:48:48,020 --> 00:48:48,860
Oh, yeah.

844
00:48:50,780 --> 00:48:52,660
Okay, and they're going to leak that out.

845
00:48:56,010 --> 00:49:00,770
Print out their leak and figure out what that's... It looks like they have meted out a misalignment, maybe?

846
00:49:00,990 --> 00:49:02,170
I'm not 100%.

847
00:49:03,010 --> 00:49:06,650
Well, so if you can adjust the size on this...

848
00:49:07,690 --> 00:49:13,470
Well, you can get a size overwrite, but just as easily you can get an X overwrite if you shift your data forward 8.

849
00:49:13,650 --> 00:49:15,270
8 more bytes.

850
00:49:15,570 --> 00:49:20,630
Right, but if they're trying to leverage that the size is incorrect here.

851
00:49:20,630 --> 00:49:23,330
Is there any way you see the exploitation from there?

852
00:49:23,530 --> 00:49:24,710
Yeah, totally.

853
00:49:25,990 --> 00:49:33,790
I mean, because it is a sequential heap allocator, it's a little bit weird because you're going to try to write past the end of program memory.

854
00:49:34,110 --> 00:49:46,430
I think what you might get is an allocation after then corruption of size of the chunk before, and then you get full overwrite of the chunk after.

855
00:49:46,430 --> 00:49:50,810
But the important part is you get an allocation after you get the...

856
00:49:50,810 --> 00:49:55,470
Sorry, you get an allocation after it before you get the size overwrite.

857
00:49:55,470 --> 00:49:58,750
So you're actually able to use that size.

858
00:49:59,270 --> 00:49:59,830
Right .

859
00:49:59,990 --> 00:50:02,450
You know, that's an option.

860
00:50:02,450 --> 00:50:05,610
As you can tell by me kind of stumbling through it, it's harder.

861
00:50:06,850 --> 00:50:10,190
It's not just, you know, you have control of the next pointer and link list.

862
00:50:11,330 --> 00:50:14,690
It is a way to get next pointer control.

863
00:50:14,750 --> 00:50:16,190
So they might take that path to it.

864
00:50:16,190 --> 00:50:22,510
Once again, because we saw them not annotating structs, they might have a good mental layout of what's going on here.

865
00:50:22,510 --> 00:50:23,710
They might be comfortable with that.

866
00:50:23,710 --> 00:50:26,790
That might be completely within the realm of possibility for them.

867
00:50:26,790 --> 00:50:28,670
I see I'm putting out some

868
00:50:32,090 --> 00:50:33,290
function pointers there.

869
00:50:33,290 --> 00:50:36,150
I think they have an idea of where they're trying to go.

870
00:50:37,730 --> 00:50:41,770
On the lower right hand side of the screen, you can see I'm printing out some pointers.

871
00:50:43,130 --> 00:50:43,990
Oh, yeah.

872
00:50:44,950 --> 00:50:45,590
Alright.

873
00:50:45,930 --> 00:50:47,970
Let's take a look at straw hat real fast.

874
00:50:47,970 --> 00:50:50,650
Straw hat was just highlighting the buggy line.

875
00:50:50,650 --> 00:50:55,270
Yeah, I saw them returning to their comment there with the triple question mark.

876
00:50:57,430 --> 00:51:03,530
It feels like they're still trying to work out what can I really do with this.

877
00:51:03,530 --> 00:51:04,710
They know something is wrong there.

878
00:51:05,250 --> 00:51:06,490
They've highlighted the bug.

879
00:51:06,490 --> 00:51:08,190
They've got the comment that nails the bug.

880
00:51:08,190 --> 00:51:09,550
They need to figure out how to hit it.

881
00:51:09,550 --> 00:51:11,890
And if they do C times 0x20...

882
00:51:11,890 --> 00:51:13,250
Yeah, 0x22.

883
00:51:13,650 --> 00:51:14,930
Sorry, just 0x22.

884
00:51:21,940 --> 00:51:24,600
Man, at this point, I am just rooting for these competitors.

885
00:51:24,600 --> 00:51:25,940
I really want to see a solve on this.

886
00:51:25,940 --> 00:51:27,680
They see a chunk with 0 size.

887
00:51:27,680 --> 00:51:28,200
So that's good.

888
00:51:28,200 --> 00:51:29,260
Which seems suspicious.

889
00:51:29,260 --> 00:51:30,860
That is very suspicious.

890
00:51:32,880 --> 00:51:33,280
And...

891
00:51:33,280 --> 00:51:35,200
I don't know.

892
00:51:35,480 --> 00:51:38,300
I don't know how this is going to go honestly.

893
00:51:39,920 --> 00:51:41,200
So doing C times...

894
00:51:41,200 --> 00:51:43,080
Oh, it needs to be C times 0x20.

895
00:51:43,140 --> 00:51:45,440
No, you forgot the 0x.

896
00:51:48,280 --> 00:51:50,320
That doesn't look like 32 Cs.

897
00:51:50,320 --> 00:51:52,620
This is the drama of CTF.

898
00:51:52,660 --> 00:51:53,720
Oh, man.

899
00:51:54,980 --> 00:51:58,180
They're so close, but that's such a simple mistake to make.

900
00:51:58,320 --> 00:52:00,520
Such an easy mistake to make, rather.

901
00:52:00,960 --> 00:52:02,880
Yeah , and you just...

902
00:52:02,880 --> 00:52:06,480
If you've played, you can appreciate the heartbreak.

903
00:52:06,580 --> 00:52:21,720
To know that you were so close, or that there's one little mistake that got you tripped up, you didn't know that you made it, and then you spent like an hour or so going down the wrong path, or thinking that what you were looking at wasn't viable when it was,

904
00:52:21,720 --> 00:52:22,760
in fact, the bug.

905
00:52:22,760 --> 00:52:23,460
Yeah.

906
00:52:23,520 --> 00:52:29,700
I mean, they annotated that line early, early, and then they just moved on to other things.

907
00:52:29,700 --> 00:52:32,320
So, I don't know if they were trying to figure out how to hit it.

908
00:52:32,320 --> 00:52:33,600
It's fairly straightforward to hit it.

909
00:52:33,600 --> 00:52:35,720
It's from every mallet call it can be hit.

910
00:52:36,420 --> 00:52:44,020
Well, on the Hypeboy side, I've seen in their debugger, which they just had up, looks like they're making progress.

911
00:52:44,320 --> 00:52:44,900
I think that they're close.

912
00:52:44,900 --> 00:52:46,480
Let's see, what are they doing here?

913
00:52:48,760 --> 00:52:49,680
They're stepping through.

914
00:52:49,680 --> 00:52:51,900
They have invalid items in rooms, which is right.

915
00:52:51,900 --> 00:52:52,780
That's great.

916
00:52:56,270 --> 00:52:57,450
They're going through...

917
00:52:57,450 --> 00:53:01,790
Oh, man.

918
00:53:01,790 --> 00:53:04,330
It looks like they have a consistent leak.

919
00:53:05,630 --> 00:53:08,270
They're just trying to figure out what to do with it.

920
00:53:10,450 --> 00:53:15,890
And they're checking where their allocation goes.

921
00:53:15,890 --> 00:53:23,970
I think they're looking for allocation into program memory, or like, you know, BSS global memory, which is the right approach.

922
00:53:23,970 --> 00:53:25,510
That's correct.

923
00:53:26,050 --> 00:53:39,210
And so, the path exploitation that it looks like they're going down is that they're looking to stage a chunk, a fake chunk, and then use that to overwrite a function pointer?

924
00:53:40,310 --> 00:53:42,290
Yeah, that's correct.

925
00:53:43,410 --> 00:53:45,270
And you can overwrite function...

926
00:53:46,150 --> 00:53:48,370
You can overwrite function pointer.

927
00:53:48,370 --> 00:53:49,610
You can...

928
00:53:49,610 --> 00:53:51,850
I think I just put an admin terminal in here.

929
00:53:51,850 --> 00:53:52,770
Did I?

930
00:53:53,150 --> 00:53:54,650
No, I put a win function in here.

931
00:53:54,650 --> 00:53:58,270
So, it's overwrite function pointer to win function.

932
00:53:58,610 --> 00:54:08,510
Which I didn't necessarily see either of our competitors playing with that win function, though certainly they may have just looked at it and said, yep, this is where I'm trying to get to go.

933
00:54:08,510 --> 00:54:10,390
Oh , they know there are two minutes left.

934
00:54:12,130 --> 00:54:13,050
Oh, man.

935
00:54:13,050 --> 00:54:15,790
It's possible, but it's going to be really close.

936
00:54:15,810 --> 00:54:19,090
Yeah, the time pressure is real.

937
00:54:19,990 --> 00:54:23,130
Capitalizing data isn't really a sign of forward progress.

938
00:54:23,130 --> 00:54:24,490
I'm worried here.

939
00:54:24,790 --> 00:54:25,870
93 seconds.

940
00:54:25,870 --> 00:54:31,110
We just saw over on the Straw Hat side checking the timer.

941
00:54:31,110 --> 00:54:38,970
I wish we had a giant digital clock counting down over there, but really that's what they've got to gauge.

942
00:54:38,970 --> 00:54:40,170
How much time they have left.

943
00:54:40,170 --> 00:54:41,590
They feel the pressure.

944
00:54:41,590 --> 00:54:43,090
This is going to be tense.

945
00:54:43,090 --> 00:54:45,870
And it looks like both teams just kind of sitting there.

946
00:54:46,390 --> 00:54:48,950
Just looking , trying to figure it out.

947
00:54:49,870 --> 00:55:02,110
Yep, this is that part of the competition that everybody's familiar with when you're just feeling like, ah, I know there's something here, but maybe the next step isn't clear.

948
00:55:02,110 --> 00:55:04,890
They're writing a chunk of 24 which is right.

949
00:55:05,290 --> 00:55:07,290
That gives them 16 byte overwrite.

950
00:55:07,730 --> 00:55:11,170
So on the Hype Boy side, I think that they're on the right path.

951
00:55:11,170 --> 00:55:14,850
The question is just, are they going to finish before the timer runs out?

952
00:55:14,850 --> 00:55:16,230
Really, yeah.

953
00:55:17,290 --> 00:55:21,230
And they have item size being the leak.

954
00:55:22,210 --> 00:55:26,390
I mean, really impressive that they've gotten this far.

955
00:55:26,390 --> 00:55:28,090
I like the LS.

956
00:55:28,090 --> 00:55:30,010
They type 50, enter, enter, LS.

957
00:55:30,010 --> 00:55:33,750
It's just like, sorry, not that lucky.

958
00:55:35,370 --> 00:55:44,070
And I think we're starting to see the desperation as the speed of their of their pointers and their typing increases.

959
00:55:44,110 --> 00:55:45,030
Yeah.

960
00:55:45,210 --> 00:55:53,350
I want to say we could poll them and see if they want to go Sudden Death or continue it, but knowing CTF players, they'd continue this until retirement.

961
00:55:53,750 --> 00:55:54,230
Yeah.

962
00:55:54,430 --> 00:55:56,790
I think that we're going to go into Sudden Death.

963
00:55:57,090 --> 00:55:58,410
I think so.

964
00:55:58,530 --> 00:56:03,350
Oh, and it looks like yeah, over on the Hype Boy side, they have controlled right into Heap.

965
00:56:03,350 --> 00:56:04,370
Oh, 7a.

966
00:56:06,290 --> 00:56:09,450
But that being said, there is still another stage to this.

967
00:56:09,710 --> 00:56:11,670
So I guess they just didn't hack hard enough.

968
00:56:11,890 --> 00:56:20,250
Well, ultimately, that is really the only thing in CTF is that you either figured it out or you didn't.

969
00:56:20,250 --> 00:56:25,170
I mean, the challenge could be broken, but barring that, I validate it.

970
00:56:25,270 --> 00:56:32,470
Barring that, we knew that this was going to be a tough challenge from the get-go and confirmed, right?

971
00:56:32,470 --> 00:56:32,790
Yeah.

972
00:56:32,790 --> 00:56:35,110
Two teams, top of their game.

973
00:56:35,290 --> 00:56:40,170
And so now we're going to set them up against a challenge where we're pretty sure that they're going to get this quite quickly.

974
00:56:40,170 --> 00:56:40,710
Yes.

975
00:56:40,710 --> 00:56:42,510
Just a question of who's first.

976
00:56:42,510 --> 00:56:48,350
House of Barbie was, I want to say, the hardest Pwn Challenge we have.

977
00:56:48,770 --> 00:56:49,550
Yeah.

978
00:56:52,230 --> 00:56:57,670
For reasons, it wasn't saved until Grand Finals, which we'll find out later.

979
00:56:57,670 --> 00:57:00,090
But now we're going into Sudden Death.

980
00:57:00,890 --> 00:57:07,870
We see one of the team members, I assume, Slack messaging their team saying, yeah, Sudden Death guy, sorry.

981
00:57:09,930 --> 00:57:10,330
Um...

982
00:57:10,330 --> 00:57:16,930
Yeah, I mean, it's important to remember that this is within the larger finals ecosystem here.

983
00:57:16,930 --> 00:57:18,990
Like, the Nautilus game is going on.

984
00:57:18,990 --> 00:57:20,270
We can see their scoreboards.

985
00:57:20,270 --> 00:57:21,390
It is, yeah.

986
00:57:21,550 --> 00:57:24,110
If they're not blanking now, probably soon.

987
00:57:24,350 --> 00:57:25,410
No, they're not blanking.

988
00:57:25,410 --> 00:57:26,890
They're not blanking today.

989
00:57:26,990 --> 00:57:29,890
I talked to Brumley yesterday and he was so happy about it.

990
00:57:29,890 --> 00:57:34,190
He's like, I always hated how you blank it at the end of the day and we're the only ones that know.

991
00:57:34,510 --> 00:57:36,630
Or rather, he's always with PPP.

992
00:57:36,630 --> 00:57:39,270
So it's like, y'all are the only ones that know.

993
00:57:40,190 --> 00:57:42,850
Brumley being fantastic also, supporting us behind the scenes.

994
00:57:42,850 --> 00:57:44,670
Supporting the entire CTF team here.

995
00:57:44,670 --> 00:57:45,510
Yeah, really great.

996
00:57:45,510 --> 00:57:47,130
And definitely appreciate that.

997
00:57:47,130 --> 00:57:48,370
Yeah, fantastic.

998
00:57:48,370 --> 00:57:58,130
So , with the larger DefCon CTF finals, the winner here is going to get points for their team and... I think the winner here gets 1337 points.

999
00:57:58,130 --> 00:57:58,630
Fitting.

1000
00:57:58,630 --> 00:58:01,030
Which is insane.

1001
00:58:01,090 --> 00:58:07,490
Because, let's see, last place right now, Mhacaroni with just under 3000.

1002
00:58:07,490 --> 00:58:10,770
To first place, MMM with...

1003
00:58:10,770 --> 00:58:12,810
Is that 7000?

1004
00:58:13,210 --> 00:58:15,490
So it's significant.

1005
00:58:15,490 --> 00:58:18,110
This is not jump change points.

1006
00:58:18,110 --> 00:58:20,350
This could really alter the rankings.

1007
00:58:20,350 --> 00:58:20,350
Oh, yeah.

1008
00:58:20,350 --> 00:58:24,770
And in the middle, you know, there's from 4th to...

1009
00:58:24,770 --> 00:58:26,210
What is that?

1010
00:58:26,210 --> 00:58:28,170
From 4th to 10th?

1011
00:58:28,170 --> 00:58:30,030
There's a 600 point difference.

1012
00:58:30,030 --> 00:58:35,210
So you can jump up like 6 places by winning live CTF.

1013
00:58:36,630 --> 00:58:38,690
It's the longest running challenge.

1014
00:58:38,690 --> 00:58:41,290
And we just got the thumbs up that we're good to go.

1015
00:58:41,930 --> 00:58:43,730
Alright, so...

1016
00:58:43,730 --> 00:58:45,290
Let's get ready to count it down.

1017
00:58:45,610 --> 00:58:48,190
It hurt they didn't solve it, but let's do sudden death here.

1018
00:58:48,190 --> 00:58:48,850
Alright.

1019
00:58:49,390 --> 00:58:53,470
5, 4, 3, 2, 1.

1020
00:58:53,470 --> 00:58:54,410
Let's go.

1021
00:58:55,430 --> 00:58:56,270
Alright.

1022
00:58:56,430 --> 00:58:59,430
Have you tried reversing it this sudden death?

1023
00:58:59,430 --> 00:59:00,810
Oh, man.

1024
00:59:00,930 --> 00:59:04,270
This is an old joke from a long time ago.

1025
00:59:04,270 --> 00:59:11,670
When we put on hack the vote at RPISec, we had an intro submission is working challenge.

1026
00:59:11,730 --> 00:59:13,350
It was category reversing.

1027
00:59:13,350 --> 00:59:16,110
And we just print the flag reverse and you need to flop it.

1028
00:59:16,470 --> 00:59:20,710
So this is also because our poners hated reversing.

1029
00:59:22,110 --> 00:59:23,870
Well, our poners hated reversing.

1030
00:59:23,870 --> 00:59:25,150
Our reversers hated poning.

1031
00:59:25,150 --> 00:59:26,570
Sorry, hard to reverse that.

1032
00:59:26,570 --> 00:59:32,610
And it was kind of a joke, like, they'd always walk over to the poners and be like, oh, have you tried reversing it?

1033
00:59:33,510 --> 00:59:36,390
So this challenge is made by Glenn.

1034
00:59:36,630 --> 00:59:38,890
Did I see a decomp failure on Ida?

1035
00:59:38,890 --> 00:59:40,270
Was there a decomp failure?

1036
00:59:40,270 --> 00:59:41,790
I think that that's what's happening.

1037
00:59:41,790 --> 00:59:43,290
Positive SP value?

1038
00:59:43,290 --> 00:59:44,370
Something like that?

1039
00:59:44,370 --> 00:59:46,790
So, you know, this is the risk.

1040
00:59:46,790 --> 00:59:50,950
Everybody's using Ida, except for I believe one competitor was using Ghidra.

1041
00:59:51,090 --> 00:59:52,890
Yeah, there was...

1042
00:59:52,890 --> 00:59:54,490
Yeah, I think just one using Ghidra.

1043
00:59:54,490 --> 00:59:54,890
You're right.

1044
00:59:54,950 --> 00:59:56,410
And this is a risk.

1045
00:59:56,410 --> 01:00:04,370
Now, I believe that any competitor at this level is going to be able to read this disassembly and figure out what's going on pretty quickly.

1046
01:00:04,370 --> 01:00:07,230
We see Hydeboy scrolling through the disassembly right now.

1047
01:00:08,810 --> 01:00:21,390
I've got to say, as one of the few non-Vector35 members here, that if you think that LiveCTF is testing their challenges in Binja, that's probably a pretty good bet.

1048
01:00:21,550 --> 01:00:23,430
No, we test our challenges in everything, honestly.

1049
01:00:23,570 --> 01:00:23,690
Really?

1050
01:00:23,690 --> 01:00:29,150
Yeah, we really, really try to not... like, we do not write challenges to make Binja look good.

1051
01:00:29,150 --> 01:00:31,070
There are some challenges where it looks worse.

1052
01:00:31,370 --> 01:00:33,070
There are some challenges where Ida looks worse.

1053
01:00:33,070 --> 01:00:34,730
We didn't test Ghidra.

1054
01:00:38,820 --> 01:00:42,200
Oh, that's a big diagonal arrow in the Ida graph view.

1055
01:00:42,280 --> 01:00:43,920
I actually haven't seen that before.

1056
01:00:43,920 --> 01:00:46,700
I don't think I've ever seen that.

1057
01:00:46,840 --> 01:00:47,620
Okay, here we go.

1058
01:00:47,620 --> 01:00:55,400
So now we've got... looks like there's a fix up there that resulted in the decouplation on one side here.

1059
01:00:55,400 --> 01:00:56,580
And then straw hat.

1060
01:00:57,220 --> 01:00:59,420
They should be able to tell that this is a string.

1061
01:00:59,420 --> 01:01:02,520
So, yeah, looking at those numbers, I'm guessing that's ASCII.

1062
01:01:02,680 --> 01:01:04,320
That is, in fact, ASCII.

1063
01:01:05,220 --> 01:01:06,560
Thank you for ASCII-ing.

1064
01:01:08,800 --> 01:01:11,480
Sorry, I should save it for the full screen us cap.

1065
01:01:11,480 --> 01:01:13,760
No, get your dad jokes out now, Josh.

1066
01:01:13,760 --> 01:01:15,060
I feel like we're going to be done here soon.

1067
01:01:15,060 --> 01:01:16,120
I have terrible news.

1068
01:01:16,120 --> 01:01:17,520
I'm never going to run out.

1069
01:01:18,060 --> 01:01:19,500
I'm so sorry.

1070
01:01:20,420 --> 01:01:25,260
If that impacts your choice to continue doing this with us, you know, I understand.

1071
01:01:25,460 --> 01:01:26,700
I'm going to need a minute to chew on that.

1072
01:01:26,700 --> 01:01:28,260
Let's flip over to Hype Boy.

1073
01:01:29,220 --> 01:01:30,680
So, Hype Boy.

1074
01:01:30,820 --> 01:01:32,760
Oh, they pulled the string out, so reversing it.

1075
01:01:32,760 --> 01:01:33,960
Yes, I have tried.

1076
01:01:35,540 --> 01:01:35,960
Except...

1077
01:01:35,960 --> 01:01:37,220
you know...

1078
01:01:37,220 --> 01:01:40,540
Oh, I see anger coming out on straw hat.

1079
01:01:40,720 --> 01:01:43,340
Anger is incredibly overkill for this.

1080
01:01:44,200 --> 01:01:45,500
But does it work?

1081
01:01:45,860 --> 01:01:48,960
This is a string compare to running your shell game.

1082
01:01:49,580 --> 01:01:51,660
Oh, we're seeing anger on both sides.

1083
01:01:51,660 --> 01:01:52,980
Are you...

1084
01:01:52,980 --> 01:01:55,280
We're seeing anger on both sides.

1085
01:01:56,120 --> 01:01:57,980
They're installing anger.

1086
01:01:57,980 --> 01:02:00,960
That is not a fast installation last I checked.

1087
01:02:00,960 --> 01:02:02,700
That might cost them some time.

1088
01:02:02,700 --> 01:02:10,460
The very, very lucky thing is, they're on our organizer internet up to the internet, so they have really fast download.

1089
01:02:10,580 --> 01:02:11,220
Wow.

1090
01:02:11,220 --> 01:02:14,100
On game net, that would have been slow.

1091
01:02:16,200 --> 01:02:17,080
Wow.

1092
01:02:19,610 --> 01:02:21,090
Oh my goodness.

1093
01:02:21,410 --> 01:02:24,830
Okay, so we see anger installed as root.

1094
01:02:25,370 --> 01:02:27,610
Did we see a pseudo pip install?

1095
01:02:27,610 --> 01:02:29,090
We saw a pseudo pip install.

1096
01:02:29,090 --> 01:02:31,290
All the rules are being thrown out the window here.

1097
01:02:31,290 --> 01:02:32,850
Maybe they're running in a docker container.

1098
01:02:32,850 --> 01:02:33,890
It looks like they are.

1099
01:02:34,250 --> 01:02:34,970
Oh, okay.

1100
01:02:34,970 --> 01:02:35,790
Well, that works.

1101
01:02:36,730 --> 01:02:38,070
Oh my god.

1102
01:02:38,390 --> 01:02:39,790
Anger coming out on both sides.

1103
01:02:39,790 --> 01:02:43,150
This is an unexpected turn of events.

1104
01:02:43,150 --> 01:02:45,250
We are watching an anger race.

1105
01:02:45,250 --> 01:02:48,830
It is a stir cup.

1106
01:02:48,830 --> 01:03:03,090
With the decouplation that we're seeing on the straw hat side, you know, this... I'm guessing that the number of equations or equality checks there, that may have been what has driven them to check anger.

1107
01:03:03,090 --> 01:03:04,830
But you see it's all ASCII .

1108
01:03:05,010 --> 01:03:05,830
Indeed.

1109
01:03:05,850 --> 01:03:17,730
And I believe that you can look at each one of those indices, it's decreasing , and it's character by character, but they're under so much pressure that they might be jumping.

1110
01:03:18,190 --> 01:03:19,890
They might have figured it out.

1111
01:03:20,870 --> 01:03:21,650
Yeah.

1112
01:03:21,650 --> 01:03:26,130
Okay, they're just going to write a Python script to pull out what it is.

1113
01:03:28,150 --> 01:03:29,030
Okay.

1114
01:03:29,370 --> 01:03:31,810
I was really worried there for a second.

1115
01:03:32,190 --> 01:03:33,070
Oh, wait a minute.

1116
01:03:33,070 --> 01:03:36,890
But over on Hypeway, we see Linux x86 shellcode.

1117
01:03:37,370 --> 01:03:38,290
That's a good sign.

1118
01:03:38,290 --> 01:03:39,490
Yeah, they're pulling it up.

1119
01:03:39,490 --> 01:03:43,770
Not using shell plus null by...

1120
01:03:44,250 --> 01:03:46,550
Ah, that's not going to work.

1121
01:03:48,090 --> 01:03:50,850
You need your payload first.

1122
01:03:50,850 --> 01:03:51,810
Yes, I've tried reversing it.

1123
01:03:51,810 --> 01:03:53,270
They put it... No, put it first!

1124
01:03:53,270 --> 01:03:54,270
Put it first!

1125
01:03:55,470 --> 01:03:56,890
But they're on the right track here.

1126
01:03:56,890 --> 01:03:58,470
They are on the right track here.

1127
01:03:58,510 --> 01:03:58,970
That might work.

1128
01:03:58,970 --> 01:04:02,630
I might not remember the Python 3 challenge.

1129
01:04:02,630 --> 01:04:04,490
Oh, yeah, they're under pressure.

1130
01:04:04,770 --> 01:04:06,250
Seems like maybe you should.

1131
01:04:06,350 --> 01:04:10,990
If they swap the order of those two, their shellcode...

1132
01:04:10,990 --> 01:04:13,470
Do you mean if they reverse the order?

1133
01:04:13,470 --> 01:04:14,710
Oh, my God.

1134
01:04:14,870 --> 01:04:15,890
It's meta.

1135
01:04:17,590 --> 01:04:20,890
If they reverse the order here, they get a shell.

1136
01:04:20,890 --> 01:04:21,490
On the Straw Hat side...

1137
01:04:21,490 --> 01:04:23,130
No, don't put it at the end.

1138
01:04:23,870 --> 01:04:24,650
Oh, wait.

1139
01:04:26,950 --> 01:04:28,030
Oh, my God.

1140
01:04:28,030 --> 01:04:29,610
They just totally rewrote their shell.

1141
01:04:29,610 --> 01:04:30,130
Okay.

1142
01:04:30,130 --> 01:04:32,310
They threw out the other thing, and they just have another.

1143
01:04:32,350 --> 01:04:35,670
On the Straw Hat side, we see them continuing...

1144
01:04:36,330 --> 01:04:38,350
to look at this Oh, my goodness.

1145
01:04:38,350 --> 01:04:40,890
It looks like Hypo is going to run away with it here.

1146
01:04:41,010 --> 01:04:44,390
Straw Hat, real fast, still running their parser.

1147
01:04:45,190 --> 01:04:46,810
Hypo over here.

1148
01:04:46,870 --> 01:04:48,490
Should run it from remote.

1149
01:04:49,290 --> 01:04:49,590
What?

1150
01:04:49,590 --> 01:04:50,650
It said...

1151
01:04:50,650 --> 01:04:52,190
Didn't they get a shell?

1152
01:04:53,330 --> 01:04:54,790
Oh, now go get a shell.

1153
01:04:54,790 --> 01:04:56,990
So they got the, yes, I've tried reversing it right.

1154
01:05:01,050 --> 01:05:01,490
But...

1155
01:05:01,490 --> 01:05:02,670
Oh, that's...

1156
01:05:02,670 --> 01:05:12,790
And Straw Hat is still continuing to fix their script and isolate just the pieces of the equality checks.

1157
01:05:12,790 --> 01:05:14,930
I think that they're still going down the road.

1158
01:05:16,530 --> 01:05:17,070
Yep.

1159
01:05:17,070 --> 01:05:21,730
We can see them printing out what the response is going to be checked against.

1160
01:05:22,770 --> 01:05:30,530
I'm going to keep an eye over on Hypo because if they just swap, if they just put, yes, I've tried reversing it in the beginning, they win.

1161
01:05:32,410 --> 01:05:35,570
At this point, it's really a pressure cooker.

1162
01:05:35,570 --> 01:05:39,630
They're already exhausted from the challenge that they just went the distance on.

1163
01:05:40,150 --> 01:05:43,010
Over on Hypo, they think it's their shell code that's wrong.

1164
01:05:45,510 --> 01:05:46,630
Oh.

1165
01:05:47,930 --> 01:05:49,810
They are so close.

1166
01:05:50,050 --> 01:05:55,810
But really all you need to do is just put the string before because it's comparing from zero index.

1167
01:05:55,950 --> 01:05:56,970
Over on Straw Hat...

1168
01:05:57,890 --> 01:05:58,390
Oh.

1169
01:05:58,470 --> 01:06:05,230
They're going all in on this string manipulation with Python which under this kind of time pressure...

1170
01:06:05,230 --> 01:06:05,530
Yeah.

1171
01:06:05,530 --> 01:06:07,230
You see that the indices are reversing.

1172
01:06:07,230 --> 01:06:12,490
You can honestly just reverse those lines and pull out the ASCII character.

1173
01:06:14,310 --> 01:06:14,790
Yeah.

1174
01:06:14,790 --> 01:06:16,690
Gosh, this is tough.

1175
01:06:17,230 --> 01:06:18,190
Yeah.

1176
01:06:18,610 --> 01:06:27,530
So it looks like they're trying to extract out the numbers and the indices and then remap everything into a string but might be a little bit of overkill for this situation.

1177
01:06:27,530 --> 01:06:28,230
Yeah.

1178
01:06:28,730 --> 01:06:31,010
Hypo going through in the debugger.

1179
01:06:31,010 --> 01:06:33,310
Looks like they see that...

1180
01:06:33,310 --> 01:06:35,470
Is that their shell code that's executing there?

1181
01:06:37,510 --> 01:06:38,910
Yeah, that looks like it.

1182
01:06:38,910 --> 01:06:40,090
But then they have an IML.

1183
01:06:40,250 --> 01:06:42,450
So something went wrong with their shell code there.

1184
01:06:42,550 --> 01:06:44,330
Oh, it looks like maybe they're...

1185
01:06:44,330 --> 01:06:45,170
Oh, no, they're in ops.

1186
01:06:45,170 --> 01:06:50,170
Or maybe that was just a non-destructive operation.

1187
01:06:50,250 --> 01:06:52,230
Because they have 0x90 in ops, right?

1188
01:06:53,610 --> 01:06:55,110
Oh, and then they have nulls.

1189
01:06:56,390 --> 01:06:57,050
Looks like it.