start	end	text
17250	21050	Welcome back, CTF fans. I'm Mark and this is Josh.
21150	24330	And we're back with the semifinals on the top bracket.
24330	28870	Oh my goodness. It's been crazy. Both these teams undefeated so far.
29170	31930	Yeah, really impressive given the level of competition that we've seen.
31930	35330	We've got Hypeboy versus Straw Hat. I think this is going to be a good one.
35330	36530	And you wrote this challenge, right?
36530	41730	I wrote this challenge. It's my hardest challenge that I wrote. I'm allowed to say that.
42370	46210	I think it's going to be really good though. Both these teams are fantastic.
46210	49450	Alright, well I'm excited to see them get at it. So let's count it down. Ready?
49450	50330	Let's do the countdown.
50630	56050	In 5, 4, 3, 2, 1, go.
56050	57130	Let's go.
58690	64830	Alright, so we have on your top right, is that Straw Hat?
65650	66110	Hypeboy.
66110	69870	Did I get backwards? Ah, top right is Hypeboy, top left is Straw Hat. That's right.
70430	72250	At this point it looks pretty similar, right?
72250	79690	The first step of every challenge, download the challenge. Looks like we're having a little bit of a technical issue here.
79690	85930	So we're going to take a look at what's going on with this.
87330	89390	Okay, false start.
89730	93950	You know, there's a lot of moving parts here and it takes a lot to get this going.
93950	99790	It really is impressive to have a show running with everything that's going on here.
99790	105450	A lot of moving pieces. I'm glad that we've had a lot of understanding on parts of Confedors.
107470	108670	It's a challenge.
108850	111530	It is a challenge, or it will be a challenge soon at least.
111790	113670	Honestly, I blame the challenge author.
113970	117310	You know, I said that going into this and here we are.
117590	120810	Look, all my other ones work totally fine.
121970	125450	Yeah, you know, but I think that it goes to show that...
125990	128070	How many matches have we had so far?
128070	132810	Oh my gosh. So we're in Grand Finals. We've had 10.
134790	138510	So with that many challenges, you're bound to run into some bumps.
138510	147610	And we've had a number of difficulties from infra, hardware, challenges needing to be updated on the fly.
147610	150630	And there's so much work that goes on behind the scenes.
150630	153450	We test everything as much as we can.
153450	156290	We make sure that every challenge is solvable.
156290	159610	Can somebody who's on the game network solve it?
159610	161150	Is it reachable? Exactly.
161150	162230	That's a big one.
162230	164310	And there's just a lot of pieces.
164310	165730	Yeah, there are a lot of pieces.
165930	167950	And I think on this one...
169090	170190	The what?
172070	173270	Okay, so it sounds like...
173270	174730	It's hyphens, not underscores.
177730	182590	So I am the only person on the team that names things with underscores.
183690	185070	Everyone else uses hyphens.
185070	186950	And it looks like that caused the mix-up.
186950	190450	So instead of the name of this challenge, we're allowed to say...
191490	192750	We'll wait to say.
193770	194150	But...
194150	195990	Yeah, it's multiple words.
195990	197350	I put underscores between them.
197350	198210	It should be hyphens.
198210	199710	Who's got time for a shift key?
200510	202650	Honestly, who has time to not use a shift key?
202750	203970	Why even use spaces?
203970	204970	Yeah, I don't need numbers.
204970	205950	I just need symbols.
207070	208650	Why even use spaces?
208790	209430	Yeah.
209810	211530	Poland can use space.
211750	213030	It's a hack-a-sack joke.
213030	213650	Oh my gosh.
213650	215290	Also another competition going on here.
215290	215890	They're great.
215890	218270	We have Jordan over there working on that right now.
218910	224010	Yeah, it was a fierce rock-paper-scissors to see who was going to be able to commentate the finals.
224010	227050	But Jordan, he is actually really good at rock-paper-scissors.
227050	228770	Oh my gosh, a professional.
228850	229850	I don't understand that.
229850	231950	Well, he's doing rocket-paper-scissors right now.
231950	232650	Oh my.
232650	233370	Ha-ha!
233470	234970	Oh, we have time before the challenge?
234970	236250	We have time for bad jokes.
236790	238030	I'll let you lead.
238850	239510	Oh, I got nothing?
239510	240290	That was my only one?
240290	241130	Oh, okay.
241130	243290	I guess now I'm the bad joke.
243630	244490	Womp womp.
244670	252570	You know, I see a lot of... you can't see this, but when we're looking out, what we're seeing is the DEF CON CTF finals floor.
252570	256110	And it is a big dark room with a lot of people.
256110	258570	And you know, I'm actually not seeing a lot of dual monitor use.
258830	265550	You know there isn't, because a lot of being on the floor at DEF CON is just being able to pick up your laptop, go work wherever.
265550	267530	Like, you're done being on the floor.
267530	268890	You don't want to sit here anymore.
268910	270070	You want to be the Chipotle guy.
270070	271230	You want to go up to the suite.
271230	273090	You want to, like, do anything else.
273090	278290	You're tired of staring at this, like, stupid heap challenge.
278770	281510	I, of course, not speaking from experience or anything.
282010	283310	Yeah, well, I can relate.
283310	287110	I'm very much a one screen guy because I just like to be able to set up wherever I am.
287410	289070	Yeah, no, that's totally fair.
289070	294810	And your awesome ergonomic setup, which, like, you set it down.
294810	296670	You have a stand for your laptop.
296670	297610	You have mouse.
297610	299370	You have ergonomic keyboard and everything.
299370	301650	I'm like, oh my gosh, this guy is a pro.
303110	307810	I'm over here with my little laptop and my, like, 90 degree angled posture.
308890	312010	It's just years of wrist rot, really.
312010	315590	So it comes back to bite you if you don't take care of it up front.
315590	317870	See, I don't get that because I don't use home rototype.
317870	320650	I have my left hand on WASD and my right is just floating.
321970	324210	I learned to type from playing video games.
324210	325030	What can I say?
325690	327430	Maybe speak and tell me how to type.
327630	328270	What to?
329010	330470	Old typing program.
330470	331730	Oh, God.
331730	333310	No, am I showing my age?
335030	336870	And I think we're getting close here.
336870	338550	We're getting close to ready here.
338650	341370	But we're good to go?
343270	346110	I think we're just making sure that the connectivity is up.
346110	346130	All right.
346130	349070	I think we're good to go with not a false start.
349830	350410	Okay.
350410	353410	So without further ado, for real this time, that was just a practice.
353490	357810	In 5, 4, 3, 2, 1.
357810	358150	Let's go.
358150	359630	Let's go for real, please.
361730	362370	Oh.
362950	363430	Okay.
363430	364610	They download the challenge.
364610	367570	I see the happy bouncing box on the Mac.
369790	370310	Yeah.
370310	371370	They download the challenge file.
371370	372390	I see something in IDA.
372390	375590	If you just screen dash R or whatever, or I can take care of it.
375790	376470	Okay.
377130	377550	So...
377550	378010	All right.
378010	381190	Now we see that beautiful challenge name popping out there.
381190	382310	We see the beautiful challenge.
382310	383430	Oh, House of Barbie.
383430	385530	I'm so proud of this challenge name.
385530	389350	This came from another challenge name that Carl came up with originally.
389350	392930	I made this as a follow-up joke, and I'm like, damn, I need to write that.
392930	396750	So House of Barbie is a custom heap allocator challenge.
397670	401810	Everyone's familiar with the, like, House of Spirit, House of Force, and all that.
402370	405130	So House of Barbie was the natural follow-up.
406290	410030	So this is, you know, in my book, a custom heap allocator.
410030	412470	That doesn't sound like an easy challenge to me.
412890	413950	It's simple.
413950	415230	We don't do TCache.
415230	416490	We don't do different bins.
416490	417530	We throw everything.
417530	420190	We use Sbreak, and we just send it.
420190	421750	You know, everything is sequential.
421750	424650	If it isn't sequential, oops, memory's bad.
425690	426610	Well, you know what?
426610	428370	Writing memory allocators is hard.
428370	428670	Yeah.
428670	430090	Who remembers how to do that?
431930	435290	So let's jump in and take a look at our competitors here.
435650	438750	So Hypoi launching into it first, going through.
438750	440250	It's fairly simple.
440250	442330	So what you have is you have a house.
442770	444290	This is going to sound so weird.
444290	445130	Keep going, Josh.
445130	446190	You have a house.
446190	447750	There are rooms in the house.
447750	449070	There's furniture in the rooms.
449070	450510	You make your dream house.
450510	453290	I think the description of the challenge was, like,
454390	458890	Stidlib Malik wasn't pink enough, so we implemented our own,
458890	460810	which also the description.
461270	462930	For those that haven't seen the Barbie movie,
462930	464690	this is going to be totally over your head.
464690	467170	But those that have, I really hope you're laughing.
469370	471950	I heard a groan from production.
471950	476970	So going through, we have very nice functions here.
476970	479550	Print state, it was supposed to be behind debug,
479550	480750	but that was actually a little hard,
480750	483290	so I just commented out the debug condition.
483330	485530	Print state prints each room in the house,
485530	487570	each furniture item in the room, and why not?
487570	489170	It prints all the heap chunks, too.
489530	492370	Heap chunk printed with the address of it,
492370	493950	the data address of it, size of it,
493950	495770	whether it's free or not, and the next.
495770	498090	So the heap here is a singly linked list,
498090	500770	which we're going to see so much in CTFs.
500770	502970	It's one of the most common data structures you see
503690	505970	because that next pointer is just so valuable,
505970	507170	especially in heap challenges.
507170	508870	You might be able to get an arb right from it
508870	510050	if you try hard enough.
510330	513170	Yeah, so definitely when I was looking at this challenge,
513170	515190	I was thinking, all right, what is the metadata
515190	516730	that we're going to see in the chunks?
516730	518430	How are these chunks laid out?
518430	520410	The print function that you mentioned
521610	523710	really does help you understand that,
523710	526070	and I'm interested to see when the competitors
526070	527910	stumble across that, and we'll be able to tell
527910	530850	because there'll be some addresses being printed out.
530850	533530	Yeah, no, it looks like Hypoi is doing that.
533530	535050	They're not annotating with it quite yet,
535050	537030	but Straw Hat is.
537210	539450	Straw Hat has already gone through and annotated
540530	543070	part of the heap struct, I believe,
543070	544910	or maybe they're just in the furniture struct still.
544910	546530	Yeah, so that's the globals.
546530	551470	There's some global metadata that manages the heap
551470	556810	as well as, I believe, the house structure.
556810	560410	The house struct is in globals.
560410	560850	Yep.
561290	562870	So that's easy to keep track of.
562870	564110	It's one less layer of indirection,
564110	566630	one less allocation you need to keep track of on the heap.
567670	570550	And both teams we're going to see going through
570550	572950	just doing basic annotation of this.
572950	574030	We talked about this earlier,
574030	576550	but this is a really good way to just get your bearings
576550	578850	in a challenge that has a couple layers to it
578850	582490	because you have the house, you have rooms,
582490	584310	and you have furniture, and all of those
584310	585570	are different structs.
585570	589410	Right, and correct me if I'm wrong here, Josh,
589410	592710	but I think that the structs themselves,
592710	595090	not in the binary, they're going to have to reconstruct that.
595090	597710	They've got hints based on strings that are in it
597710	601350	and the menu sort of saying add room, add furniture,
601350	602790	but they're still going to do a little bit
602790	605070	of struct reconstruction.
606050	608030	Reconstruction, nice. Got it, got it.
608910	610830	Yeah, they are reconstructionists.
610830	611750	Yep, yep.
612050	614630	And we've talked about this before,
614630	617230	but again, common theme, we've got a menu here.
617430	618970	We've got one competitor who looks like
618970	621390	they're very static focused,
621390	623650	so they're looking at each menu item,
623650	625590	they're reading the function that gets called.
625590	627030	The other competitor looked like they were
627030	629930	exploring the menu via just sending stuff to it.
630590	632550	Yeah, and it looks like they're just trying
632550	633970	to get interaction down, and they're trying
633970	636010	to print the state of the heap
638710	640690	after each of those interactions.
640690	643630	And what's really nice is these structs are,
643630	645630	you know, I might have been a little nice here
645630	649010	and made them divisible sizes.
649430	650570	Always helpful.
650890	653270	You might be able to just kind of
653270	656690	shove a couple of one in the space of another,
656690	659190	and the link list I might have forgotten to free,
659190	661490	so you might have a couple free chunks
661490	663170	here and there you can control.
664590	668170	But really, this challenge was
669090	671030	inspired by the name, obviously.
671030	672450	And then when I started looking up,
672450	674630	I was like, oh, what do people do for custom heap allocators?
674630	677670	I looked through a bunch of GitHub repos,
677670	679670	and all of them I found bugs.
679870	682070	Every single one had a mistake.
682070	682810	At least one.
683010	684470	As I said, it's hard.
684470	685710	Yeah, it is.
685710	689670	So I kind of pulled the bug inspired by one of those.
689670	692430	Not exactly the same, but kind of the idea of it
692430	694130	because I'm like, wow, yeah, people can really
694130	696770	make this mistake. This is kind of a real bug.
696770	698610	Well, so it's interesting you say that
698610	700270	because I think that a surprising number
700270	702910	of the challenges that we've seen,
702910	704730	both here and in other CTFs,
704730	706910	are usually modeled after a real bug
706910	708270	that someone else has found.
708270	710490	And sometimes it is literally just,
710490	712990	here's that software with this bug that I found in it.
712990	714390	You find the bug too.
714430	714730	Exactly.
714730	715730	In some CTFs.
716090	718370	Certainly some of the challenges that we've seen
718370	720090	in this competition, I know at least one of the ones
720090	722030	that I wrote was based on a real-world bug
722030	724250	with a weird primitive.
724510	726090	And I thought, hey, it would be really cool
726090	728130	to see the challengers try their hands at this.
728130	729390	Yeah, absolutely.
729390	731330	And I remember I was playing in
731330	733490	real-world CTF 20...
733490	735930	Oh, the first one. Whenever that was.
736750	737150	And...
737150	739190	they had one challenge that was
739750	741610	you know, recreate this
741610	743450	ODE in Chrome. Oh, by the way,
743450	744890	don't worry, we actually have it.
745110	747930	You're not giving us an ODE. We already have it, guys. Trust us.
747930	749230	And they had a video of them
749230	751430	showing the ODE, which was just them
751430	753450	running a script, then Chrome popped up, then Calc
753450	755150	popped up, and I'm like, dude, that doesn't prove anything.
755150	756830	You could just call Calc.
756830	759670	Print random addresses and call Calc.
759690	760950	So, there are
760950	762810	definitely real-world bugs that try
762810	764850	to be put in CTF. Sometimes, it's
764990	766950	a little shadier than others. We decided to not
766950	768570	do that challenge because we're like,
768570	771070	we don't know how we feel about this.
771370	771970	Right.
772310	774830	Yeah, I mean, they're in good company in terms of the
774830	776970	number of proof videos out there
776970	778430	that just popped up.
778870	781090	Where it's just, you know, a script
781090	782950	that's called, like, exploit.py, and inside
782950	786010	of it, all of us is like, subprocess.calc.exe.
786010	788010	Great exploit. One of my favorites.
788010	789770	So, if we switch over here to
789770	792050	Hypeboi, we can see that they're printing
792050	793190	out the
794750	796310	this is the list of the chunks,
796310	797250	and these are the
799150	800130	different... Yeah, these are all the
800130	802530	field values. The fields in the chunks.
802590	804230	So, it looks like
804670	806010	three... oh, gosh.
806050	808450	So, they're going to be creating a room.
808830	809970	Yeah, creating a room
809970	812290	and adding items to it.
812850	814350	I have to say, I really
814350	816510	especially for a challenge like this,
816510	818290	I think it's great to have stuff like that because
818290	819810	for me,
821350	821750	having
822190	824030	heap structure stuff in my head,
824570	826270	even with nice printouts like that,
826270	828530	it's hard. It is hard, definitely.
828530	830490	And unless you're really familiar with the structures,
830490	832370	like, you can hold tcache info in your head.
832370	834310	With a custom heap allocator, like, you
834310	836210	need to change your understanding and you're going to be making
836210	838730	mistakes because fields are at different places.
838890	840450	Fields don't exist. They're different
840450	842870	sizes, different everything.
842870	845150	So, having that printout is really,
845150	846430	really beneficial
846430	849350	to just being able to do this challenge,
849350	850770	period, let alone in the time
850770	852630	they're given. Yeah, and
852630	854830	I think that one of the things that
854830	856670	is tricky with a new heap
856670	858590	allocator is, as you were talking about,
858590	860590	it's nice that they're at
860590	862630	good widths because with
862630	864610	heap stuff, typically what you're looking to do is
864610	866550	you have these boxes, right,
866550	868650	and you're trying to get maybe one overlaid
868650	870590	over the other or a little bit further into
870590	872570	them, but you have to know exactly
872570	874650	what that structure is to know what's being
874650	876630	overwritten or what's being placed on top
876630	878310	of a value that used to be there.
878590	880570	Yeah, absolutely. Like,
880570	882850	if you have two structs of the same size, one with a
882850	884590	function pointer at the offset of the
885250	886790	size field of the other one,
886790	888810	you know, that's really nice. You get arb call on
888810	891270	size field, but if you have
891270	892950	mismatched sizes, you know,
892950	895230	you get, uh-oh, that function pointer is now
895790	896850	like next pointer in
896850	898910	the heap metadata, and it's just so
898910	900790	like it's probably
900790	902370	still possible, but you have to do
902830	904490	so much heap manipulation to get there
904490	907250	that it's just not feasible within an hour.
907250	908910	I'm sure everybody at home has exactly
908910	910930	the picture in their head of what Josh
910930	912610	was just talking about. I know
912610	915030	it's very easy. This is
915490	916470	child's play, surely.
917570	918530	Okay.
920210	921130	Let's take a
921130	922930	look here and see what
922930	925010	Straw Hat has going on. So
927990	928470	Straw Hat...
928470	930470	So right now they're breaking down. So this
930470	932370	is the free function. So the allocator, it's
932370	934470	essentially only three functions, right? Yeah.
934470	936630	It's, uh, what is it? Free,
937230	938350	malloc, and
938350	940490	realloc. Yep. And I
940490	942510	think looking at this, you just skipped
942510	944890	over the malloc function because you're just like,
944890	946430	oh, it's just malloc.
946430	948490	And you were looking for straight, like,
948490	950390	stdlib heap bugs. Yeah.
950890	952410	Because... Yeah, I'm like, uh, double click
952410	954390	on malloc, and you're like,
954390	956350	you bastard. Yeah.
956350	958350	If you look on the left-hand side there, you can very
958350	960510	clearly see that the malloc, free, and realloc
960510	962330	functions don't have that pink background
962330	964610	on them. So they're not imports.
964790	966390	Um, so I missed that
966390	968530	because I, you know, little detail
968530	970490	like that, and I was looking
970490	972670	for the bug and didn't see it.
972670	975230	It's a really common oversight. Honestly,
975450	976270	a big part of this
976270	978390	is, you know, going through
978390	980210	with a fine-tooth comb
980210	982590	and understanding every step of the process
982590	984490	because if you make assumptions like that, you're going
984490	986450	to be skipping over potentially major parts
986450	988450	of program logic and potentially where the
988450	990450	bug is. Right. Who knows? Right. And so I'm
990450	991830	glad to see that our competitors
992370	994630	did not fall for that like I did. Oh, my
994630	996610	god. I was honestly worried
996610	998890	and I was debating renaming them, and then I'm just like,
998890	1001030	nah, I like using these names.
1001670	1002470	Uh, yep. And we can
1002470	1004530	see that both competitors looking
1004530	1006690	at these heap implementations.
1007450	1008610	Yeah. Hypeboi also looking
1008610	1010490	at realloc and free. Yeah.
1010650	1012330	Hypeboi probably knows that
1012330	1014350	realloc is usually pretty buggy
1014910	1016230	because you need to
1016230	1018210	split chunks, you need to be able
1018210	1020650	to shift them, join them,
1020650	1022310	etc. You know, that's all this does
1022310	1024290	but other heap allocators, absolutely.
1024810	1026450	Um, but you might notice
1026450	1027910	that splitting the chunk
1027910	1030370	isn't the job of realloc.
1030370	1032270	Splitting the chunk happens in malloc.
1032790	1034370	Yeah, I was going to say that depending on how
1034370	1036370	you want to write your heap allocator,
1036370	1038350	you could end up with some of
1038350	1040670	these being pretty simple.
1040670	1042110	So, realloc
1042810	1044110	really could just be
1044750	1046550	a thin wrapper around malloc and free if you
1046550	1048930	wanted to, like if you wanted to be lazy. It was originally.
1048930	1050790	Um, and free.
1051290	1052230	I think that
1052230	1054210	if you wanted to be lazy about it,
1054210	1056490	you could do basically all the work in free
1056490	1058430	and have it do the consolidation
1058430	1060730	of chunks and malloc just be real lazy
1060730	1062610	and just, do I have a big enough free
1062610	1064610	slot? If so, yep, just take it.
1065310	1066610	Okay, well, look.
1066610	1067150	Sorry.
1068770	1070510	Shade being thrown this way because that's
1070510	1071750	kind of what it does.
1072990	1074570	I mean, but despite that, look.
1074870	1075750	Yeah.
1076370	1078690	What are we looking at? We're looking at Hypeboy here.
1078950	1081150	Um, yeah.
1081330	1082810	Looks like they're
1083630	1084510	cross-referencing
1084510	1085430	those heap
1086650	1088530	functions. See those calls to
1088530	1090910	free there. Trying to figure out what goes inside of them.
1090910	1092370	Exactly. I think once you
1092370	1094470	understand that, okay, there might be a bug
1094470	1096670	in one of the three allocator
1096670	1098690	functions, the next step is probably,
1098690	1101030	okay, where do each of these functions get used?
1101030	1103010	Yeah. As far as I'm aware,
1103010	1104170	the only bug in this program
1104170	1106390	is in the heap allocator.
1106390	1108390	It's very possible that there's another bug
1108390	1110910	somewhere, like, I'm not a perfect programmer.
1111390	1112510	And I would be delighted to
1112510	1114530	see it because I've been saying
1114530	1116130	this whole tournament
1116130	1118550	that I want to see a challenger come up
1118550	1120390	with an unintended solution because I know
1121150	1122070	it's a possibility.
1122070	1124050	We've had a little off from intended solution
1124050	1125690	but we haven't had, you know,
1125690	1128090	fully just wrong place,
1128090	1130030	not where we expected at all. We thought this
1130030	1132110	was sound. Like, I want to see
1132110	1134210	someone just tear apart my code.
1135170	1135730	Yeah, and
1136930	1138210	especially for this
1138210	1140150	one, which I think the intended solution
1140150	1142170	in this one is, it's not simple,
1142170	1144030	right? This is a tough challenge.
1144090	1146190	Yeah. This is, I want
1146190	1148090	to say, the hardest challenge I wrote for this.
1148450	1150070	Both very good teams. We were saving it
1150070	1151810	for later because we were worried that
1152270	1154010	when players were just getting used to this,
1154010	1155770	when players were still very nervous about
1155770	1157630	competing, that
1157630	1159910	they wouldn't solve it in time. But
1159910	1162010	we're pretty confident that this won't
1162010	1164550	go into sudden death, obviously, otherwise we wouldn't have fielded it.
1165390	1166230	Yeah, a lot of quality
1166230	1167790	control on our side is really
1167790	1169950	focused on, is this hard but
1169950	1172310	solvable? Yes, absolutely.
1172310	1174070	So we've got a couple of levers that we
1174070	1175770	can pull in this regard. We've got
1175770	1178010	hints, we can add
1178010	1179890	symbols or have
1179890	1181830	explanatory stuff sort of sprinkled in.
1181830	1185150	Oh yeah, and we've nerfed challenges, we've added win functions,
1185150	1185750	we added
1187190	1187690	unoptimized
1187690	1189690	gadgets in there.
1190770	1191930	And I'll also
1191930	1193950	say that the sudden
1193950	1195930	death challenges that we've seen so far
1196550	1197950	weren't necessarily the ones that
1197950	1199710	we thought were going to be the ones that would go the distance.
1199710	1201970	Absolutely. I honestly chalk
1201970	1203870	that up to nerves. Yes,
1203870	1205790	this is truly a difficult
1205790	1207750	situation to try to succeed in.
1208470	1209790	Yeah, it's
1209930	1211830	a different situation
1211830	1213790	than these teams have been in before
1213790	1216090	because they've competed in countless CTFs.
1216090	1217630	They got here,
1217630	1219790	they're used to being here, you know, you work in your
1219790	1221610	team, every team has a little, almost
1221610	1223830	enclave where they work
1223830	1225410	with their teammates. And then
1225410	1227830	you get over here, you're alone, you're
1227830	1229750	against another team that you don't
1229750	1231870	know the person potentially. You're on
1232850	1233330	unfamiliar
1233330	1235590	challenge. You have
1235590	1237550	to use tools that you might have
1237550	1239610	installed, you might need to download them. We saw with the
1240170	1241450	LEB128 package that you
1241450	1243630	needed to download the tool because no one had that
1243630	1245330	obviously. I think MMM
1245330	1246810	didn't end up using it, right?
1247210	1249810	Oh, you're right. No, they didn't end up using it at all.
1250610	1251490	But it
1251490	1253330	just goes to show, like,
1253330	1255270	it's a very different situation
1255270	1257490	and the amount that plays into it just
1258470	1259770	can't be overstated.
1259850	1261390	Yeah, it's a different game and
1261390	1263310	I have been in
1263310	1265310	the CTF scene for a long time and one of the
1265310	1267250	things that I picked up on after the first few
1267250	1269470	years of playing is that it's really a
1269470	1271570	big morale game. It's a psychological
1271570	1273450	game. Do you feel like you have momentum? Do you
1273450	1275610	feel like you're making progress? And this is
1275610	1278110	a different situation. You're just behind this
1278110	1279630	wall and it's just them back there.
1279630	1282550	They don't have their teammates to
1282550	1283970	bounce ideas off of
1283970	1286270	and all they have is
1286270	1287710	another fierce competitor sitting across from them
1287710	1289590	and they don't know how far that person's made it yet.
1289590	1291650	A big, big part
1291650	1293550	of CTF is social and
1293550	1295690	interaction and, you know, rubber
1295690	1297490	ducking, bouncing ideas, working
1297490	1299110	together on an exploit. Because
1299110	1301690	we're, as commentators, we've really found
1301690	1303830	out how easy it is to see bugs in someone else's
1303830	1305630	code. And we know this, obviously,
1305630	1307570	from, like, work, too. It's so
1307570	1309410	much easier to see bugs in someone else's code
1309410	1311550	when they're just sitting there writing it and, like, they're saying
1311550	1313470	their logic out loud and then they write something totally
1313470	1315910	different and you're like, that's not what that does.
1316130	1317770	They're like, oh, damn, you're right.
1317770	1319590	Yeah, it is always
1319590	1321730	easier when you're, you know, one
1321730	1323790	step removed. Yeah, even a, was
1323790	1325710	it, even a 10x programmer,
1325710	1327730	10x hacker needs someone to
1327730	1330050	work with sometimes. Oh, I totally agree.
1330110	1331090	And I think that when
1332570	1333750	with this tournament
1333750	1335790	in particular, we've seen a little
1335790	1338050	bit of teammate rotation. Yes.
1338050	1339830	But a lot of these challenges
1339830	1341770	have been Pwn challenges and a lot of them have been the
1341770	1343990	same competitors for... Absolutely.
1343990	1345650	most of the challenges. Yeah.
1345650	1347610	Or we've had people switch
1347610	1349770	off because they're just like, you know,
1349770	1351490	I, this isn't really my forte.
1351850	1353390	I'm not doing well
1353390	1355450	solo. I don't really want to be under
1355450	1357090	that pressure. Or they're like,
1357570	1359530	you'd be better at this. Like, go for it.
1359530	1361590	These teammates all have major
1361590	1363550	confidence and trust in each other because
1363550	1365670	you're working on these challenges. You're spending, you know,
1365670	1367550	16 hours looking at one challenge
1367550	1369750	and then you have to be able to comfortably
1369750	1371450	hand off your script to someone else so you can
1371450	1373690	sleep. Yeah. And trust them
1373690	1375570	to not like burn it all down
1375570	1377510	or ruin it or like waste
1377510	1380170	those precious hours in the competition.
1381290	1382290	Exactly.
1382390	1383810	And we've
1383810	1385190	seen that really...
1385190	1387950	I think the best example was the Python challenge yesterday.
1387950	1389570	We saw some fresh faces
1389570	1391610	and one of the competitors was
1391610	1393630	not the person
1393630	1395470	who had played previously for their team
1395470	1397810	but then they executed an extremely fast
1397810	1399730	solve. So clearly they had a specialist
1399730	1401770	on that team. They knew, hey, this is
1401770	1403950	going to be your challenge and it worked out for them.
1404190	1405850	Absolutely. And I think really
1405850	1407690	working with these people for so long and
1407690	1409570	working in these high-stress, you know,
1409570	1411550	fast-paced environments, really
1411550	1413750	you build knowledge of who can do
1413750	1415970	what the fastest and who can do what the most consistently.
1415970	1417870	Those aren't always the same person.
1418550	1420190	Exactly. Yeah. And
1420710	1422090	I've heard this from a
1422090	1424050	number of my friends in the community
1424050	1426150	and talking to them about what makes
1426150	1428070	their team good. And I think a
1428070	1429790	big part of it is really understanding
1429790	1432070	your teammates'
1432070	1433830	strengths and knowing, I'm
1433830	1435830	really struggling with this. I'm going to turn it
1435830	1437670	over to this person or go to this person because
1437670	1439730	I know that they're good
1439730	1441510	at this sort of thing or maybe
1441510	1443810	they just look at it differently.
1443810	1445750	We're both good but we look at it differently. Looking at it
1445750	1447830	differently is major also because it's so easy
1447830	1450090	to get rabbit hole and just like...
1450090	1452170	Oh yeah. Oh yeah. And that's
1452170	1453810	key when you've got a teammate to say like,
1453810	1455770	I don't think that this is the way to go.
1455770	1458470	Yeah, this is nit guys. This is memcopy.
1458470	1460550	And it is fun to see
1460550	1462570	the different approaches that people have and I
1462570	1464490	mean different in every sense of it.
1464490	1466690	I know one good friend of mine,
1467310	1468690	he is a very fast
1468690	1470690	hacker but he has another
1470690	1472490	teammate who is also very fast
1472490	1475090	and I said, so which one of you is faster?
1475090	1476410	And they looked at each other
1476410	1478490	and they said, well,
1478490	1479630	he types faster
1480390	1482830	but I have to delete my stuff less
1483570	1484630	and go back and
1484630	1486590	fix less. So we're probably about
1486690	1487650	a head and a head.
1488130	1490590	I worked with two really good friends all throughout
1490590	1492250	college and RPI sec on
1492250	1494450	like crypto challenges and some reversing
1494450	1496610	some web and we
1496610	1498270	all have different strengths and I remember
1498270	1499990	specifically when Defcon qualls,
1500410	1502410	we split off from the rest of
1502410	1504430	our team, went into
1504570	1506430	a different room and just like closed
1506430	1508450	door, like locked. We just had a big
1508450	1510290	whiteboard and we're like, okay.
1510290	1512530	And we all took a different part of this crypto problem
1512530	1514410	and at the end just like put them all together
1514410	1515930	and we got this all. Wow.
1515930	1518250	It was we all know our own specific domain
1518250	1520250	and work together to make one
1520250	1522350	beautiful solution script.
1522450	1524250	Yeah, that's great. I mean in the divide and
1524250	1526250	conquer approach really works, especially
1526250	1528310	when you've got some of these finals problems
1528310	1530110	are massive, right? Or
1530110	1532230	they'll be, you know, a common
1532230	1534270	sort of thread, but okay
1534270	1536330	so here's the same mini problem but solve
1536330	1538310	it a thousand times, right? Could be one
1538310	1540390	problem. And finals, attack, defend, you need
1540390	1542370	to submit patches for it too that don't break
1542370	1544430	SLA. Like you
1544430	1546890	need to be able to keep the service up but fix.
1546890	1548590	And one of the challenges, Torque
1548590	1550350	also written by Glenn because it's cursed
1552210	1554090	but is Torque and it's
1554590	1556090	it's Torque. You can
1556090	1557830	pop a shell in 2,000 different ways
1558370	1560390	but one of those ways is
1560390	1560770	you know
1562370	1564450	it's how the game runs. So you can't
1564450	1566410	really disable it. You need to make mitigation somewhere
1566410	1568430	else. So just
1568430	1570490	knowing specific domains and knowing how to work
1570490	1572310	together is crazy. Here alone
1572310	1574290	it looks like Hypeboy has been
1574290	1576150	making good progress. They've been writing interaction
1576150	1577470	wrappers. They're checking
1578930	1580550	the offset from heap base.
1580550	1582350	If I want to be really nice I could have had fixed base
1582350	1584510	but I'm not that nice.
1585110	1586230	Well they do, they can
1586230	1588090	print out the addresses whenever they want, right?
1588090	1590210	Yeah but then you need to write a parser and it's like who wants to
1590210	1591010	parse?
1593050	1594150	It's not like I give them
1594150	1596070	really nice output that helped me
1596330	1597910	a lot in solving this.
1597910	1599630	Yep, those info leaks
1599630	1602030	they come in handy especially when you're
1602030	1604750	in a speed challenge like this.
1604970	1605810	Oh yeah.
1606130	1608090	And what I haven't noticed yet
1608090	1609130	is anyone
1610610	1612270	highlighting the real
1612270	1614610	bug here? What function are we in?
1614750	1616230	We're in malloc here?
1616230	1617990	Oh! Wait, hang on.
1617990	1620010	He's reading the line. Line 52
1620010	1621450	where the bug is.
1621630	1624010	He's walking through it. If he does
1624690	1625910	size minus delta
1625910	1627770	he's just checking size.
1628210	1630250	So I did this exact same thing.
1630250	1631930	I looked at that exact thing and I was
1631930	1633970	like, huh, I wonder why he did that. And then I forgot
1633970	1636010	to comment it and it just went out of my
1636010	1637990	head. I really want to see the comment, this is
1637990	1640010	the bug. You're like, he's thinking about
1640010	1641990	it. Oh. So the
1641990	1643970	bug here being that you're checking the wrong
1643970	1645910	size field is bigger than twice
1645910	1647970	the size, or sorry
1648510	1649910	the size of the free
1649910	1651910	chunk is bigger than twice the size of
1651910	1653830	the size field. But the size field being
1653830	1655910	checked is the requested
1655910	1657710	size. I love that comment.
1657710	1659250	Is the requested size.
1659250	1661570	Not the allocated size. So
1661570	1664110	you get a chunk that has
1664110	1665690	the size of the heap
1665690	1667650	metadata overwrite into the next
1667650	1669150	chunks info.
1669850	1672230	Which, you know, it's the entire thing.
1672230	1673850	So you have arbitrary
1673850	1675630	you can allocate
1675630	1677710	basically a fake
1677710	1679590	chunk. And then you get
1679590	1681950	arbrite. Using the
1681950	1683850	next pointer? Yeah, using next
1683850	1685790	pointer. And it's what's
1685790	1687930	going to be really important is the second part of this challenge
1687930	1688910	which is finding
1689810	1691530	an offset that they write to
1691530	1693410	that doesn't cause a next pointer
1693850	1696130	to be an invalid deref in crash.
1696130	1697730	Ah, right. Yeah. So that's
1697730	1699630	the second part of this challenge. There's a couple of pieces here.
1699630	1701250	There are a couple of pieces, but Straw Hat
1701850	1703650	finding the line with the bug is
1703650	1705750	big. And they did go right
1705750	1707730	into writing their script
1707730	1709670	which, that's a good sign. Now,
1709670	1711670	over on Hypoi, it looks
1711670	1713590	like they're
1713590	1715590	walking through the
1715590	1717650	removal code. I really
1717650	1719570	hope they've looked at malloc and everything. I think they
1719570	1721690	have. We did see them exploring
1722370	1723950	looking at the implementation.
1723950	1725530	I don't think we saw them. So they know
1725530	1727770	it's not standard. Right.
1727870	1729590	And the category of this challenge we gave
1729590	1731430	them was custom heap allocator.
1731690	1733670	They came in knowing. They really
1734210	1735530	should know. We made sure
1735530	1737550	that they weren't going to just scan
1737550	1738450	over it.
1739370	1741510	But I really want to see. I think right now
1741510	1743750	they're looking for double freeze.
1743810	1745410	But they're noticing...
1745410	1747370	No, they're not looking for double freeze because they're in add room
1747370	1749530	remove room. So I think what they're trying to
1749530	1751490	do is make room size
1751490	1753410	mismatch. Which
1753410	1755590	is close.
1755750	1757630	Well, I'll say that if the category
1757630	1759550	is custom heap allocator, that's
1759550	1761550	still, you know, a number
1761550	1762970	of bugs could be
1763530	1765550	under that category, right? Yeah.
1765550	1767390	When I was developing this, I was debating, like,
1767390	1769670	oh, do we forget to set free in, like, a
1769670	1771550	chunk split? Or
1772130	1773710	do we forget to, like, update
1773710	1775790	the data point or the
1775790	1778350	next pointer and it points into your data?
1778350	1779710	And it could be so many
1779710	1781610	different things.
1781610	1783550	But I think...
1784110	1785290	Yeah, Hypo
1785290	1787670	is going to be going through and
1787670	1789750	trying to figure out, you know, a standard heap bug.
1789750	1791530	Is it UAF? Is it a known house of
1791530	1792510	besides House of Barbie?
1792510	1794150	Yep. I mean, my
1795090	1796610	immediate thought looking at
1796610	1798510	this was, okay, are we looking at double
1798510	1800490	free? Is this heap
1800490	1802550	buffer overflow and some friendly metadata
1802550	1804550	that can be smashed? Yeah.
1804550	1806650	Is it some UAF? Exactly.
1807210	1808470	You know, can I...
1808470	1810630	There was a challenge I always wanted to write that I'm going to
1810630	1813030	leak now. But is it, like, a
1813030	1814830	heap meets stack kind of
1814830	1816850	thing where you get... The classic
1816850	1819050	love story. Yeah.
1819050	1820430	Very boy meets world.
1820430	1822650	The stack Topanga and the heap Cory Matthews.
1822650	1824630	Oh my gosh. I remember those names.
1824630	1826490	That's crazy. How could you forget
1826630	1827690	a name like Topanga?
1828270	1830090	Match made in heaven. But
1830850	1832550	we saw Straw Hat
1832550	1834590	just then revisiting the line, trying to figure
1834590	1836570	out... It looks like trying to
1836570	1838430	figure out what they can do with it, trying to figure out the right
1838430	1840230	structs to use. If memory
1840230	1842390	serves, which sometimes
1842390	1844970	it doesn't, but in this challenge it does,
1846250	1847790	you can grow
1847790	1849730	the list of furniture
1849730	1850590	in the room
1852130	1853630	to be, you know,
1853630	1855650	32 bytes. And then the size
1855650	1857850	of the furniture struct
1857850	1859650	itself, 16 bytes.
1861010	1861690	So,
1861690	1863790	you get... What is it? The size of
1863790	1865030	the header is
1865780	1866070	24
1867710	1869710	bytes plus 16 bytes.
1869710	1871770	You get 16 byte overwrite into the
1871770	1873690	next chunk. Okay, so we
1873690	1875860	see that the first hint has dropped. Oh, the
1875860	1877720	first hint dropped. Do all chunks have the
1877720	1878940	correct size?
1880600	1881780	Which is definitely going to be a helpful
1881780	1883540	hint because at least the
1883540	1885480	size field was called out in the
1885480	1887660	printing, the debug printing function. So that's
1887660	1889760	helpful. Absolutely.
1889760	1891600	And I think that it will be
1891600	1893580	most helpful for Hypeboy because
1893580	1895920	Straw Hat, we think we've seen...
1895920	1897700	They probably know that. They
1897700	1899660	probably know. So this is going to
1899660	1901720	push Hypeboy to catch up. Yep.
1901720	1903600	So now they're looking in Realloc.
1903600	1904880	They're walking through.
1905420	1907960	One step off here. A minus 24.
1907960	1909180	So the size of the
1910020	1911520	chunk metadata is
1911520	1912540	24.
1913620	1915720	They're going to be walking through and checking.
1916420	1917400	Now, Realloc
1917900	1919580	doesn't do the actual allocation
1919580	1921600	itself. It calls out to malloc. So that should say to
1921600	1923420	them, oh, the only
1923420	1925420	place where the size is properly set
1925420	1927720	is malloc. So I need to check the branches
1927720	1928500	there.
1931730	1933190	So they're going to be going
1933190	1935290	through, stepping through,
1935290	1937110	making sure that everything is the correct
1937110	1938570	size. I'm
1939750	1941210	a little bit worried that because they
1941210	1943370	haven't gone too in-depth in the heap implementation,
1943770	1944810	that they're going to be thinking
1945350	1947370	that I'm, like,
1947370	1949070	under-allocating for a struct, just
1949070	1950390	automatically, which
1950910	1952310	I'm not that nice.
1953050	1955230	Well, I mean, especially when you're
1955230	1956930	reversing, the size of the struct
1956930	1959570	that's being allocated is usually a
1959570	1961210	very strong hint because, you know, who's going to
1961210	1962910	mess that up? But with the CTF
1962910	1965130	challenge, you never know. True.
1965130	1966990	But they should also be able to see.
1966990	1969150	They have all the info printed out to them. They should do struct
1969150	1971150	recovery, know the size of it, and just be able to
1971150	1973290	immediately knock out, oh, this is 16, this is 32,
1973290	1974950	this is also 16,
1974950	1977190	and just say, oh, these are all correct. Mark them as correct
1977190	1978450	and move on. Yeah.
1978450	1981210	I know on one side I saw
1981590	1982310	the player
1983170	1985190	annotating structs, making sure that they had that
1985190	1986550	in their decompilation.
1986550	1986950	Yeah.
1989130	1990530	I don't know if I saw that on the
1990530	1992490	Hypebites side, but I might have just missed it.
1992630	1994570	Not 100%. It looks like
1994570	1996350	they're calculating offsets
1996350	1998530	correctly. So, one other
1998530	2000530	big hint here is if you get
2001230	2002470	data minus address
2002470	2004490	not equal to size, you know
2004490	2006730	that chunk is wrong. That chunk has the wrong size.
2006730	2008290	Right. Because the data of a chunk
2008290	2010130	is just immediately after metadata.
2010850	2012730	And they should see that.
2013210	2014550	Well, so that's a little bit
2014550	2016290	of a second order analysis here, which
2016290	2018530	may not be immediately apparent.
2019350	2020490	I mean, if you break in
2020570	2022510	a debugger, if you change, the first step
2022510	2024490	of this challenge is setting the name for the house.
2024630	2026490	Or you can set the name for the house and get
2026610	2028270	a simple allocation. If you
2028930	2030390	set a debug breakpoint,
2030390	2032330	print the address of the name of the house,
2032330	2034470	and then print the address of the chunk, you should see
2034470	2036190	oh, this is just immediately after.
2036870	2038550	You know, it's a little
2038550	2040630	thing that's taken for granted in
2040630	2042330	standard lib heap.
2043030	2044370	But you really need
2044370	2045670	to get a good sense of
2046530	2047990	what this does.
2048430	2050330	Yeah, well, this is...
2050910	2052730	I'm trying to think of the number of
2053390	2054470	custom heap allocator
2054470	2056390	challenges I've seen. I mean, this may be
2056390	2058450	just kind of
2058570	2060530	a weird thing to think about. And it's not necessarily
2060530	2062270	easy. True.
2062270	2064150	There have been... I was talking with Lightning
2064150	2066430	and she did like a protected
2067450	2068330	malloc,
2068330	2070150	which was a custom
2070150	2072410	heap allocator. It was almost a complete rewrite.
2072610	2073810	But it was rewritten to use
2074570	2076810	MD5 verification of chunk metadata.
2077130	2078350	So definitely optimized
2078350	2080530	for performance. Oh, yeah, totally.
2080530	2081990	MD5 is the fastest.
2082810	2084150	Oh, my gosh.
2084370	2086510	Yeah, so I'm hoping the teams...
2086510	2088410	Obviously, I'm hoping the teams solve this.
2088410	2090370	It looks like over on
2090370	2092490	Straw Hat, they're making
2092490	2094510	consistent progress. They're trying to figure out
2094950	2096330	can I overallocate?
2096330	2098350	I'm making the size of the room. They're making the
2098350	2099170	size of the room
2100090	2101990	large enough here. It's important that
2102850	2104370	each room has a size.
2104370	2106450	Each furniture item has a size. And you can't
2106910	2108230	put, you know,
2108910	2110250	obviously too large furniture
2110250	2112230	in a room. That doesn't make it a dream house. That makes
2112230	2114010	it a nightmare house to get through the door.
2114290	2116130	So, you know,
2116130	2118390	let's just make them good sizes. It might also
2118390	2120270	be, you know, a very convenient feel to
2120270	2122270	have an arbitrary unsigned
2122270	2124470	64-bit integer in there. You know,
2124470	2126230	that would be nice. Right, right.
2126230	2128230	Yeah, I was thinking that one of the
2128230	2130230	things that I'm thinking about looking
2130230	2132250	at a heap challenge is what are the
2132250	2134270	resizable things that I control?
2134270	2135790	Or what arbitrary
2135790	2137890	data can I stuff into it? So
2137890	2140230	with, say, the names,
2140230	2142170	for example, okay, so now I've
2142170	2143750	got potentially a resizable
2144390	2145470	amount of memory
2146210	2148210	depending on how name allocation
2148210	2149210	is handled.
2149910	2152070	But as you said, if it can take
2152070	2154690	an arbitrary unsigned integer as the size,
2154690	2156050	well, now I'm thinking
2156590	2158750	how is that going to be used for exploitation?
2158790	2160550	Yeah, like, oh, I can write a pointer
2160550	2162030	here. Where do I want to write it?
2162990	2164810	And it's walking through
2164810	2166570	that. So it looks like Straw Hat is
2166570	2168650	writing just kind of a simple interaction
2168650	2170570	wrapper. They only have add room
2170570	2172630	and rename right now. Yeah, so they're working back
2172630	2174710	from the bug, right? They're only writing
2175450	2176250	the menu
2176730	2178670	interaction that they think that they need
2178670	2180610	not trying to have a wrapper function
2180610	2182590	for everything in the menu. Yeah, and it
2182590	2184610	might be possible to solve this with only rooms.
2184610	2186870	My solution used rooms and furniture,
2186870	2188570	but you could do it with
2188570	2190470	only rooms, I'm sure. I mean, I think the structs
2190470	2192630	are the same size. Well, the way you talk about
2192630	2194610	dream houses, Josh, doesn't surprise me.
2194610	2196470	How could you have a dream house with no
2196470	2198590	furniture? It's so true. Well, I
2198590	2200390	feel like it just makes the feng shui easier.
2200790	2202550	You know, the flow of energy isn't interrupted by
2202550	2203810	anything or redirected.
2204590	2206550	Josh, that's the best heap feng shui joke I've
2206550	2208150	heard all day. Thank you so much.
2210710	2212070	Wait, all day?
2212070	2213630	That was the first one.
2217170	2217890	All right.
2217890	2220070	So it looks like over on a high point,
2221090	2221530	they're...
2221530	2223810	Oh, so they have a room. They're adding furniture
2223810	2226030	to a room. They're allocating it.
2226030	2227810	You can over-allocate this. That's fine. Adding
2227810	2228590	50.
2230870	2231310	And...
2231310	2233770	Looks like they have an item with no
2233770	2235890	name. That's because you used up
2235890	2236710	the horse.
2238370	2239630	I saw a hex stump
2239630	2241870	coming out. Oh, there's a hex stump.
2241870	2243110	There's a seg fault.
2243690	2245830	Okay, that's a good sign. That's a
2245830	2247850	great sign. So they just sped
2247850	2251390	ahead here. And it looks like
2251390	2252750	that their
2252750	2254590	reallocation... They're going to find out
2254590	2256590	very soon that reallocation is very busted.
2256590	2258190	If they don't find out very soon, hint two
2258190	2261290	will let them know because I think it's exactly that.
2261290	2262510	Or no, I made it very
2262510	2265090	clear that it's not in reallocation.
2265090	2265250	It's in splitting. Yes,
2265250	2267290	an earlier iteration of the
2267290	2269650	hints led me astray.
2270710	2271430	It was...
2271930	2273230	Yeah, no, I can't
2273230	2275190	defend it. It was.
2277430	2279230	Some other sort of excitement going on
2279230	2281230	in the room right now. It's hard to
2281230	2283190	tell how much is making it through the microphones, but
2283190	2285110	there is a lot of action in this big room.
2285110	2286890	Yeah, there is a lot. Sounds like another competition
2286890	2288970	just ended, had the countdown.
2290170	2291150	I'm not sure which
2291150	2293170	it was. I think it was Hackasad, actually, so we might
2293170	2294950	be getting our Jordan back soon.
2295570	2297030	Excellent. Well, the Hackasad,
2297030	2299210	very cool competition for all of our
2299210	2301290	viewers. If you haven't heard of it,
2301290	2303250	very cool stuff. And, you
2303250	2304330	know, they've got Jordan, so
2304990	2307210	obviously they've got a pretty good commentator. Their production
2307210	2309010	values through the roof. Oh, yeah.
2309010	2311010	Really cool stuff. So it looks like
2311010	2312930	over on Hypeboy,
2312930	2315310	they're getting invalid furniture items.
2315310	2316830	They're getting reallocation bugs
2316830	2319090	because you're going back, your
2319090	2321350	furniture list is increasing,
2321350	2323270	increasing, increasing. Oh, and now they're fine
2323270	2325310	tuning their offsets to get that. Nice.
2325310	2327410	It's increasing so much, they have a leak
2327410	2329610	in the size field now, and they see it here.
2329610	2331190	So they know that the size
2331190	2333270	field overlaps. The size
2333270	2334970	field overlaps the next heap metadata
2334970	2336930	size field, or next heap metadata
2338270	2339450	next pointer.
2339450	2340610	That's what I meant to say.
2341490	2343130	It's so clear. And knowing
2343130	2345490	that, creating new furniture,
2346070	2347190	they know that they're
2347190	2348670	going to be able to write
2348670	2351250	to that next pointer.
2351390	2352870	And if you write to a next pointer,
2352870	2354810	point that up, writeable memory,
2354810	2356470	and then allocate something else,
2356470	2358770	you can get potentially an ARB write.
2359730	2360610	Yeah, I think they're
2360610	2361910	making great progress.
2362930	2363950	Oh, yeah.
2365190	2366590	I was trying to look and see
2366590	2368730	in their chunk list there,
2368730	2370390	in the debug prints,
2370390	2372590	if we saw any pointers, it started to look like
2372590	2374530	they had control. The problem is,
2374530	2376530	they are over-allocating right now.
2376530	2378330	So the debug print is going to print
2378330	2380470	so many chunks that it's going
2380470	2382230	to be hard to scroll through and find them.
2382970	2384510	So I think you only need to
2384510	2386250	add something like five,
2386250	2388390	six furniture items max.
2388670	2390530	And that's going to be a much more manageable
2390530	2392310	like 20 chunks. I saw them printing out like
2392310	2393190	54.
2394090	2396210	I think that this is the kind of problem.
2396210	2398170	I'm a very visual guy, and
2398170	2400150	for me, seeing a long list of
2400150	2402370	tabular data, it's hard
2402370	2404110	to visualize. And when I'm
2404110	2406090	working on a challenge like this, I'm making
2406250	2408330	a picture in my head. And if I can't make that picture,
2408330	2410250	just due to the raw size of the data
2410250	2412270	or the complexity of what I'm dealing with,
2412270	2414090	it's hard. Yeah, absolutely.
2414090	2416170	Honestly, it would have been really cute to write
2416370	2418350	a visualization like...
2418350	2419890	A Barbie house visualization?
2419890	2422030	Yeah, where you can see, or like for the heap
2422030	2423910	chunks just overlaps and stuff.
2423990	2425190	What a missed opportunity.
2426050	2428230	That code would have had so many bugs in it.
2428290	2430190	Like, that sounds hard.
2430190	2432130	Okay, and if we switch over to the
2432130	2433970	raw hat side, we can see that they are
2435110	2436070	examining their
2436070	2437570	chunk list.
2438730	2440290	They've got some large
2440290	2441890	allocations going on.
2442190	2444090	So that chunk size 2f is going to
2444090	2445410	come up in the future.
2446770	2447450	Yeah.
2448070	2450230	That's actually pretty important.
2450230	2451790	So what's...
2451790	2453850	I don't want to give the solution away here.
2454690	2455870	We'll see.
2456590	2458650	How far are we to hint2, production?
2463080	2464720	We're checking in now.
2465060	2466180	Hint2 just came up.
2466180	2468020	And hint2 just dropped. So the competitors,
2468020	2470240	they have a timer that they can revisit.
2470500	2472280	They may not be looking at...
2472280	2474160	I'm guessing they're not looking at the clock.
2474220	2474980	No, I don't think so.
2476300	2478160	We will probably see one of them
2478160	2480160	flip over and check to see if the hint
2480160	2482140	has dropped here. But they're both kind of on a roll
2482140	2483940	too, just judging by how
2483940	2485220	quickly they're typing.
2486240	2488520	It's definitely something that's not on the top of your mind.
2488520	2490540	Hey, what's the next hint? Unless you're stuck.
2490540	2492160	Yeah, I kind of want to
2492160	2494900	have production go tell them hint2 dropped.
2494900	2496120	But at the same time, I don't want to
2496120	2498700	ruin their train of thought. I think we don't interrupt
2498700	2500600	them. We told them when the hint was going to be at the beginning.
2500600	2502320	No, and I think that that's...
2503520	2504520	that's the way we've been
2504520	2506920	running this competition. And as you said,
2506920	2508140	both of these competitors
2508580	2510800	seem to be on a roll, typing really fast.
2510800	2513580	It's not like they just have a
2513580	2514570	cursor hanging over
2515380	2518140	idly, hovering things in IDA.
2518140	2518460	They are moving
2518460	2519720	towards the solution.
2520120	2522000	Oh, got EOF.
2522320	2524320	So it looks like they have
2525120	2526000	next.
2528640	2530020	So let's flip over to
2530020	2531500	HypeBoy and take a look.
2531500	2532720	Oh, thank you. Sorry.
2535420	2536400	Next is null.
2536400	2537520	Sending 50.
2537960	2540100	Yeah, so it looks like they're getting...
2540100	2542480	Oh, you just need to print the state of the crash here.
2542860	2543960	You're so close.
2546400	2548100	So once they get
2548100	2549520	control on
2550080	2552080	this, they overwrite a pointer.
2552080	2554020	What's the next step? So you overwrite
2554020	2556320	the next pointer. Where are you going to point it to?
2556900	2558040	Right before the
2558040	2559520	got is pretty nice.
2559840	2561860	Because, you know, I think this is no
2561860	2562700	rel row.
2563600	2565980	You can push that right before the got.
2566360	2568360	Right before the got,
2568360	2570020	you know, if they look around there, you might
2570020	2572140	notice, oh, there's a very convenient field
2572140	2574120	of zeros with, you know, some other bytes
2574120	2575540	in there. So
2575540	2577440	you could point it right before.
2578820	2579680	Let's see. Right before
2579680	2581560	the got is going to be...
2581560	2583360	Oh, I forget where it is in no rel row.
2583540	2585440	It's been a minute. So what's the
2585860	2587380	characteristics that we're looking at here?
2587380	2589480	It's readable and writable? You're looking for something
2589480	2590400	that'll have
2591700	2593320	a big enough size, a size
2593320	2595340	that you can put, you know, ideally
2595340	2597400	the house name into. Because
2597400	2599860	that's the easiest thing to control.
2599880	2601420	You're looking for something that has a size
2601420	2603540	field that matches that. You're looking
2603540	2605320	for something that has free set.
2605360	2607580	That's the most important thing, is you need
2607580	2609620	to have the free field set in order for that chunk to be used
2609620	2611340	by any new allocation.
2611540	2613600	And then you want the next pointer
2613600	2615440	to be either valid
2615440	2617420	or not.
2617620	2619680	And so in this case, what you're doing
2619680	2621620	is you're setting up a portion
2621620	2623920	of memory to look like a chunk
2623920	2625860	so that you can use it.
2626260	2627540	You're making a fake
2627540	2629600	heap chunk in, like, program
2629600	2631320	memory, in the BSS. Exactly.
2631320	2632640	So fake heap chunk.
2633980	2635320	And then from there, we're...
2637440	2639200	I see some very
2639200	2641440	active mouse work over here.
2641440	2643260	I want to jump over to HypeBoy
2643260	2645180	and see what they're looking at.
2645500	2646420	There we go.
2647720	2649300	Doing the math in their head, you could
2649300	2650500	see it work out.
2651200	2653360	Okay, so I see Straw Hat
2653360	2655240	has picked up hint
2655240	2657440	two. I didn't know hitting enter after
2657440	2659740	an examine command would just, like, step forward.
2659740	2661680	That's pretty nice. I didn't know that. I just always
2661680	2663860	change the offset. Yeah, well,
2663860	2665200	I mean, that's one of the things. I think
2666000	2666720	if you
2667940	2669860	are a competitor at this level,
2670380	2671680	if you're not taking a look at
2671680	2673720	some of the tricks that your competitors are doing, because this is
2673720	2676500	all live, right? Everybody's
2677040	2677800	aware that what
2677800	2680120	they're going to do is going to be public,
2680120	2681900	at least in that the stream is visible.
2681900	2683620	So there's a lot of interesting
2683620	2685500	techniques to be cleaned. Absolutely.
2685660	2687680	And over on Straw Hat, we see them looking
2687680	2690140	in the buggy check.
2690460	2692340	Were they just looking at Malik?
2693720	2696400	Or they're looking at where Malik is used.
2698300	2699760	Weren't they? Oh, no, they weren't
2699760	2701480	at furniture. I'm sorry. It just looked
2701480	2703640	very similar. There was a size
2703640	2705920	check greater than, but it said V2.
2706340	2707740	And so we don't think that we've seen
2707740	2708920	them have control
2710140	2711620	yet. I don't believe
2711620	2713240	they've gotten a crash yet.
2713860	2715640	I'm not 100% on that,
2715640	2715700	but
2717320	2719620	I don't know. We'll keep an eye on them
2719620	2721640	for sure. It looks
2721640	2723560	like over on Hype Boy, they're
2723560	2724600	going into
2725600	2727920	remove furniture and figuring out what it does.
2727920	2728400	It actually
2729680	2731620	well, you know, we'll see here. It frees
2731620	2733600	the name, it frees the struct, and
2733600	2735960	it decreases the size of
2736920	2737400	the
2737960	2738780	furniture item
2739460	2741620	linked list size count field,
2741620	2743480	whatever that is. It's not really
2743480	2745400	important. It's just like a linked list
2745400	2746480	implementation.
2748920	2749560	Yeah, so
2749560	2751240	part of this is really just
2752420	2753480	understanding exactly what
2753480	2755060	you're supposed to do with the bug.
2755720	2756160	Which
2757700	2759380	as we've said a couple times
2759380	2761200	now, a lot of different ways to go with
2761200	2763480	heap. I think that they're
2765260	2765700	packing
2765920	2767340	a pointer, so they're just
2767340	2768340	understanding.
2769800	2771580	So if I'm mistaken,
2771580	2773460	have they annotated that struct, or
2773460	2775940	are they just looking at offsets? No, I was just thinking that.
2775940	2777380	I would really annotate that
2777380	2779580	struct. That would make stuff stand out
2779860	2781620	a lot clearer.
2782080	2783580	Well, with more than one struct, it's
2783580	2785580	definitely something, like if it was only one
2785580	2787740	struct, sure, maybe you can just think about the offsets,
2787740	2789620	but with more than one in play,
2789620	2791640	definitely that would help. Unless
2791640	2793780	do they...
2794720	2795720	are they going to return
2795720	2796720	to it properly?
2799880	2801540	Oh, come on, you need to
2801540	2804100	print out the state, looking at debugger.
2804300	2806020	Oh, there we go, up there.
2807720	2809560	On the straw hat side, I just saw them
2809560	2810880	double-clicking. They're
2811540	2812700	looking at the
2813820	2815660	debug heap prints,
2815660	2817460	and I saw them double-clicking on the
2817460	2819460	size2f. I think
2819460	2821540	that they're...
2822140	2823460	Okay, now that might be
2823460	2825660	just standing out because that's like slash.
2826600	2827480	And it might just
2828760	2829220	be...
2829220	2831060	Well, let's see here.
2831360	2833300	Yeah, I'm curious if they're
2833300	2835320	still sort of feeling around. Maybe they
2835320	2837400	know something is wrong, but they can't
2837400	2839120	quite isolate it.
2839280	2841460	I'm not sure. Not 100%,
2841460	2842980	they have more of a wrapper now.
2843400	2845040	Yeah, they're getting their
2845040	2847100	interaction sorted out here.
2847840	2848760	And over on
2849480	2851260	Hypo, we saw them double-clicking some addresses
2851260	2852140	too.
2852880	2854880	Figuring out what the offset is.
2859040	2860120	Oh, they have...
2860120	2862800	Yeah, they have a wrong size field. Size is 0x980.
2862800	2864380	That's super wrong.
2865140	2866220	So I think they
2866220	2868020	have a write into the size field.
2868020	2870120	They need to shift it one...
2870920	2871800	Or I guess eight bytes
2871800	2874160	forward to get an overwrite into
2874160	2876020	the next field. They are
2876480	2878260	eight A's in their payload away
2878260	2879960	from getting next overwrite.
2883260	2883940	And if they
2883940	2885320	had the stroke, they'd know.
2886880	2887960	How long?
2889620	2890400	Eight minutes
2890400	2891380	to sudden death.
2893360	2894140	Wow, yep.
2894140	2896420	We knew this was going to be a hard one. It is going to come
2896420	2898940	down to the wire here. Wow, it really is.
2899720	2900440	And if we have to go
2900440	2902520	into sudden death, that's what we'll do.
2903000	2904460	We're already running a little bit
2904460	2906240	behind due to some technical difficulties.
2906240	2908400	We are, yeah. We're cutting into our lunch
2908400	2909780	break here, that's for sure.
2909960	2912300	We do that for you.
2913660	2914420	For the love of
2914420	2916040	the game. Isn't that some slogan?
2917720	2918520	Sounds familiar.
2918520	2919600	It does, yeah.
2920420	2922560	Oh, oh, oh. Item
2923780	2924840	0x7f something.
2924880	2926420	We're seeing some corruption
2926420	2928860	go down in that debug print. Oh, yeah.
2930780	2932660	Okay, and they're going to leak that out.
2936010	2936610	Print out
2936610	2938630	their leak and figure out what that's... It looks like they have
2938630	2940770	meted out a misalignment, maybe?
2940990	2942170	I'm not 100%.
2943010	2944230	Well, so if you can
2944230	2946650	adjust the size on this...
2947690	2948510	Well, you can get a size
2948510	2950430	overwrite, but just as easily you can get an X overwrite
2950430	2951950	if you shift your
2952410	2953470	data forward 8.
2953650	2956270	8 more bytes. Right, but if
2956270	2958510	they're trying to leverage that
2959050	2960270	the size is incorrect
2960270	2962310	here. Is there any way you see the exploitation
2962310	2964710	from there? Yeah, totally.
2965990	2968270	I mean, because it is a sequential
2968270	2970490	heap allocator, it's a little bit weird
2970490	2972290	because you're going to try to write past
2972290	2973790	the end of program memory.
2974110	2976370	I think what you might
2976370	2977610	get is
2979070	2980110	an allocation
2980110	2982250	after then corruption of size
2982250	2984330	of the chunk before, and then you
2984330	2986430	get full overwrite of the chunk after.
2986430	2988510	But the important part is you get an allocation
2988510	2990810	after you get the...
2990810	2992410	Sorry, you get an allocation after
2992410	2994290	it before you get the size
2994290	2996470	overwrite. So you're actually
2996470	2998750	able to use that size.
2999270	2999830	Right.
2999990	3002450	You know, that's an option.
3002450	3004250	As you can tell by me kind of stumbling
3004250	3005610	through it, it's harder.
3006850	3008350	It's not just, you know, you have
3008350	3010190	control of the next pointer and link list.
3011330	3012210	It is a way to
3012210	3014690	get next pointer control.
3014750	3016190	So they might take that path to it.
3016190	3018110	Once again, because we saw them
3018870	3020230	not annotating structs, they might
3020230	3022510	have a good mental layout of what's going on here.
3022510	3024210	They might be comfortable with that. That might be
3024210	3026290	completely within the realm of possibility
3026290	3028370	for them. I see I'm putting out
3028370	3028670	some
3032090	3032490	function
3032490	3034450	pointers there. I think they have an idea of
3034450	3036150	where they're trying to go.
3037730	3038290	On the
3038750	3040390	lower right hand side of the screen, you can see
3040390	3041770	I'm printing out some pointers.
3043130	3043990	Oh, yeah.
3044950	3046530	Alright. Let's take
3046650	3048510	a look at straw hat real fast. Straw hat was
3048510	3050650	just highlighting the buggy line.
3050650	3052590	Yeah, I saw them returning to their
3052990	3054350	comment there with the triple
3054350	3055270	question mark.
3057430	3058910	It feels like
3059550	3059950	they're
3060610	3062050	still trying to work out
3062050	3064010	what can I really do with this. They know something is
3064010	3065990	wrong there. They've highlighted
3065990	3068190	the bug. They've got the comment that nails the bug.
3068190	3070010	They need to figure out how to hit it. And if they
3070010	3071890	do C times 0x20...
3071890	3073250	Yeah, 0x22.
3073650	3074930	Sorry, just 0x22.
3081940	3083540	Man, at this point, I am just
3083540	3085180	rooting for these competitors. I really want to
3085180	3087680	see a solve on this. They see a chunk with 0 size.
3087680	3089260	So that's good. Which seems suspicious.
3089260	3090860	That is very suspicious.
3092880	3093280	And...
3093280	3095200	I don't know.
3095480	3097380	I don't know how this is going to go
3097380	3098300	honestly.
3099920	3101200	So doing C times...
3101200	3103080	Oh, it needs to be C times 0x20.
3103140	3105440	No, you forgot the 0x.
3108280	3108940	That doesn't
3108940	3110320	look like 32 Cs.
3110320	3112620	This is the drama of CTF.
3112660	3113720	Oh, man.
3114980	3117020	They're so close, but that's such a
3117020	3118760	simple mistake to make.
3118760	3121200	Such an easy mistake to make, rather.
3121200	3122880	Yeah, and you just...
3122880	3124340	If you've played,
3124340	3126480	you can appreciate the heartbreak.
3126580	3128700	To know that you were so close,
3128700	3130760	or that there's one little mistake
3130760	3132520	that got you tripped up, you didn't know that
3132520	3134140	you made it, and then you spent like an hour
3134140	3136880	or so going down
3136880	3138440	the wrong path, or thinking
3138440	3140620	that what you were looking at wasn't
3140620	3142760	viable when it was, in fact, the bug.
3142760	3144380	Yeah. I mean, they
3144380	3145800	annotated that line
3146400	3148540	early, early, and then they just moved on
3148540	3149700	to other things.
3149700	3151660	So, I don't know if they were trying to figure out
3151660	3153600	how to hit it. It's fairly straightforward to hit it.
3153600	3155720	It's from every mallet call it can be hit.
3156420	3157940	Well, on the Hypeboy side,
3157940	3160180	I've seen in their debugger,
3160180	3161800	which they just had up,
3161800	3164020	looks like they're making progress.
3164320	3164900	I think that they're close.
3164900	3166480	Let's see, what are they doing here?
3168760	3169680	They're stepping through.
3169680	3171900	They have invalid items in rooms, which is right.
3171900	3172780	That's great.
3176270	3177450	They're going through...
3177450	3181790	Oh, man.
3181790	3184330	It looks like they have a consistent leak.
3185630	3188270	They're just trying to figure out what to do with it.
3190450	3192730	And they're checking
3192730	3195010	where their allocation
3195010	3196770	goes. I think they're looking
3196770	3199250	for allocation into program memory,
3199250	3200590	or like, you know,
3200590	3202270	BSS global memory,
3202270	3203970	which is the right approach.
3203970	3205510	That's correct.
3206050	3207890	And so, the path exploitation
3207890	3209810	that it looks like they're
3209810	3211770	going down is that they're looking to
3211770	3214310	stage a chunk,
3214430	3215990	a fake chunk, and then
3216670	3218090	use that to overwrite
3218210	3219210	a function pointer?
3220310	3222290	Yeah, that's correct.
3223410	3223710	And
3223710	3225270	you can overwrite function...
3226150	3228370	You can overwrite function pointer.
3228370	3229610	You can...
3229610	3231850	I think I just put an admin terminal in here.
3231850	3232770	Did I?
3233150	3234650	No, I put a win function in here.
3234650	3236510	So, it's overwrite function pointer
3236510	3238270	to win function.
3238610	3240590	Which I didn't
3240590	3242390	necessarily see either of our competitors
3243850	3244650	playing with
3244650	3246690	that win function, though certainly they may have just looked at
3246690	3248510	it and said, yep, this is where I'm trying to get to go.
3248510	3250390	Oh, they know there are two minutes left.
3252130	3253050	Oh, man.
3253050	3254350	It's possible, but it's going to be
3254350	3255790	really close.
3255810	3259090	Yeah, the time pressure is real.
3259990	3260630	Capitalizing data
3260630	3263130	isn't really a sign of forward progress.
3263130	3264490	I'm worried here.
3264790	3265870	93 seconds.
3265870	3268550	We just saw over on the Straw Hat side
3268550	3271110	checking the timer.
3271110	3273390	I wish we had a
3274270	3275570	giant digital clock
3275570	3277230	counting down over there, but really
3277230	3279230	that's what they've got to gauge.
3279230	3280830	How much time they have left.
3280830	3283610	They feel the pressure. This is going to be tense.
3283610	3284970	And it looks like both teams
3284970	3287370	just kind of sitting there.
3287370	3290250	Just looking, trying to figure it out.
3290250	3291350	Yep, this is
3291350	3292730	that part of the competition that
3293610	3295810	everybody's familiar with when you're
3296990	3297470	just
3297470	3299390	feeling like, ah, I know
3299390	3301390	there's something here, but maybe the next
3301390	3303470	step isn't clear. They're writing a chunk of 24
3303470	3304890	which is right.
3305290	3307290	That gives them 16 byte overwrite.
3307730	3309330	So on the Hype Boy side, I think that
3310030	3311170	they're on the right path.
3311170	3313410	The question is just, are they going to finish
3313410	3314850	before the timer runs out?
3314850	3316230	Really, yeah.
3317290	3319350	And they have item size
3319350	3321230	being the leak.
3322210	3323210	I mean, really
3323210	3325390	impressive that they've
3325390	3326990	gotten this far. I like the
3326990	3329310	LS. They type 50, enter, enter,
3329310	3330950	LS. It's just like,
3330950	3333750	sorry, not that lucky.
3335370	3337430	And I think we're starting to see
3337430	3339190	the desperation as the speed of their
3339190	3340410	of their
3341330	3344070	pointers and their typing increases.
3344110	3345030	Yeah.
3345210	3347410	I want to say we could
3347410	3349130	poll them and see if they want to go Sudden Death or
3349130	3351150	continue it, but knowing CTF players,
3351150	3353350	they'd continue this until retirement.
3353750	3355370	Yeah. I think that we're
3355370	3356790	going to go into Sudden Death.
3357090	3359570	I think so. Oh, and it looks like
3359570	3361350	yeah, over on the Hype Boy side,
3361350	3363350	they have controlled right into Heap.
3363350	3364370	Oh, 7a.
3366290	3367310	But that being
3367310	3369450	said, there is still another stage to this.
3369710	3371670	So I guess they just didn't hack hard enough.
3371890	3373810	Well, ultimately, that is
3373810	3375090	really the only thing
3375090	3377110	in CTF is
3377110	3379090	that you either figured
3379090	3381130	it out or you didn't. I mean, the challenge could be
3381130	3383110	broken, but barring
3383110	3385170	that, I validate it.
3385270	3386870	Barring that,
3386870	3388990	we knew that this was going to be a tough
3388990	3390470	challenge from the get-go and
3391430	3392790	confirmed, right? Yeah.
3392790	3395110	Two teams, top of their game.
3395290	3396930	And so now we're going to set them up
3396930	3398970	against a challenge where we're pretty sure
3398970	3400710	that they're going to get this quite quickly. Yes.
3400710	3402510	Just a question of who's first.
3402510	3404030	House of Barbie was,
3404030	3406610	I want to say, the hardest
3406610	3408350	Pwn Challenge we have.
3408770	3409550	Yeah.
3412230	3414550	For reasons, it wasn't saved until Grand
3414550	3416510	Finals, which
3416510	3418550	we'll find out later. But now we're
3418550	3420090	going into Sudden Death.
3420890	3422650	We see one of the team members,
3422650	3424190	I assume,
3424190	3426330	Slack messaging their team saying,
3426330	3427870	yeah, Sudden Death guy, sorry.
3429930	3430330	Um...
3430330	3431910	Yeah, I mean, it's important to remember
3431910	3433930	that this is within the
3433930	3435350	larger finals
3436070	3437810	ecosystem here. Like, the
3437810	3440270	Nautilus game is going on. We can see their scoreboards.
3440270	3441390	It is, yeah.
3441550	3444110	If they're not blanking now, probably soon.
3444350	3445410	No, they're not blanking.
3445410	3446890	They're not blanking today.
3446990	3449890	I talked to Brumley yesterday and he was so happy about it.
3449890	3451450	He's like, I always hated how you
3451450	3454190	blank it at the end of the day and we're the only ones that know.
3454510	3455990	Or rather, he's always
3455990	3458030	with PPP. So it's like, y'all are the only ones
3458030	3459270	that know.
3460190	3462070	Brumley being fantastic also, supporting
3462070	3463930	us behind the scenes. Supporting the entire CTF
3463930	3465990	team here. Yeah, really great. And definitely
3465990	3468370	appreciate that. Yeah, fantastic.
3468370	3469910	So, with the larger DefCon
3469910	3471170	CTF finals,
3471810	3473930	the winner here is going to get points for their
3473930	3476030	team and... I think the winner here
3476030	3478130	gets 1337 points.
3478130	3479170	Fitting. Which is
3480150	3482050	insane. Because, let's
3482050	3484470	see, last place right now,
3484470	3486490	Mhacaroni with just under
3486490	3489410	3000. To first place,
3489410	3490770	MMM with...
3490770	3492810	Is that 7000?
3493210	3494190	So it's
3494190	3496330	significant. This is not
3496330	3498390	jump change points. This could
3498390	3500350	really alter the rankings. Oh, yeah.
3500350	3501930	And in the middle, you know, there's
3502770	3504770	from 4th to...
3504770	3506210	What is that?
3506210	3508170	From 4th to 10th?
3508170	3510030	There's a 600 point difference.
3510030	3511570	So you can jump up
3511570	3513570	like 6 places
3513570	3515210	by winning live CTF.
3516630	3517570	It's the longest
3517570	3519570	running challenge. And we just got the thumbs
3519570	3521290	up that we're good to go.
3521930	3523730	Alright, so...
3523730	3525290	Let's get ready to count it down.
3525610	3527550	It hurt they didn't solve it, but let's do
3527550	3528850	sudden death here. Alright.
3529390	3531870	5, 4, 3,
3531870	3533690	2, 1. Let's
3533690	3534410	go.
3535430	3537550	Alright. Have you tried reversing
3537550	3539430	it this sudden death?
3539430	3540810	Oh, man.
3540930	3542790	This is an old joke
3542790	3544850	from a long time ago. When we put on
3544850	3546750	hack the vote at RPISec, we had
3546750	3549230	an intro
3549890	3551670	submission is working challenge.
3551730	3553350	It was category reversing.
3553350	3555170	And we just print the flag reverse and you need
3555170	3556990	to flop it. So this
3556990	3559210	is also because
3559210	3560710	our poners hated reversing.
3562110	3563290	Well, our poners
3563290	3565150	hated reversing. Our reversers hated poning.
3565150	3566570	Sorry, hard to reverse that.
3566570	3568550	And it was kind of
3568710	3570610	a joke, like, they'd always walk over to the
3570610	3572610	poners and be like, oh, have you tried reversing it?
3573510	3574830	So this challenge
3574830	3576390	is made by Glenn.
3576630	3578890	Did I see a decomp failure on Ida?
3578890	3580270	Was there a decomp failure?
3580270	3583290	I think that that's what's happening. Positive SP value?
3583290	3584370	Something like that?
3584370	3586790	So, you know, this is the risk.
3586790	3588310	Everybody's using Ida, except for
3588310	3590950	I believe one competitor was using Ghidra.
3591090	3592890	Yeah, there was...
3592890	3594610	Yeah, I think just one using Ghidra. You're
3594610	3596410	right. And this is a risk.
3596410	3598570	Now, I believe
3598570	3600570	that any competitor at this level is going to be able
3600570	3602690	to read this disassembly and figure
3602690	3604370	out what's going on pretty quickly.
3604370	3606550	We see Hydeboy scrolling through the disassembly right
3606550	3607230	now.
3608810	3610430	I've got to say, as one of the few
3610430	3611510	non-Vector35
3612570	3613590	members here, that
3614870	3616270	if you think that
3617210	3618690	LiveCTF is testing their challenges
3618690	3620610	in Binja, that's probably a pretty
3620610	3622870	good bet. No, we test our challenges in everything,
3622870	3624830	honestly. Really? Yeah, we really, really
3624830	3626750	try to not... like, we
3626750	3629150	do not write challenges to make Binja look good.
3629150	3631070	There are some challenges where it looks worse.
3631370	3633070	There are some challenges where Ida looks worse.
3633070	3634730	We didn't test Ghidra.
3638820	3640220	Oh, that's a big diagonal
3640220	3642200	arrow in the Ida graph view.
3642280	3643920	I actually haven't seen that before.
3643920	3646700	I don't think I've ever seen that.
3646840	3648180	Okay, here we go. So now
3648180	3650260	we've got... looks like there's a fix up
3650260	3652180	there that resulted in the
3652180	3654220	decouplation on
3654220	3656580	one side here. And then straw hat.
3657220	3658280	They should be able to tell
3658280	3660200	that this is a string. So, yeah, looking at
3660200	3662520	those numbers, I'm guessing that's ASCII.
3662680	3664320	That is, in fact, ASCII.
3665220	3666560	Thank you for ASCII-ing.
3668800	3670380	Sorry, I should save it for the
3670380	3672560	full screen us cap. No, get your
3672560	3674180	dad jokes out now, Josh. I feel like
3674180	3676120	we're going to be done here soon. I have terrible news.
3676120	3677520	I'm never going to run out.
3678060	3679500	I'm so sorry.
3680420	3681760	If that impacts
3681760	3683980	your choice to continue doing this with us,
3683980	3685260	you know, I understand.
3685460	3687520	I'm going to need a minute to chew on that. Let's flip over to
3687520	3688260	Hype Boy.
3689220	3691440	So, Hype Boy. Oh, they pulled
3691440	3693960	the string out, so reversing it. Yes, I have tried.
3695540	3695960	Except...
3695960	3697220	you know...
3697220	3698860	Oh, I see anger coming out on
3699340	3701280	straw hat. Anger is
3701280	3703340	incredibly overkill for this.
3704200	3705500	But does it work?
3705860	3707200	This is a string compare
3707200	3708960	to running your shell game.
3709580	3711260	Oh, we're seeing anger on both
3711260	3712980	sides. Are you...
3712980	3715280	We're seeing anger on both sides.
3716120	3717080	They're installing
3717080	3719040	anger. That is not a fast
3719620	3720960	installation last I checked.
3720960	3723440	That might cost them some time. The very, very
3723440	3725340	lucky thing is, they're on our
3726160	3727120	organizer internet
3727120	3729180	up to the internet, so they
3729180	3731220	have really fast download. Wow.
3731220	3732860	On game net, that would have been
3732860	3734100	slow.
3736200	3737080	Wow.
3739610	3741090	Oh my goodness.
3741410	3743110	Okay, so we see
3743110	3744830	anger installed as root.
3745370	3746730	Did we see a pseudo
3746730	3749090	pip install? We saw a pseudo pip install.
3749090	3751290	All the rules are being thrown out the window here.
3751290	3753150	Maybe they're running in a docker container. It looks like
3753150	3754970	they are. Oh, okay.
3754970	3755790	Well, that works.
3756730	3758070	Oh my god.
3758390	3760410	Anger coming out on both sides. This is an unexpected
3762030	3763150	turn of events.
3763150	3765250	We are watching an anger race.
3765250	3768230	It is a
3768230	3770390	stir cup. With the decouplation
3770390	3772350	that we're seeing on the straw hat side,
3772350	3775490	you know, this...
3775490	3776390	I'm guessing that
3776390	3778710	the number of equations
3778710	3780410	or equality checks there, that
3780410	3782390	may have been what has driven them
3782390	3784270	to check anger. But you see it's all
3784270	3787270	ASCII. Indeed.
3787270	3788390	And I believe that you can
3788390	3790210	look at each one of those indices,
3790210	3793010	it's decreasing, and it's character by character,
3793010	3793890	but they're under so much pressure
3793890	3796150	that they
3796150	3797730	might be jumping.
3798190	3799890	They might have figured it out.
3800870	3801650	Yeah.
3801650	3803070	Okay, they're just going to write a Python script
3803070	3806130	to pull out what it is.
3808150	3809030	Okay.
3809370	3811810	I was really worried there for a second.
3812190	3813930	Oh, wait a minute. But over on Hypeway,
3813930	3815890	we see Linux x86
3815890	3817990	shellcode. That's a good
3817990	3819970	sign. Yeah, they're pulling it up. Not using
3820630	3821510	shell plus
3822970	3823770	null by...
3824250	3825490	Ah, that's not going
3825490	3826550	to work.
3828090	3829370	You need your
3829950	3831650	payload first. Yes, I've tried reversing
3831650	3833270	it. They put it... No, put it first!
3833270	3834270	Put it first!
3835470	3837570	But they're on the right track here. They are on the right
3837570	3839770	track here. That might work. I might not remember
3839770	3840290	the
3841470	3843610	Python 3 challenge. Oh, yeah, they're
3843610	3845450	under pressure. Seems like maybe
3845450	3847730	you should. If they swap
3848330	3849670	the order of those two,
3849670	3850990	their shellcode...
3850990	3853470	Do you mean if they reverse the order?
3853470	3855270	Oh, my God. It's
3855270	3855890	meta.
3857590	3859670	If they reverse the order here,
3860190	3861490	they get a shell. On the Straw Hat side...
3861490	3863130	No, don't put it at the end.
3863870	3864650	Oh, wait.
3866950	3869610	Oh, my God. They just totally rewrote their shell.
3869610	3871430	Okay. They threw out the other thing, and they
3871430	3873410	just have another. On the Straw Hat side,
3873410	3875670	we see them continuing...
3876330	3876970	to look at this
3876970	3878870	Oh, my goodness. It looks like
3878870	3880890	Hypo is going to run away with it here.
3881010	3882970	Straw Hat, real fast, still running
3882970	3884390	their parser.
3885190	3886810	Hypo over here.
3886870	3888490	Should run it from remote.
3889290	3890650	What? It said...
3890650	3892190	Didn't they get a shell?
3893330	3894790	Oh, now go get a shell.
3894790	3896990	So they got the, yes, I've tried reversing it right.
3901050	3901490	But...
3901490	3902670	Oh, that's...
3902670	3904330	And Straw Hat is still continuing
3905910	3906790	to fix
3906790	3908110	their script and
3909670	3910790	isolate just the
3910790	3912790	pieces of the equality checks.
3912790	3914930	I think that they're still going down the road.
3916530	3917070	Yep.
3917070	3918310	We can see them printing out
3919550	3920950	what the response is going to be
3920950	3921730	checked against.
3922770	3924510	I'm going to keep an eye over on Hypo because
3924510	3926930	if they just swap,
3926930	3928810	if they just put, yes, I've tried reversing it in the
3928810	3930530	beginning, they win.
3932410	3934770	At this point, it's really
3934810	3936790	a pressure cooker. They're already exhausted from
3936790	3938950	the challenge that they just went the distance
3938950	3939630	on.
3940150	3943010	Over on Hypo, they think it's their shell code that's wrong.
3945510	3946630	Oh.
3947930	3948850	They are so
3948850	3950850	close. But really
3950850	3952850	all you need to do is just put the string
3952850	3954870	before because it's comparing from zero
3954870	3956970	index. Over on Straw Hat...
3957890	3958390	Oh.
3958470	3961010	They're going all in on this
3961010	3962850	string manipulation with Python
3962850	3965230	which under this kind of time pressure...
3965230	3966790	Yeah. You see that the indices are
3966790	3968870	reversing. You can honestly just reverse those lines
3969610	3970090	and
3970590	3972490	pull out the ASCII character.
3974310	3974790	Yeah.
3974790	3976690	Gosh, this is tough.
3977230	3978190	Yeah.
3978610	3980830	So it looks like they're trying to extract out the
3980830	3982850	numbers and the indices and then remap everything
3982850	3983670	into a string but
3984590	3987530	might be a little bit of overkill for this situation.
3987530	3988230	Yeah.
3988730	3991010	Hypo going through in the debugger.
3991010	3993310	Looks like they see that...
3993310	3995470	Is that their shell code that's executing there?
3997510	3998910	Yeah, that looks like it.
3998910	4000090	But then they have an IML.
4000250	4002450	So something went wrong with their shell code there.
4002550	4004330	Oh, it looks like maybe they're...
4004330	4005170	Oh, no, they're in ops.
4005170	4008610	Or maybe that was just a non-destructive
4009370	4010170	operation.
4010250	4012230	Because they have 0x90 in ops, right?
4013610	4015110	Oh, and then they have nulls.
4016390	4017050	Looks like it.