start	end	text
18480	26020	We'll see. Let's try this again. Yes. Oh, I think we're audible. Oh, nice. Hello everybody. It's
26020	33320	been crazy. This has been a crazy day. Welcome. I'm CypherTX. I'm here with Carl. Hello. We have
33320	39040	we've had a busy day. Yeah, yeah. But now we're here. We're here and we'll find out shortly
39040	46020	whether the challenges are here. We've got four competitors in the back. The challenges are
46020	50800	tested. So I think we're ready to count it in. Let's just do a really quick introduction of
50800	55520	kind of what the format is this year and what teams we have and how this is going to work.
55520	61240	Right. We will talk more about this. But the very short thing is we have a head-to-head, two players,
61240	66260	one challenge. First one to solve it wins. Two matches running in parallel. We will be casting
66260	70800	and commentating one of them. If you really want to watch the other one or the live feed from the
70800	76000	players, it's available. And I think that's it for now. We will talk more about it later. We're
76000	83280	going to get the teams started and then we can, you know, talk about the challenge and
83980	88700	all that. So I'm just going to, you know, look over to production and say that we are
88700	98620	ready to go. I'm ready. Countdown. Five, four, three, two, one. Go. Let them go.
99780	108200	All right. So we should be going. Yep. And let's switch over to one of our competitors here.
108200	115800	Full screen terminal already. Yep. So the way this is going to work, both of the players,
115800	123500	they are given a challenge, the same challenge. It is a pwnable challenge of binary exploitation,
123500	128600	you know, memory corruption, vulnerabilities and exploits that we're looking at here. The
129160	137280	goal of this is to take this program, this binary, find a vulnerability, develop an exploit,
137280	143160	test it locally and then exploit this on a remote server. Once you do that, you will eventually
143160	149860	manage to get code execution on this server. And that's when then you're basically done. And then
149860	155540	to prove that you're done, you will run the command on the server, which, yeah.
155540	162380	But this year, unlike last year, we're a double elimination tournament. So last time it was as
162380	165860	soon as you lost, you were out. But this time you have to lose twice before you're out. So that
165860	169900	gives teams one a little bit more of a buffer, which is great, but also increases the complexity
170280	174960	a fair amount. Yeah. We've got a bunch more streams, a bunch more captures. We've got a whole
174960	180780	lot that we're trying to juggle here. So we've got the two teams that we're going to be looking at
180780	187940	here are going to be Pigbuttsad and then they're playing against mHackeroni. So those are our two
187940	194460	teams that we're eyeballing. We don't have the overlay text. We're a little bit... we'll get
194460	200060	that added as we move forward. Yes. But we're currently looking at mHackeroni. Right. So they
200060	209260	are here in IDA, one of the popular reverse engineering platforms, the disassembly compiler.
209260	216440	You can see the player here looking at the code, you know, renaming variables because, you know,
216440	221840	they only get these... they get this decompilation, which is very nice, but you still have, you know,
221840	227800	no variable names and so on. So they're trying to like clean up the code here to be able to
227800	232760	understand what's going on. So it's kind of as you can see, because we've got the... we're currently
232760	238080	in the overlay view. It was very convenient these two teams to choose dark and light themes for us.
238080	242760	So it's really obvious when we're in... when we're looking at mHackeroni, they're going to be the
242760	247720	dark IDA. And when we're looking at PigButSAD, they're going to be over there in the light IDA.
247720	252280	And we can flip back and forth and take a look at kind of each one in a little more detail.
252280	257880	So let's switch over to PigButSAD. You can see they're looking at essentially the same
257880	262300	piece of code. This is kind of the core functionality of this program. You can see
262300	268860	that they are trying to create some structures here to figure out what is going on. So this...
268860	272800	And I saw that it had a name. So that function name was called interpreter, right? So do we
272800	278740	have symbols in these binaries, or did they already name that? Let's see. I think... I think
278740	285500	this one does have symbols. Yeah, this varies from... no, I'm looking over here. No, we... yes, yes, we do
285500	290300	have... we do have symbols in this one. So we have function names to help them out a little bit,
290300	295940	because, you know, we want... so these challenges... so we want to make these challenges, you know, easy
295940	303960	enough that we can do this kind of like high-speed format here. So that's... sometimes we do give
303960	311000	them some, you know, things to grab onto, like the function names and so on. Yeah. Sometimes we decide
311000	316100	to strip them out if that makes more sense in the context of the challenge. Yeah, but these are...
316100	321580	so these matches that we've got, normally we're scheduled for about an hour each match. And if
321580	325260	things go to plan, we want them to be solved in like 40 minutes, right? The goal is actually 40
325260	330820	minutes after the challenge starts. They should be at that point already done, because we do go
330820	335520	to a sudden death. So if it's taking them more than 50, we're going to go to a sudden death mode.
335520	342060	And at that point, we give them a new challenge that is like as simple as it can be. It's meant
342060	351560	to be very, very basic. And that's a truly painful race at that point. Yep. And we can see here on
351560	357940	the Piglet side reversing that they are still working on... you can see there they named one of
357940	364280	the fields of the structure PC, typically for a program counter. And we did tell them
364280	369420	the category in advance, right? So we try to tell teams the architecture, whether it's a reversing
369420	373380	challenge, a pwnable challenge, a little bit of information about it. Primarily because we want
373380	377800	them to send their best person. Different teammates will have different skills. And so in fact,
377800	381620	for example, one of the the organizers came up and said, well, you've listed us for a challenge that
381620	387220	says Linux Pwn, but is it Linux Kernel or Linux Userland? Right. Because they're like, it's a
387220	391740	different guy we send for each one of those. And so we do try to, you know, try to give them a
391740	395180	little information. And for this particular challenge, which by the way, anyone can see.
395180	406520	If you go to the challenge.com, we have the full bracket there. You can see it. But if you
406520	412580	actually go to the raw challenge page as well, there's details for every one of those matches.
412580	416880	And so it not only links to the streams where you can see it. So again, these are just the two of
416880	421420	the players we've got. And we've also got Hypeboy and TWN playing at the same time on the same
421420	426680	challenge. And it's entirely possible that the fastest solve actually comes on one of those feeds.
426780	432200	So, right. And I want to switch over here to Hackeroni because they are writing a part of
432200	436300	their exploit script here, which I think is really cool. So they are writing this in Python
437040	442640	using Pwn tools. And you can see that at the top of their script there, you can see that they had
442640	447860	written out a couple of functions. So they have small like, you could always call them like
448400	453560	macros, helper functions with short names that you can quickly just, you know, plug in there.
454060	460740	They are, you can see that they're building up a kind of payload here where they're using the
460740	466000	cyclic function in Pwn tools, which is a very handy tool where, let's say you have some kind
466000	470680	of overflow and you gain control of some value that you're in, like, for example, the return
470680	476380	address or some register or so on. But you're unsure exactly which part of your payload ends up
476380	483100	in that location. You can use this cyclic function to generate a pattern, send it,
483100	487740	look in the debugger, and then immediately deduce... Those four bytes or eight bytes are
487740	493240	exactly a unique offset into that buffer. Right. So there's like DeBruin sequence generators,
493240	498280	the other, you know, name for you. Somebody else will hear that. Exactly. So the, instead of trying
498280	502680	to like calculate this by looking at the various offsets and like figuring out how much of the
502680	508480	stack will be popped and so on, you just like dump this in, look in the debugger, and then you
508480	512620	like calculate backwards to get the index. This was not a common technique when I started, so I
512620	516680	remember putting just a bunch of A's and then B's and trying to like binary search it, just trying
516680	521640	to figure out where it was. And this is like the sophisticated version of that. It's also much,
521640	531500	much faster too, which is good for a live CTF. Yeah. So this leads me to believe that they
531500	536680	have kind of found the vulnerability, but you know, they're now kind of exploring it
536680	544060	to see exactly how and what they control, which is like good progress there.
544180	548220	We have seen people too, though, in the past, sometimes they start their PwnScript immediately,
548220	551840	even as they're just exploring the service and interacting with it, or they want to use it to
551840	556680	generate things in a debugger just to kind of see what the behavior is. But yeah, usually you would
556680	562460	think that they've got the exploit there. They may or may not. We are seeing in PigButtSAD,
562460	565620	they've now also switched over a little bit to debugger, which went back to...
565620	568340	Right. Let's go over to their screen. There we go. Yeah.
568680	573140	Yeah. Some exploit here also using Python with PwnTools, also some helper functions.
573140	576320	The same helper, like the same... Yeah. Maybe, I wonder if there's like,
576320	579640	you know, now they're slightly different, but it's, you know, similar contents.
579640	584200	Very, very similar. Yeah. So also running some debugger.
585560	592560	Yeah. I did not see quite what they were sending in. I think maybe they're just also exploring...
592560	596580	Oh, there was a breakpoint on OXDeadBeef. So I don't know if it's... Okay. They're just coming
596580	599840	out right now. That was like leftover maybe. Yeah. Maybe just setting up their environment.
599840	603980	I was like, they already have control of EIP. No, no, no. I think it's, you know,
604380	607740	they're just setting up the GDB scripting and then making sure that, you know,
607740	613880	they have their stuff in order. So, I mean, this is a very nice... PwnTools has a lot of
613880	618760	nice features like this, where you can start your program, attach a debugger, run the GDB script,
618760	625400	for example, set up some breakpoints, like all of these things to help you do this iterative process
625400	631620	of developing the exploit. So minimize the number of manual commands you have to type in each time
631620	634520	you test your exploits. So I don't think... Did the teams...
636420	641240	We gave them the binary name, correct, when they downloaded this? Or did we just call it
641240	647980	something generic? No, they do get... So the archive that they download is called PushPop
647980	657840	Automaton, which is the name of this challenge. And, yeah, it's a stack-based virtual machine,
658820	665020	which has a... I bet it has a push and a pop. Yeah, yeah, yeah. Very few operations,
665020	669160	including a push and a pop. So you can, like, grow and shrink this stack structure,
670140	677100	which, you know, if one would just take a guess at what the vulnerability could be,
677100	683200	you know, maybe this pushing and popping, it does not properly respect the bounds of this.
683200	686740	What? A CTF challenge that doesn't have bounds checking? That's shocking.
686740	689000	Shocking, yeah. So we can see here some...
691180	696540	On the Macaroni's side, they're looking in the debugger. We see that they're dumping some memory,
696540	705140	trying to figure out exactly what, you know, what things are in the memory at a certain
705140	712060	point in time. I'm not sure what this point in time is. But, yeah, it's
714380	719040	hard to tell exactly how far their progress is right now. Like, the exploit script was still
719040	724720	pretty bare bones. Now, is this one that you playtested? I know that this was a challenge
724720	729360	Glenn wrote. Yep. But this is one you've solved before, so you've at least got a solution.
729360	733720	Although, as is the case for us in a lot of our challenges, we don't know if we'll see the same
733720	741260	solution. Right. There may very well be multiple ways to solve it. Yep. I did solve it. It was
741260	746680	probably one of the first ones I did in our whole development process. So it was a couple of weeks
746680	759280	ago. But it is, I mean, so it is pretty straightforward. But you also have the added,
759280	767900	you know, stress of this format, the live CTF format with, you know, it's this one-on-one,
767900	772500	you have no help from your teammates. Oh, and yeah, the time pressure alone, just knowing that
772500	777760	there's one person you're racing and that the first to solve it is like, you know, the victor
777760	783740	with all the points. It's stressful. It really is. Yeah. And we are, I mean, we are running a
783740	789220	double elimination this year, right? So, you know, you're not out immediately, but it's still like,
789220	794840	you know, this is one of your two chances, right? And so let's talk about the points and the scoring
794840	800200	and how this kind of factors into the overall DEF CON CTF, right? So that we are in the middle of
800200	806900	DEF CON here in Las Vegas. And there's 12 teams here at the final event. Each of the 12 teams
806900	813220	sends an individual for a round of live CTF. And those individuals don't have to be the same. So
813220	818320	if they play multiple rounds, they could actually choose to send a different person. That's again,
818320	823200	also why we tell them the category. Yeah. So they know who they can send. I want to just bring
823200	828080	attention here to PigBetSav. You can see that there were a bunch of memory leaking out there
828080	833540	on their screen that we have up. You can see here the memory dump in PwnTool. So they're doing some
833540	843000	kind of leak here. This is a good step. Yeah, that would be step one of this exploit. Almost
843000	847000	certainly would be some kind of leak. Any modern binary, you've got to have a leak kind of built
847000	857780	into it. So if I remember correctly, basically you use the pop feature to read memory. You go
857780	862640	further than you were supposed to. And then you use the push feature to modify those things.
864320	869560	And so that gives you both a read and a write primitive on the stack. Yeah. And then there are
869640	873060	a couple of things you need to keep in mind, because since you're going like backwards and
873060	879140	forwards, you need to keep track of the order, because you're writing things in the opposite
879140	885980	order of what you were reading. So there are details to keep in mind there. And that's the
886360	890000	hardest when there's the time pressure. It's the kind of thing where if you were casually doing it,
890000	895360	you wouldn't even be fine. But when you're in a hurry, it's easy to miss that. And then off by
895360	902100	one things, like the push thing, does it write first and then increment the pointer? Is the
902100	909520	pointer pointing to the current empty slots or the top of the stack? And you can easily get an
909520	914400	off by one issue there. I think both teams did exactly the right thing, though, because debugging
914400	918560	will help you answer a lot of those questions, right? You want to have your script. There are
918560	922280	people that I know who can one-shot this, and they just muddle it in their head, and then they solve
922280	926440	it, and they write it, and they're done. And they're fun to watch. But certainly, I would be using a
926440	930660	debugger as well. Yeah. I want to go over to Macaroni again and bring attention here. You can
930660	936920	see that they're writing this leak equals, and then they are... So they've already got a leak,
936920	941840	and now we're going to... So they're just... And then using the debug printing here to validate,
941840	948400	yeah, you can see that they printed out an address. What does it look like? Code address,
948400	954900	though. I'm not sure what they're trying to leak. It seems like it's off. Like the 55 is usually
955760	960040	like a good... Oh, that one, though, looks like... There we go. You can see this 7F thing. Yeah.
960040	966460	Looks very much like a library address, right? Yeah, library. Yeah. Well, I bet they're going to
966460	973900	see what they do. And they're checking... Yeah. So they're copying the leak over,
973900	979140	or they were copying the leak over. Let's see. They have a leak. Copy it. Are they going to
979140	987600	check in like via map or... So they're checking this is in... Yeah. So they got the... Okay. Yeah.
987600	995440	So there was an in the offset, and you can see they use this feature in GDB to take this address.
995440	1001580	This is an absolute address, but the GDB plugins convert this into an offset within the library.
1001580	1005340	So now they can then bring this back into their exploit script, and you can see that they
1005340	1010040	subtract this offset from the leak to get the base address of libc, bring this back into the
1010040	1014300	script, and now they can easily calculate any addresses within libc that they are...
1014300	1017960	They'll look for one gadget or whatever other function pointers they want to call.
1017960	1023440	Although this is complete overkill for this challenge because you have a win function,
1023440	1027560	but... Oh, I don't know if we saw anyone look at the win function there.
1027560	1032080	So I saw that the function list was open, and there's... You can see... Oh, yeah. You saw it
1032080	1035060	there very briefly. Yeah. Yeah. Yeah. And especially because we gave them the symbols,
1035060	1037780	right? Because they've got the symbols for function names. But this is so easy to miss
1037780	1047700	because like, okay, this is maybe not a super common thing to have in modern challenges.
1047700	1052480	We've kind of evolved past that in the CTF community, in the CTF challenges.
1052480	1059660	But again, since we want this to be very fast, very... Well, compared to a lot of
1059660	1066200	pwnable challenges, easy to solve. I'm not saying it's easy. It's easier. And that's why we put this
1066200	1069680	in. Don't feel bad. It's certainly... I wouldn't be able to solve this in an hour or as fast as
1069680	1074480	these teams were. So don't feel bad if you're doing this and thinking, wow, you call this
1074480	1078440	easy, but it took me, you know, like several hours. Like this is just relatively speaking
1078440	1083020	to sort of the state of the art in pwnable challenges now. So yeah, it is a little more
1083020	1088300	unusual. And you know, I would have expected to see... Although actually they would need a leak
1088300	1093540	to the program itself, right? Right. Right. Right. Right. So, I mean, this is a different
1093540	1097160	approach. Maybe it's, you know... It may have been the first pointer they grabbed was a libc and
1097160	1100820	good enough. They can get system out of that. Right. So I want to bring back attention here
1100820	1108100	now to PigBetSAD. You can see a little bit more of their exploit script there. You have some...
1110340	1117320	They are... Okay. They're reading until they can see these specific bytes. So they're also
1117320	1123200	looking at some leak here. You can see some memory dump. I'm trying to like orient myself
1123200	1128180	here at what they're doing. It is interesting that they're building their GDB into their same
1128180	1132280	script as well. As opposed to we saw earlier in Hackeroni had a separate session that they were
1132280	1140940	debugging it with. Yeah. So, yeah. Are they getting back a pointer? Are they... Here we can see... I
1140940	1145260	mean, there's a bunch of memory being dumped out. Yeah. They looked like environment variables.
1145260	1148880	Yeah. Environment from stack. Yeah. Yep. Absolutely. Right. Right. Right on the stack
1148880	1157700	prior to your... Right. Your main. I... Actually, let's leave them there for a moment and go back
1157700	1165800	to Macaroni because I think there's some pretty good stuff coming up here. I saw that... You can
1165800	1172260	see that they're trying to put together a ROP chain. Let me see. This is... You know, it's a
1172260	1176980	little bit difficult to follow now because they're jumping very quickly back and forth between the
1176980	1182340	export script and the debugger. You know, they're making small changes, trying it and doing like
1182340	1187240	very quick iterations. You can see them like fiddling with like some offsets here and there.
1187240	1194180	This is exactly what I'm talking about. These things are... Very fiddly. Yeah. Yeah. And can be
1194180	1199380	so frustrating because like you feel like you should have this, like I know what's going on
1199380	1205840	and that something is like not adding up. Like you forget some detail. Extremely frustrating.
1205840	1209920	Yeah. It looks like they're actually changing... They had a libc leak clearly earlier, but now
1209920	1215000	they've gone back and they're changing it again. Did they... Did they... The environment... Did
1215000	1218420	something change or what? I'm wondering what they're doing that's causing them to undo the
1218420	1224000	progress they felt like they've made earlier. And I'll keep an eye out. I don't see Pigbuttsad
1224000	1229360	having successfully gotten... Oh, they do think they have a leak now. Let's see. They're...
1229360	1233800	Yeah. Well, let's switch over to them and look at that. I think they might have... Yeah. So it
1233800	1238580	looks like they're dumping... Oh, so we've now dumped some... Right. And there they're also
1238580	1244340	calculating. You can see they didn't use as fancy features there, but you can see that they're
1244340	1250500	calculating an offset by subtracting those two absolute addresses there in the exploit script,
1250500	1257920	those 7F addresses. Yeah. This will give them... So you see they take the values in the specific
1257920	1263960	instance, take the difference, get the offset, and then use that to calculate the base there.
1263960	1267600	Slightly longer version of the same thing that we saw in Macaroni... Yeah.
1268100	1279540	That we just copy and paste. Yeah. It's... Right. So, yeah, they're back in the disassembler.
1280180	1285160	You know, I think this is interesting because we had quite a, you know, a period here of them,
1285160	1288840	like, mostly looking at the exploit script and the debugger. Yeah. And now they're coming back
1288840	1293780	into the disassembler, maybe double checking some... Maybe they were just looking at the size
1293780	1302520	of this buffer or the stack thing. Yeah. It looks like their structure offset they were using
1302520	1310300	to determine... Oh, we had, by the way, a solve on our other stream. Oh, my God. Check out our
1310300	1317720	other stream. Congratulations to Hypeboi. Yeah. So, really great job. Hyperboi win... They win
1317720	1323560	their first live CTF match here. So, as I said, we are running two matches in parallel. We are
1323560	1327680	casting one of them, but then there's another match going on in the background. And that
1327680	1335100	match just finished with Hyperboi... Hypeboi. Hypeboi. Hypeboi winning against... Which team
1335100	1341460	was the other one? Hypeboi was playing in this match... TWN48. Right. So, TWN48 against Hypeboi
1341460	1346380	and Hypeboi did win that match. I can't wait to go watch the VOD on that one because that was a
1346380	1353160	blazing fast. I'm just knowing, like, the progress that they must have, like, quickly know what to do
1353160	1359520	and then landed that. Really cool. Good for them. Really cool to see. But we are still going strong
1359520	1365360	here in this match. A little bit of a sigh of relief as an organizer for your full solve coming
1365360	1368560	through because, I mean, you know it's solvable, you're pretty sure, but just to see somebody do
1368560	1373940	it... Yeah. That's a good feeling. And, oh, my God, the issues we've had today. Today was cursed.
1373940	1380500	Everything that conceivably could break, broke and a few more things. Yeah, so we had
1380500	1384860	multiple hardware failures on laptops. So the machine that we're streaming to you on now
1384860	1388380	died. The machine that's running the game infrastructure died. Yeah. We're on, like,
1388380	1393140	secondary machines for all of that. We had our mixer board, as we came on the stream just at
1393140	1396680	the very beginning. Right. Isn't connecting for some reason on the new machine we swapped out.
1396680	1402020	So we switched audio inputs. It's been... Yeah. It's been a lot of craziness, but... Right. So,
1402580	1409660	high five for our first... Yeah, really, really nice to see. And, yeah, I mean, we will also be
1409660	1413620	talking a bit more throughout these days. We will be talking a little bit about, you know,
1413620	1418280	the production, the behind the scenes and stuff. But, you know, we will come back to that. We can
1418280	1422420	talk a little bit more about... So now we want to get back on schedule and get things going. Right.
1422420	1430940	So let's check out Macaroni again. You can see here, it feels like they're trying to...
1430940	1435960	Looks like some indices and values. They're trying to figure out some kind of offset,
1436340	1442040	maybe. You could see there was a big list of various offsets, and I guess it was the
1442040	1446000	corresponding value or something. And I think they're trying to, again, fiddle around a little
1446000	1455720	bit with the exact offsets of these exploits. Yeah. I don't feel either team is necessarily
1455720	1459340	stuck, but I also don't feel like they're confidently going to the next step yet,
1459340	1465940	either. They're still, I think, tweaking and trying to figure out. But it's like,
1465940	1471140	you know, you can see here, like you have the ROP chain with the system call with the shell,
1471140	1476820	like they have pieces there and now they're just trying to debug their exploit script and trying
1476820	1482120	to find, like, where is this not doing what they think it should do? It actually reminds me of the
1482120	1487400	first match we had last year in the finals, which you can go watch on YouTube or on livectf.com,
1488680	1491680	because it was the same thing that you're tweaking and fiddling with. And then the
1491680	1496480	team we weren't watching snuck in and actually solved it just off screen. Because it's hard to
1496480	1501700	know, like if for one of them to suddenly figure it out exactly, it could go down in just a few
1501700	1510180	seconds. But I do still see a lot over here on Pigbuttsad. Oops, wrong one. If we bring up
1511060	1516980	Pigbuttsad, that one there. We can go ahead. They really haven't, they just, yeah, they hop
1516980	1520000	back down to Vita, but they've been here for a lot. They're really still looking at their offsets.
1520000	1523760	I think this, to me, still feels like in their head, they're still working out what they want
1523760	1529080	to do. They don't have exactly the sizes figured out. They don't have a goal necessarily figured
1529080	1535600	out. Because I don't, I think if you understand what the virtual machine is doing at this point,
1535600	1539440	there shouldn't be a whole lot you would need to look at. Even things like offsets, for example,
1539440	1544000	dynamically just pulling that out of your running session seems like it might have been a little
1544000	1554420	easier. And they are, yeah, they're looking at the interpreter code. I mean, this is a time where
1554420	1562440	you really wish you could, like, read the minds of the players. Yeah, yeah. Because, you know,
1563140	1568520	they are clearly staring at this code and, you know, there's something they're trying to, like,
1568520	1573620	wrap their head around. You're just not exactly sure what it is, right?
1575540	1581340	See if that macaroni has got more momentum now or if they're still stuck with their leak being a
1581340	1585780	little bit like, oh, okay, so that's the same offset value dump. So they're just dumping out
1585780	1590340	a bunch of stack values, essentially. Right. Trying to figure out... You can see that they're
1590340	1595640	looking at these, like, 7F value. They're probably interested in that one. Looking at the corresponding
1596060	1606120	offset. Yeah. You can see here the AAC offset copying this, I guess. And it looks like they
1606120	1610480	already had that there. So it's like, yeah, maybe they wonder, like, why is this not doing the
1610480	1614040	thing? And, you know, are they going the wrong direction, like, up or down? You gotta remember,
1614040	1619100	like, which stack goes one way, but the bytes go the other way. And that can be tricky. Right.
1621060	1625560	And then... This challenge definitely gives you all the tools, though,
1625560	1629460	that you need to solve it. It's just a matter of, like, wiring them up the right way.
1632420	1640120	So, yeah, it didn't even send in eight bytes on that unpack. Right. Adding an interactive call,
1640120	1645240	which is a nice feature in PwnTools, where, like, you can do some automation and then, like,
1645240	1649820	take over with manual... Which works really well on a service like this, where it's the sort of
1649820	1653940	text-based interactive thing. Right. And so maybe they want to just try to, like,
1653940	1662240	leak a few more things or change what they're doing on the fly. Yeah. And so I'm trying to,
1662240	1667260	like, read, you know, the different things. Basically, it seems like, basically, you know,
1667260	1673800	they are using the payload to leak an address, use this address to calculate the base address.
1673800	1680480	From this, they can construct a ROP chain, and then they are inserting this ROP chain.
1680780	1685180	I do think we're coming up on first hint time as well. So we should...
1685180	1688400	Right. We should talk about... Why don't you talk about how that process works.
1688400	1696720	Right. So... So they did get the hint. Do they know to check the page? Why don't we go on over
1696720	1700540	there and remind them about the hint schedule? So... I don't think we told them the hint schedule,
1700540	1710000	so someone should go tell them. Right. So the way we do this is after 20 minutes of game time,
1710000	1714320	we release a hint. On the same web page they downloaded the challenge on. Right. And then
1714320	1723500	after another 15 minutes, we release a second hint, which I... Honestly, for this challenge,
1723500	1726700	I don't think the hints... I'm not sure if it's going to help them. Yeah. Yeah. I don't think
1726700	1730200	it's... it's helpful because I think they've already figured that part out. Right. I think
1730200	1736960	they're now just fiddling around with, like, the offsets and, yeah, those parts. Yeah, I agree. I
1736960	1741320	think we've seen that in the past, some of the challenges. Did we lose? No, we're still going.
1741440	1745720	I've seen in the past in some challenges, the hints aren't really going to help you. You understand
1745720	1749220	you've got all the right tools in the tool shop, but you're still having trouble building the chair.
1749220	1753500	You've still got to, like, kind of put it together. So... Right. And here's interesting. We can see
1753500	1760240	adding a, like, a red sled to their ROP chain. So, if you're familiar with, like, old school
1760240	1766060	shell coding, you know, you sometimes could add, like, a NOP sled to, like, you know, if you didn't
1766060	1770220	know exactly where your code was located, you would jump into this kind of long sequence of
1770220	1774140	NOP instructions that would, like, then slide you all the way... No matter where you hit, they would
1774140	1777940	all hit NOP and you would go to the very very end. Right. Yeah. Instead of trying to find the exact
1777940	1782980	offset. And a red sled is, like, kind of the equivalent thing, but for a ROP chain, where
1782980	1787460	if you don't know exactly how your ROP chain is going to offset on the stack, you just have a
1787460	1791840	sequence of RET instructions that just progresses the ROP chain further without making any state
1791840	1796880	changes. Or specifically a pointer to a return instruction from something you know at a fixed
1796880	1801180	location. Yeah. And all those pointers in a row, so that no matter where you hit in a return,
1801180	1804840	you'll just keep returning until you get to your next gadget that you want. Yep.
1805640	1813980	Let's go back to PigBetSAD. We can see that they are... feels like they're still messing around
1813980	1820560	with, like, the initial payload. Kind of this program that you are submitting to the
1823180	1828800	automaton, to the VM. Maybe they're, you know, trying around a little bit with
1829420	1835620	how long the various sequences of push and pop instructions need to be for this to all
1836640	1844880	work the way they have, you know, they expect it. Now I do see, let's talk, there's U, O, and H.
1844920	1850540	We saw those, and they've even labeled the O as output. So presumably this is going to be,
1850540	1855180	these are like text instructions that we're sending into the virtual machine, and that's
1855180	1862260	going to be what does our pushing or popping? Yeah, so each, you send a sequence of commands,
1862260	1868640	each of them is like one character, and then followed potentially by some input or outputs
1868640	1875680	that you get back. So we can actually see... Ah, there we go, they just refreshed for the hints.
1877020	1880960	Yeah, and they saw the hint. It was too quick, it was keep popping something something. Right,
1880960	1888380	keep popping beyond the bounds or something, which as I said, they figured that out a long time ago.
1890400	1896080	So yeah, you know, not very helpful in this case, which is like, you know, good and bad,
1896080	1900620	because it means that, you know, they have had some progress, and they have another
1902720	1908000	25-30 minutes, basically. Total time, I think, yeah, we have still another...
1908000	1912140	Right, well, until the sudden death, we have to actually, we have to go back and look at
1912140	1918180	and turn over the exact start time. So yeah, somebody wrote that down. So yes, we definitely
1918180	1922040	got started late, and the being late was definitely our fault and not theirs. They were all here on
1922040	1926880	time. That was just us, as you heard or saw us getting our, fixing our microphones and fixing
1927360	1931960	all sorts of fun stuff. It was a mess, but we are here. It's working, so far it's working,
1931960	1935840	and we already got one solved, and hopefully we'll see another one soon. Yep, yep, and
1938000	1944340	yeah, big but sad, still messing around with, like, the payload structure here. The, you know,
1944340	1950640	they're padding out there with these O instructions to a fixed size payload. Oh,
1950640	1955600	I saw something interesting there. I want to go back to Macaroni. They were doing some more
1956820	1964940	leaking there, I think. I saw some sequence of bytes popping out. Could have been interesting.
1967080	1972980	Like, they, let's see, they go back here to this, to the, yeah, you know, they changed the
1974180	1981220	size of the, you know, the code that they're sending, or the the length of these. The total,
1981220	1986400	total payload. Yeah, and then, oh, this seems like they kind of, you know, they've subtracted
1986400	1993700	eight in one place, and maybe they're compensating down here as well. I don't know exactly what these
1993700	2000420	various offsets are, but it's, it's so weird, because we saw that libc leak real early on,
2001120	2006200	and then I feel like we have kind of gotten stalled. We haven't really made it anything
2006200	2017460	past that. So, yeah, it's, I'm really, you know, like, rooting for these teams to
2017460	2021120	succeed with these things. I know how, like, frustrating it can be
2022060	2026560	when you are, you know, trying to solve one of these challenges. And when we were testing this,
2026560	2030780	we don't have the time pressure, too, right? So, like, we definitely had it easier that we could,
2030780	2034820	yeah, put it down and walk away, think, get some fresh ideas, come back later, and think, oh,
2034820	2038180	I bet I was messing up that, you know, go sleep on it, or whatever. Yeah, I was, like, you know,
2038180	2042080	I was solving the challenge on one screen, and, like, watching some Twitch stream on the other
2042080	2047320	screen, and, I mean, obviously that, you know, I didn't solve it in 45 minutes then. Yeah, for
2047320	2052980	sure. Or even the 25 or whatever, the 20 minute one. Oh, no, no, no. From Hypeboy, that was great.
2052980	2062560	Really, really impressive work there. So, yeah. I think the kind of benchmark we had throughout
2062560	2068600	the development process was that, like, if we can solve it within, like, two hours in, like,
2068740	2073600	a relaxed setting, then... Because, one, these players are all better than us. Yes. And every
2073600	2076900	one of them are better than every one of us, I think, is probably fairly safe to say. Yeah.
2076900	2080440	And then, two, again, we weren't kind of in a hurry, we were taking our time,
2080440	2085220	and then not feeling rushed. Although, it works conversely, too. The opposite also works. The
2085220	2091160	fact that we were not time pressured sometimes means that you had less stress in doing it, so.
2091580	2102560	Yeah. I'm going to switch over again here to PigButSad, and... It does crack me up every
2102560	2107960	time I see a bunch of, like, uuuh... How do you pronounce that exactly?
2110940	2117540	Yeah. They're, again, like, messing with the various sizes of the parts of the payloads.
2119000	2126000	Yeah, look, and you can see there, that's the address of the... when they call the
2126000	2130920	interpreter, so it's setting a breakpoint when going into the interpreter to, you know,
2131840	2141200	investigate exactly what's going on there. Yeah, it's still... I mean, if I were to,
2141200	2146180	you know, bet at this point, I'm a little bit with Macaroni.
2146180	2150640	Yeah. Yeah, I mean, it certainly had progress early on. I don't think we've yet to see
2151460	2155820	a successful, like, libc leak out of PigButSad, unfortunately, yet.
2155820	2156380	Yeah.
2156480	2158720	Although, it could have happened, we just missed it, too. That happens a lot,
2158720	2160480	as well. It's hard to track everything.
2162820	2166640	But with, you know, the nature of these challenges is that, you know, if one team
2166640	2174200	gets stuck, the other one can definitely catch up and, you know, cruise through and steal the win.
2174200	2175400	So, you know...
2175400	2177220	It is still anyone's game, for sure.
2177220	2177720	Yeah, yeah, yeah, for sure.
2177720	2180200	Just getting progress here from either one.
2182340	2187160	Yeah, and this definitely lends itself to, I feel like, a more dynamic approach,
2187160	2191560	this type of challenge, where you've got this primitives that you can just poke at and see
2191560	2197940	what they do, see what you get on the stack, and just try a write and then go look at the
2197940	2199060	stack after you've done your write.
2199960	2205400	So, I remember, I think, what I did was, like, you know, I read the code and got, like,
2205560	2209080	a rough sense of it. Like, you get that rough... the size of the buffer is, like,
2209080	2214800	hex 800 or something. So, I started out with that as, like, a base thing, did something,
2214800	2220180	then looked in the debugger, and then made adjustments. It's very similar to what I feel
2220180	2226480	like the players are doing here. But, yeah, it's gonna be...
2226480	2229940	So, that was interesting. We saw that, like, I mean, times 100 makes sense if we're pushing
2229940	2235940	or popping eight bytes at a time, right? If it's an eight byte stack. But we had three
2235940	2243500	use in a row times 100. So, I'm not sure if that was just, you know, do more just to...
2245280	2249320	Yeah, I'm not sure about that. Like, three seems like a bit of an odd number.
2249780	2250960	Three times hex 100.
2250960	2258460	Yeah, like, if it was two or four, maybe. But, yeah, I don't know about that one.
2263250	2263730	It's...
2264830	2269910	You can tell the teams are a little bit ready for live CTF, though. We saw them come in with,
2269910	2275050	like, this starter shell scripts with their alias macros or whatever. We've got
2276230	2283030	two people very familiar with PwnTools and with even the interactor. Now, is the interactive
2283030	2285090	prompt, is that Jeff or...
2285810	2286990	No, that's PwnTools.
2286990	2288750	PwnTools has its own kind of interactive...
2288750	2289390	Yeah, yeah, yeah.
2289390	2291850	...GDB session that has all the same kind of...
2291850	2294370	Oh, no, no, no. The interactive is just, you know...
2294370	2297090	Well, no, no. So, I know the PwnTools interactive, but on the right side, for example,
2297090	2301170	on Macaroni now, they're looking at the debugging session, right?
2301170	2304330	Right. So, here you can see that they're running PwnDebug,
2306130	2312270	which adds all of these, like, nice colorings and extra plugins and stuff to GDB. So, I think
2312270	2321350	there are, I would say, currently two big GDB kind of add-ons for exploit development. PwnDebug
2321350	2327610	being one of them, and then Jeff, G-E-F, being the other one, both, you know, with their pros
2327610	2334090	and cons and popular within the CTF community. So, they have a bunch of modules adding these,
2334090	2339190	like, trying to interpret addresses. You can see these, like, various pointers with different
2339190	2344350	colors, like, whether it's in the text segment or, you know, the stack and so on.
2344350	2348950	Yeah, it definitely is easier to read when you can see those highlights, as well as even just
2348950	2353730	seeing the register from the stack, as opposed to the default GDB interface, which is empty.
2353790	2357570	Now, you will see these, like, stack printouts, where it will also, like,
2357570	2362370	dereference the pointer. Like, it will say, like, this is a pointer to, you know, the heap,
2362370	2369430	and it's pointing to this value, and things like this. And it can even do that, like,
2369430	2373730	multiple times. Like, this is a pointer to the heap, pointing to another pointer to the heap,
2373730	2380210	and so on, which can be very helpful in these situations when you're playing.
2380210	2384250	So, I've been watching a thing about SAD, and it looks like they've changed their league. So,
2384250	2391490	now they're trying to offset in... they've changed that hard-coded hex 100 to a hex 80,
2392570	2398930	and they're using 80 U's, then, to look at it. Okay, so now we've got a whole bunch of...
2400250	2405750	is that 5.7 or 7.5 on the stack? Oh, these are probably ASCII U's. So,
2405750	2411570	I've probably seen their own payload on the stack, I think. So, if you look at whatever
2411570	2417870	hex 75 is... yeah, lowercase u. So, you can see it right there. So, that is indeed
2419270	2427310	them reaching their own buffer. And there are definitely, like, the sort of, like, finding your
2427310	2433650	own buffer in, you know, in the memories is oftentimes a component of an exploit, right?
2433650	2438390	We've got to, like... maybe you want to remove an old pointer from your thing so it can go further,
2438390	2442750	or you want to write some... maybe you want to write bytes into your buffer that weren't
2442750	2446390	writable in the original input, but you could do it with a virtual machine, or maybe you wanted
2446390	2449390	to write some other metadata around your buffer. You know, there's a lot of things you could do by
2449390	2455170	sort of, you know, finding that data. I think we're so used to, like, Git code execution.
2455270	2459950	Right. But ultimately, the goal is, like, you know, there could be other steps along the way.
2460410	2465390	And I want to switch back over to Macaroni here. We can see if they do it again, because I saw
2465730	2469270	one thing they did, like, down there. You can see the ROP chain, and they have also, like,
2469270	2473670	some A's appended to the ROP chain. And I saw that they were looking for that in the debugger.
2473670	2478210	They pre-appended it as well with some A's, and ran it in the debugger, and they showed up. Let's
2478210	2484970	see if this happens again, or if they, you know, were done with that particular step of their
2485510	2490850	analysis. But I think it can be a pretty nice educational moment. You can see here,
2490850	2494430	they're changing around the offset again. I think they maybe got something out from
2494430	2497550	the thing that I just described, where they pre-appended it, they saw, like,
2497550	2501770	the offset, and now they're making adjustments. So let's see here if we can see this.
2503790	2509210	Okay, they quit out immediately. Okay, they forgot they had this dumper section, right?
2510090	2515150	And they, you know, they, you know, have... this can also be, like, you know, a thing where you
2515150	2519690	you start messing around with your exploit script. You put in various scaffolding,
2519690	2524050	and then you remove it, or you forget to remove it. Yeah, you get worse off before you realize
2524050	2528370	you've actually left something in. You've got to go back and, yeah, fix up. I definitely did that
2528370	2532030	several times when playtesting my challenge.
2535980	2544020	Well, so again, adjusting... I think we're actually past second hint time as well,
2544020	2548280	although, again, I don't know if... I don't think there's anything we can tell them that they don't
2548280	2553500	know about the binary in terms of how it works. It's really just a question of who's going to
2553500	2560600	actually get the mechanics, iron out all the kinks, and I would be much more worried if we
2560600	2565800	hadn't seen one solve already. But we do know, like, yeah, getting that one solve in is reassuring
2565800	2572860	as an author. It is doable. We know it got done, but let's see if we end up needing a sudden
2572860	2577160	death challenge for this one or not. So I think they're going back to remind the team, so we might
2577160	2581600	see them pull up that hit page again. They're going to let them know that, hey, that you have
2581600	2589660	gone past that 35-minute timer. Yeah, and I mean, I really want to see the teams succeed. Oh, we all
2589660	2599080	do, yeah. And we also would prefer to not have to use one of our sudden death challenges. Let's say
2599080	2604980	we have not prepared the challenges enough for sudden deaths for every match. No, no, but we also
2604980	2609860	have done horribly wrong if we have to use it. Oh, I just saw a very interesting thing. You can
2609860	2614160	see they're changing their thing here. They're changing the whole thing. They found the win
2614160	2622700	function, and they were getting rid of the libc stuff. They were leaking the program base.
2622700	2627940	They're changing it, and now let's see if they actually manage to do it. I think PigButt said
2627940	2633000	it's going to be very sad if they just missed the win function, and that's the difference here.
2633000	2638600	Yeah, let's see here. They are still having some kind of... oh, right, they
2639740	2648800	forgot to rename the variable in one place. Is that a shell? No, it's a breakpoint in the GDB,
2648800	2656100	so we'll see here. It could be so close, but they're having... it's the stress that causes
2656100	2669760	tiny mistakes, and it's frustrating, but it feels like I can almost see the stress in the way the
2669760	2676280	cursor moves. It's regenerating. Yeah, and they're thinking in their head, my opponent's seconds
2676280	2681540	ahead of me. Right, and especially once you find something that's... It makes it easier.
2681540	2687820	Really, it's like, oh no, I missed this. Obviously, the other team, they know about this.
2687820	2692820	And yet, every indication is they do not. You get to see PigButt sad, honing in on that.
2692820	2696300	But they don't know that. Ironically, given that they've spent the most time in IDA,
2696300	2699660	I think, looking at it, they were really looking around that main loop and around the
2700800	2707240	interpreter loop, so we haven't seen them. Yeah, you can see now they're just extending
2708380	2715840	like spamming the win function, adding ref instructions, just trying to get this to work.
2718260	2723760	Yeah, I feel... Oh, they have the shell. There's a shell. There's a shell for macaroni.
2723960	2728720	So now they need to connect to that. Oh, they're going to throw it remotely.
2729140	2731700	So now let's see if we have... This is looking like it.
2731700	2736760	Copy pasting the address. They're doing remote. They have a shell. They do.
2736760	2739160	Submitter. And then...
2739160	2742680	Yep, that's it. Congratulations to Macaroni.
2742680	2748040	Great job. Very nice. Very nice, Macaroni. Yeah, let's...
2749980	2754500	If I can pull up the right sheet. There we go.
2754500	2764120	So that was our first round of matches here at the live CPF from the DEF CON CPF finals.
2765840	2771720	And yeah, I think maybe we didn't mention this. So live CPF is part of the DEF CON CPF,
2771720	2776420	where you have 12 of the best CPF teams across the world playing in like a big attack-defense
2776420	2782880	competition against each other. And it's like a sub-event within this. They play this live CPF,
2782880	2789100	like a one-on-one competition, where the results from this will then give them points that feed
2789100	2794100	into the main event. So the total points they're going to get are going to range from about 1,337
2794660	2799980	the elite point range in the first place, all the way down to 500 points for the last place team.
2799980	2805020	So every team who participates gets points. That way nobody can skip out and not send somebody to
2805020	2809540	try to play. We wanted... I'm glad Nautilus Institute, who are the organizers of the main
2809540	2814860	CTF, encouraged teams to participate by... there is a participation award for even doing this.
2814860	2820120	Because it is brave. It is stressful to get up and be willing to let people talk about what
2820120	2824060	you're doing. So yeah, we're glad that they did that. We're going to go ahead and get set
2824060	2829140	up for the next match, which is going to be coming shortly. Yeah, because we are... since
2829140	2832980	we are a little bit behind the schedule, we will get this going as soon as possible. We'll go to...
2832980	2838300	we'll bring up some like intermission slides. And yeah, we will be right back.
2838500	2840840	Don't go anywhere. As soon as we get ready. Take care. See ya.