start	end	text
0	2300	I think it's live now.
6520	11120	Welcome back to the second round of live CTF.
11120	15900	I'm still here, Carl, ZD2, but I have replaced Jordan with Mark.
15900	16660	Hello.
16780	18400	Hi, I'm Mark Griffin.
18560	21580	I've been around the CTF community for a while,
21580	24280	big into vulnerabilities and secure software,
24280	27440	and I'm really into explaining bugs and visualizing bugs,
27440	28540	so I'm really excited for this.
28540	29900	Yeah, this is going to be awesome.
29900	33660	We are going to get straight into it,
33660	38200	so I'll just check with the production that we are ready to go,
38200	47420	and then we'll do a countdown of 5, 4, 3, 2, 1, go.
47420	52400	All right, so the teams are off to the races.
52400	55160	In this match, again, same thing as before,
55160	57120	we have two matches running in parallel.
57120	58840	We are casting one of them.
58980	62200	This match is Shellfish versus NorseCode,
62200	63880	and I'm really excited about this
63880	68400	because I was pretty much the person who founded NorseCode
68560	70220	a couple of years ago.
71060	76040	I guess you are a bit excited about this match as well.
76540	78020	Yeah, that's right.
78080	80500	This bug has a lot of history.
80500	82080	This is a really cool one to me
82080	84880	because this bug was found over 20 years ago.
84880	88360	This is a famous bug called the crack adder bug
88360	90260	found by Mark Dowd,
90260	93960	and originally this bug was found with manual auditing,
93960	95760	as in just looking through the source code
95760	98380	and seeing this bug, which is pretty incredible.
98520	102200	But what made it famous was several years later
102200	104420	it was popularized by Howard Blake,
104420	106580	who pointed it out as this is the kind of bug
106580	108880	that's difficult to solve automatically
108880	112040	with program analysis or symbolic execution techniques.
112040	116440	So today, these competitors, fast forward 10 years,
116440	118680	they have all of these techniques at their disposal.
118680	122120	So I'm interested to see if anybody tries to solve it
122120	124780	with anger or other symbolic execution tools.
124780	126740	Yep, it's going to be super cool to see.
126740	130380	Let's take a look at what the two players are doing.
130380	133760	If we can start by going to NorseCode here,
133760	136180	we can see a bit of an IDA window in the background,
136180	142560	but also diving straight into starting to write the exploit script.
142820	145740	Again, like in the last match we saw,
145740	149620	using Python with PwnTools, a very popular choice.
149680	153180	Oh yeah, it really helps to be able to get your script going real fast,
153180	155260	have everything in place, and then you're just filling in the blanks
155260	156380	once you find the bug.
157220	161500	Right. So we can see here that the player from NorseCode
162780	165500	is looking at this main...
166420	169220	there's kind of like a parsing function in here, right?
169260	170120	Yeah, exactly.
170200	175960	And they're going through the code, renaming variables.
176660	179680	You can see that there was a P, there was a C, there was a current.
181020	184760	Trying to figure out what's going on here, really.
185260	187880	And we see there like...
187880	193080	is that a conveniently placed address to the system function there as well?
193460	198360	Yeah, so this is definitely something that's designed to be solved quickly.
198480	201580	It's really getting at the heart of the head-to-head competition
201580	203680	and trying to solve these things quickly, I think,
203680	205600	is what makes this competition so exciting.
205600	206080	Yeah.
207660	211800	So I think we can then switch back over to...
211800	213780	well, not back, but switch to Shellfish for the first time
213780	215540	and just see what they're doing.
215760	220780	Also, using IDA, we are four out of four on IDA so far
220780	224020	as the reverse engineering platform of choice.
224020	225440	You can see them looking at...
227780	231700	looking at the same piece of code here.
232240	234920	Yeah, I think this is really interesting
234920	237860	because this is the part when they're starting to figure out
237860	242560	what are the key tokens or key characters that are driving the parsing
242560	244560	because they know that there's a bug.
244560	245940	This is a small target.
245940	250200	They know that there's probably a pretty easy bug
250200	252000	or at least something isn't right here.
252000	253980	And so watching this part is really exciting to me
253980	256840	because it's just a matter of time
256840	258540	until you see it happen in their head
258540	260720	when they figure out going from reading the code
260720	263860	to, oh, I see it, and then they'll start writing their overflow
263860	266020	or at least testing what they think is their theory.
266020	270960	Yeah, and it's a really interesting challenge.
270960	277460	I test solved this challenge internally within the LiveCTF group.
277760	283700	And I actually, just for fun, I decided to try to just run a fuzzer.
284020	286440	I'm not knowledgeable in fuzzing,
286440	288800	but I was like, I'm just going to try it for this.
288880	293800	And it did, in fact, find the crash pretty much immediately.
293800	298960	But I had such a hard time converting the fuzz,
298960	301320	like the crash example, into anything useful
301320	303440	that I could actually write and exploit out of.
303440	307220	So I had to kind of go back, start over,
307220	308980	and do a more manual approach
308980	312680	to actually be able to solve the challenge.
313080	315620	Yeah, and that's one of the things here.
315820	320160	So this same bug was featured in the DARPA Cyber Grand Challenge
321540	323740	2015-2016 timeframe,
323740	326840	and it was solved by the competitors in that match,
326840	330000	by automating competitors, but using fuzzing.
330780	333200	Fuzzers work really well against this target,
333200	335900	and so I don't see that either of the competitors were watching
335900	337400	or trying any fuzzing.
337500	339960	But as you said, sometimes fuzzing,
339960	341380	you still have to go through the effort
341380	343840	of cleaning up the crash that you get.
344080	345880	And in this particular case,
345880	347700	there's only so many characters,
347700	350520	and so if you have a really messy-looking crash,
350520	352580	it may not be obvious what the bug is.
353900	359240	And I want to switch over a bit to NorseCode's side again.
359400	361980	I saw that, you know, they started...
361980	364300	Yeah, you can see here they're running it in the debugger.
364340	366400	You know, classic, inputting a bunch of As
366400	368800	just to see what's going on.
369300	371720	Comparing this with the code and seeing what's going on.
371720	374780	You can see they're grabbing an offset there as well.
375540	377560	Yeah, adding, you know, some debugs.
377560	379520	We're probably going to set a breakpoint.
379520	380300	Yeah, exactly.
380300	384680	So, you know, they're kind of setting up their environment,
384680	386060	you know, wiring everything up
386060	390340	to do the further analysis for this.
390400	391780	Yeah, and it's really interesting for me.
391780	393280	One of the things I love to see,
393280	396460	especially in a competition like this,
396460	398000	is to see the tools that everybody uses
398000	399380	and the different strategies.
399380	401020	Pretty much everybody's going to use a debugger,
401020	404420	but it is really cool to see just top competitors like this
404420	405900	and what their different techniques are
405900	408840	about how they understand a program.
408840	411060	Right. And I was just about to say
411060	413280	that we have pretty much the exact same setup
413280	415160	for every player so far, but that's not true.
415160	417160	Because if we look here at Shellfish,
417160	422840	they're using Jeff as their GDP add-on framework,
422840	424280	which I mentioned in the previous match
424280	427920	that there are two big names here currently,
427920	429060	and it's PonyBug and Jeff.
429060	432220	And we saw that the NorseCode player was using PonyBug
432220	434780	and the Shellfish player is using Jeff.
434800	435940	I'm a Jeff guy.
436080	437760	Yeah, me too, me too.
437760	445960	I started out with Peta, and then it stopped being maintained,
445960	447600	I think, or so. It got a bit outdated.
447600	449460	Someone came up with PonyBug,
449460	452620	and I think PonyBug grew kind of big and heavy.
452740	455100	And then someone came up with Jeff,
455100	458380	which is a bit more slimmed down,
458380	460040	but in my opinion contains everything
460040	462460	that I care about, really.
462460	462520	Yeah.
462520	463400	So, yeah.
463400	466400	Well, and one thing that I want to bring up on that note
466400	468920	is that some people, I mean,
468920	471880	the GDB experience out of the box is very, very vanilla,
471880	473620	but it's easy to sort of underestimate
473980	475820	how much of a difference it really makes
475820	479060	to have a clean display of your information.
479060	481380	So like the color coding, it's not an accident
481380	484020	that these color codings are, you know,
484020	486700	very similar across because it allows you
486700	489180	to build an intuition and see,
489180	492580	oh, hey, this pointer, this is a code pointer,
492680	494060	a stack pointer, a heap pointer,
494060	496080	or like this is where my input is.
496080	499300	Very powerful because then you're talking
499300	500920	about an experience where previously
500920	502880	if you're using GDB by itself,
502880	504060	you'd have to do a lot of commands
504060	505640	to get that same amount of information.
505640	506220	Oh, yeah, yeah.
506220	507980	And then like, yeah, just having this thing
507980	510180	like immediately output all of this thing
510180	511860	and like bringing in some like context
511860	513060	and a set of colors.
513060	515240	See, someone's already got an idea of what the bug is.
515240	515700	Right.
515700	517460	So if we look here, we see all of these
517460	519940	like various bracket pairs.
520960	525240	And this is definitely a key to the solution here.
526460	528980	It's, if I remember correctly,
528980	530420	there's like in a place,
530420	531820	there's basically a global variable
531820	533480	that's being incremented.
533660	535100	And then it should be like,
535100	537300	there should be a corresponding decrement
537300	539820	of the same variable, but that never happens.
539840	543880	So like a, basically a bound grows
543880	545480	and then you can kind of get outside
545480	547580	the intended memory region.
547800	550160	Is that basically, yeah.
550160	551040	That's exactly right.
551040	552860	I mean, this is, imagine, you know,
552860	554370	20 years ago, it was a different environment
554370	557030	for coding, but really what this came from
557030	561890	is this code had an inbound that was,
561890	564210	that left a little bit of room
564210	565270	at the end of the buffer.
565270	567510	And then they sort of said, okay, well, you know,
567510	568910	we'll increment that bound a little bit.
568910	570290	We've got a little extra space there,
570290	571570	but they didn't really expect
573130	574810	a specially designed malicious input
574810	577410	to push that down farther than the buffer itself.
577410	578010	Yeah.
578410	581410	Because it's, so in this case,
581410	585110	it's packaged as like a mail quoting thing.
585110	588090	Was that the original context as well?
588110	589490	Yeah, so crack adder.
589490	593010	It was an email parsing
594150	596030	because, you know, naturally,
596030	597290	everybody thinks about these things.
597290	599370	Well, email address, how complex could that be?
599370	601330	But, you know, parsing is difficult.
601330	602570	I think that's what we've learned.
602570	603670	Yep, yep, yep.
603810	604610	Truly.
604610	606170	And if we look here at Shellfish,
606170	608390	you can see there's some of their exploit code
608390	610630	just passed by.
610630	614110	Yeah, and there is a couple of different components
614110	614930	that are going on.
614930	616750	You have the pairs.
617070	618730	It looks like there's a little bit of a leak
618730	620890	going on there as well.
621970	624150	Right, they're leaking a base address
624150	626510	or they're trying to leak a base address there.
626570	629410	So there's definitely progress on that side.
629410	630170	Oh, yeah.
630250	635890	Let's switch over to Norse code and check.
637210	639310	A lot of action in this room.
639310	641810	He's really happy over there.
641810	644810	So we are here at the DEF CON,
644810	647590	like in the CTF room on the DEF CON floor.
647890	649790	So, you know, if you're here and during the weekend
649790	653170	you want to stop by and, you know, say hello,
653170	655250	you know, please come here.
655250	656270	We have stickers.
656270	658290	We do have stickers.
659290	664590	And, yeah, that also means there can be some noises
664590	666550	from other people here,
666550	668230	enthusiastic players of the CTF.
669310	672050	But anyway, we can see here some analysis going on
672050	674810	in Aida trying to figure out all these quotation.
674810	678510	You can see these variables like quotation, round quote.
678810	682150	There's this flag being toggled on and off.
682510	684830	And you can see that, you know, the player here
684830	687850	is like trying to, you know, look what's going on.
687850	689870	I think he's got an idea looking at it
689870	690650	about what it's supposed to be.
690650	692790	I definitely saw his cursor, you know, jumping back
692790	694350	and forth between the key things.
694350	696590	And didn't you say that there was a particular pattern
696590	697930	you saw when you were...
697930	701150	Right, so when I solved this, because the parser
701150	702790	has like two quote types.
702790	704690	I think it's like, you know, the regular parenthesis
704690	706530	and then it's like angle brackets.
706530	707570	Yeah, angle brackets.
707730	711250	And my intuition was like, well, these two
711250	713030	should behave the same.
713030	714270	Like, it doesn't really matter if you have
714810	716090	a parenthesis or an angle bracket.
716090	718750	So I kind of like compared them, like pair-wise
718750	720670	the piece of code, and I saw that there's like
720670	724410	in one of the arms of the switch statement
724810	727410	there was like a line that was missing.
727890	728630	Right.
728630	731690	Compared to the other corresponding piece of code.
731690	734490	And then I was like, okay, that has to be significant.
734490	736990	And I looked further into that and got, yeah,
736990	738410	to the solution.
738410	739330	So, I wonder.
739330	740770	But we can see here in the exploit,
741270	744110	he also has this, the parenthesis pair
744110	746030	as part of the payload there.
746150	748490	You know, sending a number of...
748490	750030	So you can see, like, he wants to send
750510	752450	hex C8 number of bytes.
752590	754730	And then, so he divides that by two,
754730	757770	but then sends a pair for that number.
757770	760930	So, definitely clearly on the way there.
760930	762930	Yeah, making good progress.
762970	764970	And I don't have the timer right in front of me,
764970	767530	but this is moving quickly.
767530	769750	I mean, there's really only so many steps here
770210	774290	because it is a smaller target for speed purposes.
774410	776830	The original was actually quite a large function
776830	778910	and this is much more streamlined.
779410	780290	Right.
780290	782790	But, so, I think the steps that they're trying to do
782790	785270	is discover the bug, leak an address,
785270	790450	which they'll want, and then use that for ROP.
790450	793290	Or, I think that this one has
793550	795790	a pretty friendly mitigation scenario.
795790	797590	I think that most of the protections are off.
797590	798430	Right.
798570	800170	Which definitely would have been the case
800170	801150	many years ago.
801150	801690	Yeah.
802090	803990	What mitigations?
803990	804910	Yeah, exactly.
804910	807810	That didn't exist back then.
807810	807950	Yeah.
807950	809830	But we can see here from Shellfish,
809830	811530	they're also, you know,
811530	812850	fiddling around with this payload,
812850	816150	looking at how many brackets to send.
817150	820230	Yeah, we can definitely see that he's leaked the...
820730	821930	Oh, the base address.
821930	822970	The address of the...
822970	824130	Very nice.
824370	826190	...the binary itself.
827870	830190	I think you may have leaked the stack pointer
830190	832210	when you solved it.
832210	833070	Yeah, I'm trying to remember
833070	834910	because I know that we had a slight...
834910	836830	So, you had your reference solution.
836830	837190	That's right.
837190	838350	And I had a solution.
838350	839350	And they were, like,
839890	842070	the overall idea was the same,
842070	844530	but there was one step that differed a bit.
844710	845870	The check sec there,
845870	846890	I think that that's the key.
846890	848890	And you can see there's no canary,
848890	850090	NX is disabled,
850090	851090	RWX segments,
851090	853370	that means that they can execute code on the stack.
853370	853750	Right.
853750	858370	And that's very important to look out for
858370	861230	because I think I mentioned this in the previous match.
861230	865850	Nowadays, having challenges with, like,
865850	868330	NX disabled is not super common.
868330	869890	So, it's easy, you know,
869890	872690	if you're a CDF player,
872690	875070	it's easy to kind of forget about stats
875070	878110	and, like, start to get into more complicated things
878110	880870	when, like, all you had to do was to, like,
880870	883010	put your shellcode on the stack and execute it.
883010	883710	Right, right.
883710	887290	Well, you know, it rewards paying close attention.
887490	889450	But also, I mean, sometimes I feel like
889450	891630	the exciting part is finding the bug.
891630	892530	For me, anyway.
892610	893890	I love finding the bug
893890	895150	and then going through all the steps
895150	897370	to actually exploit the bug
898310	899990	can be a little tedious
899990	901650	because sometimes there's, you know,
901650	903490	it's a lot of doing the same thing
903490	905950	or maybe there's, like, little gotchas
905950	908870	that trip you up, but you know you have it.
909410	909770	Yeah.
909770	911470	No, it's...
912950	913570	Yeah.
913570	916510	So, especially in these, like, stressful situations
916990	918030	with, like, the one-on-one.
918030	919010	Like, the players...
919010	920030	So, you don't see it here,
920030	921050	but, like, the players are literally...
921050	922630	They're sitting behind this wall.
922850	924470	They're sitting opposite each other,
924470	925610	like, at the same table.
925610	927110	I see some shellcode going down here.
927110	928590	Oh, oh, oh, okay.
928590	929990	So, yeah, we should, you know,
929990	932650	keep our attention here on the shellfish.
933090	935390	Let's, you know, quickly switch over to Norse code
935390	937790	while keeping a little bit of attention on the shellfish.
937790	939710	But we can see that, like, you know,
939710	942190	there is stuff going on here as well with the brackets,
942190	944770	but I don't see kind of, like, shellcode and stuff yet.
944770	945790	So, I would...
945790	947250	If I were to take a guess,
947250	949590	like, I would say the shellfish is, like,
949590	951550	slightly ahead here.
951790	953770	I'm switching back until I'm here.
953770	956490	And, yeah, is that a...
956490	957170	Oh, there was...
957170	959330	Oh, I see the ID command going down.
959330	960050	Yeah, okay.
960050	963770	So, they believe that they should have a shell,
963770	967230	but it doesn't seem to work quite yet.
967290	968850	Oh, they're, like, single-stepping.
968850	970150	Yeah, and I got to say,
970150	971870	I don't know if everybody can appreciate it.
971870	973810	Oh, but they were single-stepping through the shellcode, right?
973810	974750	Yes, that's what it looks like.
974750	975350	Right.
975390	977650	So, they were just checking, like, why...
977650	978870	See that?
979190	981710	Using host lib thread, executing new program.
981710	982610	Oh, they do have the shell.
982610	983290	They do have the shell.
983290	984070	Okay, okay.
984070	984550	Oh, my God.
984550	987610	So, Shellfish is, I'm pretty sure, going to...
987610	988230	Yep, they're switching over to the remote.
988230	990890	They're switching over to the remote, copy-pasting the server.
991150	991610	That's good.
991610	996170	So, you know, we're going to have Shellfish as the winners of this match.
996830	1000390	Remember, there is a second match going on in the background,
1000390	1002850	which we don't have the results of yet.
1002850	1003950	But it is streaming.
1003950	1005910	If you haven't seen it, there's...
1005910	1006410	Right.
1006410	1008710	There's another link on the live CTF YouTube...
1009210	1009390	Right.
1009390	1011710	...that you should be able to watch both of the other two competitors.
1011710	1012130	Right.
1012130	1018050	There is no commentary going on there, just the perspectives of the players.
1018310	1023310	If you want a more zen approach to this event, which is completely valid.
1023310	1024750	Okay, they're running.
1025510	1026030	And...
1026030	1027990	Yes, there it is.
1028070	1028650	Well done.
1028650	1029970	Great job, Shellfish.
1029970	1030390	Well done.
1030550	1031370	Congratulations.
1031370	1032950	Really nice work.
1033510	1040430	So, what's going to happen now is that let me just switch back to this view.
1040430	1044510	And, as I said, we have another match going on in the background.
1044510	1047310	You can switch to the other stream to see that thing going on.
1047990	1051650	I think we're not going to really continue here.
1051650	1056830	We're going to go to an intermission and come back with the next set of matches.
1056830	1060790	So, what's going to happen, the second match needs to finish.
1060790	1066370	We need to do some setup and then we'll be back with a new round of matches.
1066570	1068610	I will be replaced.
1068610	1071230	You will stay on for the next one.
1071870	1075290	Yeah, really nice to commentate with you.
1075290	1077610	This was a fairly quick one, I would say.
1077610	1079090	Yeah, but I had a lot of fun.
1079090	1080290	Yeah, it was great.
1080430	1083770	I also hope all of you had fun with this.
1084350	1087290	And, yeah, we will be back in a bit.