[00:00.000 --> 00:02.300]  I think it's live now.
[00:06.520 --> 00:11.120]  Welcome back to the second round of live CTF.
[00:11.120 --> 00:15.900]  I'm still here, Carl, ZD2, but I have replaced Jordan with Mark.
[00:15.900 --> 00:16.660]  Hello.
[00:16.780 --> 00:18.400]  Hi, I'm Mark Griffin.
[00:18.560 --> 00:21.580]  I've been around the CTF community for a while,
[00:21.580 --> 00:24.280]  big into vulnerabilities and secure software,
[00:24.280 --> 00:27.440]  and I'm really into explaining bugs and visualizing bugs,
[00:27.440 --> 00:28.540]  so I'm really excited for this.
[00:28.540 --> 00:29.900]  Yeah, this is going to be awesome.
[00:29.900 --> 00:33.660]  We are going to get straight into it,
[00:33.660 --> 00:38.200]  so I'll just check with the production that we are ready to go,
[00:38.200 --> 00:47.420]  and then we'll do a countdown of 5, 4, 3, 2, 1, go.
[00:47.420 --> 00:52.400]  All right, so the teams are off to the races.
[00:52.400 --> 00:55.160]  In this match, again, same thing as before,
[00:55.160 --> 00:57.120]  we have two matches running in parallel.
[00:57.120 --> 00:58.840]  We are casting one of them.
[00:58.980 --> 01:02.200]  This match is Shellfish versus NorseCode,
[01:02.200 --> 01:03.880]  and I'm really excited about this
[01:03.880 --> 01:08.400]  because I was pretty much the person who founded NorseCode
[01:08.560 --> 01:10.220]  a couple of years ago.
[01:11.060 --> 01:16.040]  I guess you are a bit excited about this match as well.
[01:16.540 --> 01:18.020]  Yeah, that's right.
[01:18.080 --> 01:20.500]  This bug has a lot of history.
[01:20.500 --> 01:22.080]  This is a really cool one to me
[01:22.080 --> 01:24.880]  because this bug was found over 20 years ago.
[01:24.880 --> 01:28.360]  This is a famous bug called the crack adder bug
[01:28.360 --> 01:30.260]  found by Mark Dowd,
[01:30.260 --> 01:33.960]  and originally this bug was found with manual auditing,
[01:33.960 --> 01:35.760]  as in just looking through the source code
[01:35.760 --> 01:38.380]  and seeing this bug, which is pretty incredible.
[01:38.520 --> 01:42.200]  But what made it famous was several years later
[01:42.200 --> 01:44.420]  it was popularized by Howard Blake,
[01:44.420 --> 01:46.580]  who pointed it out as this is the kind of bug
[01:46.580 --> 01:48.880]  that's difficult to solve automatically
[01:48.880 --> 01:52.040]  with program analysis or symbolic execution techniques.
[01:52.040 --> 01:56.440]  So today, these competitors, fast forward 10 years,
[01:56.440 --> 01:58.680]  they have all of these techniques at their disposal.
[01:58.680 --> 02:02.120]  So I'm interested to see if anybody tries to solve it
[02:02.120 --> 02:04.780]  with anger or other symbolic execution tools.
[02:04.780 --> 02:06.740]  Yep, it's going to be super cool to see.
[02:06.740 --> 02:10.380]  Let's take a look at what the two players are doing.
[02:10.380 --> 02:13.760]  If we can start by going to NorseCode here,
[02:13.760 --> 02:16.180]  we can see a bit of an IDA window in the background,
[02:16.180 --> 02:22.560]  but also diving straight into starting to write the exploit script.
[02:22.820 --> 02:25.740]  Again, like in the last match we saw,
[02:25.740 --> 02:29.620]  using Python with PwnTools, a very popular choice.
[02:29.680 --> 02:33.180]  Oh yeah, it really helps to be able to get your script going real fast,
[02:33.180 --> 02:35.260]  have everything in place, and then you're just filling in the blanks
[02:35.260 --> 02:36.380]  once you find the bug.
[02:37.220 --> 02:41.500]  Right. So we can see here that the player from NorseCode
[02:42.780 --> 02:45.500]  is looking at this main...
[02:46.420 --> 02:49.220]  there's kind of like a parsing function in here, right?
[02:49.260 --> 02:50.120]  Yeah, exactly.
[02:50.200 --> 02:55.960]  And they're going through the code, renaming variables.
[02:56.660 --> 02:59.680]  You can see that there was a P, there was a C, there was a current.
[03:01.020 --> 03:04.760]  Trying to figure out what's going on here, really.
[03:05.260 --> 03:07.880]  And we see there like...
[03:07.880 --> 03:13.080]  is that a conveniently placed address to the system function there as well?
[03:13.460 --> 03:18.360]  Yeah, so this is definitely something that's designed to be solved quickly.
[03:18.480 --> 03:21.580]  It's really getting at the heart of the head-to-head competition
[03:21.580 --> 03:23.680]  and trying to solve these things quickly, I think,
[03:23.680 --> 03:25.600]  is what makes this competition so exciting.
[03:25.600 --> 03:26.080]  Yeah.
[03:27.660 --> 03:31.800]  So I think we can then switch back over to...
[03:31.800 --> 03:33.780]  well, not back, but switch to Shellfish for the first time
[03:33.780 --> 03:35.540]  and just see what they're doing.
[03:35.760 --> 03:40.780]  Also, using IDA, we are four out of four on IDA so far
[03:40.780 --> 03:44.020]  as the reverse engineering platform of choice.
[03:44.020 --> 03:45.440]  You can see them looking at...
[03:47.780 --> 03:51.700]  looking at the same piece of code here.
[03:52.240 --> 03:54.920]  Yeah, I think this is really interesting
[03:54.920 --> 03:57.860]  because this is the part when they're starting to figure out
[03:57.860 --> 04:02.560]  what are the key tokens or key characters that are driving the parsing
[04:02.560 --> 04:04.560]  because they know that there's a bug.
[04:04.560 --> 04:05.940]  This is a small target.
[04:05.940 --> 04:10.200]  They know that there's probably a pretty easy bug
[04:10.200 --> 04:12.000]  or at least something isn't right here.
[04:12.000 --> 04:13.980]  And so watching this part is really exciting to me
[04:13.980 --> 04:16.840]  because it's just a matter of time
[04:16.840 --> 04:18.540]  until you see it happen in their head
[04:18.540 --> 04:20.720]  when they figure out going from reading the code
[04:20.720 --> 04:23.860]  to, oh, I see it, and then they'll start writing their overflow
[04:23.860 --> 04:26.020]  or at least testing what they think is their theory.
[04:26.020 --> 04:30.960]  Yeah, and it's a really interesting challenge.
[04:30.960 --> 04:37.460]  I test solved this challenge internally within the LiveCTF group.
[04:37.760 --> 04:43.700]  And I actually, just for fun, I decided to try to just run a fuzzer.
[04:44.020 --> 04:46.440]  I'm not knowledgeable in fuzzing,
[04:46.440 --> 04:48.800]  but I was like, I'm just going to try it for this.
[04:48.880 --> 04:53.800]  And it did, in fact, find the crash pretty much immediately.
[04:53.800 --> 04:58.960]  But I had such a hard time converting the fuzz,
[04:58.960 --> 05:01.320]  like the crash example, into anything useful
[05:01.320 --> 05:03.440]  that I could actually write and exploit out of.
[05:03.440 --> 05:07.220]  So I had to kind of go back, start over,
[05:07.220 --> 05:08.980]  and do a more manual approach
[05:08.980 --> 05:12.680]  to actually be able to solve the challenge.
[05:13.080 --> 05:15.620]  Yeah, and that's one of the things here.
[05:15.820 --> 05:20.160]  So this same bug was featured in the DARPA Cyber Grand Challenge
[05:21.540 --> 05:23.740]  2015-2016 timeframe,
[05:23.740 --> 05:26.840]  and it was solved by the competitors in that match,
[05:26.840 --> 05:30.000]  by automating competitors, but using fuzzing.
[05:30.780 --> 05:33.200]  Fuzzers work really well against this target,
[05:33.200 --> 05:35.900]  and so I don't see that either of the competitors were watching
[05:35.900 --> 05:37.400]  or trying any fuzzing.
[05:37.500 --> 05:39.960]  But as you said, sometimes fuzzing,
[05:39.960 --> 05:41.380]  you still have to go through the effort
[05:41.380 --> 05:43.840]  of cleaning up the crash that you get.
[05:44.080 --> 05:45.880]  And in this particular case,
[05:45.880 --> 05:47.700]  there's only so many characters,
[05:47.700 --> 05:50.520]  and so if you have a really messy-looking crash,
[05:50.520 --> 05:52.580]  it may not be obvious what the bug is.
[05:53.900 --> 05:59.240]  And I want to switch over a bit to NorseCode's side again.
[05:59.400 --> 06:01.980]  I saw that, you know, they started...
[06:01.980 --> 06:04.300]  Yeah, you can see here they're running it in the debugger.
[06:04.340 --> 06:06.400]  You know, classic, inputting a bunch of As
[06:06.400 --> 06:08.800]  just to see what's going on.
[06:09.300 --> 06:11.720]  Comparing this with the code and seeing what's going on.
[06:11.720 --> 06:14.780]  You can see they're grabbing an offset there as well.
[06:15.540 --> 06:17.560]  Yeah, adding, you know, some debugs.
[06:17.560 --> 06:19.520]  We're probably going to set a breakpoint.
[06:19.520 --> 06:20.300]  Yeah, exactly.
[06:20.300 --> 06:24.680]  So, you know, they're kind of setting up their environment,
[06:24.680 --> 06:26.060]  you know, wiring everything up
[06:26.060 --> 06:30.340]  to do the further analysis for this.
[06:30.400 --> 06:31.780]  Yeah, and it's really interesting for me.
[06:31.780 --> 06:33.280]  One of the things I love to see,
[06:33.280 --> 06:36.460]  especially in a competition like this,
[06:36.460 --> 06:38.000]  is to see the tools that everybody uses
[06:38.000 --> 06:39.380]  and the different strategies.
[06:39.380 --> 06:41.020]  Pretty much everybody's going to use a debugger,
[06:41.020 --> 06:44.420]  but it is really cool to see just top competitors like this
[06:44.420 --> 06:45.900]  and what their different techniques are
[06:45.900 --> 06:48.840]  about how they understand a program.
[06:48.840 --> 06:51.060]  Right. And I was just about to say
[06:51.060 --> 06:53.280]  that we have pretty much the exact same setup
[06:53.280 --> 06:55.160]  for every player so far, but that's not true.
[06:55.160 --> 06:57.160]  Because if we look here at Shellfish,
[06:57.160 --> 07:02.840]  they're using Jeff as their GDP add-on framework,
[07:02.840 --> 07:04.280]  which I mentioned in the previous match
[07:04.280 --> 07:07.920]  that there are two big names here currently,
[07:07.920 --> 07:09.060]  and it's PonyBug and Jeff.
[07:09.060 --> 07:12.220]  And we saw that the NorseCode player was using PonyBug
[07:12.220 --> 07:14.780]  and the Shellfish player is using Jeff.
[07:14.800 --> 07:15.940]  I'm a Jeff guy.
[07:16.080 --> 07:17.760]  Yeah, me too, me too.
[07:17.760 --> 07:25.960]  I started out with Peta, and then it stopped being maintained,
[07:25.960 --> 07:27.600]  I think, or so. It got a bit outdated.
[07:27.600 --> 07:29.460]  Someone came up with PonyBug,
[07:29.460 --> 07:32.620]  and I think PonyBug grew kind of big and heavy.
[07:32.740 --> 07:35.100]  And then someone came up with Jeff,
[07:35.100 --> 07:38.380]  which is a bit more slimmed down,
[07:38.380 --> 07:40.040]  but in my opinion contains everything
[07:40.040 --> 07:42.460]  that I care about, really.
[07:42.460 --> 07:42.520]  Yeah.
[07:42.520 --> 07:43.400]  So, yeah.
[07:43.400 --> 07:46.400]  Well, and one thing that I want to bring up on that note
[07:46.400 --> 07:48.920]  is that some people, I mean,
[07:48.920 --> 07:51.880]  the GDB experience out of the box is very, very vanilla,
[07:51.880 --> 07:53.620]  but it's easy to sort of underestimate
[07:53.980 --> 07:55.820]  how much of a difference it really makes
[07:55.820 --> 07:59.060]  to have a clean display of your information.
[07:59.060 --> 08:01.380]  So like the color coding, it's not an accident
[08:01.380 --> 08:04.020]  that these color codings are, you know,
[08:04.020 --> 08:06.700]  very similar across because it allows you
[08:06.700 --> 08:09.180]  to build an intuition and see,
[08:09.180 --> 08:12.580]  oh, hey, this pointer, this is a code pointer,
[08:12.680 --> 08:14.060]  a stack pointer, a heap pointer,
[08:14.060 --> 08:16.080]  or like this is where my input is.
[08:16.080 --> 08:19.300]  Very powerful because then you're talking
[08:19.300 --> 08:20.920]  about an experience where previously
[08:20.920 --> 08:22.880]  if you're using GDB by itself,
[08:22.880 --> 08:24.060]  you'd have to do a lot of commands
[08:24.060 --> 08:25.640]  to get that same amount of information.
[08:25.640 --> 08:26.220]  Oh, yeah, yeah.
[08:26.220 --> 08:27.980]  And then like, yeah, just having this thing
[08:27.980 --> 08:30.180]  like immediately output all of this thing
[08:30.180 --> 08:31.860]  and like bringing in some like context
[08:31.860 --> 08:33.060]  and a set of colors.
[08:33.060 --> 08:35.240]  See, someone's already got an idea of what the bug is.
[08:35.240 --> 08:35.700]  Right.
[08:35.700 --> 08:37.460]  So if we look here, we see all of these
[08:37.460 --> 08:39.940]  like various bracket pairs.
[08:40.960 --> 08:45.240]  And this is definitely a key to the solution here.
[08:46.460 --> 08:48.980]  It's, if I remember correctly,
[08:48.980 --> 08:50.420]  there's like in a place,
[08:50.420 --> 08:51.820]  there's basically a global variable
[08:51.820 --> 08:53.480]  that's being incremented.
[08:53.660 --> 08:55.100]  And then it should be like,
[08:55.100 --> 08:57.300]  there should be a corresponding decrement
[08:57.300 --> 08:59.820]  of the same variable, but that never happens.
[08:59.840 --> 09:03.880]  So like a, basically a bound grows
[09:03.880 --> 09:05.480]  and then you can kind of get outside
[09:05.480 --> 09:07.580]  the intended memory region.
[09:07.800 --> 09:10.160]  Is that basically, yeah.
[09:10.160 --> 09:11.040]  That's exactly right.
[09:11.040 --> 09:12.860]  I mean, this is, imagine, you know,
[09:12.860 --> 09:14.370]  20 years ago, it was a different environment
[09:14.370 --> 09:17.030]  for coding, but really what this came from
[09:17.030 --> 09:21.890]  is this code had an inbound that was,
[09:21.890 --> 09:24.210]  that left a little bit of room
[09:24.210 --> 09:25.270]  at the end of the buffer.
[09:25.270 --> 09:27.510]  And then they sort of said, okay, well, you know,
[09:27.510 --> 09:28.910]  we'll increment that bound a little bit.
[09:28.910 --> 09:30.290]  We've got a little extra space there,
[09:30.290 --> 09:31.570]  but they didn't really expect
[09:33.130 --> 09:34.810]  a specially designed malicious input
[09:34.810 --> 09:37.410]  to push that down farther than the buffer itself.
[09:37.410 --> 09:38.010]  Yeah.
[09:38.410 --> 09:41.410]  Because it's, so in this case,
[09:41.410 --> 09:45.110]  it's packaged as like a mail quoting thing.
[09:45.110 --> 09:48.090]  Was that the original context as well?
[09:48.110 --> 09:49.490]  Yeah, so crack adder.
[09:49.490 --> 09:53.010]  It was an email parsing
[09:54.150 --> 09:56.030]  because, you know, naturally,
[09:56.030 --> 09:57.290]  everybody thinks about these things.
[09:57.290 --> 09:59.370]  Well, email address, how complex could that be?
[09:59.370 --> 10:01.330]  But, you know, parsing is difficult.
[10:01.330 --> 10:02.570]  I think that's what we've learned.
[10:02.570 --> 10:03.670]  Yep, yep, yep.
[10:03.810 --> 10:04.610]  Truly.
[10:04.610 --> 10:06.170]  And if we look here at Shellfish,
[10:06.170 --> 10:08.390]  you can see there's some of their exploit code
[10:08.390 --> 10:10.630]  just passed by.
[10:10.630 --> 10:14.110]  Yeah, and there is a couple of different components
[10:14.110 --> 10:14.930]  that are going on.
[10:14.930 --> 10:16.750]  You have the pairs.
[10:17.070 --> 10:18.730]  It looks like there's a little bit of a leak
[10:18.730 --> 10:20.890]  going on there as well.
[10:21.970 --> 10:24.150]  Right, they're leaking a base address
[10:24.150 --> 10:26.510]  or they're trying to leak a base address there.
[10:26.570 --> 10:29.410]  So there's definitely progress on that side.
[10:29.410 --> 10:30.170]  Oh, yeah.
[10:30.250 --> 10:35.890]  Let's switch over to Norse code and check.
[10:37.210 --> 10:39.310]  A lot of action in this room.
[10:39.310 --> 10:41.810]  He's really happy over there.
[10:41.810 --> 10:44.810]  So we are here at the DEF CON,
[10:44.810 --> 10:47.590]  like in the CTF room on the DEF CON floor.
[10:47.890 --> 10:49.790]  So, you know, if you're here and during the weekend
[10:49.790 --> 10:53.170]  you want to stop by and, you know, say hello,
[10:53.170 --> 10:55.250]  you know, please come here.
[10:55.250 --> 10:56.270]  We have stickers.
[10:56.270 --> 10:58.290]  We do have stickers.
[10:59.290 --> 11:04.590]  And, yeah, that also means there can be some noises
[11:04.590 --> 11:06.550]  from other people here,
[11:06.550 --> 11:08.230]  enthusiastic players of the CTF.
[11:09.310 --> 11:12.050]  But anyway, we can see here some analysis going on
[11:12.050 --> 11:14.810]  in Aida trying to figure out all these quotation.
[11:14.810 --> 11:18.510]  You can see these variables like quotation, round quote.
[11:18.810 --> 11:22.150]  There's this flag being toggled on and off.
[11:22.510 --> 11:24.830]  And you can see that, you know, the player here
[11:24.830 --> 11:27.850]  is like trying to, you know, look what's going on.
[11:27.850 --> 11:29.870]  I think he's got an idea looking at it
[11:29.870 --> 11:30.650]  about what it's supposed to be.
[11:30.650 --> 11:32.790]  I definitely saw his cursor, you know, jumping back
[11:32.790 --> 11:34.350]  and forth between the key things.
[11:34.350 --> 11:36.590]  And didn't you say that there was a particular pattern
[11:36.590 --> 11:37.930]  you saw when you were...
[11:37.930 --> 11:41.150]  Right, so when I solved this, because the parser
[11:41.150 --> 11:42.790]  has like two quote types.
[11:42.790 --> 11:44.690]  I think it's like, you know, the regular parenthesis
[11:44.690 --> 11:46.530]  and then it's like angle brackets.
[11:46.530 --> 11:47.570]  Yeah, angle brackets.
[11:47.730 --> 11:51.250]  And my intuition was like, well, these two
[11:51.250 --> 11:53.030]  should behave the same.
[11:53.030 --> 11:54.270]  Like, it doesn't really matter if you have
[11:54.810 --> 11:56.090]  a parenthesis or an angle bracket.
[11:56.090 --> 11:58.750]  So I kind of like compared them, like pair-wise
[11:58.750 --> 12:00.670]  the piece of code, and I saw that there's like
[12:00.670 --> 12:04.410]  in one of the arms of the switch statement
[12:04.810 --> 12:07.410]  there was like a line that was missing.
[12:07.890 --> 12:08.630]  Right.
[12:08.630 --> 12:11.690]  Compared to the other corresponding piece of code.
[12:11.690 --> 12:14.490]  And then I was like, okay, that has to be significant.
[12:14.490 --> 12:16.990]  And I looked further into that and got, yeah,
[12:16.990 --> 12:18.410]  to the solution.
[12:18.410 --> 12:19.330]  So, I wonder.
[12:19.330 --> 12:20.770]  But we can see here in the exploit,
[12:21.270 --> 12:24.110]  he also has this, the parenthesis pair
[12:24.110 --> 12:26.030]  as part of the payload there.
[12:26.150 --> 12:28.490]  You know, sending a number of...
[12:28.490 --> 12:30.030]  So you can see, like, he wants to send
[12:30.510 --> 12:32.450]  hex C8 number of bytes.
[12:32.590 --> 12:34.730]  And then, so he divides that by two,
[12:34.730 --> 12:37.770]  but then sends a pair for that number.
[12:37.770 --> 12:40.930]  So, definitely clearly on the way there.
[12:40.930 --> 12:42.930]  Yeah, making good progress.
[12:42.970 --> 12:44.970]  And I don't have the timer right in front of me,
[12:44.970 --> 12:47.530]  but this is moving quickly.
[12:47.530 --> 12:49.750]  I mean, there's really only so many steps here
[12:50.210 --> 12:54.290]  because it is a smaller target for speed purposes.
[12:54.410 --> 12:56.830]  The original was actually quite a large function
[12:56.830 --> 12:58.910]  and this is much more streamlined.
[12:59.410 --> 13:00.290]  Right.
[13:00.290 --> 13:02.790]  But, so, I think the steps that they're trying to do
[13:02.790 --> 13:05.270]  is discover the bug, leak an address,
[13:05.270 --> 13:10.450]  which they'll want, and then use that for ROP.
[13:10.450 --> 13:13.290]  Or, I think that this one has
[13:13.550 --> 13:15.790]  a pretty friendly mitigation scenario.
[13:15.790 --> 13:17.590]  I think that most of the protections are off.
[13:17.590 --> 13:18.430]  Right.
[13:18.570 --> 13:20.170]  Which definitely would have been the case
[13:20.170 --> 13:21.150]  many years ago.
[13:21.150 --> 13:21.690]  Yeah.
[13:22.090 --> 13:23.990]  What mitigations?
[13:23.990 --> 13:24.910]  Yeah, exactly.
[13:24.910 --> 13:27.810]  That didn't exist back then.
[13:27.810 --> 13:27.950]  Yeah.
[13:27.950 --> 13:29.830]  But we can see here from Shellfish,
[13:29.830 --> 13:31.530]  they're also, you know,
[13:31.530 --> 13:32.850]  fiddling around with this payload,
[13:32.850 --> 13:36.150]  looking at how many brackets to send.
[13:37.150 --> 13:40.230]  Yeah, we can definitely see that he's leaked the...
[13:40.730 --> 13:41.930]  Oh, the base address.
[13:41.930 --> 13:42.970]  The address of the...
[13:42.970 --> 13:44.130]  Very nice.
[13:44.370 --> 13:46.190]  ...the binary itself.
[13:47.870 --> 13:50.190]  I think you may have leaked the stack pointer
[13:50.190 --> 13:52.210]  when you solved it.
[13:52.210 --> 13:53.070]  Yeah, I'm trying to remember
[13:53.070 --> 13:54.910]  because I know that we had a slight...
[13:54.910 --> 13:56.830]  So, you had your reference solution.
[13:56.830 --> 13:57.190]  That's right.
[13:57.190 --> 13:58.350]  And I had a solution.
[13:58.350 --> 13:59.350]  And they were, like,
[13:59.890 --> 14:02.070]  the overall idea was the same,
[14:02.070 --> 14:04.530]  but there was one step that differed a bit.
[14:04.710 --> 14:05.870]  The check sec there,
[14:05.870 --> 14:06.890]  I think that that's the key.
[14:06.890 --> 14:08.890]  And you can see there's no canary,
[14:08.890 --> 14:10.090]  NX is disabled,
[14:10.090 --> 14:11.090]  RWX segments,
[14:11.090 --> 14:13.370]  that means that they can execute code on the stack.
[14:13.370 --> 14:13.750]  Right.
[14:13.750 --> 14:18.370]  And that's very important to look out for
[14:18.370 --> 14:21.230]  because I think I mentioned this in the previous match.
[14:21.230 --> 14:25.850]  Nowadays, having challenges with, like,
[14:25.850 --> 14:28.330]  NX disabled is not super common.
[14:28.330 --> 14:29.890]  So, it's easy, you know,
[14:29.890 --> 14:32.690]  if you're a CDF player,
[14:32.690 --> 14:35.070]  it's easy to kind of forget about stats
[14:35.070 --> 14:38.110]  and, like, start to get into more complicated things
[14:38.110 --> 14:40.870]  when, like, all you had to do was to, like,
[14:40.870 --> 14:43.010]  put your shellcode on the stack and execute it.
[14:43.010 --> 14:43.710]  Right, right.
[14:43.710 --> 14:47.290]  Well, you know, it rewards paying close attention.
[14:47.490 --> 14:49.450]  But also, I mean, sometimes I feel like
[14:49.450 --> 14:51.630]  the exciting part is finding the bug.
[14:51.630 --> 14:52.530]  For me, anyway.
[14:52.610 --> 14:53.890]  I love finding the bug
[14:53.890 --> 14:55.150]  and then going through all the steps
[14:55.150 --> 14:57.370]  to actually exploit the bug
[14:58.310 --> 14:59.990]  can be a little tedious
[14:59.990 --> 15:01.650]  because sometimes there's, you know,
[15:01.650 --> 15:03.490]  it's a lot of doing the same thing
[15:03.490 --> 15:05.950]  or maybe there's, like, little gotchas
[15:05.950 --> 15:08.870]  that trip you up, but you know you have it.
[15:09.410 --> 15:09.770]  Yeah.
[15:09.770 --> 15:11.470]  No, it's...
[15:12.950 --> 15:13.570]  Yeah.
[15:13.570 --> 15:16.510]  So, especially in these, like, stressful situations
[15:16.990 --> 15:18.030]  with, like, the one-on-one.
[15:18.030 --> 15:19.010]  Like, the players...
[15:19.010 --> 15:20.030]  So, you don't see it here,
[15:20.030 --> 15:21.050]  but, like, the players are literally...
[15:21.050 --> 15:22.630]  They're sitting behind this wall.
[15:22.850 --> 15:24.470]  They're sitting opposite each other,
[15:24.470 --> 15:25.610]  like, at the same table.
[15:25.610 --> 15:27.110]  I see some shellcode going down here.
[15:27.110 --> 15:28.590]  Oh, oh, oh, okay.
[15:28.590 --> 15:29.990]  So, yeah, we should, you know,
[15:29.990 --> 15:32.650]  keep our attention here on the shellfish.
[15:33.090 --> 15:35.390]  Let's, you know, quickly switch over to Norse code
[15:35.390 --> 15:37.790]  while keeping a little bit of attention on the shellfish.
[15:37.790 --> 15:39.710]  But we can see that, like, you know,
[15:39.710 --> 15:42.190]  there is stuff going on here as well with the brackets,
[15:42.190 --> 15:44.770]  but I don't see kind of, like, shellcode and stuff yet.
[15:44.770 --> 15:45.790]  So, I would...
[15:45.790 --> 15:47.250]  If I were to take a guess,
[15:47.250 --> 15:49.590]  like, I would say the shellfish is, like,
[15:49.590 --> 15:51.550]  slightly ahead here.
[15:51.790 --> 15:53.770]  I'm switching back until I'm here.
[15:53.770 --> 15:56.490]  And, yeah, is that a...
[15:56.490 --> 15:57.170]  Oh, there was...
[15:57.170 --> 15:59.330]  Oh, I see the ID command going down.
[15:59.330 --> 16:00.050]  Yeah, okay.
[16:00.050 --> 16:03.770]  So, they believe that they should have a shell,
[16:03.770 --> 16:07.230]  but it doesn't seem to work quite yet.
[16:07.290 --> 16:08.850]  Oh, they're, like, single-stepping.
[16:08.850 --> 16:10.150]  Yeah, and I got to say,
[16:10.150 --> 16:11.870]  I don't know if everybody can appreciate it.
[16:11.870 --> 16:13.810]  Oh, but they were single-stepping through the shellcode, right?
[16:13.810 --> 16:14.750]  Yes, that's what it looks like.
[16:14.750 --> 16:15.350]  Right.
[16:15.390 --> 16:17.650]  So, they were just checking, like, why...
[16:17.650 --> 16:18.870]  See that?
[16:19.190 --> 16:21.710]  Using host lib thread, executing new program.
[16:21.710 --> 16:22.610]  Oh, they do have the shell.
[16:22.610 --> 16:23.290]  They do have the shell.
[16:23.290 --> 16:24.070]  Okay, okay.
[16:24.070 --> 16:24.550]  Oh, my God.
[16:24.550 --> 16:27.610]  So, Shellfish is, I'm pretty sure, going to...
[16:27.610 --> 16:28.230]  Yep, they're switching over to the remote.
[16:28.230 --> 16:30.890]  They're switching over to the remote, copy-pasting the server.
[16:31.150 --> 16:31.610]  That's good.
[16:31.610 --> 16:36.170]  So, you know, we're going to have Shellfish as the winners of this match.
[16:36.830 --> 16:40.390]  Remember, there is a second match going on in the background,
[16:40.390 --> 16:42.850]  which we don't have the results of yet.
[16:42.850 --> 16:43.950]  But it is streaming.
[16:43.950 --> 16:45.910]  If you haven't seen it, there's...
[16:45.910 --> 16:46.410]  Right.
[16:46.410 --> 16:48.710]  There's another link on the live CTF YouTube...
[16:49.210 --> 16:49.390]  Right.
[16:49.390 --> 16:51.710]  ...that you should be able to watch both of the other two competitors.
[16:51.710 --> 16:52.130]  Right.
[16:52.130 --> 16:58.050]  There is no commentary going on there, just the perspectives of the players.
[16:58.310 --> 17:03.310]  If you want a more zen approach to this event, which is completely valid.
[17:03.310 --> 17:04.750]  Okay, they're running.
[17:05.510 --> 17:06.030]  And...
[17:06.030 --> 17:07.990]  Yes, there it is.
[17:08.070 --> 17:08.650]  Well done.
[17:08.650 --> 17:09.970]  Great job, Shellfish.
[17:09.970 --> 17:10.390]  Well done.
[17:10.550 --> 17:11.370]  Congratulations.
[17:11.370 --> 17:12.950]  Really nice work.
[17:13.510 --> 17:20.430]  So, what's going to happen now is that let me just switch back to this view.
[17:20.430 --> 17:24.510]  And, as I said, we have another match going on in the background.
[17:24.510 --> 17:27.310]  You can switch to the other stream to see that thing going on.
[17:27.990 --> 17:31.650]  I think we're not going to really continue here.
[17:31.650 --> 17:36.830]  We're going to go to an intermission and come back with the next set of matches.
[17:36.830 --> 17:40.790]  So, what's going to happen, the second match needs to finish.
[17:40.790 --> 17:46.370]  We need to do some setup and then we'll be back with a new round of matches.
[17:46.570 --> 17:48.610]  I will be replaced.
[17:48.610 --> 17:51.230]  You will stay on for the next one.
[17:51.870 --> 17:55.290]  Yeah, really nice to commentate with you.
[17:55.290 --> 17:57.610]  This was a fairly quick one, I would say.
[17:57.610 --> 17:59.090]  Yeah, but I had a lot of fun.
[17:59.090 --> 18:00.290]  Yeah, it was great.
[18:00.430 --> 18:03.770]  I also hope all of you had fun with this.
[18:04.350 --> 18:07.290]  And, yeah, we will be back in a bit.