WEBVTT 00:00.000 --> 00:02.300 I think it's live now. 00:06.520 --> 00:11.120 Welcome back to the second round of live CTF. 00:11.120 --> 00:15.900 I'm still here, Carl, ZD2, but I have replaced Jordan with Mark. 00:15.900 --> 00:16.660 Hello. 00:16.780 --> 00:18.400 Hi, I'm Mark Griffin. 00:18.560 --> 00:28.540 I've been around the CTF community for a while, big into vulnerabilities and secure software, and I'm really into explaining bugs and visualizing bugs, so I'm really excited for this. 00:28.540 --> 00:29.900 Yeah, this is going to be awesome. 00:29.900 --> 00:47.420 We are going to get straight into it, so I'll just check with the production that we are ready to go, and then we'll do a countdown of 5, 4, 3, 2, 1, go. 00:47.420 --> 00:52.400 All right, so the teams are off to the races. 00:52.400 --> 00:57.120 In this match, again, same thing as before, we have two matches running in parallel. 00:57.120 --> 00:58.840 We are casting one of them. 00:58.980 --> 01:10.220 This match is Shellfish versus NorseCode, and I'm really excited about this because I was pretty much the person who founded NorseCode a couple of years ago. 01:11.060 --> 01:16.040 I guess you are a bit excited about this match as well. 01:16.540 --> 01:18.020 Yeah, that's right. 01:18.080 --> 01:20.500 This bug has a lot of history. 01:20.500 --> 01:24.880 This is a really cool one to me because this bug was found over 20 years ago. 01:24.880 --> 01:38.380 This is a famous bug called the crack adder bug found by Mark Dowd, and originally this bug was found with manual auditing, as in just looking through the source code and seeing this bug, which is pretty incredible. 01:38.520 --> 01:52.040 But what made it famous was several years later it was popularized by Howard Blake, who pointed it out as this is the kind of bug that's difficult to solve automatically with program analysis or symbolic execution techniques. 01:52.040 --> 01:58.680 So today, these competitors, fast forward 10 years, they have all of these techniques at their disposal. 01:58.680 --> 02:04.780 So I'm interested to see if anybody tries to solve it with anger or other symbolic execution tools. 02:04.780 --> 02:06.740 Yep, it's going to be super cool to see. 02:06.740 --> 02:10.380 Let's take a look at what the two players are doing. 02:10.380 --> 02:22.560 If we can start by going to NorseCode here, we can see a bit of an IDA window in the background, but also diving straight into starting to write the exploit script. 02:22.820 --> 02:29.620 Again, like in the last match we saw, using Python with PwnTools, a very popular choice. 02:29.680 --> 02:36.380 Oh yeah, it really helps to be able to get your script going real fast, have everything in place, and then you're just filling in the blanks once you find the bug. 02:37.220 --> 02:38.180 Right. 02:38.360 --> 02:45.500 So we can see here that the player from NorseCode is looking at this main... 02:46.420 --> 02:49.220 there's kind of like a parsing function in here, right? 02:49.260 --> 02:50.120 Yeah, exactly. 02:50.200 --> 02:55.960 And they're going through the code, renaming variables. 02:56.660 --> 02:59.680 You can see that there was a P, there was a C, there was a current. 03:01.020 --> 03:04.760 Trying to figure out what's going on here, really. 03:05.260 --> 03:07.880 And we see there like... 03:07.880 --> 03:13.080 is that a conveniently placed address to the system function there as well? 03:13.460 --> 03:18.360 Yeah, so this is definitely something that's designed to be solved quickly. 03:18.480 --> 03:25.600 It's really getting at the heart of the head-to-head competition and trying to solve these things quickly, I think, is what makes this competition so exciting. 03:25.600 --> 03:26.080 Yeah. 03:27.660 --> 03:31.800 So I think we can then switch back over to... 03:31.800 --> 03:35.540 well, not back, but switch to Shellfish for the first time and just see what they're doing. 03:35.760 --> 03:44.020 Also, using IDA, we are four out of four on IDA so far as the reverse engineering platform of choice. 03:44.020 --> 03:45.440 You can see them looking at... 03:47.780 --> 03:51.700 looking at the same piece of code here. 03:52.240 --> 04:04.560 Yeah, I think this is really interesting because this is the part when they're starting to figure out what are the key tokens or key characters that are driving the parsing because they know that there's a bug. 04:04.560 --> 04:05.940 This is a small target. 04:05.940 --> 04:12.000 They know that there's probably a pretty easy bug or at least something isn't right here. 04:12.000 --> 04:26.020 And so watching this part is really exciting to me because it's just a matter of time until you see it happen in their head when they figure out going from reading the code to, oh, I see it, and then they'll start writing their overflow or at least testing what they think is their theory. 04:26.020 --> 04:30.960 Yeah, and it's a really interesting challenge. 04:30.960 --> 04:37.460 I test solved this challenge internally within the LiveCTF group. 04:37.760 --> 04:43.700 And I actually, just for fun, I decided to try to just run a fuzzer. 04:44.020 --> 04:48.800 I'm not knowledgeable in fuzzing, but I was like, I'm just going to try it for this. 04:48.880 --> 04:53.800 And it did, in fact, find the crash pretty much immediately. 04:53.800 --> 05:03.440 But I had such a hard time converting the fuzz, like the crash example, into anything useful that I could actually write and exploit out of. 05:03.440 --> 05:12.680 So I had to kind of go back, start over, and do a more manual approach to actually be able to solve the challenge. 05:13.080 --> 05:15.620 Yeah, and that's one of the things here. 05:15.820 --> 05:30.000 So this same bug was featured in the DARPA Cyber Grand Challenge 2015-2016 timeframe, and it was solved by the competitors in that match, by automating competitors, but using fuzzing. 05:30.780 --> 05:37.400 Fuzzers work really well against this target, and so I don't see that either of the competitors were watching or trying any fuzzing. 05:37.500 --> 05:43.840 But as you said, sometimes fuzzing, you still have to go through the effort of cleaning up the crash that you get. 05:44.080 --> 05:52.580 And in this particular case, there's only so many characters, and so if you have a really messy-looking crash, it may not be obvious what the bug is. 05:53.900 --> 05:59.240 And I want to switch over a bit to NorseCode's side again. 05:59.400 --> 06:01.980 I saw that, you know, they started... 06:01.980 --> 06:04.300 Yeah, you can see here they're running it in the debugger. 06:04.340 --> 06:08.800 You know, classic, inputting a bunch of As just to see what's going on. 06:09.300 --> 06:11.720 Comparing this with the code and seeing what's going on. 06:11.720 --> 06:14.780 You can see they're grabbing an offset there as well. 06:15.540 --> 06:17.560 Yeah, adding, you know, some debugs. 06:17.560 --> 06:19.520 We're probably going to set a breakpoint. 06:19.520 --> 06:20.300 Yeah, exactly. 06:20.300 --> 06:30.340 So, you know, they're kind of setting up their environment, you know, wiring everything up to do the further analysis for this. 06:30.400 --> 06:31.780 Yeah, and it's really interesting for me. 06:31.780 --> 06:39.380 One of the things I love to see, especially in a competition like this, is to see the tools that everybody uses and the different strategies. 06:39.380 --> 06:48.840 Pretty much everybody's going to use a debugger, but it is really cool to see just top competitors like this and what their different techniques are about how they understand a program. 06:48.840 --> 06:49.380 Right. 06:49.380 --> 06:55.160 And I was just about to say that we have pretty much the exact same setup for every player so far, but that's not true. 06:55.160 --> 07:09.060 Because if we look here at Shellfish, they're using Jeff as their GDP add-on framework, which I mentioned in the previous match that there are two big names here currently, and it's PonyBug and Jeff. 07:09.060 --> 07:14.780 And we saw that the NorseCode player was using PonyBug and the Shellfish player is using Jeff. 07:14.800 --> 07:15.940 I'm a Jeff guy. 07:16.080 --> 07:17.760 Yeah, me too, me too. 07:17.760 --> 07:26.520 I started out with Peta, and then it stopped being maintained, I think, or so. 07:26.520 --> 07:27.600 It got a bit outdated. 07:27.600 --> 07:32.620 Someone came up with PonyBug, and I think PonyBug grew kind of big and heavy. 07:32.740 --> 07:42.460 And then someone came up with Jeff, which is a bit more slimmed down, but in my opinion contains everything that I care about, really. 07:42.460 --> 07:42.520 Yeah . 07:42.520 --> 07:43.400 So, yeah. 07:43.400 --> 07:59.060 Well, and one thing that I want to bring up on that note is that some people, I mean, the GDB experience out of the box is very, very vanilla, but it's easy to sort of underestimate how much of a difference it really makes to have a clean display of your information. 07:59.060 --> 08:16.080 So like the color coding, it's not an accident that these color codings are, you know, very similar across because it allows you to build an intuition and see, oh, hey, this pointer, this is a code pointer, a stack pointer, a heap pointer, or like this is where my input is. 08:16.080 --> 08:25.640 Very powerful because then you're talking about an experience where previously if you're using GDB by itself, you'd have to do a lot of commands to get that same amount of information. 08:25.640 --> 08:26.220 Oh , yeah, yeah. 08:26.220 --> 08:33.060 And then like, yeah, just having this thing like immediately output all of this thing and like bringing in some like context and a set of colors. 08:33.060 --> 08:35.240 See, someone's already got an idea of what the bug is. 08:35.240 --> 08:35.700 Right. 08:35.700 --> 08:39.940 So if we look here, we see all of these like various bracket pairs. 08:40.960 --> 08:45.240 And this is definitely a key to the solution here. 08:46.460 --> 08:53.480 It's, if I remember correctly, there's like in a place, there's basically a global variable that's being incremented. 08:53.660 --> 08:59.820 And then it should be like, there should be a corresponding decrement of the same variable, but that never happens. 08:59.840 --> 09:07.580 So like a, basically a bound grows and then you can kind of get outside the intended memory region. 09:07.800 --> 09:10.160 Is that basically, yeah. 09:10.160 --> 09:11.040 That's exactly right. 09:11.040 --> 09:25.270 I mean, this is, imagine, you know, 20 years ago, it was a different environment for coding, but really what this came from is this code had an inbound that was, that left a little bit of room at the end of the buffer. 09:25.270 --> 09:28.910 And then they sort of said, okay, well, you know, we'll increment that bound a little bit. 09:28.910 --> 09:37.410 We've got a little extra space there, but they didn't really expect a specially designed malicious input to push that down farther than the buffer itself. 09:37.410 --> 09:38.010 Yeah. 09:38.410 --> 09:45.110 Because it's, so in this case, it's packaged as like a mail quoting thing. 09:45.110 --> 09:48.090 Was that the original context as well? 09:48.110 --> 09:49.490 Yeah, so crack adder. 09:49.490 --> 09:57.290 It was an email parsing because, you know, naturally, everybody thinks about these things. 09:57.290 --> 09:59.370 Well, email address, how complex could that be? 09:59.370 --> 10:01.330 But , you know, parsing is difficult. 10:01.330 --> 10:02.570 I think that's what we've learned. 10:02.570 --> 10:03.670 Yep, yep, yep. 10:03.810 --> 10:04.610 Truly. 10:04.610 --> 10:10.630 And if we look here at Shellfish, you can see there's some of their exploit code just passed by. 10:10.630 --> 10:14.930 Yeah, and there is a couple of different components that are going on. 10:14.930 --> 10:16.750 You have the pairs. 10:17.070 --> 10:20.890 It looks like there's a little bit of a leak going on there as well. 10:21.970 --> 10:26.510 Right, they're leaking a base address or they're trying to leak a base address there. 10:26.570 --> 10:29.410 So there's definitely progress on that side. 10:29.410 --> 10:30.170 Oh, yeah. 10:30.250 --> 10:35.890 Let's switch over to Norse code and check. 10:37.210 --> 10:39.310 A lot of action in this room. 10:39.310 --> 10:41.810 He's really happy over there. 10:41.810 --> 10:47.590 So we are here at the DEF CON, like in the CTF room on the DEF CON floor. 10:47.890 --> 10:55.250 So, you know, if you're here and during the weekend you want to stop by and, you know, say hello, you know, please come here. 10:55.250 --> 10:56.270 We have stickers. 10:56.270 --> 10:58.290 We do have stickers. 10:59.290 --> 11:08.230 And, yeah, that also means there can be some noises from other people here, enthusiastic players of the CTF. 11:09.310 --> 11:14.810 But anyway, we can see here some analysis going on in Aida trying to figure out all these quotation. 11:14.810 --> 11:18.510 You can see these variables like quotation, round quote. 11:18.810 --> 11:22.150 There's this flag being toggled on and off. 11:22.510 --> 11:27.850 And you can see that, you know, the player here is like trying to, you know, look what's going on. 11:27.850 --> 11:30.650 I think he's got an idea looking at it about what it's supposed to be. 11:30.650 --> 11:34.350 I definitely saw his cursor, you know, jumping back and forth between the key things. 11:34.350 --> 11:37.930 And didn't you say that there was a particular pattern you saw when you were... 11:37.930 --> 11:42.790 Right, so when I solved this, because the parser has like two quote types. 11:42.790 --> 11:46.530 I think it's like, you know, the regular parenthesis and then it's like angle brackets. 11:46.530 --> 11:47.570 Yeah, angle brackets. 11:47.730 --> 11:53.030 And my intuition was like, well, these two should behave the same. 11:53.030 --> 11:56.090 Like, it doesn't really matter if you have a parenthesis or an angle bracket. 11:56.090 --> 12:07.410 So I kind of like compared them, like pair-wise the piece of code, and I saw that there's like in one of the arms of the switch statement there was like a line that was missing. 12:07.890 --> 12:08.630 Right. 12:08.630 --> 12:11.690 Compared to the other corresponding piece of code. 12:11.690 --> 12:14.490 And then I was like, okay, that has to be significant. 12:14.490 --> 12:18.410 And I looked further into that and got, yeah, to the solution. 12:18.410 --> 12:19.330 So , I wonder. 12:19.330 --> 12:26.030 But we can see here in the exploit, he also has this, the parenthesis pair as part of the payload there. 12:26.150 --> 12:28.490 You know, sending a number of... 12:28.490 --> 12:32.450 So you can see, like, he wants to send hex C8 number of bytes. 12:32.590 --> 12:37.770 And then, so he divides that by two, but then sends a pair for that number. 12:37.770 --> 12:40.930 So , definitely clearly on the way there. 12:40.930 --> 12:42.930 Yeah, making good progress. 12:42.970 --> 12:47.530 And I don't have the timer right in front of me, but this is moving quickly. 12:47.530 --> 12:54.290 I mean, there's really only so many steps here because it is a smaller target for speed purposes. 12:54.410 --> 12:58.910 The original was actually quite a large function and this is much more streamlined. 12:59.410 --> 13:00.290 Right. 13:00.290 --> 13:10.450 But, so, I think the steps that they're trying to do is discover the bug, leak an address, which they'll want, and then use that for ROP. 13:10.450 --> 13:15.790 Or, I think that this one has a pretty friendly mitigation scenario. 13:15.790 --> 13:17.590 I think that most of the protections are off. 13:17.590 --> 13:18.430 Right. 13:18.570 --> 13:21.150 Which definitely would have been the case many years ago. 13:21.150 --> 13:21.690 Yeah . 13:22.090 --> 13:23.990 What mitigations? 13:23.990 --> 13:24.910 Yeah, exactly. 13:24.910 --> 13:27.810 That didn't exist back then. 13:27.810 --> 13:27.950 Yeah . 13:27.950 --> 13:36.150 But we can see here from Shellfish, they're also, you know, fiddling around with this payload, looking at how many brackets to send. 13:37.150 --> 13:40.230 Yeah, we can definitely see that he's leaked the... 13:40.730 --> 13:41.930 Oh, the base address. 13:41.930 --> 13:42.970 The address of the... 13:42.970 --> 13:44.130 Very nice. 13:44.370 --> 13:46.190 ...the binary itself. 13:47.870 --> 13:52.210 I think you may have leaked the stack pointer when you solved it. 13:52.210 --> 13:54.910 Yeah, I'm trying to remember because I know that we had a slight... 13:54.910 --> 13:56.830 So, you had your reference solution. 13:56.830 --> 13:57.190 That's right. 13:57.190 --> 13:58.350 And I had a solution. 13:58.350 --> 14:04.530 And they were, like, the overall idea was the same, but there was one step that differed a bit. 14:04.710 --> 14:06.890 The check sec there, I think that that's the key. 14:06.890 --> 14:13.370 And you can see there's no canary, NX is disabled, RWX segments, that means that they can execute code on the stack. 14:13.370 --> 14:13.750 Right. 14:13.750 --> 14:21.230 And that's very important to look out for because I think I mentioned this in the previous match. 14:21.230 --> 14:28.330 Nowadays, having challenges with, like, NX disabled is not super common. 14:28.330 --> 14:43.010 So, it's easy, you know, if you're a CDF player, it's easy to kind of forget about stats and, like, start to get into more complicated things when, like, all you had to do was to, like, put your shellcode on the stack and execute it. 14:43.010 --> 14:43.710 Right, right. 14:43.710 --> 14:47.290 Well, you know, it rewards paying close attention. 14:47.490 --> 14:51.630 But also, I mean, sometimes I feel like the exciting part is finding the bug. 14:51.630 --> 14:52.530 For me, anyway. 14:52.610 --> 15:08.870 I love finding the bug and then going through all the steps to actually exploit the bug can be a little tedious because sometimes there's, you know, it's a lot of doing the same thing or maybe there's, like, little gotchas that trip you up, but you know you have it. 15:09.410 --> 15:09.770 Yeah. 15:09.770 --> 15:11.470 No, it's... 15:12.950 --> 15:13.570 Yeah. 15:13.570 --> 15:18.030 So, especially in these, like, stressful situations with, like, the one-on-one. 15:18.030 --> 15:19.010 Like, the players... 15:19.010 --> 15:21.050 So, you don't see it here, but, like, the players are literally... 15:21.050 --> 15:22.630 They're sitting behind this wall. 15:22.850 --> 15:25.610 They're sitting opposite each other, like, at the same table. 15:25.610 --> 15:27.110 I see some shellcode going down here. 15:27.110 --> 15:28.590 Oh, oh, oh, okay. 15:28.590 --> 15:32.650 So, yeah, we should, you know, keep our attention here on the shellfish. 15:33.090 --> 15:37.790 Let's, you know, quickly switch over to Norse code while keeping a little bit of attention on the shellfish. 15:37.790 --> 15:44.770 But we can see that, like, you know, there is stuff going on here as well with the brackets, but I don't see kind of, like, shellcode and stuff yet. 15:44.770 --> 15:45.790 So, I would... 15:45.790 --> 15:51.550 If I were to take a guess, like, I would say the shellfish is, like, slightly ahead here. 15:51.790 --> 15:53.770 I'm switching back until I'm here. 15:53.770 --> 15:56.490 And , yeah, is that a... 15:56.490 --> 15:57.170 Oh, there was... 15:57.170 --> 15:59.330 Oh, I see the ID command going down. 15:59.330 --> 16:00.050 Yeah, okay. 16:00.050 --> 16:07.230 So, they believe that they should have a shell, but it doesn't seem to work quite yet. 16:07.290 --> 16:08.850 Oh, they're, like, single-stepping. 16:08.850 --> 16:11.870 Yeah, and I got to say, I don't know if everybody can appreciate it. 16:11.870 --> 16:13.810 Oh, but they were single-stepping through the shellcode, right? 16:13.810 --> 16:14.750 Yes, that's what it looks like. 16:14.750 --> 16:15.350 Right. 16:15.390 --> 16:17.650 So, they were just checking, like, why... 16:17.650 --> 16:18.870 See that? 16:19.190 --> 16:21.710 Using host lib thread, executing new program. 16:21.710 --> 16:22.610 Oh, they do have the shell. 16:22.610 --> 16:23.290 They do have the shell. 16:23.290 --> 16:24.070 Okay, okay. 16:24.070 --> 16:24.550 Oh, my God. 16:24.550 --> 16:27.610 So, Shellfish is, I'm pretty sure, going to... 16:27.610 --> 16:28.230 Yep , they're switching over to the remote. 16:28.230 --> 16:30.890 They're switching over to the remote, copy-pasting the server. 16:31.150 --> 16:31.610 That's good. 16:31.610 --> 16:36.170 So , you know, we're going to have Shellfish as the winners of this match. 16:36.830 --> 16:42.850 Remember, there is a second match going on in the background, which we don't have the results of yet. 16:42.850 --> 16:43.950 But it is streaming. 16:43.950 --> 16:45.910 If you haven't seen it, there's... 16:45.910 --> 16:46.410 Right. 16:46.410 --> 16:48.710 There's another link on the live CTF YouTube... 16:49.210 --> 16:49.390 Right. 16:49.390 --> 16:51.710 ...that you should be able to watch both of the other two competitors. 16:51.710 --> 16:52.130 Right. 16:52.130 --> 16:58.050 There is no commentary going on there, just the perspectives of the players. 16:58.310 --> 17:03.310 If you want a more zen approach to this event, which is completely valid. 17:03.310 --> 17:04.750 Okay, they're running. 17:05.510 --> 17:06.030 And... 17:06.030 --> 17:07.990 Yes, there it is. 17:08.070 --> 17:08.650 Well done. 17:08.650 --> 17:09.970 Great job, Shellfish. 17:09.970 --> 17:10.390 Well done. 17:10.550 --> 17:11.370 Congratulations. 17:11.370 --> 17:12.950 Really nice work. 17:13.510 --> 17:20.430 So, what's going to happen now is that let me just switch back to this view. 17:20.430 --> 17:24.510 And, as I said, we have another match going on in the background. 17:24.510 --> 17:27.310 You can switch to the other stream to see that thing going on. 17:27.990 --> 17:31.650 I think we're not going to really continue here. 17:31.650 --> 17:36.830 We're going to go to an intermission and come back with the next set of matches. 17:36.830 --> 17:40.790 So, what's going to happen, the second match needs to finish. 17:40.790 --> 17:46.370 We need to do some setup and then we'll be back with a new round of matches. 17:46.570 --> 17:48.610 I will be replaced. 17:48.610 --> 17:51.230 You will stay on for the next one. 17:51.870 --> 17:55.290 Yeah, really nice to commentate with you. 17:55.290 --> 17:57.610 This was a fairly quick one, I would say. 17:57.610 --> 17:59.090 Yeah, but I had a lot of fun. 17:59.090 --> 18:00.290 Yeah, it was great. 18:00.430 --> 18:03.770 I also hope all of you had fun with this. 18:04.350 --> 18:07.290 And, yeah, we will be back in a bit.