1
00:00:11,580 --> 00:00:13,300
And we're back.

2
00:00:13,300 --> 00:00:15,260
Live CTF here at DEF CON.

3
00:00:15,300 --> 00:00:18,820
And I'm Mark Griffin and I'm joined this time by Josh from Vector35.

4
00:00:18,820 --> 00:00:22,280
Yeah, Josh aka Negasora on everything I'm on.

5
00:00:22,480 --> 00:00:24,480
And it's been fun working on this.

6
00:00:24,480 --> 00:00:26,500
It's my first time on camera for it.

7
00:00:26,600 --> 00:00:28,880
I think, oh my gosh, maybe ever.

8
00:00:28,880 --> 00:00:29,640
You're welcome.

9
00:00:29,640 --> 00:00:31,900
Yeah, thank you so much seasoned veteran like yourself.

10
00:00:31,900 --> 00:00:32,300
Yeah, right.

11
00:00:32,300 --> 00:00:33,040
My second time.

12
00:00:33,040 --> 00:00:33,760
Yeah.

13
00:00:34,700 --> 00:00:39,760
No, but I've been working behind the scenes and just set up infrastructure to be one script that works.

14
00:00:39,940 --> 00:00:42,640
So I think without further ado.

15
00:00:42,640 --> 00:00:43,400
Yeah, let's get into it.

16
00:00:43,400 --> 00:00:44,940
So again, this is the third challenge.

17
00:00:44,940 --> 00:00:46,420
We got matches five and six.

18
00:00:46,440 --> 00:00:51,220
Bluewater versus Macaroni and we'll be commenting Super Dice Code versus Hypoid.

19
00:00:51,220 --> 00:00:51,780
Yeah.

20
00:00:51,780 --> 00:00:55,060
So Bluewater, Macaroni, team one versus team eight seated.

21
00:00:55,280 --> 00:01:00,560
And then Super Dice Code placed fourth and falls Hypoid 12th.

22
00:01:00,560 --> 00:01:02,580
So I think these are going to be pretty good matches.

23
00:01:02,580 --> 00:01:03,780
There could be an upset here.

24
00:01:04,040 --> 00:01:04,920
I'm excited to see it.

25
00:01:04,920 --> 00:01:06,200
So should we just get into it?

26
00:01:06,200 --> 00:01:06,600
All right.

27
00:01:06,600 --> 00:01:06,780
Yeah.

28
00:01:06,780 --> 00:01:11,920
Let's start the challenge in five, four, three, two, one.

29
00:01:12,360 --> 00:01:13,140
Go.

30
00:01:13,580 --> 00:01:14,180
Go.

31
00:01:14,180 --> 00:01:15,260
And we're live.

32
00:01:15,260 --> 00:01:16,140
Let's watch.

33
00:01:17,180 --> 00:01:21,240
And I think we can watch and get right into it.

34
00:01:21,240 --> 00:01:22,400
Oh, very nice.

35
00:01:23,860 --> 00:01:24,120
All right.

36
00:01:24,120 --> 00:01:28,480
So this is a challenge called Shop that I wrote.

37
00:01:28,940 --> 00:01:30,160
Oh, God.

38
00:01:30,680 --> 00:01:31,940
Three months ago.

39
00:01:31,940 --> 00:01:32,240
Yeah.

40
00:01:32,240 --> 00:01:34,380
Let's go three months ago and not a month ago.

41
00:01:34,380 --> 00:01:35,460
Super fresh in your mind.

42
00:01:35,460 --> 00:01:35,660
Super.

43
00:01:35,660 --> 00:01:36,740
Oh, it's real.

44
00:01:36,740 --> 00:01:38,460
You know, I still think about it.

45
00:01:38,540 --> 00:01:39,420
Never.

46
00:01:42,080 --> 00:01:43,760
It's a simple one.

47
00:01:43,760 --> 00:01:44,800
I'm not going to lie.

48
00:01:44,800 --> 00:01:56,220
You know, it should be one of the faster matches, but it should still be interesting to see the way they approach it because it is open ended enough that there are there's more than just my intended solution.

49
00:01:56,480 --> 00:01:56,800
Yeah.

50
00:01:56,800 --> 00:02:03,900
And, you know, of course, with the time pressure and the environment and these these folks have been working hard on the DEF CON CTF final.

51
00:02:03,900 --> 00:02:08,180
So they're under a lot of pressure, a lot of mental fatigue already, I'm guessing.

52
00:02:08,180 --> 00:02:12,520
So definitely even the easiest problems can become hard.

53
00:02:12,740 --> 00:02:13,840
Yeah, absolutely.

54
00:02:13,920 --> 00:02:25,320
But we see Super Dice Code getting right into it, dropping it into IDA, starting to starting to annotate, fill out the the names of everything so they can really figure out what's going on.

55
00:02:25,320 --> 00:02:32,700
Now, interestingly, Hypeboi, instead of dropping it directly into a decompiler, well, OK, as I say that, but they were just interacting with it.

56
00:02:32,760 --> 00:02:38,300
They just wanted to see what the flow was before they even took a look at it, which honestly, that's usually my approach.

57
00:02:38,300 --> 00:02:43,540
If I know it's not like malware in the CTF setting, I just run the thing and I'm like, OK, it prints here.

58
00:02:43,540 --> 00:02:46,440
Let's step back from the first print and see if anything weird happens.

59
00:02:46,440 --> 00:02:47,640
Then I continue forward.

60
00:02:47,840 --> 00:02:49,580
Yeah, you know, I find it's really interesting.

61
00:02:49,960 --> 00:02:54,040
There's really a lot of different opinions on how to go about it.

62
00:02:54,040 --> 00:03:00,540
Some people like to go completely static until they have an idea of what the bug is, and some people just want to jump in and start interacting with it.

63
00:03:00,540 --> 00:03:06,900
The people that just look at a binary statically and get it, like just have a solution from it.

64
00:03:06,900 --> 00:03:10,260
I don't know how they have the stack layout in their mind like that.

65
00:03:10,260 --> 00:03:14,200
I try to remember and it pulls a memory overflow.

66
00:03:14,200 --> 00:03:16,480
Yeah, some of my good friends.

67
00:03:16,480 --> 00:03:19,120
But yeah, me, I love dynamic analysis.

68
00:03:19,120 --> 00:03:20,660
I want to see it in the debugger.

69
00:03:21,920 --> 00:03:23,200
That's how I operate.

70
00:03:23,200 --> 00:03:25,500
And I think I already see a debugger popping open.

71
00:03:25,500 --> 00:03:27,060
Yeah, that's fast.

72
00:03:27,260 --> 00:03:28,060
Oh my gosh.

73
00:03:28,060 --> 00:03:32,720
OK, so they're going through the interaction loop right now, at least over on Hypeboi they are.

74
00:03:32,720 --> 00:03:34,300
Yeah, we're looking at Hypeboi.

75
00:03:34,380 --> 00:03:35,860
And let's see.

76
00:03:35,860 --> 00:03:37,380
So it's a shop interface.

77
00:03:37,380 --> 00:03:41,540
You can open accounts, you can look at shelves, log into an account.

78
00:03:42,540 --> 00:03:46,160
And this is a fairly standard format for a CTF problem, right?

79
00:03:46,160 --> 00:03:51,340
Where there's a menu and you've got different options and each option sort of presents you a different functionality.

80
00:03:51,340 --> 00:03:57,020
And usually it's a combination of those functionalities that you use to leverage a bug, right?

81
00:03:57,020 --> 00:03:57,520
Oh, yeah.

82
00:03:57,800 --> 00:03:58,300
Yeah.

83
00:03:58,300 --> 00:04:00,920
Whenever I see a menu pop up, my first thought is heap.

84
00:04:01,240 --> 00:04:05,480
And then if I don't see mallocs or anything in there, I'm just like this author has no idea.

85
00:04:05,720 --> 00:04:09,640
Yeah, well, so the last challenge, for example, no menu.

86
00:04:09,640 --> 00:04:11,540
It was a straight stack buffer overflow.

87
00:04:11,540 --> 00:04:13,040
The bug was in parsing.

88
00:04:13,040 --> 00:04:19,060
And in this case, we're looking at a heap bug and the menu is classic.

89
00:04:20,320 --> 00:04:26,500
Though I think that this one, it's not exactly your typical heap, right?

90
00:04:26,500 --> 00:04:31,900
Like usually there's like one setup, add, delete, print sort of thing.

91
00:04:31,900 --> 00:04:33,800
It looked like there was a little bit more going on in this one.

92
00:04:33,800 --> 00:04:34,960
There's a little more going on.

93
00:04:34,960 --> 00:04:39,340
You have to do a little bit of heap manipulation to actually get things to line up where you want it.

94
00:04:39,720 --> 00:04:45,260
The gist of it and actually super dice code just was in the win.

95
00:04:45,260 --> 00:04:46,580
Yeah, the win function here.

96
00:04:46,580 --> 00:04:52,900
So they already marked a condition as the win flag, which, you know, it's like an admin check kind of.

97
00:04:52,900 --> 00:04:53,040
Okay.

98
00:04:53,040 --> 00:04:55,020
I was going to ask , was it labeled win function?

99
00:04:55,020 --> 00:04:57,940
Because I know some of the these like faster challenges.

100
00:04:58,060 --> 00:04:59,820
I think yeah, this is stripped.

101
00:05:00,320 --> 00:05:03,120
So they're, they're working from nothing.

102
00:05:03,760 --> 00:05:04,320
Gosh.

103
00:05:04,320 --> 00:05:19,700
And that's, that is something that for me, I, I really just love it when I see symbols in a binary, if it's stripped and you have to, you have to manually annotate what each variable is or function, it can be time consuming.

104
00:05:19,700 --> 00:05:20,240
Yeah.

105
00:05:20,240 --> 00:05:23,460
Allow me to be a shill for a second, but Binary Ninja just got auto var naming.

106
00:05:23,460 --> 00:05:25,740
So like, honestly, it's been kind of nice.

107
00:05:25,740 --> 00:05:29,380
I used to, when I was testing one of your challenges, it just sped it up.

108
00:05:29,940 --> 00:05:30,800
And that's a good point.

109
00:05:30,800 --> 00:05:49,820
And you know, one of the things that I'm interested to see here is that we've got amazing competitors with really all sorts of tools, but I think that I've largely just been seeing IDA and debugger use and, you know, phone tools for scripting, but not a whole lot else.

110
00:05:49,820 --> 00:05:59,980
And I was curious what people might bring to these challenges, whether it's something like anger, symbolic execution, or, or the shellfish team didn't go for anger, right?

111
00:05:59,980 --> 00:06:08,920
I I'm thinking it's a second language for them, which it probably is, but I does their first language, especially, I think it was Kyle bought for shellfish.

112
00:06:08,920 --> 00:06:10,200
So that doesn't surprise me.

113
00:06:12,100 --> 00:06:15,900
But yeah, but with a bug like this, what, what, what's your approach?

114
00:06:15,900 --> 00:06:23,080
So you, we've talked about, okay, so there's a menu, but you know, what's your approach for trying to find a bug when you see that menu?

115
00:06:23,080 --> 00:06:24,300
What are you looking for?

116
00:06:24,300 --> 00:06:29,060
So when I see that menu, I want to look for like misuses.

117
00:06:29,660 --> 00:06:40,700
So passing to realloc, malloc zero, you know, just like an unchecked free, especially in custom memory implementations.

118
00:06:40,700 --> 00:06:41,860
That's a really big one.

119
00:06:42,020 --> 00:06:43,700
So those are the first step.

120
00:06:43,700 --> 00:06:46,300
And then I go through, I annotate structures.

121
00:06:46,300 --> 00:06:49,720
I want to see like, is it going to be a fast spin thing?

122
00:06:49,720 --> 00:06:51,240
Is it going to be a T-cache thing?

123
00:06:51,340 --> 00:06:56,820
Like, because if it's a T-cache thing, you know, it's ABC, it's like a formula.

124
00:06:58,140 --> 00:07:03,480
So I'm looking to see kind of what the allocated chunks would be, how they can push each other around.

125
00:07:03,540 --> 00:07:09,780
If I have any likely, like, or if I have an overwrite, like how far invented out it can I get, et cetera.

126
00:07:10,000 --> 00:07:10,540
Yeah.

127
00:07:10,540 --> 00:07:14,200
And, and so you brought up a fast spin T-cache.

128
00:07:14,200 --> 00:07:23,800
I think that it's really important for a lot of folks who are newer to this, that you can get a challenge like this, and maybe you don't know those techniques, and it can be really intimidating.

129
00:07:24,080 --> 00:07:28,220
But a lot of the time, it is more procedural, I think, than people make it.

130
00:07:28,220 --> 00:07:35,140
Once you understand the bug primitive, like, what does this really give you or allow you to do that you shouldn't be able to do?

131
00:07:35,240 --> 00:07:44,280
From there, as you said, you can say, oh, well, this is, this is playing into, you know, using a T-cache-based technique or something similar.

132
00:07:44,280 --> 00:07:45,860
Really, hacking is just that.

133
00:07:45,860 --> 00:07:51,060
It's building on, you know, baby steps of knowledge and kind of inching closer to your goal.

134
00:07:51,120 --> 00:07:59,640
And that's, you know, hackers are notorious for, you know, having code that works, but it's built on a pile of hacks.

135
00:07:59,740 --> 00:08:08,580
Like, but that, that's kind of a thought process you pick up, is you make tiny steps towards the eventual goal.

136
00:08:09,120 --> 00:08:09,360
Yeah.

137
00:08:09,360 --> 00:08:12,320
So, let's take a look at, let's switch over to Hypeboi here.

138
00:08:12,560 --> 00:08:15,900
So, what are we seeing on the, what does it look like they're doing with their debugger over there?

139
00:08:15,900 --> 00:08:16,280
Okay.

140
00:08:16,280 --> 00:08:18,600
So, they actually just got double free in T-cache.

141
00:08:18,600 --> 00:08:19,220
Oh.

142
00:08:19,540 --> 00:08:20,060
Very nice.

143
00:08:20,060 --> 00:08:21,080
Making good progress.

144
00:08:21,080 --> 00:08:22,740
Yeah, that's making great progress.

145
00:08:23,340 --> 00:08:24,960
I think it's making great progress.

146
00:08:24,960 --> 00:08:26,340
I don't remember the solution right now.

147
00:08:26,480 --> 00:08:28,240
It sounds really familiar.

148
00:08:28,380 --> 00:08:34,920
But, well, I can see, it looks like they're using Jeff as their GDB init script.

149
00:08:35,080 --> 00:08:39,280
And it looks like they've got a heap helper that they're using, right?

150
00:08:39,280 --> 00:08:41,640
To tell them what they've got.

151
00:08:41,640 --> 00:08:42,900
Oh, and those can be invaluable.

152
00:08:42,900 --> 00:08:44,540
I used that when developing this challenge.

153
00:08:44,540 --> 00:08:44,700
Yeah.

154
00:08:44,700 --> 00:08:48,060
And it was just so nice helping figure out what the layout was.

155
00:08:48,060 --> 00:08:49,620
I used Pwnbag, Pwndebug.

156
00:08:49,840 --> 00:08:52,400
But I used to use Jeff.

157
00:08:52,940 --> 00:08:54,560
Both of them are fantastic.

158
00:08:54,560 --> 00:08:56,180
Used to use PdoA before that.

159
00:08:56,180 --> 00:08:56,760
Yep.

160
00:08:58,760 --> 00:08:59,580
Let's see.

161
00:08:59,580 --> 00:09:02,700
So, they're going through, they're figuring out that there's a max number of users.

162
00:09:02,860 --> 00:09:03,900
No.

163
00:09:05,680 --> 00:09:08,340
Oh, they're just figuring out that users is a linked list.

164
00:09:09,100 --> 00:09:10,100
Okay.

165
00:09:11,480 --> 00:09:15,480
So, going through, figuring out how they get to the double free.

166
00:09:16,360 --> 00:09:19,620
And there's a common technique, or a common technique.

167
00:09:19,620 --> 00:09:24,640
There's a way to avoid detecting tcache double frees.

168
00:09:24,720 --> 00:09:27,240
And that's to something in between.

169
00:09:27,600 --> 00:09:28,080
You know?

170
00:09:28,080 --> 00:09:29,220
It's dumb.

171
00:09:30,040 --> 00:09:33,140
But glibc is itself.

172
00:09:34,660 --> 00:09:35,460
So, let's see.

173
00:09:35,460 --> 00:09:39,000
Setting break points in... I shouldn't have stripped this.

174
00:09:39,000 --> 00:09:40,620
It makes it hard to commentate.

175
00:09:41,060 --> 00:09:43,980
It looks like they're setting break points in the checkout.

176
00:09:44,040 --> 00:09:51,820
Though I will say, it may not be easy to tell from the streams, but these folks are extremely fast.

177
00:09:51,820 --> 00:09:52,900
Oh, they're crazy fast.

178
00:09:52,900 --> 00:09:55,300
They are annotating as they're going.

179
00:09:55,300 --> 00:09:56,820
And they're typing so fast.

180
00:09:56,820 --> 00:10:00,720
If we had them on the stream, you know, it's just... Oh, it's wild.

181
00:10:00,720 --> 00:10:01,300
It's crazy.

182
00:10:01,300 --> 00:10:02,020
You see the people...

183
00:10:02,020 --> 00:10:02,680
They're so fast.

184
00:10:02,680 --> 00:10:03,320
Yeah.

185
00:10:03,840 --> 00:10:08,880
And you think one person is going fast and the other person just suddenly jumps like five steps ahead of them.

186
00:10:08,880 --> 00:10:17,680
It was last match, I think, where... no, two matches ago, where someone was building a ROP chain before the other guy even started.

187
00:10:17,680 --> 00:10:20,100
Other guy just knocked one out immediately.

188
00:10:20,100 --> 00:10:21,100
The guy was still debugging.

189
00:10:21,100 --> 00:10:22,380
The first guy was still debugging it.

190
00:10:22,380 --> 00:10:24,440
He's like, oh, my God, I can't believe it.

191
00:10:24,480 --> 00:10:29,760
When you're in these high-pressure, you know, race situations, your thinking just goes all over the place.

192
00:10:29,760 --> 00:10:31,060
Your heart rate's up.

193
00:10:31,240 --> 00:10:33,220
You're thinking, like, oh, how far is he?

194
00:10:33,220 --> 00:10:34,640
Did he find something I didn't like?

195
00:10:34,640 --> 00:10:36,140
He's been paused for kind of a long time now.

196
00:10:36,140 --> 00:10:37,500
Is he just watching his script run?

197
00:10:37,500 --> 00:10:40,140
Like, so many things going through your mind.

198
00:10:41,020 --> 00:10:45,060
Yeah , I really feel like it's stops and starts, you know?

199
00:10:45,060 --> 00:10:45,960
Like, you will be...

200
00:10:46,340 --> 00:10:48,240
okay, I see what I need to do here.

201
00:10:48,240 --> 00:10:48,940
Get there.

202
00:10:48,940 --> 00:10:51,800
And then you need to stop and think and explore what's the next step.

203
00:10:51,800 --> 00:10:56,640
And then, especially at this level, once they know what that next step is, they are off to the races.

204
00:10:56,640 --> 00:10:57,200
Oh, yeah.

205
00:10:57,200 --> 00:10:58,680
And it's just bing, bing, bing, bing.

206
00:10:58,680 --> 00:11:01,360
And then, okay, what's the next thing that they have to figure out?

207
00:11:01,360 --> 00:11:04,800
Getting from point A to B is something they've done thousands of times.

208
00:11:04,800 --> 00:11:05,220
Yeah, yeah.

209
00:11:05,220 --> 00:11:06,240
There really is a lot of practice.

210
00:11:06,240 --> 00:11:19,880
In fact, before we went live on the stream on the last one, I saw one of the competitors pop and open a challenge binary from a year past or something and practicing right there, right before they went into this match.

211
00:11:19,880 --> 00:11:21,380
Getting his APM up.

212
00:11:21,620 --> 00:11:22,460
Oh, my God.

213
00:11:22,460 --> 00:11:31,100
You know, you can't... there's so much work that goes into building the knowledge and the reflexes that these competitors have.

214
00:11:31,100 --> 00:11:32,080
Oh, yeah.

215
00:11:32,260 --> 00:11:39,020
And just kind of the sixth sense you get for it, like something sticks out to you that looks totally mundane and you don't know why.

216
00:11:39,300 --> 00:11:49,380
Yeah, that's... I think that that's something that I hear from pretty much every really seasoned CTF player or vulnerability researcher is, this looks wrong.

217
00:11:49,380 --> 00:11:50,440
There's something wrong here.

218
00:11:50,440 --> 00:11:54,820
I may not be able to tell you yet what it is, but I know something's wrong.

219
00:11:54,860 --> 00:11:57,580
Let's pop over to SuperDiceCode.

220
00:11:58,040 --> 00:12:04,920
Now, they're still going through labeling a lot of this stuff.

221
00:12:05,520 --> 00:12:10,740
It looked like they had a little bit more progress than the last time we were looking at them.

222
00:12:10,740 --> 00:12:16,020
So, it looks like they're looking for overflowing a field in the password entry.

223
00:12:16,420 --> 00:12:22,160
So, they've annotated in the comments some field offsets is what it looked like or maybe sizes.

224
00:12:22,300 --> 00:12:24,560
And now they're typing out the struct.

225
00:12:24,560 --> 00:12:25,780
Okay, nice.

226
00:12:27,420 --> 00:12:28,780
Oh, yeah, they just pulled it in.

227
00:12:28,780 --> 00:12:30,440
Pulled out the decouplation.

228
00:12:30,480 --> 00:12:31,880
And now they're... yeah.

229
00:12:33,340 --> 00:12:34,140
Interesting.

230
00:12:36,680 --> 00:12:41,080
So, this is a big step of the process is just figuring out what the structs are.

231
00:12:41,780 --> 00:12:50,680
Because when it comes down to it, if you don't know that, you're going to be staring at I plus 18 and you're going to be thinking like, which one was that again?

232
00:12:51,120 --> 00:13:09,140
Yeah, this is a lot of the behind the scenes work with reverse engineering that I think if you're an old hand at it, if you're a veteran, you know there's a lot of that work that you need to do in order to really understand what's going on and have a sense.

233
00:13:09,140 --> 00:13:16,880
And usually, that's not a fast process, especially if you've got a strict binary or a really large binary.

234
00:13:17,480 --> 00:13:21,340
And so, it's really interesting with these speed matches.

235
00:13:21,680 --> 00:13:26,340
You don't want to be spending time annotating, but you kind of have to in order to understand.

236
00:13:26,340 --> 00:13:26,800
Absolutely.

237
00:13:26,800 --> 00:13:28,040
It's cost benefit.

238
00:13:28,040 --> 00:13:32,440
It's, you know, retaining knowledge in the binary versus you're losing time for it.

239
00:13:32,440 --> 00:13:32,900
Right.

240
00:13:32,900 --> 00:13:36,820
I just saw I'm checking out that admin check, which I'm sure is going to be...

241
00:13:36,820 --> 00:13:38,900
Well, it only lets the best admins through.

242
00:13:39,380 --> 00:13:40,960
It's infallible, obviously.

243
00:13:40,960 --> 00:13:42,260
You shouldn't even look at it.

244
00:13:45,750 --> 00:13:53,390
And I'm noticing here, it's interesting that they're flipping back and forth between the disassembly and the graph view and the decompilation.

245
00:13:54,250 --> 00:14:02,910
Yeah, going in graph view, it's really nice to see kind of interaction loops and switch cases laid out in front of you and see if there are any complex paths it can take.

246
00:14:02,910 --> 00:14:03,570
Yeah.

247
00:14:03,870 --> 00:14:05,590
And then linear is just nice.

248
00:14:05,590 --> 00:14:06,430
True.

249
00:14:06,430 --> 00:14:10,870
I don't know about you, but for decompilation, I want it linear.

250
00:14:10,870 --> 00:14:13,710
But when I'm looking at assembly, I want it in graph view.

251
00:14:13,870 --> 00:14:20,270
And I mean, I learned to RE on disassembly and graph view.

252
00:14:20,270 --> 00:14:21,690
So that's very comfortable for me.

253
00:14:21,690 --> 00:14:24,770
I know some people are linear disassembly all the way.

254
00:14:24,770 --> 00:14:30,210
I like linear because that's how I learned to write assembly, you know, in a file.

255
00:14:30,210 --> 00:14:32,610
So that's how I read it.

256
00:14:33,210 --> 00:14:33,870
Yeah.

257
00:14:33,870 --> 00:14:40,010
And I think that, you know, we were just talking about how much time you have to spend REing or annotating.

258
00:14:40,690 --> 00:14:54,530
One of the things that I was taught and I pass on to anybody that I teach about reverse engineering is you really want to spend as little time as possible annotating or like diving into what does this function do?

259
00:14:54,530 --> 00:14:59,650
Unless you're absolutely certain that that's an important function, because especially in a match like this.

260
00:14:59,650 --> 00:15:00,210
Oh my gosh.

261
00:15:00,210 --> 00:15:03,410
Imagine, you know, there's this function that doesn't really do anything.

262
00:15:03,410 --> 00:15:04,450
The rabbit holes.

263
00:15:04,450 --> 00:15:05,930
Yeah, the rabbit holes.

264
00:15:05,970 --> 00:15:16,830
How many times have you like just gotten dragged into like an optimized stir comp function or like something that's so obvious when you look at it, when you look back at it?

265
00:15:16,830 --> 00:15:17,070
Right.

266
00:15:17,070 --> 00:15:21,850
But when you're in there, you're just like, oh, this, this moves so much memory around, like it has to be doing something weird.

267
00:15:21,850 --> 00:15:22,710
There's an offset missing?

268
00:15:22,710 --> 00:15:25,470
No, it's totally fine.

269
00:15:26,030 --> 00:15:40,290
Yeah, and that's something where having the experience, the reps, understanding common algorithms and what they look like in the decompiler or in the graph, disassembly graph view can really pay off because, you know, I've been there and I'm sure you have,

270
00:15:40,290 --> 00:15:51,190
or been there working with a team member where they pop open a function and it's, you know, stripped or whatever, and they just look at it and go, yep, that's quicksort or that's this hash function.

271
00:15:51,210 --> 00:15:52,650
I don't even need to read it.

272
00:15:52,650 --> 00:16:00,270
No, I feel like everyone competing here has been on both sides of that, where you're looking at it and you're like, I have no idea what this is doing.

273
00:16:00,270 --> 00:16:02,210
And it's like, no, that's just bubble sort.

274
00:16:02,490 --> 00:16:10,750
Or, you know, you're looking at some algorithm on someone else's screen, just like from across the room while you're waiting for, you know, Z3 to finish sometime.

275
00:16:11,030 --> 00:16:16,090
And you're just like, oh, you're looking at like Winston Churchill's algorithms.

276
00:16:16,370 --> 00:16:18,130
I couldn't think of one.

277
00:16:18,530 --> 00:16:18,970
Classic.

278
00:16:18,970 --> 00:16:20,610
I love Winston Churchill's algorithms.

279
00:16:20,610 --> 00:16:22,930
One of the computers of all time.

280
00:16:23,290 --> 00:16:23,610
Yeah .

281
00:16:24,030 --> 00:16:25,250
Little known.

282
00:16:25,470 --> 00:16:26,130
Okay.

283
00:16:26,130 --> 00:16:32,750
And so on the superdice code, we see that their exploit script starting to take some shape here.

284
00:16:32,750 --> 00:16:40,370
They're starting to put the entries from the menu into the script itself, which to me gives an indication that they've got an idea of what they're doing.

285
00:16:40,370 --> 00:16:42,130
Are they breaking inside of malloc?

286
00:16:47,780 --> 00:16:49,440
Well, I see read.

287
00:16:49,440 --> 00:16:49,740
Yeah.

288
00:16:49,740 --> 00:16:54,380
Well, at the very, oh, yeah, they have some breakpoints inside of libc malloc.

289
00:16:54,380 --> 00:17:00,100
Oh, do you think that maybe they have a watch point or something that prints out?

290
00:17:00,100 --> 00:17:00,480
Oh, yeah.

291
00:17:00,480 --> 00:17:12,860
It looks like it's printing out the pointer and the size for a malloc, which is very smart, especially if you don't have one of those heap introspection tools, it sort of lays it out for you.

292
00:17:12,900 --> 00:17:13,280
Yeah.

293
00:17:14,000 --> 00:17:18,780
Well, this also just sees because, you know, you could have the heap layout in front of you, but you don't know the previous state of it.

294
00:17:18,820 --> 00:17:22,600
This kind of helps you figure out, oh, I need to move this allocation later.

295
00:17:22,600 --> 00:17:23,160
Yeah.

296
00:17:25,140 --> 00:17:25,660
Yeah.

297
00:17:25,660 --> 00:17:29,340
And I'm sure that the the tension is just mounting.

298
00:17:29,340 --> 00:17:34,380
And when you when you have to do that sort of thing and instrument malloc.

299
00:17:34,380 --> 00:17:35,260
Yeah.

300
00:17:35,820 --> 00:17:37,020
That's that's tough.

301
00:17:37,020 --> 00:17:37,220
All right.

302
00:17:37,220 --> 00:17:38,500
Let's take a look at Hypeboi.

303
00:17:38,500 --> 00:17:38,720
Yeah.

304
00:17:38,760 --> 00:17:41,980
Hypeboi, it looks like they're making some progress on their exploit.

305
00:17:42,460 --> 00:17:47,520
They have once we see it, they have interaction wrappers.

306
00:17:48,380 --> 00:17:49,380
No, they don't.

307
00:17:49,380 --> 00:17:51,320
They just have commands they're sending raw.

308
00:17:52,820 --> 00:17:56,740
Looks like they've got they've tried a few things based on what I'm seeing commented.

309
00:17:56,740 --> 00:17:57,840
Oh, yeah.

310
00:17:58,000 --> 00:17:59,760
And they're what is that?

311
00:17:59,760 --> 00:18:04,960
To creating a user to zero is add an item to cart, I think.

312
00:18:04,960 --> 00:18:06,400
Then they log out.

313
00:18:06,560 --> 00:18:09,540
OK, that's sounding like like they're moving towards the solution.

314
00:18:09,540 --> 00:18:10,840
It sounds like they figured something.

315
00:18:10,840 --> 00:18:13,040
Oh, and look, they're laying out the chunks and the sizes.

316
00:18:13,260 --> 00:18:14,140
OK.

317
00:18:16,280 --> 00:18:18,240
And you see them counting with the mouse.

318
00:18:18,320 --> 00:18:19,260
I love that.

319
00:18:19,260 --> 00:18:20,100
I do that.

320
00:18:21,000 --> 00:18:32,880
Yeah, I don't know about you, but it's often the case for me where I will be trying so many things out in a script that by the end of it, it's like three quarters is junk that I never went down a rabbit hole.

321
00:18:32,880 --> 00:18:33,920
Nope, that's not what I want to do.

322
00:18:33,920 --> 00:18:35,160
And just commented it out.

323
00:18:35,160 --> 00:18:38,060
And there's like five lines of actual work.

324
00:18:38,060 --> 00:18:39,960
Yeah, absolutely.

325
00:18:39,960 --> 00:18:42,100
Well, you have to do the work to get the final result.

326
00:18:42,600 --> 00:18:44,660
You can't just sit down and have a solution to this.

327
00:18:44,660 --> 00:18:46,620
You need to work on it.

328
00:18:46,620 --> 00:18:48,700
And we see him going through it really fast.

329
00:18:50,280 --> 00:18:53,120
Yeah, so fast, just flipping through screens.

330
00:18:53,120 --> 00:18:58,100
They have this understanding in their head of the shape of this and what they're trying to do.

331
00:18:58,100 --> 00:19:02,620
And you can see him moving between IDA and their terminal and debugger.

332
00:19:02,620 --> 00:19:07,140
So it looks like HiPoI hasn't defined a user struct yet.

333
00:19:07,140 --> 00:19:11,280
So I don't know if they're just writing it off or if there have been other places.

334
00:19:11,500 --> 00:19:13,600
Or maybe they just didn't assign it in that case.

335
00:19:13,920 --> 00:19:18,280
Well, you know, as we were saying, it takes time to build struct annotations.

336
00:19:18,280 --> 00:19:24,820
Depending on what you're used to doing, maybe they just felt like they didn't have time for it.

337
00:19:24,840 --> 00:19:26,500
True, maybe they don't need to.

338
00:19:28,340 --> 00:19:37,280
If we take a look on the super dice codes tied here, I think I just saw a double free or a tcache issue.

339
00:19:37,280 --> 00:19:38,840
So I feel like they're making progress too.

340
00:19:38,840 --> 00:19:40,260
Okay, very nice.

341
00:19:41,660 --> 00:19:47,280
Yeah, because they took kind of different approaches, it doesn't surprise me that HiPoI got the first tcache free or tcache double free.

342
00:19:48,280 --> 00:19:51,680
Because it looks like super dice code has way more marked up.

343
00:19:52,020 --> 00:19:56,680
I noticed that, yeah, as they were going on, they were consistently just annotating, annotating.

344
00:19:56,680 --> 00:20:04,020
Yep, we can see they're using phone debug and getting the heap helper to lay out what's going on.

345
00:20:04,020 --> 00:20:06,900
Yeah, it may not look it, but these are like two very different approaches.

346
00:20:06,900 --> 00:20:11,420
HiPoI going highly dynamic, super dice code going methodical.

347
00:20:11,460 --> 00:20:12,700
Well , they're both methodical.

348
00:20:12,700 --> 00:20:17,660
But going static and then running, you know, figuring out if his assertions hold.

349
00:20:17,660 --> 00:20:18,300
Right.

350
00:20:18,960 --> 00:20:21,340
And then going back and annotating some more.

351
00:20:22,240 --> 00:20:31,120
And I just saw, I don't know if we've seen checksec yet, but I am, I can't remember what the mitigations were on this.

352
00:20:31,120 --> 00:20:32,800
Oh, I'm surprised, yeah.

353
00:20:32,980 --> 00:20:33,840
Really shaped.

354
00:20:34,460 --> 00:20:35,740
Well, it's a heap exploit.

355
00:20:35,740 --> 00:20:38,980
No, no, this has like full railroad, it has pi.

356
00:20:38,980 --> 00:20:40,000
Okay, okay.

357
00:20:40,160 --> 00:20:41,500
It has canaries.

358
00:20:41,500 --> 00:20:52,440
This isn't, if I recall, this is more of a figure out how to do a precise corruption and you win, rather than having to do a full, you know, riprop or...

359
00:20:52,440 --> 00:20:52,880
Yeah.

360
00:20:52,880 --> 00:20:57,900
So once you get, you know, some write primitive, you...

361
00:20:59,540 --> 00:21:01,280
Well, no, I don't think it has pi.

362
00:21:02,920 --> 00:21:03,940
I don't remember.

363
00:21:03,940 --> 00:21:08,340
But anyway, once you get a controlled write, you overwrite the admin flag and win.

364
00:21:08,340 --> 00:21:11,100
There was a win function there that admins get through.

365
00:21:11,360 --> 00:21:13,960
Which, of course, they'll never be able to do because they're not admins.

366
00:21:13,960 --> 00:21:15,300
Not yet.

367
00:21:15,300 --> 00:21:16,980
Yeah, I don't know why they're there, it's crazy.

368
00:21:17,960 --> 00:21:19,720
Just a matter of time, I'm sure.

369
00:21:20,220 --> 00:21:25,280
Yeah, but I'm, yeah, I'm surprised there's been no checks there.

370
00:21:26,200 --> 00:21:28,720
I guess they just haven't found anything to warrant it.

371
00:21:29,340 --> 00:21:38,160
Right, well, you know, if it is a heap bug, then your first question probably is, like, what's the bug, right?

372
00:21:38,160 --> 00:21:38,820
Yeah.

373
00:21:40,320 --> 00:21:45,560
Not an admin, so we see them poking at that, seeing the system call right there.

374
00:21:45,560 --> 00:21:46,820
They know they want to get there.

375
00:21:47,040 --> 00:21:47,380
Yeah .

376
00:21:49,240 --> 00:21:54,580
Ah, so, yep, now they're starting to figure out, okay, what do I need to change to get there?

377
00:21:54,720 --> 00:21:55,660
Got it.

378
00:21:57,520 --> 00:22:00,760
Oh, yeah, and they're not even calling names, they're calling them chunks.

379
00:22:00,780 --> 00:22:03,820
They don't care what they are, they just care about the memory they use.

380
00:22:03,820 --> 00:22:04,500
Right.

381
00:22:07,500 --> 00:22:08,400
All right.

382
00:22:11,020 --> 00:22:22,320
Yep, okay, so we see that they've got on one side, they've used their debugger to instrument the malloc and free calls, see exactly which pointers are getting allocated when, as they're interacting with it.

383
00:22:22,320 --> 00:22:24,100
And that's very fast, they've got it in their head.

384
00:22:24,100 --> 00:22:24,780
That's really fast.

385
00:22:24,780 --> 00:22:27,520
Yep, this command is going to malloc the free mode.

386
00:22:29,540 --> 00:22:36,980
So, I feel like they're getting closer and closer.

387
00:22:36,980 --> 00:22:38,480
All right, error removing item.

388
00:22:41,750 --> 00:22:42,610
All right.

389
00:22:42,610 --> 00:22:43,930
Man, they're moving so fast.

390
00:22:43,930 --> 00:22:44,030
All right.

391
00:22:44,030 --> 00:22:45,990
Yeah, let's hop back over to Hypoi.

392
00:22:45,990 --> 00:22:49,450
And they're making good progress.

393
00:22:49,450 --> 00:22:52,910
Looks like they've created a second user.

394
00:22:55,070 --> 00:22:57,770
And we'll see what else they did once they go back to their script.

395
00:22:57,770 --> 00:23:03,650
We have to be faster reading, because they know these scripts really well, and we have to keep track of two of them that they're writing.

396
00:23:05,310 --> 00:23:15,050
Yeah, so this is, I think it's funny, this is sort of the tense time when, okay, it's not a quick solve, it's starting to drag on a little bit.

397
00:23:15,050 --> 00:23:19,130
Like you said, there's kind of a morale aspect, but there's also hints, right?

398
00:23:19,190 --> 00:23:20,570
There's two hints.

399
00:23:20,610 --> 00:23:24,670
I think they're at, what are they, 25 and 40 minutes?

400
00:23:25,230 --> 00:23:28,090
20, 35, something like that.

401
00:23:28,090 --> 00:23:28,270
Yeah .

402
00:23:28,270 --> 00:23:37,630
So, they're probably, I don't know how long we've been going here, probably right about on the first hint or so, as far as timing.

403
00:23:38,010 --> 00:23:52,550
And it's up to the challenge authors to figure out what is the hint that we should provide to really give them a little bit of a breakthrough, and then that second hint should really be the, all right, you've got, what, like 10 minutes left?

404
00:23:52,550 --> 00:23:55,950
So , it should really pretty much lay it out there for them, that second hint.

405
00:23:55,950 --> 00:23:57,030
Oh, it does.

406
00:23:57,090 --> 00:23:58,170
Oh, it does.

407
00:23:59,610 --> 00:24:01,870
Yeah, the first hint, not very helpful.

408
00:24:02,350 --> 00:24:05,010
You know, it's a nudge, it's a nub in the right direction.

409
00:24:05,010 --> 00:24:08,230
The second hint is shooting them out of a cannon in the right direction.

410
00:24:08,950 --> 00:24:10,210
Sometimes you need that.

411
00:24:10,210 --> 00:24:11,550
Sometimes, yeah.

412
00:24:11,550 --> 00:24:17,150
If you get the second hint, which, to be fair, these aren't the easiest challenges in the world.

413
00:24:17,410 --> 00:24:19,990
Like, these aren't your CTF 50-point challenges.

414
00:24:20,490 --> 00:24:28,350
Yeah, and I think that that's really important to mention here, is that we sort of categorize these as easy because we want the challengers to be able to solve them.

415
00:24:28,350 --> 00:24:37,250
We want it to be more of a speed competition, but it is always hard to know exactly, like, what is, what's the exact difficulty level to get right?

416
00:24:37,250 --> 00:24:44,330
And it's really hard to judge that when you have teams from all over the world with different specialties, different members every year.

417
00:24:45,070 --> 00:24:47,410
And, you know, they're the best in the world.

418
00:24:47,410 --> 00:24:49,170
They're at DEF CON finals.

419
00:24:49,290 --> 00:24:50,190
Right, right.

420
00:24:51,730 --> 00:25:01,310
Yeah, so going back to the hints real quick, I remember on the first challenge, there was a, we were in that moment where it was a little tense.

421
00:25:01,430 --> 00:25:04,210
How long is it going to take to get to a solve here?

422
00:25:05,330 --> 00:25:12,530
And so the first hint went out, and I'm pretty sure they looked at the hint, looked at us, and they were like, all right, I already knew that.

423
00:25:12,530 --> 00:25:13,750
Like, let me get back to hacking.

424
00:25:13,750 --> 00:25:15,090
Why are you distracting me, you know?

425
00:25:15,090 --> 00:25:20,850
Yeah, actually, I think the first challenge, the first challenge is pretty long, right?

426
00:25:20,850 --> 00:25:27,110
So on the first challenge, now remember, we are, we're doing two matches, two head-to-head matches, right?

427
00:25:27,290 --> 00:25:34,190
And on the first challenge, the sort of other match finished very quickly.

428
00:25:34,190 --> 00:25:46,330
We're announcing one match, and then the other match is, you can see one stream of each player, and those players solve it quite quickly, at least 10 or 15 minutes faster.

429
00:25:46,330 --> 00:25:56,170
And I think that on that, it was really a, somebody noticed a detail that the challenge author left in that made it easier that I think everybody else missed.

430
00:25:56,950 --> 00:26:05,430
Yeah, at the end of the first challenge, I was building the, it goes long, a sudden-death challenge, and I was building it, ready to deploy it.

431
00:26:05,530 --> 00:26:05,890
Yeah .

432
00:26:06,070 --> 00:26:11,210
But right as I finished building it, I was about to ping people that, hey, we need to go sudden-death.

433
00:26:11,210 --> 00:26:12,150
They got dissolved.

434
00:26:12,370 --> 00:26:15,850
Yeah, it was a tense moment over here at the live CTF HQ.

435
00:26:15,850 --> 00:26:16,530
Oh, yeah.

436
00:26:17,750 --> 00:26:20,150
I'm really hoping we don't go into sudden-death here.

437
00:26:20,150 --> 00:26:22,430
Of course, because it's my challenge, I want them to solve it.

438
00:26:22,430 --> 00:26:22,950
Sure.

439
00:26:22,950 --> 00:26:26,310
But, you know, I want to give them some closure on the challenge.

440
00:26:26,710 --> 00:26:27,110
Right?

441
00:26:27,110 --> 00:26:33,390
Oh, I know, I think I saw at least one competitor who, they just wanted to finish, you know?

442
00:26:33,390 --> 00:26:33,790
Oh , yeah.

443
00:26:33,790 --> 00:26:36,350
They didn't win, but they wanted to finish.

444
00:26:36,350 --> 00:26:39,430
They asked, can I stay around and just please debug my ROP chain?

445
00:26:39,430 --> 00:26:39,950
Yeah.

446
00:26:39,950 --> 00:26:41,390
Like, why didn't it work?

447
00:26:41,390 --> 00:26:42,170
Yeah.

448
00:26:43,070 --> 00:26:51,490
So let's reassess where we've got SuperDiceCode and see what works.

449
00:26:51,490 --> 00:26:55,950
It looks like SuperDiceCode is breaking on the admin checker once again.

450
00:26:56,010 --> 00:26:57,770
Setting some breakpoints in their exploits here.

451
00:26:57,770 --> 00:26:58,950
Oh, no, they're just calm, yeah.

452
00:26:58,950 --> 00:27:01,450
They look like they are on their way.

453
00:27:02,050 --> 00:27:03,170
Username and password.

454
00:27:03,590 --> 00:27:04,650
Single-stepping.

455
00:27:07,710 --> 00:27:10,630
They have a different pwnbag layout than I do, and it's kind of messing with my...

456
00:27:10,630 --> 00:27:12,490
Yeah, and they're very fast, right?

457
00:27:12,490 --> 00:27:16,690
So I'm used to looking at Jeff, and it's just a little bit different layout.

458
00:27:17,870 --> 00:27:19,650
Yeah, we have the screens on the wrong side.

459
00:27:19,650 --> 00:27:21,590
I have the Jeff screen and you have pwnbag.

460
00:27:21,810 --> 00:27:22,970
Oh, you want to switch seats?

461
00:27:22,970 --> 00:27:24,050
No, I'm good.

462
00:27:27,400 --> 00:27:28,380
Let's see.

463
00:27:29,320 --> 00:27:32,620
I'm definitely looking at that login.

464
00:27:32,620 --> 00:27:35,160
Well , SuperDiceCode is annotating everything they can.

465
00:27:35,160 --> 00:27:37,120
They're getting a good understanding of the program.

466
00:27:37,120 --> 00:27:46,220
Even if the bug hasn't immediately jumped out at them, you know, by the time they reach that intersection of their two kind of growing ends of knowledge, something will click.

467
00:27:46,660 --> 00:27:50,180
Yeah, and that's, as you said, the differing approaches.

468
00:27:50,420 --> 00:28:07,520
I tend to be more of the, I want dynamic analysis, but I really just want it so I can enrich my static so I have a real understanding or a guarantee that what I'm looking at is what I think it is.

469
00:28:07,520 --> 00:28:12,600
Because if I try to do it all statically, you know, there's a lot of question marks in my variable names.

470
00:28:12,840 --> 00:28:15,520
Well, you can see on SuperDiceCode they have eight what?

471
00:28:15,560 --> 00:28:19,080
Like they have 16 password, eight what?

472
00:28:20,620 --> 00:28:25,400
There are so many times I just call something like underscore maybe or underscore maybe not.

473
00:28:27,600 --> 00:28:29,180
Offset eight thing.

474
00:28:31,280 --> 00:28:34,700
I'm pretty sure I saw LOL go down in a comment somewhere.

475
00:28:36,060 --> 00:28:36,860
Oh, here we go.

476
00:28:36,860 --> 00:28:37,980
Double free detected.

477
00:28:37,980 --> 00:28:38,440
All right.

478
00:28:38,440 --> 00:28:39,820
So they have double free.

479
00:28:40,260 --> 00:28:43,120
Need to figure out how to bypass that check.

480
00:28:45,790 --> 00:28:49,470
And I think you can almost feel it in the pace that they're going.

481
00:28:49,470 --> 00:28:51,710
They feel like they're on to something.

482
00:28:51,710 --> 00:28:53,110
They feel like they're close.

483
00:28:54,210 --> 00:28:57,810
See the TCache chain there.

484
00:28:57,810 --> 00:28:58,770
Comprex negative...

485
00:28:59,510 --> 00:29:00,750
That was an impact.

486
00:29:02,170 --> 00:29:03,370
That's an instruction.

487
00:29:03,370 --> 00:29:03,770
Okay.

488
00:29:03,770 --> 00:29:04,610
I don't know though.

489
00:29:04,610 --> 00:29:05,850
I didn't write it.

490
00:29:05,990 --> 00:29:07,050
I was in read.

491
00:29:09,330 --> 00:29:10,990
That would explain it.

492
00:29:12,050 --> 00:29:14,990
I did not in fact write libc.

493
00:29:15,210 --> 00:29:16,690
Believe it or not, I did not do that.

494
00:29:16,690 --> 00:29:17,750
You're not the author.

495
00:29:17,750 --> 00:29:18,350
No, sorry.

496
00:29:18,350 --> 00:29:19,630
I'm not John libc.

497
00:29:19,630 --> 00:29:21,610
We'll have to see if we can get them on next time.

498
00:29:21,610 --> 00:29:22,190
Yeah.

499
00:29:26,920 --> 00:29:28,420
So they're definitely...

500
00:29:28,420 --> 00:29:30,740
Oh, so it looks like over on HypeBoy.

501
00:29:30,740 --> 00:29:32,040
HypeBoy.

502
00:29:32,060 --> 00:29:42,140
They have just kind of highlighted Realloc as a point of interest, which may or may not be a point of interest, but they're breaking on it.

503
00:29:43,300 --> 00:29:44,760
There we go.

504
00:29:46,220 --> 00:29:54,140
So for Realloc, when you're looking at a Realloc in the context of a challenge like this, what specifically are you looking for?

505
00:29:55,540 --> 00:29:58,500
I mean, Realloc is such a specific thing.

506
00:29:58,500 --> 00:30:01,860
Going through it, it's usually totally fine.

507
00:30:01,860 --> 00:30:13,320
If someone calculates a size wrong, or they increment a list size, like size T, and then Realloc for it, and you have a leak at the end of it.

508
00:30:13,320 --> 00:30:16,620
You know, just basic things like that, where you kind of do things out of order.

509
00:30:17,540 --> 00:30:22,000
Also, if you pass zero to Realloc, fun fact, it's free.

510
00:30:22,080 --> 00:30:24,060
That's what I was going to highlight.

511
00:30:24,060 --> 00:30:24,700
Yeah.

512
00:30:24,960 --> 00:30:27,980
So that might be relevant.

513
00:30:27,980 --> 00:30:29,000
Yep.

514
00:30:31,020 --> 00:30:42,140
Realloc is always relevant if you can get a mismatch between the size value going into Realloc and the size of the field as the object itself, or how it's being interacted with.

515
00:30:42,160 --> 00:30:46,940
But also, if you can get that value to be zero somehow, Realloc becomes a free.

516
00:30:46,940 --> 00:30:51,540
And I am guessing that that's the case.

517
00:30:51,540 --> 00:30:55,540
You have to be real careful as a C author with that.

518
00:30:55,540 --> 00:30:56,440
Oh, yeah.

519
00:30:56,460 --> 00:30:57,620
You got to be real careful.

520
00:30:57,620 --> 00:31:00,520
Otherwise, you know, you might end up with tcache double free.

521
00:31:00,520 --> 00:31:02,280
And , you know, no one wants that.

522
00:31:02,580 --> 00:31:04,020
Especially these players.

523
00:31:04,720 --> 00:31:06,380
Oh, I think that they do want it.

524
00:31:06,380 --> 00:31:07,380
Oh, nah.

525
00:31:07,840 --> 00:31:09,440
That's not how the program's supposed to work.

526
00:31:09,440 --> 00:31:12,040
This is a nice little family run shop program.

527
00:31:12,280 --> 00:31:15,420
And they're just in here just destroying the heap.

528
00:31:17,920 --> 00:31:20,100
And I think I saw some...

529
00:31:20,800 --> 00:31:23,440
But yeah, I mean, nice shot.

530
00:31:23,440 --> 00:31:26,820
But I think I saw some eggs in there, and I'm just waiting for the shellcode to come out.

531
00:31:26,820 --> 00:31:28,700
Oh, wait, they're adding eggs?

532
00:31:29,280 --> 00:31:32,000
No, one of the items in the shop.

533
00:31:32,000 --> 00:31:33,460
Oh, shell, geez.

534
00:31:33,520 --> 00:31:34,100
Yep, I win.

535
00:31:34,100 --> 00:31:38,340
Yeah, I'm so like trying to figure out, you know, where they are in this.

536
00:31:38,340 --> 00:31:42,880
Because it is part of the solution to put eggs in your cards.

537
00:31:43,700 --> 00:31:46,860
Look, we're simple people here.

538
00:31:47,080 --> 00:31:49,480
We enjoy our dad jokes.

539
00:31:50,160 --> 00:31:52,000
You know, the in jokes in the CTF community.

540
00:31:52,000 --> 00:31:53,920
Oh, I saw somebody looking at the rules page.

541
00:31:53,920 --> 00:31:54,220
Oh, wait.

542
00:31:54,220 --> 00:31:56,800
Oh, they're connecting to a remote instance.

543
00:31:57,340 --> 00:31:59,980
Oh, they got a shell.

544
00:32:00,560 --> 00:32:02,360
Oh, we might be looking at...

545
00:32:02,360 --> 00:32:02,820
At Hypeboy.

546
00:32:02,820 --> 00:32:04,040
Yeah, Hypeboy got a shell.

547
00:32:04,040 --> 00:32:04,880
They submitted.

548
00:32:04,960 --> 00:32:05,980
Hypeboy won.

549
00:32:06,820 --> 00:32:07,500
Oh my goodness.

550
00:32:07,500 --> 00:32:08,320
Hypeboy wins.

551
00:32:08,340 --> 00:32:10,220
And they have a cute cat in their taskbar.

552
00:32:10,700 --> 00:32:11,520
Congratulations, Hypeboy.

553
00:32:11,520 --> 00:32:12,100
Well done.

554
00:32:12,200 --> 00:32:12,880
Well done.

555
00:32:12,880 --> 00:32:13,880
How long was that match?

556
00:32:13,880 --> 00:32:14,080
Did we...

557
00:32:14,080 --> 00:32:17,200
Oh, unknown.

558
00:32:17,220 --> 00:32:17,720
Unknown.

559
00:32:17,720 --> 00:32:18,540
It was a match.

560
00:32:18,540 --> 00:32:20,120
Oh, and they already turned off the stream.

561
00:32:20,180 --> 00:32:20,780
They're done.

562
00:32:21,120 --> 00:32:22,700
So they're over there shaking hands.

563
00:32:22,700 --> 00:32:24,880
Everyone's been fantastic sports.

564
00:32:24,880 --> 00:32:28,720
You know, it's been all smiles.

565
00:32:28,720 --> 00:32:30,680
No one's salty about this.

566
00:32:30,680 --> 00:32:31,920
It's a fun competition.

567
00:32:31,920 --> 00:32:33,400
People respect each other here.

568
00:32:33,400 --> 00:32:35,540
Everyone knows you've earned your place here.

569
00:32:35,700 --> 00:32:39,100
Yeah, I think I've seen disappointment.

570
00:32:39,100 --> 00:32:39,780
Sure.

571
00:32:39,880 --> 00:32:42,720
But I, you know, shaking hands.

572
00:32:43,240 --> 00:32:45,220
I think everybody respects each other.

573
00:32:45,220 --> 00:32:48,580
Everybody knows that if you're here, you have made it.

574
00:32:48,580 --> 00:32:53,820
And these challenges are hard for no other reason than just the environment that it's in.

575
00:32:53,820 --> 00:32:58,380
All of these players have already been playing in, you know, the Olympics of hacking.

576
00:32:58,420 --> 00:33:04,780
So to come and play this sprint on the side of it, in the middle of a marathon, if you will.

577
00:33:06,400 --> 00:33:08,520
Well, that was another match from us.

578
00:33:08,520 --> 00:33:10,100
It was a pleasure casting with you.

579
00:33:10,100 --> 00:33:10,460
Yep.

580
00:33:10,460 --> 00:33:11,420
I'm glad they solved it.

581
00:33:11,420 --> 00:33:12,740
Great working with you, Josh.

582
00:33:13,320 --> 00:33:14,960
And good job on the challenge.

583
00:33:14,960 --> 00:33:18,940
I think that was appropriately difficult.

584
00:33:19,100 --> 00:33:22,520
It was tense there for a bit, but I'm glad that we got to see a solve.

585
00:33:22,520 --> 00:33:25,160
That was my nicest challenge.

586
00:33:25,160 --> 00:33:26,700
The other ones are mean.

587
00:33:26,980 --> 00:33:29,260
So we'll see how those go later.

588
00:33:30,460 --> 00:33:33,060
But it's been fun casting.

589
00:33:33,060 --> 00:33:33,940
It was a good match.

590
00:33:33,940 --> 00:33:35,160
Thank y'all for joining.

591
00:33:35,200 --> 00:33:38,540
And we'll be back with another match shortly.

592
00:33:38,540 --> 00:33:39,180
Yep.

593
00:33:39,320 --> 00:33:39,980
See you soon.

594
00:33:39,980 --> 00:33:40,580
Take care.