And we're back. Live CTF here at DEF CON. And I'm Mark Griffin and I'm joined this time
by Josh from Vector35. Yeah, Josh aka Negasora on everything I'm on. And it's been fun working
on this. It's my first time on camera for it. I think, oh my gosh, maybe ever. You're
welcome. Yeah, thank you so much seasoned veteran like yourself. Yeah, right. My second
time. Yeah. No, but I've been working behind the scenes and just set up infrastructure
to be one script that works. So I think without further ado. Yeah, let's get into it. So again,
this is the third challenge. We got matches five and six. Bluewater versus Macaroni and
we'll be commenting Super Dice Code versus Hypoid. Yeah. So Bluewater, Macaroni, team
one versus team eight seated. And then Super Dice Code placed fourth and falls Hypoid 12th.
So I think these are going to be pretty good matches. There could be an upset here. I'm
excited to see it. So should we just get into it? All right. Yeah. Let's start the challenge
in five, four, three, two, one. Go. Go. And we're live. Let's watch. And I think we can
watch and get right into it. Oh, very nice. All right. So this is a challenge called Shop
that I wrote. Oh, God. Three months ago. Yeah. Let's go three months ago and not a month ago.
Super fresh in your mind. Super. Oh, it's real. You know, I still think about it. Never.
It's a simple one. I'm not going to lie. You know, it should be one of the faster matches,
but it should still be interesting to see the way they approach it because it is open ended
enough that there are there's more than just my intended solution. Yeah. And, you know, of course,
with the time pressure and the environment and these these folks have been working hard on the
DEF CON CTF final. So they're under a lot of pressure, a lot of mental fatigue already,
I'm guessing. So definitely even the easiest problems can become hard. Yeah, absolutely.
But we see Super Dice Code getting right into it, dropping it into IDA, starting to
starting to annotate, fill out the the names of everything so they can really figure out what's
going on. Now, interestingly, Hypeboi, instead of dropping it directly into a decompiler,
well, OK, as I say that, but they were just interacting with it. They just wanted to see
what the flow was before they even took a look at it, which honestly, that's usually my approach.
If I know it's not like malware in the CTF setting, I just run the thing and I'm like,
OK, it prints here. Let's step back from the first print and see if anything weird happens.
Then I continue forward. Yeah, you know, I find it's really interesting. There's really
a lot of different opinions on how to go about it. Some people like to go completely static until
they have an idea of what the bug is, and some people just want to jump in and start interacting
with it. The people that just look at a binary statically and get it, like just have a solution
from it. I don't know how they have the stack layout in their mind like that. I try to remember
and it pulls a memory overflow. Yeah, some of my good friends. But yeah, me, I love dynamic
analysis. I want to see it in the debugger. That's how I operate. And I think I already
see a debugger popping open. Yeah, that's fast. Oh my gosh. OK, so they're going through the
interaction loop right now, at least over on Hypeboi they are. Yeah, we're looking at Hypeboi.
And let's see. So it's a shop interface. You can open accounts, you can look at shelves,
log into an account. And this is a fairly standard format for a CTF problem, right?
Where there's a menu and you've got different options and each option sort of presents you a
different functionality. And usually it's a combination of those functionalities that you
use to leverage a bug, right? Oh, yeah. Yeah. Whenever I see a menu pop up, my first thought
is heap. And then if I don't see mallocs or anything in there, I'm just like this author
has no idea. Yeah, well, so the last challenge, for example, no menu. It was a straight stack
buffer overflow. The bug was in parsing. And in this case, we're looking at a heap bug and the
menu is classic. Though I think that this one, it's not exactly your typical heap, right? Like
usually there's like one setup, add, delete, print sort of thing. It looked like there was a little
bit more going on in this one. There's a little more going on. You have to do a little bit of
heap manipulation to actually get things to line up where you want it. The gist of it and actually
super dice code just was in the win. Yeah, the win function here. So they already marked a
condition as the win flag, which, you know, it's like an admin check kind of. Okay. I was going to
ask, was it labeled win function? Because I know some of the these like faster challenges. I think
yeah, this is stripped. So they're, they're working from nothing. Gosh. And that's, that is
something that for me, I, I really just love it when I see symbols in a binary, if it's stripped
and you have to, you have to manually annotate what each variable is or function, it can be
time consuming. Yeah. Allow me to be a shill for a second, but Binary Ninja just got auto var naming.
So like, honestly, it's been kind of nice. I used to, when I was testing one of your challenges,
it just sped it up. And that's a good point. And you know, one of the things that I'm
interested to see here is that we've got amazing competitors with really all sorts of tools, but
I think that I've largely just been seeing IDA and debugger use and, you know, phone tools for
scripting, but not a whole lot else. And I was curious what people might bring to these
challenges, whether it's something like anger, symbolic execution, or, or the shellfish team
didn't go for anger, right? I I'm thinking it's a second language for them, which it probably is,
but I does their first language, especially, I think it was Kyle bought for shellfish.
So that doesn't surprise me. But yeah, but with a bug like this, what, what, what's your approach?
So you, we've talked about, okay, so there's a menu, but you know, what's your approach for
trying to find a bug when you see that menu? What are you looking for?
So when I see that menu, I want to look for like misuses. So passing to realloc, malloc zero,
you know, just like an unchecked free, especially in custom memory implementations.
That's a really big one. So those are the first step. And then I go through, I annotate structures.
I want to see like, is it going to be a fast spin thing? Is it going to be a T-cache thing?
Like, because if it's a T-cache thing, you know, it's ABC, it's like a formula.
So I'm looking to see kind of what the allocated chunks would be, how they can push each other
around. If I have any likely, like, or if I have an overwrite, like how far invented out it can I
get, et cetera. Yeah. And, and so you brought up a fast spin T-cache. I think that it's really
important for a lot of folks who are newer to this, that you can get a challenge like this,
and maybe you don't know those techniques, and it can be really intimidating. But a lot of the time,
it is more procedural, I think, than people make it. Once you understand the bug primitive, like,
what does this really give you or allow you to do that you shouldn't be able to do? From there,
as you said, you can say, oh, well, this is, this is playing into, you know,
using a T-cache-based technique or something similar. Really, hacking is just that. It's
building on, you know, baby steps of knowledge and kind of inching closer to your goal. And that's,
you know, hackers are notorious for, you know, having code that works, but it's built on a pile
of hacks. Like, but that, that's kind of a thought process you pick up, is you make tiny steps
towards the eventual goal. Yeah. So, let's take a look at, let's switch over to Hypeboi here.
So, what are we seeing on the, what does it look like they're doing with their debugger over there?
Okay. So, they actually just got double free in T-cache. Oh. Very nice. Making good progress.
Yeah, that's making great progress. I think it's making great progress. I don't remember
the solution right now. It sounds really familiar. But, well, I can see, it looks like they're using
Jeff as their GDB init script. And it looks like they've got a heap helper that they're using,
right? To tell them what they've got. Oh, and those can be invaluable. I used that
when developing this challenge. Yeah. And it was just so nice helping
figure out what the layout was. I used Pwnbag, Pwndebug. But I used to use Jeff.
Both of them are fantastic. Used to use PdoA before that. Yep.
Let's see. So, they're going through, they're figuring out that there's a max number of users.
No. Oh, they're just figuring out that users is a linked list. Okay.
So, going through, figuring out how they get to the double free. And there's a common technique,
or a common technique. There's a way to avoid detecting tcache double frees. And that's to
something in between. You know? It's dumb. But glibc is itself. So, let's see. Setting break
points in... I shouldn't have stripped this. It makes it hard to commentate.
It looks like they're setting break points in the checkout.
Though I will say, it may not be easy to tell from the streams, but these folks are extremely
fast. Oh, they're crazy fast. They are annotating as they're going. And they're typing so fast. If
we had them on the stream, you know, it's just... Oh, it's wild. It's crazy. You see the people...
They're so fast. Yeah. And you think one person is going fast and the other person just suddenly
jumps like five steps ahead of them. It was last match, I think, where... no, two matches ago,
where someone was building a ROP chain before the other guy even started. Other guy just
knocked one out immediately. The guy was still debugging. The first guy was still debugging it.
He's like, oh, my God, I can't believe it. When you're in these high-pressure, you know,
race situations, your thinking just goes all over the place. Your heart rate's up. You're thinking,
like, oh, how far is he? Did he find something I didn't like? He's been paused for kind of a
long time now. Is he just watching his script run? Like, so many things going through your mind.
Yeah, I really feel like it's stops and starts, you know? Like, you will be...
okay, I see what I need to do here. Get there. And then you need to stop and think and explore
what's the next step. And then, especially at this level, once they know what that next step
is, they are off to the races. Oh, yeah. And it's just bing, bing, bing, bing. And then,
okay, what's the next thing that they have to figure out? Getting from point A to B is something
they've done thousands of times. Yeah, yeah. There really is a lot of practice. In fact,
before we went live on the stream on the last one, I saw one of the competitors pop and open
a challenge binary from a year past or something and practicing right there, right before they went
into this match. Getting his APM up. Oh, my God. You know, you can't... there's so much work that
goes into building the knowledge and the reflexes that these competitors have. Oh, yeah. And just
kind of the sixth sense you get for it, like something sticks out to you that looks totally
mundane and you don't know why. Yeah, that's... I think that that's something that I hear from
pretty much every really seasoned CTF player or vulnerability researcher is,
this looks wrong. There's something wrong here. I may not be able to tell you yet what it is,
but I know something's wrong. Let's pop over to SuperDiceCode. Now, they're
still going through labeling a lot of this stuff.
It looked like they had a little bit more progress than the last time we were looking at them.
So, it looks like they're looking for overflowing a field in the password entry. So,
they've annotated in the comments some field offsets is what it looked like or maybe sizes.
And now they're typing out the struct. Okay, nice.
Oh, yeah, they just pulled it in. Pulled out the decouplation. And now they're... yeah.
Interesting. So, this is a big step of the process is just figuring out what the structs are.
Because when it comes down to it, if you don't know that, you're going to be staring at
I plus 18 and you're going to be thinking like, which one was that again?
Yeah, this is a lot of the behind the scenes work with reverse engineering that I think
if you're an old hand at it, if you're a veteran, you know there's a lot of that
work that you need to do in order to really understand what's going on and have a sense.
And usually, that's not a fast process, especially if you've got a strict binary
or a really large binary. And so, it's really interesting with these speed matches.
You don't want to be spending time annotating, but you kind of have to in order to understand.
Absolutely. It's cost benefit. It's, you know, retaining knowledge in the binary versus
you're losing time for it.
Right. I just saw I'm checking out that admin check, which I'm sure is going to be...
Well, it only lets the best admins through.
It's infallible, obviously. You shouldn't even look at it.
And I'm noticing here, it's interesting that they're flipping back and forth between
the disassembly and the graph view and the decompilation.
Yeah, going in graph view, it's really nice to see kind of interaction loops and switch cases
laid out in front of you and see if there are any complex paths it can take.
Yeah.
And then linear is just nice.
True. I don't know about you, but for decompilation, I want it linear.
But when I'm looking at assembly, I want it in graph view.
And I mean, I learned to RE on disassembly and graph view.
So that's very comfortable for me.
I know some people are linear disassembly all the way.
I like linear because that's how I learned to write assembly, you know, in a file.
So that's how I read it.
Yeah. And I think that, you know, we were just talking about how much time you have
to spend REing or annotating.
One of the things that I was taught and I pass on to anybody that I teach about reverse
engineering is you really want to spend as little time as possible annotating or like
diving into what does this function do?
Unless you're absolutely certain that that's an important function,
because especially in a match like this.
Oh my gosh.
Imagine, you know, there's this function that doesn't really do anything.
The rabbit holes.
Yeah, the rabbit holes.
How many times have you like just gotten dragged into like an optimized stir comp function
or like something that's so obvious when you look at it, when you look back at it?
Right.
But when you're in there, you're just like, oh, this, this moves so much memory around,
like it has to be doing something weird.
There's an offset missing?
No, it's totally fine.
Yeah, and that's something where having the experience, the reps,
understanding common algorithms and what they look like in the decompiler or in the graph,
disassembly graph view can really pay off because, you know, I've been there and I'm sure you have,
or been there working with a team member where they pop open a function and it's,
you know, stripped or whatever, and they just look at it and go,
yep, that's quicksort or that's this hash function.
I don't even need to read it.
No, I feel like everyone competing here has been on both sides of that,
where you're looking at it and you're like, I have no idea what this is doing.
And it's like, no, that's just bubble sort.
Or, you know, you're looking at some algorithm on someone else's screen,
just like from across the room while you're waiting for, you know, Z3 to finish sometime.
And you're just like, oh, you're looking at like Winston Churchill's algorithms.
I couldn't think of one.
Classic. I love Winston Churchill's algorithms.
One of the computers of all time.
Yeah. Little known.
Okay. And so on the superdice code, we see that their exploit script
starting to take some shape here.
They're starting to put the entries from the menu into the script itself, which
to me gives an indication that they've got an idea of what they're doing.
Are they breaking inside of malloc?
Well, I see read.
Yeah. Well, at the very, oh, yeah, they have some breakpoints inside of libc malloc.
Oh, do you think that maybe they have a watch point or something that prints out?
Oh, yeah. It looks like it's printing out the pointer and the size for a malloc,
which is very smart, especially if you don't have one of those
heap introspection tools, it sort of lays it out for you.
Yeah. Well, this also just sees because, you know, you could have the heap layout in front of you,
but you don't know the previous state of it.
This kind of helps you figure out, oh, I need to move this allocation later.
Yeah. Yeah. And I'm sure that the the tension is just mounting.
And when you when you have to do that sort of thing and instrument malloc.
Yeah. That's that's tough.
All right. Let's take a look at Hypeboi.
Yeah. Hypeboi, it looks like they're making some progress on their exploit.
They have once we see it, they have interaction wrappers.
No, they don't. They just have commands they're sending raw.
Looks like they've got they've tried a few things based on what I'm seeing commented.
Oh, yeah. And they're what is that?
To creating a user to zero is add an item to cart, I think.
Then they log out.
OK, that's sounding like like they're moving towards the solution.
It sounds like they figured something.
Oh, and look, they're laying out the chunks and the sizes.
OK. And you see them counting with the mouse.
I love that. I do that.
Yeah, I don't know about you, but it's often the case for me where
I will be trying so many things out in a script that by the end of it,
it's like three quarters is junk that I never went down a rabbit hole.
Nope, that's not what I want to do.
And just commented it out.
And there's like five lines of actual work.
Yeah, absolutely.
Well, you have to do the work to get the final result.
You can't just sit down and have a solution to this.
You need to work on it.
And we see him going through it really fast.
Yeah, so fast, just flipping through screens.
They have this understanding in their head
of the shape of this and what they're trying to do.
And you can see him moving between IDA and their terminal and debugger.
So it looks like HiPoI hasn't defined a user struct yet.
So I don't know if they're just writing it off or if there have been other places.
Or maybe they just didn't assign it in that case.
Well, you know, as we were saying, it takes time to build struct annotations.
Depending on what you're used to doing,
maybe they just felt like they didn't have time for it.
True, maybe they don't need to.
If we take a look on the super dice codes tied here,
I think I just saw a double free or a tcache issue.
So I feel like they're making progress too.
Okay, very nice.
Yeah, because they took kind of different approaches,
it doesn't surprise me that HiPoI got the first tcache free or tcache double free.
Because it looks like super dice code has way more marked up.
I noticed that, yeah, as they were going on,
they were consistently just annotating, annotating.
Yep, we can see they're using phone debug
and getting the heap helper to lay out what's going on.
Yeah, it may not look it, but these are like two very different approaches.
HiPoI going highly dynamic, super dice code going methodical.
Well, they're both methodical.
But going static and then running, you know,
figuring out if his assertions hold.
Right.
And then going back and annotating some more.
And I just saw, I don't know if we've seen checksec yet,
but I am, I can't remember what the mitigations were on this.
Oh, I'm surprised, yeah.
Really shaped.
Well, it's a heap exploit.
No, no, this has like full railroad, it has pi.
Okay, okay.
It has canaries.
This isn't, if I recall, this is more of a
figure out how to do a precise corruption and you win,
rather than having to do a full, you know, riprop or...
Yeah.
So once you get, you know, some write primitive, you...
Well, no, I don't think it has pi.
I don't remember.
But anyway, once you get a controlled write,
you overwrite the admin flag and win.
There was a win function there that admins get through.
Which, of course, they'll never be able to do because they're not admins.
Not yet.
Yeah, I don't know why they're there, it's crazy.
Just a matter of time, I'm sure.
Yeah, but I'm, yeah, I'm surprised there's been no checks there.
I guess they just haven't found anything to warrant it.
Right, well, you know, if it is a heap bug, then your first question probably is,
like, what's the bug, right?
Yeah.
Not an admin, so we see them poking at that,
seeing the system call right there.
They know they want to get there.
Yeah.
Ah, so, yep, now they're starting to figure out,
okay, what do I need to change to get there?
Got it.
Oh, yeah, and they're not even calling names, they're calling them chunks.
They don't care what they are, they just care about the memory they use.
Right.
All right.
Yep, okay, so we see that they've got on one side,
they've used their debugger to instrument the malloc and free calls,
see exactly which pointers are getting allocated when, as they're interacting with it.
And that's very fast, they've got it in their head.
That's really fast.
Yep, this command is going to malloc the free mode.
So, I feel like they're getting closer and closer.
All right, error removing item.
All right.
Man, they're moving so fast.
All right.
Yeah, let's hop back over to Hypoi.
And they're making good progress.
Looks like they've created a second user.
And we'll see what else they did once they go back to their script.
We have to be faster reading, because they know these scripts really well,
and we have to keep track of two of them that they're writing.
Yeah, so this is, I think it's funny, this is sort of the tense time when,
okay, it's not a quick solve, it's starting to drag on a little bit.
Like you said, there's kind of a morale aspect, but there's also hints, right?
There's two hints.
I think they're at, what are they, 25 and 40 minutes?
20, 35, something like that.
Yeah.
So, they're probably, I don't know how long we've been going here,
probably right about on the first hint or so, as far as timing.
And it's up to the challenge authors to figure out what is the hint that we should provide
to really give them a little bit of a breakthrough, and then that second hint should really be the,
all right, you've got, what, like 10 minutes left?
So, it should really pretty much lay it out there for them, that second hint.
Oh, it does. Oh, it does.
Yeah, the first hint, not very helpful.
You know, it's a nudge, it's a nub in the right direction.
The second hint is shooting them out of a cannon in the right direction.
Sometimes you need that.
Sometimes, yeah.
If you get the second hint, which, to be fair, these aren't the easiest challenges in the world.
Like, these aren't your CTF 50-point challenges.
Yeah, and I think that that's really important to mention here, is that we sort of categorize
these as easy because we want the challengers to be able to solve them.
We want it to be more of a speed competition, but it is always hard to know exactly, like,
what is, what's the exact difficulty level to get right?
And it's really hard to judge that when you have teams from all over the world
with different specialties, different members every year.
And, you know, they're the best in the world.
They're at DEF CON finals.
Right, right.
Yeah, so going back to the hints real quick, I remember on the first challenge,
there was a, we were in that moment where it was a little tense.
How long is it going to take to get to a solve here?
And so the first hint went out, and I'm pretty sure they looked at the hint, looked at us,
and they were like, all right, I already knew that.
Like, let me get back to hacking.
Why are you distracting me, you know?
Yeah, actually, I think the first challenge, the first challenge is pretty long, right?
So on the first challenge, now remember, we are, we're doing two matches,
two head-to-head matches, right?
And on the first challenge, the sort of other match finished very quickly.
We're announcing one match, and then the other match is, you can see one stream of each player,
and those players solve it quite quickly, at least 10 or 15 minutes faster.
And I think that on that, it was really a, somebody noticed a detail that the
challenge author left in that made it easier that I think everybody else missed.
Yeah, at the end of the first challenge, I was building the, it goes long,
a sudden-death challenge, and I was building it, ready to deploy it.
Yeah.
But right as I finished building it, I was about to ping people that,
hey, we need to go sudden-death. They got dissolved.
Yeah, it was a tense moment over here at the live CTF HQ.
Oh, yeah. I'm really hoping we don't go into sudden-death here.
Of course, because it's my challenge, I want them to solve it.
Sure.
But, you know, I want to give them some closure on the challenge.
Right? Oh, I know, I think I saw at least one competitor who,
they just wanted to finish, you know?
Oh, yeah.
They didn't win, but they wanted to finish.
They asked, can I stay around and just please debug my ROP chain?
Yeah.
Like, why didn't it work?
Yeah. So let's reassess where we've got SuperDiceCode and see what works.
It looks like SuperDiceCode is breaking on the admin checker once again.
Setting some breakpoints in their exploits here.
Oh, no, they're just calm, yeah.
They look like they are on their way.
Username and password.
Single-stepping.
They have a different pwnbag layout than I do, and it's kind of messing with my...
Yeah, and they're very fast, right?
So I'm used to looking at Jeff, and it's just a little bit different layout.
Yeah, we have the screens on the wrong side.
I have the Jeff screen and you have pwnbag.
Oh, you want to switch seats?
No, I'm good.
Let's see.
I'm definitely looking at that login.
Well, SuperDiceCode is annotating everything they can.
They're getting a good understanding of the program.
Even if the bug hasn't immediately jumped out at them, you know, by the time they reach
that intersection of their two kind of growing ends of knowledge, something will click.
Yeah, and that's, as you said, the differing approaches.
I tend to be more of the, I want dynamic analysis, but I really just want it so I can enrich my
static so I have a real understanding or a guarantee that what I'm looking at is what
I think it is.
Because if I try to do it all statically, you know, there's a lot of question marks
in my variable names.
Well, you can see on SuperDiceCode they have eight what?
Like they have 16 password, eight what?
There are so many times I just call something like underscore maybe or underscore maybe not.
Offset eight thing.
I'm pretty sure I saw LOL go down in a comment somewhere.
Oh, here we go.
Double free detected.
All right.
So they have double free.
Need to figure out how to bypass that check.
And I think you can almost feel it in the pace that they're going.
They feel like they're on to something.
They feel like they're close.
See the TCache chain there.
Comprex negative...
That was an impact.
That's an instruction.
Okay.
I don't know though.
I didn't write it.
I was in read.
That would explain it.
I did not in fact write libc.
Believe it or not, I did not do that.
You're not the author.
No, sorry.
I'm not John libc.
We'll have to see if we can get them on next time.
Yeah.
So they're definitely...
Oh, so it looks like over on HypeBoy.
HypeBoy.
They have just kind of highlighted Realloc as a point of interest,
which may or may not be a point of interest, but they're breaking on it.
There we go.
So for Realloc, when you're looking at a Realloc in the context of a challenge like this,
what specifically are you looking for?
I mean, Realloc is such a specific thing.
Going through it, it's usually totally fine.
If someone calculates a size wrong, or they increment a list size, like size T,
and then Realloc for it, and you have a leak at the end of it.
You know, just basic things like that, where you kind of do things out of order.
Also, if you pass zero to Realloc, fun fact, it's free.
That's what I was going to highlight.
Yeah.
So that might be relevant.
Yep.
Realloc is always relevant if you can get a mismatch between the size value going into Realloc
and the size of the field as the object itself, or how it's being interacted with.
But also, if you can get that value to be zero somehow, Realloc becomes a free.
And I am guessing that that's the case.
You have to be real careful as a C author with that.
Oh, yeah.
You got to be real careful.
Otherwise, you know, you might end up with tcache double free.
And, you know, no one wants that.
Especially these players.
Oh, I think that they do want it.
Oh, nah.
That's not how the program's supposed to work.
This is a nice little family run shop program.
And they're just in here just destroying the heap.
And I think I saw some...
But yeah, I mean, nice shot.
But I think I saw some eggs in there, and I'm just waiting for the shellcode to come out.
Oh, wait, they're adding eggs?
No, one of the items in the shop.
Oh, shell, geez.
Yep, I win.
Yeah, I'm so like trying to figure out, you know, where they are in this.
Because it is part of the solution to put eggs in your cards.
Look, we're simple people here.
We enjoy our dad jokes.
You know, the in jokes in the CTF community.
Oh, I saw somebody looking at the rules page.
Oh, wait.
Oh, they're connecting to a remote instance.
Oh, they got a shell.
Oh, we might be looking at...
At Hypeboy.
Yeah, Hypeboy got a shell.
They submitted.
Hypeboy won.
Oh my goodness.
Hypeboy wins.
And they have a cute cat in their taskbar.
Congratulations, Hypeboy.
Well done.
Well done.
How long was that match?
Did we...
Oh, unknown.
Unknown.
It was a match.
Oh, and they already turned off the stream.
They're done.
So they're over there shaking hands.
Everyone's been fantastic sports.
You know, it's been all smiles.
No one's salty about this.
It's a fun competition.
People respect each other here.
Everyone knows you've earned your place here.
Yeah, I think I've seen disappointment.
Sure.
But I, you know, shaking hands.
I think everybody respects each other.
Everybody knows that if you're here, you have made it.
And these challenges are hard for no other reason than just the environment that it's in.
All of these players have already been playing in, you know, the Olympics of hacking.
So to come and play this sprint on the side of it, in the middle of a marathon, if you will.
Well, that was another match from us.
It was a pleasure casting with you.
Yep.
I'm glad they solved it.
Great working with you, Josh.
And good job on the challenge.
I think that was appropriately difficult.
It was tense there for a bit, but I'm glad that we got to see a solve.
That was my nicest challenge.
The other ones are mean.
So we'll see how those go later.
But it's been fun casting.
It was a good match.
Thank y'all for joining.
And we'll be back with another match shortly.
Yep.
See you soon.
Take care.