start	end	text
350	1550	Oh.
2910	5030	Okay, so we're going to sudden death.
5030	5470	All right.
5470	6410	It's a face-off here.
6410	7310	It's all three of us.
7310	9270	He was saying say hi to the camera.
9670	11170	Instead, we just look confused.
11170	11390	Yeah.
11390	12070	All right.
12070	12570	Yeah.
12570	13110	Hello.
13110	14470	Good to see you again, everyone.
14610	15110	Welcome back.
15110	16290	We've been here the entire time.
16290	17170	We have.
18370	19550	Yeah, I'm...
19550	20750	The real challenge starts,
20750	24350	which is they have to use my laptop to deploy sudden death.
24370	24830	Oh, no.
24830	26630	I have a script that runs it.
26770	27570	Okay.
27650	29310	It should be straightforward.
29310	31930	Is this the first sudden death of the day?
32270	32970	It is.
32970	33270	It is.
33270	33810	Okay.
33870	34630	All right.
34630	36990	So I'm going to be very curious how this goes.
36990	39710	We really got so close to sudden deaths before.
40310	42750	We got, I think, within a minute of one for the last one.
42750	43430	The last one.
43430	43930	Yeah.
44070	45990	And then this one, we finally went...
45990	46710	Yeah.
46710	48370	We finally went a mile, a full distance.
49730	50730	That's tough.
50730	52850	It's really tough because you're kicking yourself.
52930	54210	You're still...
54210	56010	Even though you're setting up for the sudden death,
56010	56890	like you know in your head,
56890	58930	you're thinking about like where those things were on the stack,
58930	60250	what gadgets you're using,
60250	62090	and you're getting those epiphanies of like,
62090	63050	oh, I should have done this,
63050	65310	or oh, I remember that error is because of this.
65390	69790	I wonder if we're going to see someone just overflow gets and start calling Ioctl.
70190	72450	Yeah, just go right in, right back in.
72450	73250	Yeah, go back.
73810	76190	No, but it's nice because it's not a sudden death we're going into
76190	77990	where one team had a major lead above the other.
77990	78290	Right.
78290	80110	These were neck and neck.
80210	80430	Yeah.
80430	81910	It cannot be closer.
81910	83310	We were both writing their off-chains.
83310	86850	We had a system being called over here with just a Python error.
86850	87470	Right.
87470	88950	Building up to a system called here.
88950	92850	Yeah, it's really tough to say who was further ahead there.
92850	94550	I think it was a dead tie.
94550	95330	Dead tie.
95330	95930	Yeah.
96550	100870	I don't know how hard it is to fix those PwnTools errors when they come up.
101510	105210	It looks pretty scary because I have no idea what that was.
105270	106970	I don't know if that's solvable.
106970	108870	So is this the challenge?
108870	111030	Okay, we're closing the old challenge.
111150	112510	Did he save the IDP?
112510	113270	What's up?
113270	113810	Countdown?
114050	116070	All right, we're doing another countdown.
116610	117150	Oh.
118250	120350	Okay, so we're explaining the rules.
120370	122150	Sudden death, very easy challenge.
122150	125250	We don't have a hard time limit on it because it is kind of easy.
126830	128570	And we're ready for the countdown.
128570	129530	You do it this time.
129530	130470	Thank you so much.
130470	135650	We're going with sudden death in 5, 4, 3, 2, 1.
136010	138330	All right, here we go.
138910	139430	What do we got?
139430	141710	We got the live CTF page open.
142030	143370	Downloading the challenge.
143370	146050	Literally just gets is the name of the challenge here.
146050	147450	Gets is the challenge.
147450	150290	I'll wait to switch over until they're out of their downloads folder.
150290	151010	Yep, yep.
151010	152410	But let's go over to...
152410	153750	Oh, there's natural scrolling on.
153750	154230	That's up.
154810	156750	Let's go over to Straw Hat.
157130	160170	They're immediately loading it into IDA, as we expect.
160170	161510	Literally just gets.
161510	163110	Literally just gets.
163570	167650	And on Orge Accrout, they're doing their Pwn Template and IDA.
167650	169690	Sudden death, it's just gets.
169690	171450	It is literally just gets.
171450	172410	It is just gets.
172410	173030	It is...
173030	173690	Gets buffed.
174310	176390	Technically, there was a knit.
176390	177810	I don't know what a knit does.
177810	179070	A knit sets vbuff.
179070	179730	Oh, okay.
179730	180470	Okay, yeah.
180470	181170	All right.
181990	183710	You don't want to be literally just gets.
183710	184850	By the way, we buffer your input.
184850	186010	Yeah, yeah, yeah.
187330	193110	So, I think Orge Accrout has a slight edge here because they already have the Pwn Template.
193190	195030	I see, yeah.
195030	196870	It has the executable.
196870	199190	It has GDB stubs for it.
200610	202670	Yeah, literally just gets.
202670	204630	And there can't be stack cookies, right?
204630	205930	There's no way there's stack cookies.
205930	207370	That would make this very difficult.
207370	210250	Yeah, but there's stack cookies.
210270	213290	Yeah, so, let's see.
213290	215290	Do we have any win conditions?
215290	216650	It looks like we...
217140	219190	Is this an all the gadgets sort of thing?
219450	220250	I don't know if it's an all the gadgets sort of thing.
220250	223350	Because if we have to wrap, then we're kind of just where we were before, aren't we?
223350	223730	Oh my god.
223730	225510	Because they already had PC.
225790	227350	There's no way were they.
227350	227890	Right?
228250	229570	Wait, there's no way.
229570	231390	Because if they have to wrap, then it's...
231390	234030	Unless there's like no relocation or something like that.
234030	237410	And you, like, there's just less fix-ups or fewer fix-ups.
237410	240330	Yeah, it could be no railroad and you just go back and over again.
240330	241030	Right.
241050	242670	But then how do you get a libc lead?
243190	243990	Yeah.
244330	246250	Yeah, you can do partial overwrite.
246350	247890	Yeah, partial overwrite.
248190	249710	Partial overwrite got returned to system.
249710	250290	I think that's fine.
250290	251610	Yep, 264.
251610	252850	How big was the buffer?
252870	253950	256, was it?
253950	255010	256, probably.
255010	256270	And then there's...
256270	257370	Orbit route is looking at cyclic.
257370	259090	So they're figuring exact offsets.
259090	260350	Yep, then the stack address.
260350	261770	So you get the stack address.
261770	262630	Yeah, oh, here it is.
262630	264750	Oh, yeah, they're just straight hard coding.
264850	269330	Now, I don't know if anyone has actually listed the protections on this.
269330	270630	No one has.
271570	272070	On this.
272070	274130	Yeah, they're looking for ROP gadgets.
274130	274990	And it's the same thing.
274990	276110	It's all the gadgets.
276110	276310	We're back.
276310	278370	So we might just be right back where we were.
278370	279610	It's going to be a ROP race.
279910	281450	It's a ROP race again.
281730	285690	But I don't know how much difference this environment...
285690	286610	Hang on, hang on.
286610	286910	Wait a minute.
286910	288190	Orbit route is just go...
288190	289530	Okay, well, they went away from it.
289530	291310	Orbit route is just going straight to shellcode.
291770	292170	Okay.
292210	295450	They're just doing pwntools shellcraft sh.
295470	296190	Okay.
297390	304090	Yeah, I guess you know that the binary is not going to be relocated if you see the 40100, right?
304090	306330	Because otherwise, it would be based at zero.
306870	310050	I mean, theoretically, I guess you probably could have it that way.
310050	312450	Yeah, I guess you don't know that, but it is.
312450	314130	Yeah, it definitely is.
315430	318350	So we at least have the addresses hardcoded.
318350	322750	And on Straw Hat, it looks like we're making the actual payload that we're going to send.
323870	328870	264As, a PopRDI gadget, which is where we're going to ret to.
330450	332530	And yeah, it looks like...
332530	335770	All right, so they're just finding gadgets right now.
335770	336390	Yeah.
336550	338570	Orgicrout, I think...
338570	341030	I don't know if there's NX.
342110	342950	Really?
343250	344310	Well, they haven't checked.
344310	345310	No one's checked?
345310	346090	No one's checked.
346090	347610	Unless there's some, like, small...
347610	349830	Oh, no NX. There's no Pi, no NX.
349830	351290	It's RWX segments.
351410	352710	No Canary, no Railroad.
352770	353910	Oh, okay.
354610	355050	Okay.
355630	356490	Huh.
357510	357950	So...
357950	360970	Now, on Straw Hat, we're doing Rob, and I think that's...
360970	362790	I think that's super overkill.
363170	364050	I do too.
364050	366150	I mean...
366150	369630	I guess, will they know where libc is going to be based at here?
369630	370730	I don't think they will.
370730	372230	I don't think they do.
372230	374550	They're going to have to somehow figure that out.
375070	378010	It looks like there are a lot of functions for literally just Gatsby.
378530	381990	Oh, I think they're calling puts so they can leak an address, but I...
382610	384370	Ah, this is going to be really tough.
384370	385370	Wait, they're roping too!
385370	386990	Oh, god, here we go again.
386990	389070	Oh, god, it's...
389070	390630	Oh, oh, hang on.
390630	392950	But they're going to rop to...
392950	395810	Maybe they're going to rop to one of the RWX sections?
396490	397890	Do they know where it is?
398870	399590	I don't know.
399590	400590	Oh, well, yeah, I guess they do.
400590	401930	It's in the binary. It's not Pi.
401950	402550	Yeah.
403870	405230	Are they going to rop to puts 2?
405230	407310	If they rop to puts 2, we're switching back to Stronger.
408290	409570	We're switching back anyway.
410250	411090	Oh, my gosh.
411110	412830	What's going on over there? It's a little far from my eyes.
412830	413550	Yeah, so we're...
414230	415790	Do you want me to turn this a little bit towards you?
415830	416370	Maybe.
416370	417590	I don't want to, like, tip it off the table.
417590	418470	Oh, god, just don't...
418470	420310	That's fine. Don't touch any more than that.
422210	424550	Um, yeah, it looks like we are...
425150	427630	So they have a PubRDI, they have NSH, they have System.
427890	428450	Yep.
428950	430270	Do they have RIP?
430970	432370	Oh, they just got a success.
432370	435390	That's good. I think that's the first segment so far.
436790	438750	We are going to look at segments on Oracle Cloud.
438810	440530	Oracle Cloud immediately loading segments.
440550	440790	R...
441510	442690	Maybe it's not RWX.
442690	445130	Oh, it's probably in the init is the RWX.
445570	447410	I see. I see.
448430	450690	Oh, VM map. Now we get to see what it is.
450850	451570	Stack is RWX.
451570	452330	Yeah, there's no NX.
452330	454350	Oh, yeah, so just stack is RWX there.
454350	455630	Just stack is RWX.
456270	457810	But do you know where the stack is?
457810	460890	I guess if you leak it, like a puts or something like that.
461850	464770	Well, you also have the...
464770	467750	You can get it off the stack as well, potentially.
467850	471410	I mean, you get one ROP, you get like RSP or something.
471410	472110	Yeah.
472250	475810	Here we're doing a remote connection on Straw Hat.
475810	476570	Oh, hang on.
476570	477350	Wait, is that...
477350	478650	Are they running it?
478650	480090	Dot slash submitter?
480090	482370	You won, your team won, Straw Hat.
483930	485030	Oh my gosh.
485030	486030	And they just...
486030	487370	It came down to the ROP race.
487370	487870	Yeah.
489710	490910	All right.
491450	492890	Oh my goodness.
492890	493530	Wow.
495530	495930	That's...
495930	497590	That was pretty good.
497590	498610	That was a really good match.
498610	504810	I mean, I'm kind of glad that we got to see some of the ROP at the very end there because, you know, we all like seeing ROP.
504810	506010	We all like seeing ROP.
506010	506210	Yeah.
506210	508070	You know, I've never met someone who doesn't like ROP.
508070	509310	Of course, yeah.
510190	510850	Wow.
511050	512450	That was a really good match.
512450	513430	It went to full time.
513430	514810	It went into sudden death.
514810	517570	Did they end up being the same exploit technique?
517810	518130	Yeah.
518130	522950	I didn't end up seeing if Straw Hat ended up using that RWX.
522950	524190	I think they just ROP'd it.
524190	524890	They just ROP'd it.
524890	526830	I think they just straight ROP'd it.
526870	530070	You don't even need a non-NX stack.
530170	530670	Yeah.
530670	533870	To be honest, that's an easy enough ROP that you might as well.
533870	534270	That's fair.
534410	534810	So...
534810	537310	I think the ROP is easier than the leak.
537310	537790	Yeah.
537790	538350	Yeah.
538350	538890	All right.
538890	541010	Well, it looks like they have all wrapped up here.
541010	541590	Yeah, that's it.
541590	543330	That was our final match for the day.
543330	543870	Yeah.
544310	545810	We're going to take a look...
545810	547550	I mean, we're not going to take a look.
547550	548930	We're going to be on the bracket for the rest.
548930	550770	And then we'll be back tomorrow.
550770	551150	Yeah.
551150	552010	Sounds good.
552410	553870	What time are we back tomorrow?
555510	556350	We should know this.
556350	557470	Yeah, you should know this, Jordan.
557470	557990	Yeah.
558010	560630	So, ideally, we'll be back at...
561170	561530	At...
562150	562510	At...
563730	565170	10 a.m. Pacific.
566350	567010	All right.
567010	568970	Okay, so we'll be back at early Pacific.
568970	569810	We'll see you then.
569810	570930	And we'll see you all then.
570930	571690	Thanks for tuning in.
571690	572290	Cheers.
573870	575050	Cheers.