[00:00.350 --> 00:01.550] Oh. [00:02.910 --> 00:05.030] Okay, so we're going to sudden death. [00:05.030 --> 00:05.470] All right. [00:05.470 --> 00:06.410] It's a face-off here. [00:06.410 --> 00:07.310] It's all three of us. [00:07.310 --> 00:09.270] He was saying say hi to the camera. [00:09.670 --> 00:11.170] Instead, we just look confused. [00:11.170 --> 00:11.390] Yeah. [00:11.390 --> 00:12.070] All right. [00:12.070 --> 00:12.570] Yeah. [00:12.570 --> 00:13.110] Hello. [00:13.110 --> 00:14.470] Good to see you again, everyone. [00:14.610 --> 00:15.110] Welcome back. [00:15.110 --> 00:16.290] We've been here the entire time. [00:16.290 --> 00:17.170] We have. [00:18.370 --> 00:19.550] Yeah, I'm... [00:19.550 --> 00:20.750] The real challenge starts, [00:20.750 --> 00:24.350] which is they have to use my laptop to deploy sudden death. [00:24.370 --> 00:24.830] Oh, no. [00:24.830 --> 00:26.630] I have a script that runs it. [00:26.770 --> 00:27.570] Okay. [00:27.650 --> 00:29.310] It should be straightforward. [00:29.310 --> 00:31.930] Is this the first sudden death of the day? [00:32.270 --> 00:32.970] It is. [00:32.970 --> 00:33.270] It is. [00:33.270 --> 00:33.810] Okay. [00:33.870 --> 00:34.630] All right. [00:34.630 --> 00:36.990] So I'm going to be very curious how this goes. [00:36.990 --> 00:39.710] We really got so close to sudden deaths before. [00:40.310 --> 00:42.750] We got, I think, within a minute of one for the last one. [00:42.750 --> 00:43.430] The last one. [00:43.430 --> 00:43.930] Yeah. [00:44.070 --> 00:45.990] And then this one, we finally went... [00:45.990 --> 00:46.710] Yeah. [00:46.710 --> 00:48.370] We finally went a mile, a full distance. [00:49.730 --> 00:50.730] That's tough. [00:50.730 --> 00:52.850] It's really tough because you're kicking yourself. [00:52.930 --> 00:54.210] You're still... [00:54.210 --> 00:56.010] Even though you're setting up for the sudden death, [00:56.010 --> 00:56.890] like you know in your head, [00:56.890 --> 00:58.930] you're thinking about like where those things were on the stack, [00:58.930 --> 01:00.250] what gadgets you're using, [01:00.250 --> 01:02.090] and you're getting those epiphanies of like, [01:02.090 --> 01:03.050] oh, I should have done this, [01:03.050 --> 01:05.310] or oh, I remember that error is because of this. [01:05.390 --> 01:09.790] I wonder if we're going to see someone just overflow gets and start calling Ioctl. [01:10.190 --> 01:12.450] Yeah, just go right in, right back in. [01:12.450 --> 01:13.250] Yeah, go back. [01:13.810 --> 01:16.190] No, but it's nice because it's not a sudden death we're going into [01:16.190 --> 01:17.990] where one team had a major lead above the other. [01:17.990 --> 01:18.290] Right. [01:18.290 --> 01:20.110] These were neck and neck. [01:20.210 --> 01:20.430] Yeah. [01:20.430 --> 01:21.910] It cannot be closer. [01:21.910 --> 01:23.310] We were both writing their off-chains. [01:23.310 --> 01:26.850] We had a system being called over here with just a Python error. [01:26.850 --> 01:27.470] Right. [01:27.470 --> 01:28.950] Building up to a system called here. [01:28.950 --> 01:32.850] Yeah, it's really tough to say who was further ahead there. [01:32.850 --> 01:34.550] I think it was a dead tie. [01:34.550 --> 01:35.330] Dead tie. [01:35.330 --> 01:35.930] Yeah. [01:36.550 --> 01:40.870] I don't know how hard it is to fix those PwnTools errors when they come up. [01:41.510 --> 01:45.210] It looks pretty scary because I have no idea what that was. [01:45.270 --> 01:46.970] I don't know if that's solvable. [01:46.970 --> 01:48.870] So is this the challenge? [01:48.870 --> 01:51.030] Okay, we're closing the old challenge. [01:51.150 --> 01:52.510] Did he save the IDP? [01:52.510 --> 01:53.270] What's up? [01:53.270 --> 01:53.810] Countdown? [01:54.050 --> 01:56.070] All right, we're doing another countdown. [01:56.610 --> 01:57.150] Oh. [01:58.250 --> 02:00.350] Okay, so we're explaining the rules. [02:00.370 --> 02:02.150] Sudden death, very easy challenge. [02:02.150 --> 02:05.250] We don't have a hard time limit on it because it is kind of easy. [02:06.830 --> 02:08.570] And we're ready for the countdown. [02:08.570 --> 02:09.530] You do it this time. [02:09.530 --> 02:10.470] Thank you so much. [02:10.470 --> 02:15.650] We're going with sudden death in 5, 4, 3, 2, 1. [02:16.010 --> 02:18.330] All right, here we go. [02:18.910 --> 02:19.430] What do we got? [02:19.430 --> 02:21.710] We got the live CTF page open. [02:22.030 --> 02:23.370] Downloading the challenge. [02:23.370 --> 02:26.050] Literally just gets is the name of the challenge here. [02:26.050 --> 02:27.450] Gets is the challenge. [02:27.450 --> 02:30.290] I'll wait to switch over until they're out of their downloads folder. [02:30.290 --> 02:31.010] Yep, yep. [02:31.010 --> 02:32.410] But let's go over to... [02:32.410 --> 02:33.750] Oh, there's natural scrolling on. [02:33.750 --> 02:34.230] That's up. [02:34.810 --> 02:36.750] Let's go over to Straw Hat. [02:37.130 --> 02:40.170] They're immediately loading it into IDA, as we expect. [02:40.170 --> 02:41.510] Literally just gets. [02:41.510 --> 02:43.110] Literally just gets. [02:43.570 --> 02:47.650] And on Orge Accrout, they're doing their Pwn Template and IDA. [02:47.650 --> 02:49.690] Sudden death, it's just gets. [02:49.690 --> 02:51.450] It is literally just gets. [02:51.450 --> 02:52.410] It is just gets. [02:52.410 --> 02:53.030] It is... [02:53.030 --> 02:53.690] Gets buffed. [02:54.310 --> 02:56.390] Technically, there was a knit. [02:56.390 --> 02:57.810] I don't know what a knit does. [02:57.810 --> 02:59.070] A knit sets vbuff. [02:59.070 --> 02:59.730] Oh, okay. [02:59.730 --> 03:00.470] Okay, yeah. [03:00.470 --> 03:01.170] All right. [03:01.990 --> 03:03.710] You don't want to be literally just gets. [03:03.710 --> 03:04.850] By the way, we buffer your input. [03:04.850 --> 03:06.010] Yeah, yeah, yeah. [03:07.330 --> 03:13.110] So, I think Orge Accrout has a slight edge here because they already have the Pwn Template. [03:13.190 --> 03:15.030] I see, yeah. [03:15.030 --> 03:16.870] It has the executable. [03:16.870 --> 03:19.190] It has GDB stubs for it. [03:20.610 --> 03:22.670] Yeah, literally just gets. [03:22.670 --> 03:24.630] And there can't be stack cookies, right? [03:24.630 --> 03:25.930] There's no way there's stack cookies. [03:25.930 --> 03:27.370] That would make this very difficult. [03:27.370 --> 03:30.250] Yeah, but there's stack cookies. [03:30.270 --> 03:33.290] Yeah, so, let's see. [03:33.290 --> 03:35.290] Do we have any win conditions? [03:35.290 --> 03:36.650] It looks like we... [03:37.140 --> 03:39.190] Is this an all the gadgets sort of thing? [03:39.450 --> 03:40.250] I don't know if it's an all the gadgets sort of thing. [03:40.250 --> 03:43.350] Because if we have to wrap, then we're kind of just where we were before, aren't we? [03:43.350 --> 03:43.730] Oh my god. [03:43.730 --> 03:45.510] Because they already had PC. [03:45.790 --> 03:47.350] There's no way were they. [03:47.350 --> 03:47.890] Right? [03:48.250 --> 03:49.570] Wait, there's no way. [03:49.570 --> 03:51.390] Because if they have to wrap, then it's... [03:51.390 --> 03:54.030] Unless there's like no relocation or something like that. [03:54.030 --> 03:57.410] And you, like, there's just less fix-ups or fewer fix-ups. [03:57.410 --> 04:00.330] Yeah, it could be no railroad and you just go back and over again. [04:00.330 --> 04:01.030] Right. [04:01.050 --> 04:02.670] But then how do you get a libc lead? [04:03.190 --> 04:03.990] Yeah. [04:04.330 --> 04:06.250] Yeah, you can do partial overwrite. [04:06.350 --> 04:07.890] Yeah, partial overwrite. [04:08.190 --> 04:09.710] Partial overwrite got returned to system. [04:09.710 --> 04:10.290] I think that's fine. [04:10.290 --> 04:11.610] Yep, 264. [04:11.610 --> 04:12.850] How big was the buffer? [04:12.870 --> 04:13.950] 256, was it? [04:13.950 --> 04:15.010] 256, probably. [04:15.010 --> 04:16.270] And then there's... [04:16.270 --> 04:17.370] Orbit route is looking at cyclic. [04:17.370 --> 04:19.090] So they're figuring exact offsets. [04:19.090 --> 04:20.350] Yep, then the stack address. [04:20.350 --> 04:21.770] So you get the stack address. [04:21.770 --> 04:22.630] Yeah, oh, here it is. [04:22.630 --> 04:24.750] Oh, yeah, they're just straight hard coding. [04:24.850 --> 04:29.330] Now, I don't know if anyone has actually listed the protections on this. [04:29.330 --> 04:30.630] No one has. [04:31.570 --> 04:32.070] On this. [04:32.070 --> 04:34.130] Yeah, they're looking for ROP gadgets. [04:34.130 --> 04:34.990] And it's the same thing. [04:34.990 --> 04:36.110] It's all the gadgets. [04:36.110 --> 04:36.310] We're back. [04:36.310 --> 04:38.370] So we might just be right back where we were. [04:38.370 --> 04:39.610] It's going to be a ROP race. [04:39.910 --> 04:41.450] It's a ROP race again. [04:41.730 --> 04:45.690] But I don't know how much difference this environment... [04:45.690 --> 04:46.610] Hang on, hang on. [04:46.610 --> 04:46.910] Wait a minute. [04:46.910 --> 04:48.190] Orbit route is just go... [04:48.190 --> 04:49.530] Okay, well, they went away from it. [04:49.530 --> 04:51.310] Orbit route is just going straight to shellcode. [04:51.770 --> 04:52.170] Okay. [04:52.210 --> 04:55.450] They're just doing pwntools shellcraft sh. [04:55.470 --> 04:56.190] Okay. [04:57.390 --> 05:04.090] Yeah, I guess you know that the binary is not going to be relocated if you see the 40100, right? [05:04.090 --> 05:06.330] Because otherwise, it would be based at zero. [05:06.870 --> 05:10.050] I mean, theoretically, I guess you probably could have it that way. [05:10.050 --> 05:12.450] Yeah, I guess you don't know that, but it is. [05:12.450 --> 05:14.130] Yeah, it definitely is. [05:15.430 --> 05:18.350] So we at least have the addresses hardcoded. [05:18.350 --> 05:22.750] And on Straw Hat, it looks like we're making the actual payload that we're going to send. [05:23.870 --> 05:28.870] 264As, a PopRDI gadget, which is where we're going to ret to. [05:30.450 --> 05:32.530] And yeah, it looks like... [05:32.530 --> 05:35.770] All right, so they're just finding gadgets right now. [05:35.770 --> 05:36.390] Yeah. [05:36.550 --> 05:38.570] Orgicrout, I think... [05:38.570 --> 05:41.030] I don't know if there's NX. [05:42.110 --> 05:42.950] Really? [05:43.250 --> 05:44.310] Well, they haven't checked. [05:44.310 --> 05:45.310] No one's checked? [05:45.310 --> 05:46.090] No one's checked. [05:46.090 --> 05:47.610] Unless there's some, like, small... [05:47.610 --> 05:49.830] Oh, no NX. There's no Pi, no NX. [05:49.830 --> 05:51.290] It's RWX segments. [05:51.410 --> 05:52.710] No Canary, no Railroad. [05:52.770 --> 05:53.910] Oh, okay. [05:54.610 --> 05:55.050] Okay. [05:55.630 --> 05:56.490] Huh. [05:57.510 --> 05:57.950] So... [05:57.950 --> 06:00.970] Now, on Straw Hat, we're doing Rob, and I think that's... [06:00.970 --> 06:02.790] I think that's super overkill. [06:03.170 --> 06:04.050] I do too. [06:04.050 --> 06:06.150] I mean... [06:06.150 --> 06:09.630] I guess, will they know where libc is going to be based at here? [06:09.630 --> 06:10.730] I don't think they will. [06:10.730 --> 06:12.230] I don't think they do. [06:12.230 --> 06:14.550] They're going to have to somehow figure that out. [06:15.070 --> 06:18.010] It looks like there are a lot of functions for literally just Gatsby. [06:18.530 --> 06:21.990] Oh, I think they're calling puts so they can leak an address, but I... [06:22.610 --> 06:24.370] Ah, this is going to be really tough. [06:24.370 --> 06:25.370] Wait, they're roping too! [06:25.370 --> 06:26.990] Oh, god, here we go again. [06:26.990 --> 06:29.070] Oh, god, it's... [06:29.070 --> 06:30.630] Oh, oh, hang on. [06:30.630 --> 06:32.950] But they're going to rop to... [06:32.950 --> 06:35.810] Maybe they're going to rop to one of the RWX sections? [06:36.490 --> 06:37.890] Do they know where it is? [06:38.870 --> 06:39.590] I don't know. [06:39.590 --> 06:40.590] Oh, well, yeah, I guess they do. [06:40.590 --> 06:41.930] It's in the binary. It's not Pi. [06:41.950 --> 06:42.550] Yeah. [06:43.870 --> 06:45.230] Are they going to rop to puts 2? [06:45.230 --> 06:47.310] If they rop to puts 2, we're switching back to Stronger. [06:48.290 --> 06:49.570] We're switching back anyway. [06:50.250 --> 06:51.090] Oh, my gosh. [06:51.110 --> 06:52.830] What's going on over there? It's a little far from my eyes. [06:52.830 --> 06:53.550] Yeah, so we're... [06:54.230 --> 06:55.790] Do you want me to turn this a little bit towards you? [06:55.830 --> 06:56.370] Maybe. [06:56.370 --> 06:57.590] I don't want to, like, tip it off the table. [06:57.590 --> 06:58.470] Oh, god, just don't... [06:58.470 --> 07:00.310] That's fine. Don't touch any more than that. [07:02.210 --> 07:04.550] Um, yeah, it looks like we are... [07:05.150 --> 07:07.630] So they have a PubRDI, they have NSH, they have System. [07:07.890 --> 07:08.450] Yep. [07:08.950 --> 07:10.270] Do they have RIP? [07:10.970 --> 07:12.370] Oh, they just got a success. [07:12.370 --> 07:15.390] That's good. I think that's the first segment so far. [07:16.790 --> 07:18.750] We are going to look at segments on Oracle Cloud. [07:18.810 --> 07:20.530] Oracle Cloud immediately loading segments. [07:20.550 --> 07:20.790] R... [07:21.510 --> 07:22.690] Maybe it's not RWX. [07:22.690 --> 07:25.130] Oh, it's probably in the init is the RWX. [07:25.570 --> 07:27.410] I see. I see. [07:28.430 --> 07:30.690] Oh, VM map. Now we get to see what it is. [07:30.850 --> 07:31.570] Stack is RWX. [07:31.570 --> 07:32.330] Yeah, there's no NX. [07:32.330 --> 07:34.350] Oh, yeah, so just stack is RWX there. [07:34.350 --> 07:35.630] Just stack is RWX. [07:36.270 --> 07:37.810] But do you know where the stack is? [07:37.810 --> 07:40.890] I guess if you leak it, like a puts or something like that. [07:41.850 --> 07:44.770] Well, you also have the... [07:44.770 --> 07:47.750] You can get it off the stack as well, potentially. [07:47.850 --> 07:51.410] I mean, you get one ROP, you get like RSP or something. [07:51.410 --> 07:52.110] Yeah. [07:52.250 --> 07:55.810] Here we're doing a remote connection on Straw Hat. [07:55.810 --> 07:56.570] Oh, hang on. [07:56.570 --> 07:57.350] Wait, is that... [07:57.350 --> 07:58.650] Are they running it? [07:58.650 --> 08:00.090] Dot slash submitter? [08:00.090 --> 08:02.370] You won, your team won, Straw Hat. [08:03.930 --> 08:05.030] Oh my gosh. [08:05.030 --> 08:06.030] And they just... [08:06.030 --> 08:07.370] It came down to the ROP race. [08:07.370 --> 08:07.870] Yeah. [08:09.710 --> 08:10.910] All right. [08:11.450 --> 08:12.890] Oh my goodness. [08:12.890 --> 08:13.530] Wow. [08:15.530 --> 08:15.930] That's... [08:15.930 --> 08:17.590] That was pretty good. [08:17.590 --> 08:18.610] That was a really good match. [08:18.610 --> 08:24.810] I mean, I'm kind of glad that we got to see some of the ROP at the very end there because, you know, we all like seeing ROP. [08:24.810 --> 08:26.010] We all like seeing ROP. [08:26.010 --> 08:26.210] Yeah. [08:26.210 --> 08:28.070] You know, I've never met someone who doesn't like ROP. [08:28.070 --> 08:29.310] Of course, yeah. [08:30.190 --> 08:30.850] Wow. [08:31.050 --> 08:32.450] That was a really good match. [08:32.450 --> 08:33.430] It went to full time. [08:33.430 --> 08:34.810] It went into sudden death. [08:34.810 --> 08:37.570] Did they end up being the same exploit technique? [08:37.810 --> 08:38.130] Yeah. [08:38.130 --> 08:42.950] I didn't end up seeing if Straw Hat ended up using that RWX. [08:42.950 --> 08:44.190] I think they just ROP'd it. [08:44.190 --> 08:44.890] They just ROP'd it. [08:44.890 --> 08:46.830] I think they just straight ROP'd it. [08:46.870 --> 08:50.070] You don't even need a non-NX stack. [08:50.170 --> 08:50.670] Yeah. [08:50.670 --> 08:53.870] To be honest, that's an easy enough ROP that you might as well. [08:53.870 --> 08:54.270] That's fair. [08:54.410 --> 08:54.810] So... [08:54.810 --> 08:57.310] I think the ROP is easier than the leak. [08:57.310 --> 08:57.790] Yeah. [08:57.790 --> 08:58.350] Yeah. [08:58.350 --> 08:58.890] All right. [08:58.890 --> 09:01.010] Well, it looks like they have all wrapped up here. [09:01.010 --> 09:01.590] Yeah, that's it. [09:01.590 --> 09:03.330] That was our final match for the day. [09:03.330 --> 09:03.870] Yeah. [09:04.310 --> 09:05.810] We're going to take a look... [09:05.810 --> 09:07.550] I mean, we're not going to take a look. [09:07.550 --> 09:08.930] We're going to be on the bracket for the rest. [09:08.930 --> 09:10.770] And then we'll be back tomorrow. [09:10.770 --> 09:11.150] Yeah. [09:11.150 --> 09:12.010] Sounds good. [09:12.410 --> 09:13.870] What time are we back tomorrow? [09:15.510 --> 09:16.350] We should know this. [09:16.350 --> 09:17.470] Yeah, you should know this, Jordan. [09:17.470 --> 09:17.990] Yeah. [09:18.010 --> 09:20.630] So, ideally, we'll be back at... [09:21.170 --> 09:21.530] At... [09:22.150 --> 09:22.510] At... [09:23.730 --> 09:25.170] 10 a.m. Pacific. [09:26.350 --> 09:27.010] All right. [09:27.010 --> 09:28.970] Okay, so we'll be back at early Pacific. [09:28.970 --> 09:29.810] We'll see you then. [09:29.810 --> 09:30.930] And we'll see you all then. [09:30.930 --> 09:31.690] Thanks for tuning in. [09:31.690 --> 09:32.290] Cheers. [09:33.870 --> 09:35.050] Cheers.