1 00:00:03,980 --> 00:00:07,020 Hello, and welcome back to live CTF. 2 00:00:07,640 --> 00:00:12,260 I'm Josh, aka Nagasora, coming back for another cast back to back. 3 00:00:12,260 --> 00:00:13,800 And I'm joined by... 4 00:00:13,800 --> 00:00:14,480 Gamoza! 5 00:00:14,480 --> 00:00:15,220 Hello! 6 00:00:15,220 --> 00:00:16,100 It's good to be here. 7 00:00:16,100 --> 00:00:18,080 I'm super excited to be doing this live. 8 00:00:18,080 --> 00:00:27,380 Last year I did this, I think, over Discord with like a 60 second delay, and that made it a little awkward because I was commentating on things that had happened in the past. 9 00:00:27,380 --> 00:00:29,680 Yeah, the late CTF doesn't really have the same rig to do it. 10 00:00:29,680 --> 00:00:31,520 No, no, it definitely doesn't. 11 00:00:31,880 --> 00:00:34,060 So I'm super excited for this. 12 00:00:34,060 --> 00:00:35,480 So who do we got going up here? 13 00:00:35,480 --> 00:00:39,280 We've got Straw Hat versus Orga Kraut? 14 00:00:39,800 --> 00:00:42,640 Organizers and Sour Cloud, maybe? 15 00:00:42,640 --> 00:00:44,060 Okay, all right. 16 00:00:44,060 --> 00:00:45,000 They're a merger team. 17 00:00:45,000 --> 00:00:46,260 Making a big team. 18 00:00:46,500 --> 00:00:50,140 Because they got rid of team size caps or something recently at DEF CON? 19 00:00:50,140 --> 00:00:51,360 Oh, I don't know actually. 20 00:00:51,360 --> 00:00:56,580 Because I remember like everyone started joining and making these like bigger and bigger teams, which is just kind of interesting to see. 21 00:00:56,580 --> 00:00:56,960 Yeah. 22 00:00:57,420 --> 00:01:02,880 Well, Shellfish, I don't know if they've ever had a real cap because Shellfish has had hundreds of people it feels like. 23 00:01:02,880 --> 00:01:04,300 Yeah, exactly. 24 00:01:04,300 --> 00:01:04,420 Yeah. 25 00:01:04,840 --> 00:01:05,780 All right. 26 00:01:05,860 --> 00:01:07,740 Well, I think everyone's ready, right? 27 00:01:07,740 --> 00:01:08,140 Yeah. 28 00:01:08,140 --> 00:01:09,780 You want to go over and give it a countdown? 29 00:01:09,780 --> 00:01:12,360 Ooh, a five or a three? 30 00:01:12,400 --> 00:01:13,740 Let's give it a five. 31 00:01:13,740 --> 00:01:14,600 We'll give it a five? 32 00:01:14,600 --> 00:01:16,280 Yeah, you know, really ramp it up. 33 00:01:16,280 --> 00:01:16,940 All right. 34 00:01:17,060 --> 00:01:23,000 Let's get ready in five, four, three, two, one. 35 00:01:23,080 --> 00:01:23,620 Go. 36 00:01:23,620 --> 00:01:24,580 All right. 37 00:01:24,700 --> 00:01:25,940 Let's see what we got. 38 00:01:26,460 --> 00:01:30,420 First over at Orgacrout, they are downloading the challenge. 39 00:01:30,420 --> 00:01:31,780 Classic first step. 40 00:01:31,920 --> 00:01:32,340 Okay. 41 00:01:32,340 --> 00:01:33,300 Oh, I like this. 42 00:01:33,300 --> 00:01:36,100 We've got the anime background here, which I love to see. 43 00:01:36,180 --> 00:01:37,980 Does anyone know this character? 44 00:01:38,240 --> 00:01:39,560 I guess not character. 45 00:01:39,560 --> 00:01:40,720 This anime. 46 00:01:41,080 --> 00:01:42,500 Ooh, right into AIDA. 47 00:01:42,500 --> 00:01:44,080 No Binary Ninja here. 48 00:01:44,080 --> 00:01:44,660 No Binjo. 49 00:01:45,100 --> 00:01:46,360 We haven't seen Binjo. 50 00:01:46,360 --> 00:01:47,460 We haven't seen Ghidra. 51 00:01:47,460 --> 00:01:47,840 Okay. 52 00:01:47,840 --> 00:01:49,060 Only AIDA so far. 53 00:01:49,060 --> 00:01:51,560 I'm going to pull up a YouTube chat right now. 54 00:01:51,560 --> 00:01:55,840 So that way I can interact with people. 55 00:01:55,940 --> 00:01:57,040 See what they're saying. 56 00:01:57,040 --> 00:02:00,520 Oh, yeah, exactly. 57 00:02:00,840 --> 00:02:02,860 So immediately kind of going into here. 58 00:02:03,660 --> 00:02:06,400 I've got Straw Hat right in front of me here. 59 00:02:06,420 --> 00:02:06,900 Yeah. 60 00:02:07,200 --> 00:02:09,320 Oh, interesting. 61 00:02:09,320 --> 00:02:11,780 It has an Ubuntu VM set up. 62 00:02:11,780 --> 00:02:14,280 It seems like everyone seems to like MacBooks. 63 00:02:14,280 --> 00:02:16,320 Is that like a common thing? 64 00:02:16,320 --> 00:02:17,040 It's pretty common. 65 00:02:17,040 --> 00:02:19,520 I'm one of the holdouts for the Linux laptop. 66 00:02:19,540 --> 00:02:23,400 And honestly, it's saving this broadcast because the info is running on it now. 67 00:02:23,400 --> 00:02:23,900 Yeah. 68 00:02:23,900 --> 00:02:24,360 Yeah. 69 00:02:24,360 --> 00:02:25,580 No, that totally makes sense. 70 00:02:25,580 --> 00:02:26,240 Let me see. 71 00:02:26,240 --> 00:02:28,020 I'm grabbing the YouTube link. 72 00:02:28,120 --> 00:02:28,500 All right. 73 00:02:28,500 --> 00:02:33,920 So they're going into AIDA and they immediately go into Docs. 74 00:02:33,940 --> 00:02:35,740 POSIX OpenPT. 75 00:02:36,400 --> 00:02:37,740 It's interesting. 76 00:02:37,880 --> 00:02:46,020 I definitely find myself opening the main pages in a browser way more than I probably should when I'm on a system that has main pages in the terminal. 77 00:02:46,020 --> 00:02:46,960 Absolutely. 78 00:02:47,260 --> 00:02:47,740 But... 79 00:02:47,740 --> 00:02:48,140 I don't know why. 80 00:02:48,140 --> 00:02:50,240 It just feels nicer. 81 00:02:50,720 --> 00:02:51,520 CheckSec. 82 00:02:51,520 --> 00:02:52,640 What is that? 83 00:02:52,640 --> 00:02:53,260 CheckSec. 84 00:02:53,260 --> 00:02:54,760 So it prints common protections. 85 00:02:54,760 --> 00:02:55,020 Okay. 86 00:02:55,540 --> 00:02:57,100 Ah, I see. 87 00:02:57,100 --> 00:02:57,840 I see. 88 00:02:57,840 --> 00:02:58,380 Yep. 89 00:02:58,380 --> 00:02:58,980 All right. 90 00:02:58,980 --> 00:02:59,300 Yeah. 91 00:02:59,300 --> 00:03:00,240 It's pretty nice. 92 00:03:00,240 --> 00:03:04,160 The command line one used to have a really bad bug where it would report incorrect values. 93 00:03:04,160 --> 00:03:04,540 Oh. 94 00:03:04,540 --> 00:03:05,860 So that's very useless. 95 00:03:05,860 --> 00:03:07,220 It was useless. 96 00:03:07,220 --> 00:03:09,460 It was just actually harmful sometimes. 97 00:03:09,460 --> 00:03:14,080 But then I think that's been fixed because it matches up with my VDD output every time. 98 00:03:14,080 --> 00:03:14,760 Yeah. 99 00:03:15,120 --> 00:03:15,560 All right. 100 00:03:15,560 --> 00:03:17,520 I have the chat up now. 101 00:03:17,520 --> 00:03:18,320 Very nice. 102 00:03:18,680 --> 00:03:20,580 Do you want to put it somewhere here in the middle? 103 00:03:20,580 --> 00:03:20,600 Sure . 104 00:03:20,600 --> 00:03:21,220 Put it right in the center. 105 00:03:21,220 --> 00:03:22,060 My eyesight isn't that good. 106 00:03:22,060 --> 00:03:22,480 Yeah. 107 00:03:22,480 --> 00:03:23,900 You know, the glasses are deceiving. 108 00:03:24,200 --> 00:03:25,000 All right. 109 00:03:25,020 --> 00:03:27,960 So ttyioctl. 110 00:03:27,960 --> 00:03:28,500 All right. 111 00:03:28,500 --> 00:03:29,920 I haven't looked much at the challenge. 112 00:03:29,920 --> 00:03:31,480 I was too busy on my phone. 113 00:03:31,480 --> 00:03:31,620 Yeah. 114 00:03:31,620 --> 00:03:35,120 So the name of the challenge is IOCTL or IO Control. 115 00:03:35,120 --> 00:03:36,080 Me maybe. 116 00:03:37,180 --> 00:03:41,060 It is from a series of challenges from Glenn. 117 00:03:41,160 --> 00:03:41,720 Okay . 118 00:03:41,780 --> 00:03:43,900 It's notorious for cursed challenges. 119 00:03:44,160 --> 00:03:44,980 Ah. 120 00:03:45,060 --> 00:03:48,580 In the past, there have been torque engine challenges. 121 00:03:48,640 --> 00:03:49,300 There have been... 122 00:03:50,480 --> 00:03:51,400 What is it? 123 00:03:51,400 --> 00:03:54,500 Rock with weird instructions only. 124 00:03:54,500 --> 00:03:59,620 Oh, knop me maybe was one where it's like you have to jump into the middle of knops. 125 00:03:59,680 --> 00:04:00,040 Yeah. 126 00:04:00,040 --> 00:04:01,260 Let's start checking on Orgacrout. 127 00:04:01,260 --> 00:04:02,320 What are they up to right now? 128 00:04:02,320 --> 00:04:02,740 Yeah. 129 00:04:03,040 --> 00:04:03,840 Orgacrout. 130 00:04:04,020 --> 00:04:08,640 It looks like Stack Overflow, which is never a great sign. 131 00:04:08,780 --> 00:04:09,180 Yeah . 132 00:04:09,380 --> 00:04:10,080 Let's see. 133 00:04:10,080 --> 00:04:14,700 I did see that ChatGPT was open on the Straw Hats side. 134 00:04:14,700 --> 00:04:14,820 Yeah. 135 00:04:14,820 --> 00:04:16,020 It's the very first tab. 136 00:04:16,020 --> 00:04:18,340 So we might see some AI going on. 137 00:04:18,340 --> 00:04:22,820 Honestly, in the hierarchy, I'd put man page, Stack Overflow, ChatGPT. 138 00:04:22,820 --> 00:04:24,800 But obviously, it's upside down. 139 00:04:24,800 --> 00:04:26,340 So ChatGPT is the move. 140 00:04:26,500 --> 00:04:27,060 Now , let's see. 141 00:04:27,060 --> 00:04:29,700 I think we're both on the same website. 142 00:04:29,700 --> 00:04:32,160 We're both looking at man7.org. 143 00:04:32,160 --> 00:04:36,680 So it just seems like this is the way to do man pages on macOS. 144 00:04:36,680 --> 00:04:39,180 I guess, does macOS not have man pages? 145 00:04:39,180 --> 00:04:41,000 Is that not a thing? 146 00:04:41,000 --> 00:04:42,420 No, it has man pages. 147 00:04:42,420 --> 00:04:44,560 But this is a very Linux-specific challenge. 148 00:04:44,560 --> 00:04:44,940 OK. 149 00:04:44,940 --> 00:04:46,160 I don't know if they transfer over. 150 00:04:46,160 --> 00:04:47,520 I don't know if the options are different. 151 00:04:47,540 --> 00:04:49,180 Oh, yeah. 152 00:04:49,620 --> 00:04:52,580 Like, we're going to be learning this challenge with y'all, with them. 153 00:04:53,220 --> 00:04:55,040 We didn't write this. 154 00:04:55,040 --> 00:04:56,120 We haven't looked at it. 155 00:04:56,120 --> 00:04:56,420 No . 156 00:04:56,420 --> 00:04:59,060 No, we're basically solving this at the same time. 157 00:05:00,160 --> 00:05:00,800 Interesting. 158 00:05:00,800 --> 00:05:02,860 Just a lot of Googling right now. 159 00:05:02,860 --> 00:05:03,540 It's only... 160 00:05:04,360 --> 00:05:09,860 I'm curious if the challenge is just a simple, like, IOPTL call and you need to get the ARGs right or something. 161 00:05:09,860 --> 00:05:15,560 We haven't seen anyone really keep a disassembler or decompiler open for more than two seconds. 162 00:05:15,560 --> 00:05:18,040 Straw Hat is typing up Python. 163 00:05:18,040 --> 00:05:19,180 We do have our first... 164 00:05:19,180 --> 00:05:19,740 Straw Hat is typing Python. 165 00:05:19,740 --> 00:05:22,100 We have from PwnImport star. 166 00:05:22,100 --> 00:05:24,700 We're getting ready to just get everything going. 167 00:05:24,700 --> 00:05:25,260 Everything they need. 168 00:05:25,260 --> 00:05:26,520 Yes, yes. 169 00:05:26,640 --> 00:05:27,440 I don't know. 170 00:05:27,440 --> 00:05:29,960 I'm always really afraid to import star. 171 00:05:29,960 --> 00:05:32,020 I'm always afraid that's just going to make a mess of... 172 00:05:32,020 --> 00:05:32,680 It's super... 173 00:05:32,680 --> 00:05:34,800 Do you call it a namespace in Python? 174 00:05:34,800 --> 00:05:35,760 Is that the correct term? 175 00:05:35,760 --> 00:05:36,600 It's a module. 176 00:05:36,600 --> 00:05:37,460 A module? 177 00:05:37,460 --> 00:05:38,280 Okay. 178 00:05:38,440 --> 00:05:39,780 Nothing is namespace Python. 179 00:05:39,780 --> 00:05:41,120 It's only global. 180 00:05:41,120 --> 00:05:42,520 Everything is global. 181 00:05:42,520 --> 00:05:44,040 The locks are global. 182 00:05:45,060 --> 00:05:46,400 Not for long. 183 00:05:46,400 --> 00:05:47,240 There's that... 184 00:05:47,240 --> 00:05:48,460 I saw that. 185 00:05:48,460 --> 00:05:50,600 Almost a PR that removes the GIL. 186 00:05:51,300 --> 00:05:52,760 Is that going to be like when... 187 00:05:53,380 --> 00:05:54,020 What was it? 188 00:05:54,200 --> 00:05:56,420 OpenBSD removed their global lock. 189 00:05:56,420 --> 00:05:58,600 Every time you made a syscall, there'd be a global lock. 190 00:05:58,600 --> 00:06:02,560 And they removed that and immediately erased conditions on every single syscall. 191 00:06:02,560 --> 00:06:03,000 No way. 192 00:06:03,000 --> 00:06:03,320 Yep. 193 00:06:03,320 --> 00:06:05,100 You're telling me that processes are hard? 194 00:06:05,380 --> 00:06:06,700 It's very difficult. 195 00:06:06,740 --> 00:06:10,280 Especially when you have an OS designed for single-threaded stuff. 196 00:06:10,280 --> 00:06:13,180 What do you know about highly parallel processes? 197 00:06:14,340 --> 00:06:15,120 Interesting. 198 00:06:15,120 --> 00:06:16,200 So we're really just deep... 199 00:06:16,200 --> 00:06:20,060 Both are just in the deep man pages. 200 00:06:20,060 --> 00:06:22,540 I think they're on the same page right now. 201 00:06:22,820 --> 00:06:26,400 StrawHat over there reading something very closely. 202 00:06:26,460 --> 00:06:26,760 Yeah! 203 00:06:26,760 --> 00:06:27,940 Actually, OrgeKrout over here... 204 00:06:27,940 --> 00:06:29,480 Okay, well, as I say it... 205 00:06:29,480 --> 00:06:34,220 OrgeKrout creating a C script to try and figure out what IOCTL does. 206 00:06:34,480 --> 00:06:35,180 Oh, yeah. 207 00:06:35,180 --> 00:06:35,900 Okay. 208 00:06:36,120 --> 00:06:38,980 So you got a launch in the process, going interactive. 209 00:06:38,980 --> 00:06:42,000 And I think that's something we see a lot when we're doing CTF stuff. 210 00:06:42,000 --> 00:06:44,820 People love dropping into that interactive prompt. 211 00:06:44,820 --> 00:06:48,700 So they can just start banging out things, trying out stuff. 212 00:06:48,800 --> 00:06:49,620 And let's see. 213 00:06:49,620 --> 00:06:52,300 Do we have the first challenge running here? 214 00:06:52,380 --> 00:06:55,720 That's one of the big differences and approaches we saw last challenge, even. 215 00:06:55,720 --> 00:06:57,680 Was one team went completely static. 216 00:06:57,700 --> 00:07:00,540 And really labeled so many things before even interacting with one. 217 00:07:00,540 --> 00:07:01,300 No way! 218 00:07:01,300 --> 00:07:03,380 The other team was in GDB breaking on every option. 219 00:07:03,720 --> 00:07:04,340 Yep. 220 00:07:04,340 --> 00:07:06,640 And they were really close to one another. 221 00:07:06,640 --> 00:07:09,360 The receive until main is. 222 00:07:09,580 --> 00:07:09,900 Okay . 223 00:07:09,900 --> 00:07:11,660 Not using read until wrapper. 224 00:07:11,660 --> 00:07:12,520 Oh, I see. 225 00:07:12,520 --> 00:07:13,820 Is this an info disclosure? 226 00:07:13,820 --> 00:07:15,680 Just right on the command line? 227 00:07:15,680 --> 00:07:18,580 It just tells you where main is and where RxE is? 228 00:07:18,580 --> 00:07:19,440 Yeah, it is. 229 00:07:19,440 --> 00:07:20,220 That's great. 230 00:07:20,220 --> 00:07:22,300 Why don't my Chrome exploits tell me that? 231 00:07:23,300 --> 00:07:24,800 That would be really convenient. 232 00:07:24,800 --> 00:07:25,800 Because Chrome lost track of it too. 233 00:07:25,800 --> 00:07:27,100 It has so much memory to keep track of. 234 00:07:27,100 --> 00:07:27,840 I guess. 235 00:07:27,840 --> 00:07:28,360 Yeah. 236 00:07:28,360 --> 00:07:29,340 That's true. 237 00:07:29,500 --> 00:07:30,600 What do you want? 238 00:07:30,600 --> 00:07:31,980 Is the question here. 239 00:07:32,800 --> 00:07:34,120 We can maybe read some... 240 00:07:34,120 --> 00:07:34,920 Oh, nope. 241 00:07:34,920 --> 00:07:35,680 Code's gone again. 242 00:07:35,680 --> 00:07:36,780 Code's gone again. 243 00:07:37,000 --> 00:07:37,780 Jeez. 244 00:07:37,980 --> 00:07:38,200 All right. 245 00:07:38,200 --> 00:07:39,040 And then over here... 246 00:07:39,680 --> 00:07:39,700 Oh my god . 247 00:07:39,700 --> 00:07:41,480 Yeah, over here at Orgacrout. 248 00:07:41,840 --> 00:07:42,360 Orgacrout. 249 00:07:42,360 --> 00:07:44,460 They are xattering. 250 00:07:44,800 --> 00:07:46,940 This is a really fancy terminal. 251 00:07:46,940 --> 00:07:47,820 Oh , they're using PwnTemplate. 252 00:07:48,240 --> 00:07:48,740 PwnTemplate? 253 00:07:48,740 --> 00:07:53,680 It kind of creates a little working directory for you with PwnTools and pipenv. 254 00:07:53,680 --> 00:07:56,220 And it makes a PwnTools skeleton and stuff like that. 255 00:07:56,220 --> 00:07:57,780 I personally don't use it. 256 00:07:57,780 --> 00:08:00,040 But the last time I looked at it, it was kind of simple. 257 00:08:00,040 --> 00:08:02,820 Is that an emoji on that terminal there? 258 00:08:02,820 --> 00:08:07,640 Yeah, they have a snake emoji and a little steering wheel for a docker maybe. 259 00:08:07,640 --> 00:08:08,720 Like a ship wheel. 260 00:08:08,720 --> 00:08:09,220 Huh. 261 00:08:09,220 --> 00:08:10,200 All right. 262 00:08:10,240 --> 00:08:11,200 That's pretty fair. 263 00:08:11,200 --> 00:08:17,380 So here we're just basically parsing out all of the printouts that you're getting. 264 00:08:17,380 --> 00:08:21,100 And there hasn't been much reading of code, which is interesting. 265 00:08:21,140 --> 00:08:27,640 That's honestly the approach that I normally go for, is just banging it out immediately going into dynamic stuff. 266 00:08:27,640 --> 00:08:32,000 Yes , but what I saw there for a second, it looks like you're just getting an IOPTL call with args that you specified. 267 00:08:32,000 --> 00:08:34,580 Yeah, which would be pretty slick. 268 00:08:34,580 --> 00:08:38,560 But I don't know what sort of things you can do. 269 00:08:38,560 --> 00:08:40,360 Is it on a TTY? 270 00:08:40,360 --> 00:08:42,240 I didn't actually see what file is being opened. 271 00:08:42,240 --> 00:08:44,440 We're switching between these screens so fast. 272 00:08:45,640 --> 00:08:47,020 Too many arguments. 273 00:08:47,560 --> 00:08:51,580 Oh, so it looks like you get to pick. 274 00:08:52,180 --> 00:09:00,460 I think I saw a zero arg where you have the IOPTL number, and then it looks like two, three, and four. 275 00:09:00,460 --> 00:09:04,100 And it will prompt you, I guess, for the IOPTL code. 276 00:09:04,100 --> 00:09:05,360 So that's interesting. 277 00:09:05,360 --> 00:09:14,280 We're actually writing a function here to properly do these IOPTLs, which is pretty fancy. 278 00:09:14,280 --> 00:09:16,240 Yeah , does it allocate a VTTY or what? 279 00:09:16,240 --> 00:09:18,020 I didn't actually see what it opened. 280 00:09:18,020 --> 00:09:20,420 I've only seen it for like a split second. 281 00:09:20,420 --> 00:09:22,680 Yeah, can I get a nod or a head shake? 282 00:09:23,240 --> 00:09:26,380 A PTY, okay. 283 00:09:26,380 --> 00:09:27,580 Okay, we get a PTY. 284 00:09:27,580 --> 00:09:29,060 Is it dev PTY? 285 00:09:29,640 --> 00:09:30,920 Dev PTY 3. 286 00:09:30,920 --> 00:09:32,480 PTY 3, okay. 287 00:09:32,600 --> 00:09:40,500 Now, my favorite thing is PTMX, which I think is what basically everyone uses when they're doing their basic Linux exploits. 288 00:09:40,500 --> 00:09:45,920 For some reason, I can't remember what it was about the shape of that data structure that it allocates. 289 00:09:45,920 --> 00:09:51,560 It's just very convenient for using in your exploits and overriding the dispatch handles. 290 00:09:51,720 --> 00:09:54,960 Maybe it's just because it's really easy to get access to on Android. 291 00:09:54,960 --> 00:09:57,360 I think it has no permissions required. 292 00:09:57,360 --> 00:09:59,000 I haven't done Android exploits yet. 293 00:09:59,000 --> 00:10:00,900 This is so fancy. 294 00:10:01,100 --> 00:10:02,140 Look at this. 295 00:10:02,140 --> 00:10:02,860 Right? 296 00:10:02,860 --> 00:10:03,760 It's really colorful. 297 00:10:03,760 --> 00:10:04,440 I like it. 298 00:10:04,440 --> 00:10:07,180 I'm really impressed that we're seeing a function. 299 00:10:07,180 --> 00:10:08,000 Oh, here we go. 300 00:10:08,140 --> 00:10:09,860 Orgacrout scrolling through IDA. 301 00:10:09,860 --> 00:10:15,520 We see the project's OPPT 258, unknown what enum value that is. 302 00:10:15,520 --> 00:10:16,320 Huh. 303 00:10:16,780 --> 00:10:17,280 Okay. 304 00:10:17,280 --> 00:10:18,320 Info leak. 305 00:10:18,320 --> 00:10:19,000 And then it just... 306 00:10:19,000 --> 00:10:21,200 Oh , it looks like we're going to get that main page for this. 307 00:10:21,420 --> 00:10:22,300 Compromised password. 308 00:10:22,300 --> 00:10:23,140 That's not a good sign. 309 00:10:23,140 --> 00:10:24,220 They better get that fixed. 310 00:10:24,220 --> 00:10:25,040 Yeah , they have to. 311 00:10:25,040 --> 00:10:25,620 Yeah. 312 00:10:25,620 --> 00:10:27,200 It prints that when you start to challenge it. 313 00:10:27,200 --> 00:10:27,660 All right. 314 00:10:27,660 --> 00:10:30,540 So it looks like you give it... 315 00:10:31,080 --> 00:10:32,140 Oh, some flags. 316 00:10:32,140 --> 00:10:32,480 Okay. 317 00:10:32,480 --> 00:10:33,220 So it's probably... 318 00:10:33,220 --> 00:10:36,060 I'm guessing it's going to be like read-write or something like that. 319 00:10:36,060 --> 00:10:36,380 Yeah . 320 00:10:36,460 --> 00:10:37,000 Pty. 321 00:10:37,000 --> 00:10:41,040 I wonder if you can maybe corrupt a value in that struct. 322 00:10:41,260 --> 00:10:43,680 Yeah, that's kind of interesting. 323 00:10:43,680 --> 00:10:44,800 I'm trying to think if like... 324 00:10:45,340 --> 00:10:47,600 Look at the ads on this page. 325 00:10:47,600 --> 00:10:49,300 Oh, this is great. 326 00:10:49,480 --> 00:10:52,640 We found the CTF player that doesn't run AdBlocker. 327 00:10:52,640 --> 00:10:53,120 Yeah. 328 00:10:53,120 --> 00:10:54,140 Well, how does that work? 329 00:10:54,140 --> 00:10:54,600 It's just... 330 00:10:55,580 --> 00:10:56,640 I don't know. 331 00:10:56,640 --> 00:10:58,640 They just scrolled in really menacingly. 332 00:10:58,640 --> 00:11:01,120 I mean, I guess maybe... 333 00:11:02,360 --> 00:11:02,840 Let's... 334 00:11:02,840 --> 00:11:03,340 Oh, this... 335 00:11:04,420 --> 00:11:05,920 Docstore.mic.ua... 336 00:11:05,920 --> 00:11:06,540 What is this? 337 00:11:06,540 --> 00:11:10,540 Are we just like reading a book on how iOctals work? 338 00:11:10,540 --> 00:11:11,300 I guess so. 339 00:11:11,300 --> 00:11:12,100 That's pretty good. 340 00:11:12,100 --> 00:11:14,480 We're going to walk away from this with so much knowledge. 341 00:11:14,480 --> 00:11:15,240 I like Straw Hat. 342 00:11:15,240 --> 00:11:23,520 Straw Hat's doing exactly the approach that I would do, which is going into user include, grepping for the thing, trying to find exactly how these are made. 343 00:11:23,520 --> 00:11:25,760 And this is literally exactly how I do it. 344 00:11:25,760 --> 00:11:30,300 Anytime I want to figure out what does that code actually turn into is this. 345 00:11:30,300 --> 00:11:35,100 And the reason that's so complex is those I-O codes are all like macro-based. 346 00:11:35,100 --> 00:11:36,760 So I think that's an I-O... 347 00:11:36,760 --> 00:11:38,340 It's an I-O-W. 348 00:11:38,340 --> 00:11:44,100 The fact that it's a right I-Octal, the T is the special code that they're going to use. 349 00:11:44,100 --> 00:11:46,360 Probably stands for TTY in this case. 350 00:11:46,500 --> 00:11:49,040 And then it also has an int, which is the arg. 351 00:11:49,060 --> 00:11:52,020 And in that macro, it's going to use sizeof. 352 00:11:52,020 --> 00:11:57,640 And basically, the I-O control code has the T in there, which is like a magic identifier. 353 00:11:57,640 --> 00:12:00,400 Some flags about if it's read, write, or whatever. 354 00:12:00,400 --> 00:12:02,560 And then the size of the args. 355 00:12:02,560 --> 00:12:04,320 And I forget what the 31 hex is. 356 00:12:04,320 --> 00:12:05,660 That's kind of interesting. 357 00:12:06,440 --> 00:12:11,300 Oh, and here we have a standard printout where you just go in for the %x. 358 00:12:11,460 --> 00:12:13,340 I think we're just ignoring that warning now. 359 00:12:13,340 --> 00:12:16,300 He's working in an isolated environment just trying to figure out what it does. 360 00:12:16,300 --> 00:12:17,060 What does it transform? 361 00:12:17,060 --> 00:12:18,040 What can I touch? 362 00:12:18,040 --> 00:12:21,740 You know, he obviously knows all the addresses that were leaked from his own code. 363 00:12:21,740 --> 00:12:22,100 Right. 364 00:12:22,100 --> 00:12:23,580 So it's essentially... 365 00:12:23,580 --> 00:12:26,900 He's rewriting the challenge to try and figure out what it can do. 366 00:12:27,120 --> 00:12:28,580 Context log level debug? 367 00:12:28,580 --> 00:12:29,740 Do you know what that does? 368 00:12:29,740 --> 00:12:30,200 Yeah. 369 00:12:30,200 --> 00:12:33,760 PwnTools, that prints like every transmit, every receive, the sizes of things. 370 00:12:33,760 --> 00:12:35,880 Do you get like a hex printout when they run? 371 00:12:35,880 --> 00:12:36,720 Oh, nice. 372 00:12:37,180 --> 00:12:46,680 Yeah, it looks like we have to find some way to do corruption on our own process using just these TTY octal codes. 373 00:12:46,980 --> 00:12:50,280 And I think I could be really wrong on this. 374 00:12:50,280 --> 00:12:56,520 I think octals are hierarchical, where you can have some generic TTY ones. 375 00:12:56,520 --> 00:12:59,080 But then beyond that, you can have pseudo TTY ones. 376 00:12:59,080 --> 00:13:01,160 And they kind of build on top of each other. 377 00:13:01,160 --> 00:13:04,240 So I think a pseudo TTY like inherits TTY. 378 00:13:04,240 --> 00:13:06,020 I could be very wrong about that. 379 00:13:06,020 --> 00:13:06,860 I have no idea. 380 00:13:07,380 --> 00:13:08,960 That's more than I know about. 381 00:13:09,600 --> 00:13:13,600 It's been a long time since I've read advanced programming in the Unix environment. 382 00:13:13,600 --> 00:13:14,360 That's for sure. 383 00:13:14,360 --> 00:13:14,940 I think it is. 384 00:13:14,940 --> 00:13:16,060 Yeah, no, I never did. 385 00:13:16,060 --> 00:13:16,460 Yeah. 386 00:13:17,020 --> 00:13:18,440 But this is kind of fun. 387 00:13:18,440 --> 00:13:20,660 I really do like this as a challenge. 388 00:13:20,840 --> 00:13:22,260 Ah, looking for... 389 00:13:22,260 --> 00:13:23,120 Yeah, get it. 390 00:13:23,120 --> 00:13:26,560 There's a getter for the window size, a setter for the window size. 391 00:13:26,840 --> 00:13:35,260 And it looks like, yeah, if you called that getter, it's going to probably fill out that structure where you get rows, columns, x pixels, and y pixels. 392 00:13:35,280 --> 00:13:47,060 And , you know, it'd be kind of cool if we could see someone go after that, maybe use some weird x command to, like, force the terminal to some weird size, and then write some shellcode with the window size. 393 00:13:47,060 --> 00:13:49,800 I'm wondering if TTYs have a maximum size up there that... 394 00:13:49,800 --> 00:13:50,980 I have no idea. 395 00:13:51,040 --> 00:13:54,320 Like, can you just have it go way off the screen or, you know... 396 00:13:54,840 --> 00:13:55,080 Huh. 397 00:13:55,080 --> 00:13:55,940 I assume you can. 398 00:13:55,940 --> 00:14:00,320 I'm sure there's a better way to get, like, arbitrary outputs. 399 00:14:00,320 --> 00:14:00,740 Oh , yeah. 400 00:14:00,780 --> 00:14:05,060 TIO, I don't know if we're limited to the I-O control code that we have. 401 00:14:06,100 --> 00:14:09,240 And let's check in on Orgicrout, let's see what they're doing. 402 00:14:09,480 --> 00:14:10,400 Yeah, okay. 403 00:14:10,400 --> 00:14:11,900 So Orgicrout going through... 404 00:14:11,900 --> 00:14:12,420 They're trying... 405 00:14:12,420 --> 00:14:14,080 They're going to try every IOC. 406 00:14:14,100 --> 00:14:16,080 They're going to run this thing with every IOC. 407 00:14:16,080 --> 00:14:17,560 Now, that's what we call fuzzing here. 408 00:14:17,560 --> 00:14:21,900 That is an advanced security technique, and that's a really good way to find bugs. 409 00:14:21,920 --> 00:14:25,920 So I think this is an interesting approach. 410 00:14:25,920 --> 00:14:26,480 We have... 411 00:14:27,100 --> 00:14:28,520 It looks like no functions here. 412 00:14:28,520 --> 00:14:29,000 We're doing a... 413 00:14:29,720 --> 00:14:30,460 Wow. 414 00:14:30,840 --> 00:14:35,860 So I guess we're just going to blast the apples until we get a result. 415 00:14:35,860 --> 00:14:36,080 Now... 416 00:14:36,080 --> 00:14:37,920 I really hope they don't run out of that piece. 417 00:14:37,920 --> 00:14:44,320 I will say, from Python, it's going to be really hard to enumerate all four billion combinations. 418 00:14:44,320 --> 00:14:52,920 And the I-O control codes are pretty well spaced, because some of those, like, read-write flags are spaced in just weird ways. 419 00:14:52,920 --> 00:14:54,400 So I've done this before. 420 00:14:54,400 --> 00:14:56,620 I've brute-forced I-O control codes. 421 00:14:56,620 --> 00:15:06,500 But if you really want to do that, the best way to do it is to enumerate, like , understand, basically, how the control code is packed, and then, like, do reasonable numbers. 422 00:15:06,500 --> 00:15:09,800 Like, I think the size might be the bottom 16 bits. 423 00:15:09,860 --> 00:15:14,600 And none of these are going to really reasonably take more than, like, a 64-byte structure. 424 00:15:14,600 --> 00:15:17,960 So you could really reduce the state space that you have to search. 425 00:15:18,620 --> 00:15:20,120 That's just going to be a lot of iterations. 426 00:15:20,120 --> 00:15:22,100 I don't know if he has time to write that. 427 00:15:22,180 --> 00:15:22,900 That's true. 428 00:15:22,900 --> 00:15:23,840 That's true. 429 00:15:23,840 --> 00:15:25,280 So you just have that sitting around. 430 00:15:25,280 --> 00:15:28,460 And yeah, we do have control of the I-Optimum number. 431 00:15:28,460 --> 00:15:30,380 I don't think there's any filter. 432 00:15:30,380 --> 00:15:31,320 I think this is purely... 433 00:15:31,320 --> 00:15:32,300 No, there's all of them. 434 00:15:32,300 --> 00:15:38,840 It looks like you just have an ARB number and ARB args on a PTY, and you just have to... 435 00:15:39,360 --> 00:15:39,940 Yep. 436 00:15:40,100 --> 00:15:42,340 And you just have to find a way to make that work. 437 00:15:42,340 --> 00:15:45,280 And I think that's probably not going to be too bad. 438 00:15:45,280 --> 00:15:45,780 It looks like... 439 00:15:47,240 --> 00:15:50,940 Oh, we're naming stuff over here on Straw Hat. 440 00:15:50,940 --> 00:15:53,540 We're actually doing some AIDA stuff. 441 00:15:54,080 --> 00:15:56,240 Actual reversing, which is kind of interesting. 442 00:15:56,400 --> 00:15:58,860 I mean, honestly, I'd say this is pretty readable. 443 00:15:58,860 --> 00:16:01,980 That shows me basically everything I need to know. 444 00:16:01,980 --> 00:16:05,320 When 70% of your output is strings, I think I know what's going on. 445 00:16:05,320 --> 00:16:05,900 Yeah. 446 00:16:06,000 --> 00:16:06,960 So that's cool. 447 00:16:06,960 --> 00:16:12,860 So it looks like you get the hexadecimal of where main is, where the stack is located. 448 00:16:13,060 --> 00:16:14,380 And now you're just going to... 449 00:16:14,380 --> 00:16:16,560 Is that getWindowSize? 450 00:16:16,560 --> 00:16:17,340 Oh, there we go. 451 00:16:17,340 --> 00:16:18,480 He just ran that. 452 00:16:18,480 --> 00:16:19,100 And I think that's... 453 00:16:19,100 --> 00:16:20,700 Yeah , he just threw his window to the right. 454 00:16:20,880 --> 00:16:21,600 Yeah. 455 00:16:21,600 --> 00:16:23,980 That's why he's running in poor man's demos. 456 00:16:24,080 --> 00:16:25,940 So he can see the window changes. 457 00:16:26,040 --> 00:16:26,240 Yeah. 458 00:16:26,240 --> 00:16:33,680 So he has gotten the Iowa control codes for set and getWindowSize. 459 00:16:33,680 --> 00:16:38,460 And honestly, that makes sense because you could just set the window size first using that, what was it? 460 00:16:38,460 --> 00:16:40,980 Four ints or four shorts or something like that. 461 00:16:41,140 --> 00:16:42,980 And then just call get. 462 00:16:42,980 --> 00:16:45,540 And you'll just get the result at a different address. 463 00:16:45,540 --> 00:16:48,260 So I feel like that's a pretty good approach. 464 00:16:48,260 --> 00:16:52,960 Now, that does take a pointer to a structure, if I'm not mistaken. 465 00:16:52,960 --> 00:16:55,640 I don't think it takes multiple args. 466 00:16:55,640 --> 00:17:02,540 So how would you set the pointer to that structure that has the size of that TTY? 467 00:17:02,540 --> 00:17:05,320 Well, you have the stack offset, and they allocate it right before. 468 00:17:05,320 --> 00:17:06,720 So I'd assume it's on top of the stack. 469 00:17:06,720 --> 00:17:07,380 Oh, OK. 470 00:17:07,380 --> 00:17:08,740 Yeah, you're right there. 471 00:17:08,960 --> 00:17:12,640 Do you have any good place on the stack where you can stash this? 472 00:17:12,640 --> 00:17:14,180 They don't have any leak beyond that, though. 473 00:17:14,180 --> 00:17:15,760 Right, right. 474 00:17:15,780 --> 00:17:18,020 Like, you can't read stack memory. 475 00:17:18,020 --> 00:17:20,640 Outside of, obviously, the struct. 476 00:17:20,640 --> 00:17:23,320 Because you know where it is, you have things to interact with it. 477 00:17:23,520 --> 00:17:26,420 So I'm curious to see where this goes. 478 00:17:26,420 --> 00:17:30,400 This is really tough, because you have to kind of make the decision early on. 479 00:17:30,400 --> 00:17:34,660 When you're doing these CTFs, it's like, should we commit to this? 480 00:17:34,660 --> 00:17:36,400 Like, getting and setting the window size. 481 00:17:36,400 --> 00:17:43,840 Obviously, if we can put a pointer to control data, then we can set the window size, put a pointer to other data. 482 00:17:43,840 --> 00:17:47,660 And now we have just overwritten something with control data. 483 00:17:47,660 --> 00:17:56,320 I'm curious, if input is done on the stack, you can push it down, maybe IOCTL pointer to the stack? 484 00:17:56,320 --> 00:17:57,920 Or is the pointer just set in there? 485 00:17:58,020 --> 00:17:59,600 Does it operate on top of the stack? 486 00:17:59,600 --> 00:18:02,720 I don't actually know what that stack printout is. 487 00:18:02,720 --> 00:18:13,080 Yeah , we print out, at the very top, it's argca, which I don't know where that variable is on the stack. 488 00:18:13,080 --> 00:18:18,820 If it just takes an FD, can't you FD standard in and make, like, a fake and IOCTL stroke be a standard input? 489 00:18:18,940 --> 00:18:20,840 I don't think you have control of the FD. 490 00:18:22,120 --> 00:18:23,600 For the IOCTLs? 491 00:18:23,600 --> 00:18:25,860 Yeah, doesn't it ask you what FD you want? 492 00:18:26,820 --> 00:18:27,500 Hmm. 493 00:18:28,380 --> 00:18:30,080 I think it's only the... 494 00:18:30,080 --> 00:18:31,860 I'm getting a thumbs up from the author. 495 00:18:32,560 --> 00:18:33,800 It asks for the FD? 496 00:18:33,800 --> 00:18:34,740 I'm on the right track. 497 00:18:34,740 --> 00:18:35,240 All right. 498 00:18:35,240 --> 00:18:36,480 Ah, I see. 499 00:18:36,480 --> 00:18:36,920 OK. 500 00:18:37,860 --> 00:18:38,560 OK. 501 00:18:38,560 --> 00:18:40,260 OK, every single parameter is controlled. 502 00:18:40,260 --> 00:18:40,660 Nice. 503 00:18:40,660 --> 00:18:42,740 OK, so you do get the FD. 504 00:18:42,740 --> 00:18:47,720 So, yeah, I mean, Parliament of Ducks just got it. 505 00:18:47,720 --> 00:18:49,220 OK, wow. 506 00:18:49,260 --> 00:18:50,380 Wow, that was fast. 507 00:18:50,380 --> 00:18:51,960 That was quite fast. 508 00:18:51,960 --> 00:18:53,400 I'm curious what approach they did. 509 00:18:53,400 --> 00:19:05,240 I'm thinking what it is, is you take FD0, you have standard in control, it operates on standard input IOCTL, you send EOF after your fake struct to be a standard input, and maybe there are function pointers in there? 510 00:19:05,240 --> 00:19:06,980 I'm not really sure about the next part. 511 00:19:06,980 --> 00:19:07,800 Hmm. 512 00:19:08,040 --> 00:19:09,860 Do you have only IOCTL? 513 00:19:10,060 --> 00:19:11,500 It's one IOCTL call, it looks like. 514 00:19:11,500 --> 00:19:12,300 One IOCTL call. 515 00:19:12,300 --> 00:19:15,540 OK, let's see. 516 00:19:15,540 --> 00:19:18,100 Yeah , let's go back over to Orge Crowd. 517 00:19:18,100 --> 00:19:19,560 They've been in IDA, too. 518 00:19:19,560 --> 00:19:23,720 OK, and they're using the dark scheme in IDA, which is interesting. 519 00:19:23,720 --> 00:19:24,380 Thank you. 520 00:19:24,380 --> 00:19:32,400 Every time I use the dark scheme in IDA, I kind of regret it, because some things just don't look right, or the colors are off, or the highlighting is weird. 521 00:19:32,480 --> 00:19:33,620 Yeah, I don't know what it is. 522 00:19:33,620 --> 00:19:37,060 I don't know if it's gotten better or what. 523 00:19:37,680 --> 00:19:50,500 But I remember, like, a couple times, like, you'd pop up a window, like, just some weird, you know, listing of, you know, functions or something like that, and it would just be white, or it would not match the color scheme, and that would always just bleach your eyes. 524 00:19:50,500 --> 00:19:51,660 Oh, it's painful. 525 00:19:51,660 --> 00:19:52,640 I cannot light theme. 526 00:19:52,640 --> 00:19:54,620 We have a couple of people in the office who light them. 527 00:19:54,620 --> 00:19:55,000 Yeah. 528 00:19:55,740 --> 00:19:57,420 I know it's better to read. 529 00:19:57,420 --> 00:20:03,440 I know it's, like, technically supposed to be better for your eyes and, like, your ability to, like, read the text. 530 00:20:03,600 --> 00:20:05,360 But I'm not convinced. 531 00:20:05,360 --> 00:20:05,820 I'm a dark theme. 532 00:20:05,820 --> 00:20:08,840 I'll take the extra second for comfort. 533 00:20:08,840 --> 00:20:09,580 Yeah. 534 00:20:09,580 --> 00:20:11,000 So, what do we have over here? 535 00:20:11,000 --> 00:20:14,440 Is it still... are we still doing the brute force of all the eye octals? 536 00:20:14,500 --> 00:20:16,680 It looks like they have that in there, but they're working above it. 537 00:20:16,680 --> 00:20:19,320 So, I wonder if they thought of another approach they want to try first. 538 00:20:19,320 --> 00:20:20,660 Yeah, yeah. 539 00:20:21,700 --> 00:20:22,340 Huh. 540 00:20:22,600 --> 00:20:24,680 Oh, they got it for a second. 541 00:20:25,620 --> 00:20:27,600 Oh, no, they're just trying to figure out how to run it, it looks like. 542 00:20:27,600 --> 00:20:28,140 Okay. 543 00:20:28,620 --> 00:20:30,000 Yeah, this is tough. 544 00:20:30,020 --> 00:20:32,060 Yeah, okay, you have four different eye octals. 545 00:20:32,060 --> 00:20:36,360 So, you can do 0 arg, 1 arg, 2 arg, or 3 arg, I think. 546 00:20:36,420 --> 00:20:37,060 Okay. 547 00:20:37,840 --> 00:20:39,560 And, yeah, this is really tough. 548 00:20:39,560 --> 00:20:42,240 Like, do you want to commit to doing the window size approach? 549 00:20:42,240 --> 00:20:45,240 Because, obviously, that's... I'm sure that's Turing complete. 550 00:20:45,240 --> 00:20:48,120 You can probably get your arbitrary corruption with that. 551 00:20:48,680 --> 00:20:52,680 But, is that the best eye octal? 552 00:20:52,680 --> 00:20:55,420 Is that the easiest eye octal, or is there an easier one? 553 00:20:55,480 --> 00:20:57,760 All of the eye octals are the best eye octal if they get you there. 554 00:20:57,760 --> 00:20:58,820 Right, exactly. 555 00:20:58,820 --> 00:21:02,560 Like, this is a solve it and solve it first challenge. 556 00:21:02,560 --> 00:21:03,480 Yeah, yeah. 557 00:21:03,480 --> 00:21:06,880 You're not trying to get undetected, you're not trying to get minimal size. 558 00:21:06,880 --> 00:21:15,520 Over here on Straw Hat, it looks like we're looking at the stack overflow on the responsibilities of each pseudo-terminal PTY component. 559 00:21:15,540 --> 00:21:17,940 And look at that, we had a diagram up there? 560 00:21:18,260 --> 00:21:27,500 That we are, like, I think we're, like, learning how, like, just PTYs work on Linux. 561 00:21:27,500 --> 00:21:29,040 We're learning how to control IO. 562 00:21:29,040 --> 00:21:29,460 Yeah. 563 00:21:31,080 --> 00:21:32,660 This is interesting. 564 00:21:32,660 --> 00:21:41,960 Okay, we're getting more and more different C printouts here of, basically, what these IO control codes are, so we can go test them out, see how they go. 565 00:21:41,960 --> 00:21:44,920 I do like that every time we come over here, their window is a little bit larger. 566 00:21:45,000 --> 00:21:46,240 Yeah, yeah. 567 00:21:47,700 --> 00:21:52,940 Look at this, Oracle Streams Programming Guide. 568 00:21:54,740 --> 00:21:57,460 When you end up on an Oracle page, you know you're in. 569 00:21:57,460 --> 00:22:01,080 Yeah, like, whenever I end up on Oracle, I'm getting out immediately. 570 00:22:01,080 --> 00:22:01,840 Oh, yeah. 571 00:22:01,840 --> 00:22:03,220 Oh, look at that, struct.pack. 572 00:22:03,220 --> 00:22:04,760 Is this just the exploit right here? 573 00:22:04,760 --> 00:22:06,000 No way. 574 00:22:06,000 --> 00:22:08,460 Well, it's not, because that needs to be a pointer. 575 00:22:08,500 --> 00:22:10,160 That is the right structure. 576 00:22:10,160 --> 00:22:11,820 It is four shorts. 577 00:22:11,820 --> 00:22:19,580 But you will need to put four shorts somewhere in memory, know the address of it, and then give that address. 578 00:22:19,580 --> 00:22:20,900 That's a lot of work, too. 579 00:22:20,900 --> 00:22:21,580 Right. 580 00:22:21,580 --> 00:22:26,320 And I haven't seen IDA enough to get the stack layout yet. 581 00:22:26,320 --> 00:22:41,060 So I, like, don't know, like, because we know the stack address, we know where main is, and it's like, where can we store some things that are controlled over the network or something that we can end up, you know, writing out somewhere in memory, or, I guess, 582 00:22:41,060 --> 00:22:44,240 storing in the kernel first, then writing out to memory with a GET request. 583 00:22:44,240 --> 00:22:46,560 It looks like you can do multiple app calls. 584 00:22:46,560 --> 00:22:48,400 Yeah, yeah, it does look like a loop. 585 00:22:48,400 --> 00:22:52,520 Yeah, which I think should make this quite easy. 586 00:22:52,600 --> 00:22:57,120 There's, I think, many of these, because a lot of these apps are getters and setters. 587 00:22:57,120 --> 00:22:57,640 So you're just... 588 00:22:57,640 --> 00:22:59,720 You transform that struct on the stack. 589 00:22:59,720 --> 00:23:00,000 Right. 590 00:23:00,000 --> 00:23:01,520 Have known data, known address. 591 00:23:01,520 --> 00:23:02,660 Right, exactly. 592 00:23:02,820 --> 00:23:03,220 Yeah . 593 00:23:05,180 --> 00:23:05,980 Interesting. 594 00:23:06,680 --> 00:23:08,060 Okay, so they're walking through. 595 00:23:08,060 --> 00:23:09,440 They have lots of naked ones. 596 00:23:10,260 --> 00:23:10,760 Huh. 597 00:23:10,760 --> 00:23:12,700 Looks like they're just making invalid calls right now. 598 00:23:12,700 --> 00:23:13,400 Yeah. 599 00:23:13,500 --> 00:23:13,920 Yeah. 600 00:23:13,920 --> 00:23:15,880 Let's check in on Orgacrout, see what they're doing. 601 00:23:16,160 --> 00:23:16,960 Orgacrout? 602 00:23:17,600 --> 00:23:19,260 They are making... 603 00:23:19,260 --> 00:23:21,480 It looks like an array of interesting IOCTLs. 604 00:23:21,480 --> 00:23:21,760 Okay. 605 00:23:21,760 --> 00:23:22,360 That they want to... 606 00:23:22,360 --> 00:23:22,780 Yep. 607 00:23:22,780 --> 00:23:26,380 Oh, it might be that they're making a IOCTL chain. 608 00:23:26,380 --> 00:23:27,040 I don't know. 609 00:23:27,040 --> 00:23:27,740 Yeah. 610 00:23:28,120 --> 00:23:29,160 IOCTL op. 611 00:23:29,740 --> 00:23:30,340 Huh. 612 00:23:32,720 --> 00:23:34,080 This is going to be very interesting. 613 00:23:34,080 --> 00:23:35,520 This is really interesting. 614 00:23:35,520 --> 00:23:36,360 Because we don't know where we're at. 615 00:23:36,360 --> 00:23:37,700 Have we gotten a crash yet? 616 00:23:38,160 --> 00:23:38,900 Oh, no. 617 00:23:38,900 --> 00:23:39,620 There's the stack. 618 00:23:39,620 --> 00:23:43,360 Okay, FD number, number of args, and then I think four args. 619 00:23:43,360 --> 00:23:45,660 I think I got all those. 620 00:23:45,660 --> 00:23:46,680 You're fast. 621 00:23:46,900 --> 00:23:47,220 Yep. 622 00:23:47,400 --> 00:23:48,560 FD number, number of args. 623 00:23:48,560 --> 00:23:48,800 Yeah. 624 00:23:48,800 --> 00:23:49,220 Yeah. 625 00:23:49,220 --> 00:23:51,540 So you should know where those args are. 626 00:23:51,540 --> 00:23:54,560 So if you were to just shoot... 627 00:23:54,560 --> 00:23:57,960 I don't know if it's okay if you have invalid IOCTL. 628 00:23:57,960 --> 00:24:00,580 I imagine it will just silently ignore it and just go through again. 629 00:24:00,580 --> 00:24:01,520 We saw that on Straw Hat. 630 00:24:01,520 --> 00:24:02,800 They were getting lots of negative one returns. 631 00:24:02,800 --> 00:24:10,480 So I think what I would do is I would use like the three or the four arg version, because I think they're 64-bit ints. 632 00:24:10,480 --> 00:24:15,660 I don't know what they're doing for A2I or whatever that might limit the space of the ints. 633 00:24:15,720 --> 00:24:19,500 But you should be able to do one pass through using the full things. 634 00:24:19,500 --> 00:24:20,680 Who cares about the IOCTL? 635 00:24:20,680 --> 00:24:21,640 Just let it fail. 636 00:24:21,640 --> 00:24:24,480 That will set up the args on the stack. 637 00:24:24,660 --> 00:24:27,100 And now you can come through and put a pointer to that. 638 00:24:27,100 --> 00:24:31,400 And now you have control data that you can write to some data you point to. 639 00:24:31,400 --> 00:24:33,300 Although you do have to dodge. 640 00:24:33,300 --> 00:24:37,520 You might have to put them further up the arg stack, because you need the first args. 641 00:24:37,520 --> 00:24:39,880 If you use one of these arguments first, then you can go back and just flubber the bottom one. 642 00:24:39,880 --> 00:24:40,500 Exactly. 643 00:24:40,500 --> 00:24:41,040 Yeah. 644 00:24:41,040 --> 00:24:43,660 And that's, I think, the approach that I would take. 645 00:24:43,660 --> 00:24:46,980 But once again, I haven't seen much of the IDA here. 646 00:24:46,980 --> 00:24:48,600 You have args in known places. 647 00:24:48,600 --> 00:24:49,000 Right. 648 00:24:49,000 --> 00:24:49,720 Now what? 649 00:24:49,720 --> 00:24:50,140 Right. 650 00:24:50,140 --> 00:24:50,840 Yeah. 651 00:24:50,920 --> 00:24:52,000 So I don't know. 652 00:24:52,000 --> 00:24:56,980 I think just a setter, put it in the kernel temporarily, and then get it back out into... 653 00:24:56,980 --> 00:24:59,060 I'm sticking true to my standard input. 654 00:24:59,060 --> 00:24:59,400 Yeah. 655 00:25:00,200 --> 00:25:01,400 Standard input. 656 00:25:01,400 --> 00:25:02,000 Yeah. 657 00:25:02,360 --> 00:25:05,640 I'm sticking true to FD0, reading from FD0 for the IOctal. 658 00:25:05,640 --> 00:25:07,560 But do you have access to a read? 659 00:25:07,560 --> 00:25:10,520 Can you do a read through an IOctal? 660 00:25:11,540 --> 00:25:12,340 Oh. 661 00:25:12,700 --> 00:25:14,320 Oh, no, because it just asks for an FD. 662 00:25:14,320 --> 00:25:15,360 It doesn't check if... 663 00:25:15,360 --> 00:25:15,940 No? 664 00:25:15,940 --> 00:25:17,660 Oh, because the FD's on the PTY. 665 00:25:17,660 --> 00:25:19,780 Yeah, but you only have the IOctal sys call. 666 00:25:19,780 --> 00:25:21,580 So how would you get that to do a read? 667 00:25:21,580 --> 00:25:26,260 Like, is there a way to cause a read from standard in or whatever through an IOctal? 668 00:25:26,260 --> 00:25:27,680 Or am I misunderstanding? 669 00:25:28,300 --> 00:25:29,980 Well, I wonder if it's... 670 00:25:29,980 --> 00:25:32,480 Can you buffer standard input, maybe? 671 00:25:32,480 --> 00:25:34,420 Send the IOctal to FD0. 672 00:25:34,420 --> 00:25:37,200 It doesn't prompt for input, but it reads the buffer data. 673 00:25:37,200 --> 00:25:39,900 Like, you can buffer it in the choice input. 674 00:25:40,020 --> 00:25:40,900 Hmm. 675 00:25:42,120 --> 00:25:42,800 I'm not sure. 676 00:25:42,800 --> 00:25:43,520 I don't know. 677 00:25:43,520 --> 00:25:44,000 Okay. 678 00:25:44,000 --> 00:25:44,700 Yeah. 679 00:25:45,400 --> 00:25:45,720 Yeah. 680 00:25:45,960 --> 00:25:49,780 Okay, and it looks like we're adding more libraries here. 681 00:25:51,420 --> 00:25:52,860 Oh, you know what? 682 00:25:52,860 --> 00:26:02,920 We just got a file control, which I think we're going to literally write the example out so we can try out how does this actually work. 683 00:26:02,920 --> 00:26:06,960 Like, assuming we have full control, what kind of FD number are we going to get? 684 00:26:06,960 --> 00:26:13,020 Now, that's going to be FD3, of course, because 0, 1, and 2 are allocated to your standard ins and outs. 685 00:26:13,140 --> 00:26:16,000 And so he's going to print out a 3. 686 00:26:16,000 --> 00:26:17,440 He doesn't have a helper in this terminal. 687 00:26:17,440 --> 00:26:18,840 They'll shove his FDs further down. 688 00:26:18,840 --> 00:26:19,280 Yeah. 689 00:26:19,280 --> 00:26:19,440 Yeah. 690 00:26:19,440 --> 00:26:21,780 It automatically allocates more. 691 00:26:21,840 --> 00:26:23,960 And then, okay, we're getting these values. 692 00:26:23,960 --> 00:26:25,000 Yep, and this makes sense. 693 00:26:25,000 --> 00:26:26,220 You're going to get... 694 00:26:27,060 --> 00:26:28,720 We're going to pass a ref. 695 00:26:28,720 --> 00:26:31,380 So we're going to actually get the window size here. 696 00:26:32,140 --> 00:26:33,400 This is really interesting. 697 00:26:33,400 --> 00:26:37,480 So it's kind of dangerous, in my opinion, to keep going in and out of Vim. 698 00:26:37,480 --> 00:26:43,800 Like, I'd probably pull Vim up on another window because you're going to lose your history or your undo buffer here if you end up making a mistake. 699 00:26:43,800 --> 00:26:44,100 Really? 700 00:26:44,700 --> 00:26:46,360 Oh, yeah, I forgot. 701 00:26:46,500 --> 00:26:48,180 Vim 8 added that or whatever? 702 00:26:48,180 --> 00:26:51,140 I think I just disabled that immediately. 703 00:26:51,260 --> 00:26:52,280 Oh , that's so nice. 704 00:26:52,400 --> 00:26:55,520 But it adds a bunch of temporary files, and I hate that. 705 00:26:55,520 --> 00:26:57,920 Put it in your user directory or put it in something you can clean up and do. 706 00:26:57,920 --> 00:26:59,180 So much work. 707 00:26:59,180 --> 00:26:59,680 Oh , my. 708 00:26:59,680 --> 00:27:00,440 So much work. 709 00:27:00,440 --> 00:27:02,000 I've seen what you do on screens. 710 00:27:03,220 --> 00:27:05,640 I keep my environment pretty default here. 711 00:27:05,640 --> 00:27:06,880 Yeah, oh, yeah. 712 00:27:08,960 --> 00:27:11,380 Well, it looks like these guys are using what works for them. 713 00:27:11,380 --> 00:27:11,680 Yeah. 714 00:27:11,680 --> 00:27:15,660 That happens to be four terminals kind of splayed out and man7.com. 715 00:27:15,660 --> 00:27:16,260 Yeah. 716 00:27:16,260 --> 00:27:17,040 Man7.org. 717 00:27:17,140 --> 00:27:18,020 Man7.org. 718 00:27:18,020 --> 00:27:18,960 I guess. 719 00:27:19,380 --> 00:27:23,080 Which you would think Ubuntu would have the Linux man pages. 720 00:27:23,080 --> 00:27:23,640 Oh, it does. 721 00:27:23,640 --> 00:27:24,020 Yeah. 722 00:27:24,020 --> 00:27:24,920 Oh, it has all of them. 723 00:27:24,920 --> 00:27:26,960 Yeah, that's like... 724 00:27:26,960 --> 00:27:28,700 Well, all of them for what you have, obviously. 725 00:27:28,840 --> 00:27:31,000 So that's kind of interesting. 726 00:27:31,400 --> 00:27:32,680 Chad, what do you say? 727 00:27:32,680 --> 00:27:42,160 Do you normally use in-terminal man pages or do you end up on like a die.org or I guess man7.org? 728 00:27:42,160 --> 00:27:44,200 I guess that's what the cool kids use these days. 729 00:27:44,200 --> 00:27:47,380 It's just the first one that comes up because it has man in the domain, I guess. 730 00:27:47,380 --> 00:27:48,100 Yeah. 731 00:27:48,840 --> 00:27:49,800 SEO. 732 00:27:50,280 --> 00:27:51,140 Huh. 733 00:27:53,380 --> 00:27:54,800 That's pretty wild. 734 00:27:54,800 --> 00:27:57,580 I feel like we're kind of looking at the same thing. 735 00:27:57,580 --> 00:28:01,300 We're really, really committing to this getting and setting the window size. 736 00:28:01,300 --> 00:28:02,020 Oh , my God. 737 00:28:02,020 --> 00:28:05,580 And we're actually far enough in that the first hint has been released. 738 00:28:05,580 --> 00:28:06,160 Okay. 739 00:28:06,160 --> 00:28:08,620 We haven't seen what that hint is, have we? 740 00:28:08,620 --> 00:28:09,040 We have. 741 00:28:09,040 --> 00:28:10,720 Has anyone pulled up that hint? 742 00:28:10,720 --> 00:28:13,880 They might need to be hinted at that there's a hint. 743 00:28:14,860 --> 00:28:16,340 We're 20 minutes in. 744 00:28:16,340 --> 00:28:17,100 Okay. 745 00:28:17,700 --> 00:28:18,580 Okay. 746 00:28:18,780 --> 00:28:19,580 Huh. 747 00:28:20,960 --> 00:28:21,780 I don't know. 748 00:28:21,780 --> 00:28:25,040 I think these approaches are pretty good. 749 00:28:26,080 --> 00:28:28,980 Oh, and now we're doing S traits. 750 00:28:28,980 --> 00:28:30,020 So now we're... 751 00:28:30,020 --> 00:28:31,300 So Orgo Kraut. 752 00:28:31,420 --> 00:28:37,860 Yeah, so Orgo Kraut has Ida open and that was interesting in the non-pseudocode view. 753 00:28:38,420 --> 00:28:41,300 But yeah, it's literally just while read int, do another. 754 00:28:41,300 --> 00:28:43,460 Yeah, you say zero or one if you want to read another. 755 00:28:43,460 --> 00:28:51,500 So you have an arbitrary amount of arbitrary ioctals, arbitrary FD, arbitrary io-control code, arbitrary args. 756 00:28:51,500 --> 00:28:53,620 So it is actually ioctal-oriented programming. 757 00:28:53,620 --> 00:28:54,540 Yeah, yeah. 758 00:28:54,540 --> 00:28:56,140 I think that's a great challenge. 759 00:28:56,140 --> 00:28:57,540 I don't think I've seen that before. 760 00:28:57,540 --> 00:28:59,300 It's just, it's brilliant. 761 00:28:59,300 --> 00:29:05,500 That's Glenn's challenge is he just comes up with weird ideas and makes them, but they end up being really cool. 762 00:29:05,560 --> 00:29:06,340 Huh. 763 00:29:06,340 --> 00:29:07,240 I like that. 764 00:29:07,240 --> 00:29:13,100 The other thing I was thinking about, which would be a fun challenge, is the... 765 00:29:13,100 --> 00:29:18,080 What's this syscall that always has bugs and handles the locks and stuff on Linux? 766 00:29:18,080 --> 00:29:20,940 The super fast locks. 767 00:29:21,140 --> 00:29:22,140 Why am I blanking on it? 768 00:29:22,140 --> 00:29:25,820 Was it Geohot's bug way back in the day was on this syscall? 769 00:29:26,160 --> 00:29:27,380 Oh, jeez. 770 00:29:27,860 --> 00:29:29,540 Oh, I forget what it is. 771 00:29:29,540 --> 00:29:31,380 This is outside of my scope of knowledge. 772 00:29:31,380 --> 00:29:32,600 I'm not a historian. 773 00:29:32,600 --> 00:29:44,580 Oh, it's like the fundamental way that you do fast locks on Linux, where they're like, you give it memory addresses and it will alert you when they've changed so you can come back and try your atomic spin lock. 774 00:29:44,580 --> 00:29:48,940 But that whole API is, I think, turn complete in the kernel. 775 00:29:49,080 --> 00:29:49,360 Really ? 776 00:29:49,360 --> 00:29:57,680 You could, I'm pretty sure you could just give it straight up invalid addresses because it won't crash your program because the kernel will fail to access it. 777 00:29:57,680 --> 00:30:01,500 So that would allow you to just try random things. 778 00:30:01,500 --> 00:30:05,300 Or if you don't know an ASLR location, you probably could just jam things in there. 779 00:30:05,300 --> 00:30:10,700 And I think you can tell the kernel to increment or decrement a value at an address, which is fantastic. 780 00:30:10,700 --> 00:30:12,780 So you can do address space pre-coursing in the kernel. 781 00:30:12,780 --> 00:30:13,720 Yes , yes, yes. 782 00:30:13,720 --> 00:30:15,540 So I've wanted to see that. 783 00:30:15,540 --> 00:30:16,980 I've wanted to see that in exploits. 784 00:30:16,980 --> 00:30:18,700 I've wanted to see it in just so many things. 785 00:30:18,700 --> 00:30:20,680 I think it's a really cool way of doing it. 786 00:30:20,680 --> 00:30:22,460 Futex, yes, Futex, exactly. 787 00:30:22,540 --> 00:30:23,240 Futex. 788 00:30:23,240 --> 00:30:26,860 Because Futex has a bunch of different operating modes. 789 00:30:26,860 --> 00:30:27,300 Is it really buggy? 790 00:30:27,300 --> 00:30:28,280 I didn't know that. 791 00:30:28,880 --> 00:30:30,500 Well, that's not even like the bug. 792 00:30:30,500 --> 00:30:32,340 It used to be pretty buggy. 793 00:30:32,340 --> 00:30:37,900 Like, there was one really big Futex bug, and I think that's what... 794 00:30:37,900 --> 00:30:40,720 I think it was like a GeoHotBug way back in the day. 795 00:30:41,060 --> 00:30:43,200 But it's just a really complex... 796 00:30:43,200 --> 00:30:47,360 you know, immediately there's an enum of a bunch of different modes that you can hit in that. 797 00:30:47,820 --> 00:30:50,340 So , and this kind of reminds me of that same thing. 798 00:30:51,520 --> 00:30:54,000 In fact, I think that would apply here. 799 00:30:54,000 --> 00:31:00,260 If you gave IOCTL an invalid address, the kernel's going to report back, bad adder. 800 00:31:00,260 --> 00:31:01,920 It's not going to crash your program. 801 00:31:01,920 --> 00:31:07,580 So if you need to make a couple guesses, in this case, I don't know why you would, you have the address that you care about. 802 00:31:08,640 --> 00:31:11,500 But , oh, we're in read int. 803 00:31:11,500 --> 00:31:12,400 We're seeing what we get. 804 00:31:12,400 --> 00:31:19,220 It looks like an LX was the read int command, which means that you will get the full 64 bits. 805 00:31:19,520 --> 00:31:20,240 Oh , that's interesting. 806 00:31:20,240 --> 00:31:21,600 The return code is 32. 807 00:31:21,880 --> 00:31:24,660 On Straw Hat, they're adding hex to everything. 808 00:31:24,660 --> 00:31:26,560 I think they weren't using hex. 809 00:31:26,560 --> 00:31:29,720 And explicitly, it's pulling it in as hex. 810 00:31:29,840 --> 00:31:32,240 And that really hurts. 811 00:31:32,240 --> 00:31:34,300 This might be a bit of a breakthrough for them. 812 00:31:34,300 --> 00:31:36,620 I think that is a pretty big breakthrough. 813 00:31:36,920 --> 00:31:38,140 Oh, no. 814 00:31:38,500 --> 00:31:39,320 Yeah. 815 00:31:40,100 --> 00:31:40,660 Yeah. 816 00:31:40,660 --> 00:31:42,840 Just goes to show, no one knows how this works. 817 00:31:42,840 --> 00:31:43,480 Right. 818 00:31:43,480 --> 00:31:45,420 Yeah, I mean, that's really tough. 819 00:31:45,420 --> 00:31:47,880 That's the sort of thing that you get stuck on for a while. 820 00:31:47,880 --> 00:31:51,880 I think that's why he went into GCC to try it out. 821 00:31:51,880 --> 00:31:53,300 And then it probably worked in GCC. 822 00:31:53,300 --> 00:31:54,300 And he's like, what the hell? 823 00:31:54,300 --> 00:31:57,280 You can see, trying to do four ones. 824 00:31:57,280 --> 00:32:00,340 He got bad adder from the IOCTL. 825 00:32:01,060 --> 00:32:02,600 And that makes sense. 826 00:32:02,600 --> 00:32:04,200 That totally makes sense. 827 00:32:04,440 --> 00:32:08,000 So it looks like we're probably on a pretty fast path now. 828 00:32:08,000 --> 00:32:11,840 I think Straw Hat should have a pretty direct route. 829 00:32:11,840 --> 00:32:13,200 You know where your arcs are. 830 00:32:13,200 --> 00:32:14,720 You know what you control on the stack. 831 00:32:14,720 --> 00:32:16,860 I mean, that IDA output is fantastic. 832 00:32:16,860 --> 00:32:17,860 They have that going now. 833 00:32:17,860 --> 00:32:20,220 It's going to be smooth for them, whatever they want to do. 834 00:32:20,220 --> 00:32:21,180 For sure. 835 00:32:22,440 --> 00:32:24,500 What do we got going on, Orger Crout, over here? 836 00:32:24,500 --> 00:32:28,280 Orger Crout is looking at PTY docs. 837 00:32:29,600 --> 00:32:31,260 OK, you know. 838 00:32:31,260 --> 00:32:35,600 I feel like we've almost had time to read through all of these docs by this point. 839 00:32:35,600 --> 00:32:41,580 I feel like, if you just take screenshots of every frame, you could see every IOCTL doc. 840 00:32:41,580 --> 00:32:41,900 Right. 841 00:32:41,900 --> 00:32:43,420 Like, you could have the full thing there. 842 00:32:43,420 --> 00:32:43,760 Yeah. 843 00:32:43,940 --> 00:32:44,940 Forgetman7.org. 844 00:32:44,940 --> 00:32:46,580 Just pull up live CTM. 845 00:32:46,580 --> 00:32:47,780 Right, right. 846 00:32:49,020 --> 00:32:49,900 This is wild. 847 00:32:49,900 --> 00:32:50,900 Oh, I think this is the... 848 00:32:50,900 --> 00:32:52,140 TC Send Break? 849 00:32:53,020 --> 00:32:57,800 OK, so he's just going through the TC Send Break. 850 00:32:58,660 --> 00:32:59,740 Does that get you a write? 851 00:32:59,740 --> 00:33:02,200 Because I imagine you're going to need an arbitrary write. 852 00:33:03,440 --> 00:33:06,220 And so you're kind of going to need some sort of a getter. 853 00:33:06,220 --> 00:33:09,220 I do like the window size, because you have a setter and a getter. 854 00:33:09,220 --> 00:33:10,640 You can store stuff off. 855 00:33:10,640 --> 00:33:12,680 You can pick it and then write it to another place. 856 00:33:12,680 --> 00:33:15,700 I mean, basically, it's memcpy, but through the kernel. 857 00:33:15,700 --> 00:33:17,840 Is the argument for that UN16? 858 00:33:18,980 --> 00:33:20,260 For the IOCTL? 859 00:33:21,100 --> 00:33:22,980 So all the arguments will be long. 860 00:33:22,980 --> 00:33:24,500 So it will be 64-bit. 861 00:33:24,500 --> 00:33:30,620 And so it'll just be one arg, which is a pointer to a structure. 862 00:33:30,660 --> 00:33:34,700 And the structure is just four shorts that are packed in memory. 863 00:33:35,240 --> 00:33:36,900 I don't know what the shorts are. 864 00:33:36,900 --> 00:33:42,540 I think it's some pixel and column and size of the terminal sort of thing. 865 00:33:43,180 --> 00:33:46,580 But it looks like that's what we're committing to on Straw Hat. 866 00:33:46,660 --> 00:33:52,020 And Orgatron, I think, is still trying to decide what IOCTL they're on. 867 00:33:52,020 --> 00:33:54,840 They were reading the same exact thing, actually. 868 00:33:55,520 --> 00:33:57,640 They're thinking about the same approach. 869 00:33:57,640 --> 00:34:00,620 Wow, and you get the IOCTL return. 870 00:34:00,620 --> 00:34:07,180 So you could potentially use that if you needed to figure out some information from the kernel. 871 00:34:07,180 --> 00:34:09,180 I don't think that's necessary here. 872 00:34:09,180 --> 00:34:11,900 I think you can do this plainly. 873 00:34:11,900 --> 00:34:13,080 I don't think you need anything to fail. 874 00:34:13,080 --> 00:34:15,600 I think you can use it to verify that your hard write worked. 875 00:34:15,600 --> 00:34:16,600 Which is great. 876 00:34:16,600 --> 00:34:20,700 It is great to have an oracle that stuff is going well. 877 00:34:20,700 --> 00:34:22,820 It does only return you a 32. 878 00:34:22,940 --> 00:34:23,080 Yeah . 879 00:34:23,550 --> 00:34:24,800 Or I guess in 32. 880 00:34:24,800 --> 00:34:25,600 Right. 881 00:34:26,540 --> 00:34:27,540 Huh. 882 00:34:29,440 --> 00:34:31,900 Yeah, we'll see what we're going to get here. 883 00:34:31,900 --> 00:34:33,720 OK, we're doing some math. 884 00:34:33,780 --> 00:34:40,080 So we're subtracting main from the main of the relocated thing. 885 00:34:40,080 --> 00:34:42,860 This is going to give us basically the slide. 886 00:34:42,860 --> 00:34:46,940 Or whatever this actual ASLR offset. 887 00:34:48,030 --> 00:34:50,140 And that's good information to have. 888 00:34:50,140 --> 00:34:53,680 I guess you'll need that because... 889 00:34:53,680 --> 00:34:55,820 Is there a win function maybe they're calculating? 890 00:34:55,820 --> 00:34:57,800 I don't know if there's a win function. 891 00:34:57,800 --> 00:35:01,500 I don't know if they're just going to go right to like a system. 892 00:35:01,500 --> 00:35:03,280 Oh, they're writing like ESS or something? 893 00:35:03,280 --> 00:35:03,860 Yeah. 894 00:35:03,860 --> 00:35:04,600 OK. 895 00:35:04,700 --> 00:35:05,540 Read eight. 896 00:35:05,540 --> 00:35:06,140 OK. 897 00:35:06,140 --> 00:35:08,700 Making just a clean function for read eight. 898 00:35:08,700 --> 00:35:09,160 OK . 899 00:35:13,100 --> 00:35:13,720 IOCTL321523. 900 00:35:13,720 --> 00:35:14,940 No hex there. 901 00:35:15,040 --> 00:35:15,280 Which is... 902 00:35:15,280 --> 00:35:15,980 Wow. 903 00:35:17,560 --> 00:35:18,220 Interesting. 904 00:35:18,220 --> 00:35:20,840 OK, and then we're passing in those args. 905 00:35:21,300 --> 00:35:23,580 And I think now we're going to... 906 00:35:23,580 --> 00:35:27,680 OK, now we're going for a straight read and write primitive. 907 00:35:28,140 --> 00:35:31,420 I don't know if these values are controlled yet. 908 00:35:31,420 --> 00:35:33,960 Yeah, this is just triggering the read to an address. 909 00:35:34,000 --> 00:35:36,040 Triggering the write to an address. 910 00:35:36,440 --> 00:35:40,040 And yeah, I guess it is an eight byte read and write because it's a four short. 911 00:35:40,040 --> 00:35:42,460 So four times two is your eight. 912 00:35:43,260 --> 00:35:43,700 So... 913 00:35:43,700 --> 00:35:45,860 But that read isn't... 914 00:35:45,860 --> 00:35:46,960 Oh no, well, yeah, yeah. 915 00:35:46,960 --> 00:35:48,340 It's just the address. 916 00:35:48,340 --> 00:35:49,620 Because it'll just return success. 917 00:35:49,620 --> 00:35:50,020 That's right. 918 00:35:50,020 --> 00:35:50,980 Yep, yep. 919 00:35:52,320 --> 00:35:54,840 So it's really going to come down to what? 920 00:35:54,840 --> 00:35:56,920 Yes , that is getting the read and write primitives. 921 00:35:57,040 --> 00:35:57,460 Yeah. 922 00:35:57,460 --> 00:36:01,680 Over on Orgacram, we had some math for a second there. 923 00:36:01,960 --> 00:36:06,020 But it looks like they're going for an offset from arg two. 924 00:36:06,260 --> 00:36:07,000 OK. 925 00:36:07,000 --> 00:36:07,860 Unknown. 926 00:36:08,100 --> 00:36:11,380 I think that is kind of similar to what I was thinking. 927 00:36:11,380 --> 00:36:16,540 Because I think read int, I think that's getting a 64-bit hexadecimal value. 928 00:36:16,540 --> 00:36:25,760 So if you want to go the approach where you are reading and writing in arbitrary eight, I think you have to use the higher args, come back around. 929 00:36:25,760 --> 00:36:30,080 You need to use the low arg one so that you have the address. 930 00:36:30,080 --> 00:36:32,100 And then you can't clobber the other things. 931 00:36:32,100 --> 00:36:33,600 But that should be totally fine. 932 00:36:33,600 --> 00:36:36,020 I think that approach would just work. 933 00:36:36,360 --> 00:36:37,340 Let's see. 934 00:36:37,360 --> 00:36:38,860 AW eight. 935 00:36:38,860 --> 00:36:42,140 Oh, wait a minute. 936 00:36:42,340 --> 00:36:42,920 Oh. 937 00:36:42,920 --> 00:36:44,180 Oh, I saw set seven. 938 00:36:44,180 --> 00:36:45,000 I got excited. 939 00:36:45,000 --> 00:36:45,600 OK. 940 00:36:46,460 --> 00:36:47,280 Set win. 941 00:36:47,280 --> 00:36:49,080 Oh, OK, they're throwing some As in there. 942 00:36:49,080 --> 00:36:53,100 We're going to try and use address As, get and set window. 943 00:36:53,100 --> 00:36:56,200 And so now it looks like we have the same approaches on both. 944 00:36:56,200 --> 00:36:58,600 Oh, it's going to be a real close race. 945 00:36:58,600 --> 00:36:59,040 Yes . 946 00:37:00,460 --> 00:37:01,280 Huh. 947 00:37:01,280 --> 00:37:01,980 OK. 948 00:37:01,980 --> 00:37:10,700 Now it's starting to get more to like a mechanical thing of like, how fast can you write the code to do the right thing, get that feedback? 949 00:37:10,700 --> 00:37:16,060 Because I think both of them are clearly aware of the path that they're going to take. 950 00:37:16,060 --> 00:37:16,920 And I agree. 951 00:37:16,920 --> 00:37:18,600 It's a winning path here. 952 00:37:19,240 --> 00:37:22,900 Oh, it looks like they got a write of four bytes. 953 00:37:23,060 --> 00:37:23,100 Yep . 954 00:37:23,100 --> 00:37:23,880 There's yep. 955 00:37:23,880 --> 00:37:25,460 There's that window size. 956 00:37:25,460 --> 00:37:28,400 So that's the actual structure that they're going to be able to control. 957 00:37:28,500 --> 00:37:29,080 Nice. 958 00:37:29,300 --> 00:37:34,520 And I do think they're going to need to rely on the uninitialized memory. 959 00:37:34,720 --> 00:37:35,080 Right. 960 00:37:35,080 --> 00:37:35,580 32. 961 00:37:35,580 --> 00:37:38,180 I don't think that's a 32 bit write. 962 00:37:38,180 --> 00:37:38,720 He got a 32 bit write. 963 00:37:38,720 --> 00:37:39,620 From what? 964 00:37:39,620 --> 00:37:40,200 Do you know what? 965 00:37:40,200 --> 00:37:41,120 From this? 966 00:37:41,300 --> 00:37:42,720 I didn't see exactly what happened. 967 00:37:42,720 --> 00:37:44,240 Yeah, I didn't see that either. 968 00:37:44,660 --> 00:37:45,780 Okay. 969 00:37:45,880 --> 00:37:46,760 I'm not sure. 970 00:37:46,760 --> 00:37:48,520 That'll be really interesting to see. 971 00:37:48,520 --> 00:37:49,400 It might... 972 00:37:51,860 --> 00:37:57,460 Oh, it might be because he's doing offset from argc to arg2. 973 00:38:00,140 --> 00:38:00,700 Adder... 974 00:38:00,700 --> 00:38:02,440 Set win. 975 00:38:04,220 --> 00:38:05,340 Global ioctl. 976 00:38:05,340 --> 00:38:08,880 I don't think that's how that ioctl works. 977 00:38:09,540 --> 00:38:10,420 Oh! 978 00:38:11,280 --> 00:38:12,560 That makes sense. 979 00:38:12,560 --> 00:38:14,800 He's doing both in one syscall. 980 00:38:14,800 --> 00:38:15,160 Yeah . 981 00:38:15,160 --> 00:38:18,960 Because it'll just ignore that second argument. 982 00:38:18,980 --> 00:38:24,060 So you can just put your value in there, put the address to that, so you don't have to come back around. 983 00:38:24,060 --> 00:38:25,260 That totally makes sense. 984 00:38:25,280 --> 00:38:26,620 So that'll just work. 985 00:38:26,960 --> 00:38:27,280 Wow. 986 00:38:27,280 --> 00:38:30,040 I'm surprised it doesn't fail on invalid argument numbers. 987 00:38:30,040 --> 00:38:30,880 I won't care. 988 00:38:30,880 --> 00:38:32,000 It won't know. 989 00:38:32,000 --> 00:38:35,060 It doesn't know until it gets into the kernel and does the switch statement. 990 00:38:35,060 --> 00:38:36,440 I guess it has to be fast. 991 00:38:36,440 --> 00:38:37,440 Why does it do argchecker? 992 00:38:37,440 --> 00:38:38,540 Well, yeah, why would you do that? 993 00:38:38,540 --> 00:38:40,580 That's a perf loss and Linux is fast. 994 00:38:40,580 --> 00:38:45,360 So this, I'm pretty sure Orgertrout's on a very, very, very good path here. 995 00:38:45,360 --> 00:38:47,020 They're on a laser path. 996 00:38:47,020 --> 00:38:48,320 They have... 997 00:38:48,320 --> 00:38:50,040 Do they have the address computed? 998 00:38:50,040 --> 00:38:52,780 Do they know the offset of arg2? 999 00:38:52,780 --> 00:38:54,160 But it's exactly what they have to do. 1000 00:38:54,160 --> 00:38:55,460 They have the address of arg2. 1001 00:38:55,460 --> 00:38:57,980 They calculated argc-ox24. 1002 00:38:57,980 --> 00:39:01,200 Then they're basically, like, right there. 1003 00:39:01,200 --> 00:39:01,960 Yeah. 1004 00:39:02,220 --> 00:39:03,320 That's looking pretty good. 1005 00:39:03,320 --> 00:39:05,380 Let's check in on strawhat and realstrawhat. 1006 00:39:05,380 --> 00:39:05,860 Okay. 1007 00:39:05,860 --> 00:39:09,020 They're still doing this, like, invalid ioctl. 1008 00:39:09,020 --> 00:39:10,020 Oh, you know what? 1009 00:39:10,020 --> 00:39:11,520 That's what I was talking about. 1010 00:39:11,520 --> 00:39:13,120 They're doing an invalid ioctl. 1011 00:39:13,120 --> 00:39:15,780 They're putting a value deeper on the stack. 1012 00:39:15,780 --> 00:39:18,200 They'll come back around, and then they're going to do their writes. 1013 00:39:18,200 --> 00:39:20,140 So that's interesting. 1014 00:39:20,140 --> 00:39:25,300 I like Orgertrout's more, even though strawhat is doing it the way that I initially thought of. 1015 00:39:25,300 --> 00:39:27,520 I feel like Orgertrout's is a little restrictive. 1016 00:39:28,360 --> 00:39:29,600 I think it's cleaner. 1017 00:39:29,600 --> 00:39:32,640 I think it's cleaner because it's guaranteed it's one pass. 1018 00:39:32,640 --> 00:39:36,060 You don't have to do an invalid ioctl, which is nice. 1019 00:39:36,640 --> 00:39:42,240 It's just a little quieter for, you know, you don't want the IDS to figure out your exploit here. 1020 00:39:42,240 --> 00:39:44,140 So you want to keep the errors to a minimum. 1021 00:39:44,140 --> 00:39:46,480 You want to have a nice, clean environment. 1022 00:39:46,480 --> 00:39:47,600 Yes, exactly. 1023 00:39:47,600 --> 00:39:48,500 Exactly. 1024 00:39:48,820 --> 00:39:53,440 So it looks like we're trying to figure out AW8. 1025 00:39:53,460 --> 00:39:54,560 Write 8? 1026 00:39:54,560 --> 00:39:55,160 AW8? 1027 00:39:55,160 --> 00:39:56,480 Address write 8? 1028 00:39:56,780 --> 00:39:58,280 Address write 8. 1029 00:39:58,640 --> 00:39:59,440 Maybe. 1030 00:40:01,420 --> 00:40:08,300 And they're going to be using org4, which makes sense here, because they're doing the four arg ioctl. 1031 00:40:08,600 --> 00:40:11,220 And yeah, now we're doing some math in it. 1032 00:40:11,220 --> 00:40:12,100 Oh, hang on. 1033 00:40:12,100 --> 00:40:15,380 Over on Orgertrout, we're calculating the base address to... 1034 00:40:15,380 --> 00:40:16,840 What function was that? 1035 00:40:16,840 --> 00:40:20,700 Is he trying to pivot to the scanner for like a cleaner arbrite? 1036 00:40:21,780 --> 00:40:22,640 God, I don't know. 1037 00:40:22,640 --> 00:40:24,800 I feel like this arbrite's about as clean as you can get. 1038 00:40:24,800 --> 00:40:26,080 Yeah, it really is. 1039 00:40:26,980 --> 00:40:27,960 Pass in numbers. 1040 00:40:27,960 --> 00:40:28,940 It puts numbers. 1041 00:40:28,940 --> 00:40:29,640 I'm happy with this. 1042 00:40:29,640 --> 00:40:31,300 Have we seen a crash yet? 1043 00:40:31,560 --> 00:40:33,240 We've had the debugger open. 1044 00:40:33,240 --> 00:40:35,740 I think a debugger has only been... 1045 00:40:35,740 --> 00:40:37,080 It's only been control C. 1046 00:40:37,080 --> 00:40:37,780 Yeah. 1047 00:40:38,280 --> 00:40:40,520 So I'm excited to see our first crash. 1048 00:40:40,520 --> 00:40:41,920 Oh, we have a rock going. 1049 00:40:42,520 --> 00:40:43,640 We wait. 1050 00:40:43,840 --> 00:40:44,480 Rock? 1051 00:40:44,480 --> 00:40:46,260 It looks like he's writing red. 1052 00:40:47,120 --> 00:40:49,760 It looks like he has arbrite on top of the stack. 1053 00:40:50,540 --> 00:40:51,180 OK. 1054 00:40:51,180 --> 00:40:52,100 And he's overwriting the puts. 1055 00:40:52,100 --> 00:40:53,380 Does it have railroad, though? 1056 00:40:53,380 --> 00:40:54,860 Is he writing... 1057 00:40:54,860 --> 00:40:59,540 You will be able to skip over the cookie, which is very nice for this primitive. 1058 00:40:59,600 --> 00:41:01,360 No, just being able to poke wherever you want immediately. 1059 00:41:01,360 --> 00:41:04,640 Oh, yeah, it's just the beautiful, beautiful primitive. 1060 00:41:04,680 --> 00:41:04,960 Yeah . 1061 00:41:04,960 --> 00:41:06,860 But it looks like... 1062 00:41:06,860 --> 00:41:08,780 I don't know if this binary has railroad. 1063 00:41:09,320 --> 00:41:11,420 Because... or full, partial, whatever. 1064 00:41:11,420 --> 00:41:11,860 Yeah. 1065 00:41:11,860 --> 00:41:17,300 But he wants to jump to puts unless he's just going to use puts as a lead. 1066 00:41:18,520 --> 00:41:19,260 Interesting. 1067 00:41:19,260 --> 00:41:21,540 Because I assume he's going for, like, a got overwrite. 1068 00:41:21,580 --> 00:41:23,000 Yeah, I guess so. 1069 00:41:24,140 --> 00:41:24,940 Huh. 1070 00:41:25,700 --> 00:41:27,380 I'm going to have to close chat. 1071 00:41:27,380 --> 00:41:29,520 I'm running out of battery right now on my phone. 1072 00:41:30,640 --> 00:41:31,760 All right. 1073 00:41:31,760 --> 00:41:32,880 Red adder equals red adder. 1074 00:41:34,320 --> 00:41:36,140 Oh, I'm making progress here. 1075 00:41:36,140 --> 00:41:36,820 Yeah. 1076 00:41:36,880 --> 00:41:37,640 Straw hat. 1077 00:41:37,640 --> 00:41:43,900 Now it's really a matter of what approach are you going to pick to land, or get your executioner, or leak the flag. 1078 00:41:43,900 --> 00:41:47,100 I think all of these you're supposed to run a command to win. 1079 00:41:47,100 --> 00:41:48,620 You run, like, a shell command? 1080 00:41:48,620 --> 00:41:53,000 You get a shell, you run the submitter, and a little happy message pops up. 1081 00:41:53,000 --> 00:41:53,500 Interesting. 1082 00:41:53,500 --> 00:41:56,220 So I don't know what puts is going to be for. 1083 00:41:56,220 --> 00:41:57,280 What was added here? 1084 00:41:57,280 --> 00:42:03,300 Like, Orgicrout is about to check if they crash on invalid access to 414141. 1085 00:42:03,420 --> 00:42:04,320 OK. 1086 00:42:05,520 --> 00:42:09,580 And it looks like they're just going to send their option. 1087 00:42:11,180 --> 00:42:12,620 Wait a minute. 1088 00:42:14,080 --> 00:42:15,940 Are we back to brute forcing? 1089 00:42:15,940 --> 00:42:16,440 No, no. 1090 00:42:16,440 --> 00:42:18,180 He wrote our option for this. 1091 00:42:18,860 --> 00:42:23,500 Well, then why are we working on a brute force loop enumerate all the octal thing? 1092 00:42:23,500 --> 00:42:24,460 I think he's just... 1093 00:42:24,460 --> 00:42:26,000 Oh, that's where his code was. 1094 00:42:26,000 --> 00:42:26,220 Yeah. 1095 00:42:26,220 --> 00:42:27,180 Yeah, OK. 1096 00:42:27,260 --> 00:42:29,620 OK, so now he's got to switch back over. 1097 00:42:29,740 --> 00:42:30,880 I see. 1098 00:42:31,120 --> 00:42:32,860 Yeah , required argument not an integer. 1099 00:42:33,340 --> 00:42:34,840 Usually numbers are good. 1100 00:42:38,560 --> 00:42:38,960 Now... 1101 00:42:39,840 --> 00:42:43,720 All right, so he's going to be debugging that for, oh, there we go, u64. 1102 00:42:43,780 --> 00:42:44,780 Hang on. 1103 00:42:45,440 --> 00:42:46,060 Cool. 1104 00:42:46,060 --> 00:42:46,800 And what did we get? 1105 00:42:46,800 --> 00:42:47,640 Where's rip? 1106 00:42:47,640 --> 00:42:48,700 Are we in puts? 1107 00:42:48,760 --> 00:42:49,600 We're in puts. 1108 00:42:49,600 --> 00:42:50,460 We're in puts. 1109 00:42:50,460 --> 00:42:51,540 We're red on puts. 1110 00:42:51,540 --> 00:42:52,860 Red is... 1111 00:42:52,860 --> 00:42:54,280 And we got a success. 1112 00:42:54,720 --> 00:42:55,520 Wow. 1113 00:42:55,620 --> 00:42:56,820 So, yeah, it looks like... 1114 00:42:56,820 --> 00:42:57,420 The stack is A. 1115 00:42:57,420 --> 00:42:58,440 He's writing the format. 1116 00:42:58,440 --> 00:43:00,920 Yeah, that's looking pretty good. 1117 00:43:00,920 --> 00:43:02,320 That's looking really good. 1118 00:43:02,320 --> 00:43:03,460 It's close. 1119 00:43:03,600 --> 00:43:05,060 Let's check in on straw hat. 1120 00:43:05,060 --> 00:43:06,220 Let's see where we're at. 1121 00:43:06,620 --> 00:43:07,300 I'll keep an eye on him. 1122 00:43:07,300 --> 00:43:10,740 We should have an arbitrary write here. 1123 00:43:10,740 --> 00:43:12,980 I think we're going to probably see that crash. 1124 00:43:12,980 --> 00:43:18,620 I don't know if he's going to try and write maybe over that return address and just see what happens. 1125 00:43:18,620 --> 00:43:21,820 You also have the arb read, which is quite nice to have. 1126 00:43:21,820 --> 00:43:25,000 I don't know if you really need to use that. 1127 00:43:25,000 --> 00:43:26,040 I mean, you have binary base. 1128 00:43:26,040 --> 00:43:28,660 You can just read a PLT and be like, oh, I'll just appear. 1129 00:43:28,700 --> 00:43:29,460 Yeah. 1130 00:43:31,080 --> 00:43:34,560 Yeah, have any of them looked for a win function yet? 1131 00:43:34,960 --> 00:43:36,700 I don't think there is a win function yet. 1132 00:43:36,700 --> 00:43:37,940 Okay, no win function? 1133 00:43:37,940 --> 00:43:38,380 Yeah. 1134 00:43:38,380 --> 00:43:41,080 I imagine if there was a win function instead of A's, he'd just put that. 1135 00:43:41,080 --> 00:43:41,660 Yeah. 1136 00:43:41,660 --> 00:43:42,700 Yeah, exactly. 1137 00:43:42,700 --> 00:43:44,740 Like, you would just be done at this point. 1138 00:43:45,020 --> 00:43:51,940 So, I mean, there could be a win function they haven't looked yet, and that would be rough. 1139 00:43:51,980 --> 00:43:52,680 Oh. 1140 00:43:52,680 --> 00:43:53,460 You know? 1141 00:43:54,380 --> 00:43:54,860 So... 1142 00:43:54,860 --> 00:43:56,620 We've been in this one function, yeah. 1143 00:43:56,940 --> 00:43:57,760 Huh. 1144 00:43:58,240 --> 00:43:59,200 Yeah. 1145 00:43:59,700 --> 00:44:02,480 Okay, so Orgicrout running their script again. 1146 00:44:02,480 --> 00:44:02,960 Okay. 1147 00:44:02,960 --> 00:44:04,600 They have print out of... 1148 00:44:04,600 --> 00:44:05,680 Is that libc? 1149 00:44:06,600 --> 00:44:07,300 7foe? 1150 00:44:07,300 --> 00:44:08,920 That doesn't look like stack address. 1151 00:44:13,280 --> 00:44:14,860 That looks like the libc link. 1152 00:44:14,860 --> 00:44:16,300 7 hex bytes. 1153 00:44:16,680 --> 00:44:17,400 Yeah. 1154 00:44:17,400 --> 00:44:19,340 Either libc or ld, I don't know which. 1155 00:44:21,760 --> 00:44:24,500 Unmapped address, context failed. 1156 00:44:25,320 --> 00:44:29,600 So, they're actually hamstrung by their Jeff installation. 1157 00:44:29,600 --> 00:44:32,140 They just had a Python, like, int access error. 1158 00:44:32,140 --> 00:44:33,220 Oh, no. 1159 00:44:33,780 --> 00:44:34,360 Oh, no. 1160 00:44:34,360 --> 00:44:36,620 So , I really hope it doesn't come down to that. 1161 00:44:36,620 --> 00:44:38,220 Because they are... 1162 00:44:38,220 --> 00:44:39,440 They got a libc leak. 1163 00:44:39,440 --> 00:44:40,520 They have the libc. 1164 00:44:40,520 --> 00:44:43,740 They can calculate offset to exec be and pass whatever they want. 1165 00:44:43,740 --> 00:44:45,060 Exactly, yeah. 1166 00:44:45,520 --> 00:44:48,000 And yet, they're calculating the leak right now. 1167 00:44:48,000 --> 00:44:49,220 Or unpacking it. 1168 00:44:49,220 --> 00:44:49,920 Yep. 1169 00:44:52,560 --> 00:44:53,940 U64, what does that do? 1170 00:44:53,940 --> 00:44:55,260 Is that just parses it? 1171 00:44:55,300 --> 00:44:55,500 Unpack 64 . 1172 00:44:55,500 --> 00:44:55,640 Oh. 1173 00:44:55,640 --> 00:44:58,120 It just bytes and turns them into int versus an int. 1174 00:44:58,120 --> 00:45:01,020 Oh, so you don't have to do struct.unpack every time. 1175 00:45:01,020 --> 00:45:02,580 Oh, that's quite nice. 1176 00:45:02,580 --> 00:45:03,220 Yeah. 1177 00:45:03,880 --> 00:45:07,200 Hey, we got a SIGSAT, that PC of 414141 on strawhat. 1178 00:45:07,200 --> 00:45:08,800 Oh, this is really close. 1179 00:45:08,800 --> 00:45:10,420 So, now we got that going. 1180 00:45:10,420 --> 00:45:12,200 Strawhat is not 4141. 1181 00:45:12,200 --> 00:45:14,380 But Orgicrout is calculating offset to exec be. 1182 00:45:14,380 --> 00:45:15,160 I know. 1183 00:45:15,160 --> 00:45:16,140 I know. 1184 00:45:16,740 --> 00:45:18,420 Oh, my goodness. 1185 00:45:19,980 --> 00:45:21,040 That's tough. 1186 00:45:21,040 --> 00:45:26,500 It really comes down to how quickly can you go from that. 1187 00:45:26,500 --> 00:45:27,680 What is this all the gadgets? 1188 00:45:27,680 --> 00:45:29,440 Strawhat's about to pull up... 1189 00:45:29,440 --> 00:45:32,000 Oh, I thought they were going to pull up all the gadgets function. 1190 00:45:32,000 --> 00:45:33,640 I was very curious what that was. 1191 00:45:33,640 --> 00:45:34,380 Because that... 1192 00:45:34,380 --> 00:45:36,280 What if that just has... 1193 00:45:36,280 --> 00:45:38,580 What if that is a win function or something like that? 1194 00:45:38,780 --> 00:45:42,300 Because that function has not been needed for anything else yet. 1195 00:45:42,300 --> 00:45:46,640 It's clearly in there, like, intentionally. 1196 00:45:46,640 --> 00:45:47,560 Oh, yeah. 1197 00:45:47,560 --> 00:45:49,500 We're looking for the got here. 1198 00:45:49,980 --> 00:45:52,400 And we've got ioctyl in there. 1199 00:45:52,400 --> 00:45:59,100 So, we're actually going to try and use the address of the ioctyl entry in the got. 1200 00:46:00,320 --> 00:46:02,700 Oh, so they don't have to call a different function. 1201 00:46:02,700 --> 00:46:04,840 They just look back around and it's there for you. 1202 00:46:04,840 --> 00:46:05,880 Okay, that's kind of nice. 1203 00:46:05,880 --> 00:46:06,580 So, we'll see. 1204 00:46:06,580 --> 00:46:07,920 Oh, hang on. 1205 00:46:07,940 --> 00:46:08,400 Okay. 1206 00:46:08,660 --> 00:46:09,240 Orgicrout. 1207 00:46:09,240 --> 00:46:11,840 I see rop.call libc.symbol system. 1208 00:46:12,440 --> 00:46:12,820 Wow. 1209 00:46:12,820 --> 00:46:13,620 This is... 1210 00:46:13,620 --> 00:46:15,540 Is that going to work out of the box? 1211 00:46:15,620 --> 00:46:16,020 Yeah. 1212 00:46:16,020 --> 00:46:18,840 I mean, they set the base address of libc. 1213 00:46:18,840 --> 00:46:21,280 They loaded it as an ELF. 1214 00:46:21,540 --> 00:46:22,740 No, PwnTools is nice. 1215 00:46:22,740 --> 00:46:23,340 Yeah. 1216 00:46:23,820 --> 00:46:25,840 I've just never really used PwnTools. 1217 00:46:25,840 --> 00:46:29,280 Oh, oh, over here on Straw Hat, we're looking at RopGadgets. 1218 00:46:29,440 --> 00:46:31,760 Oh, so they're both building chains right now. 1219 00:46:31,760 --> 00:46:34,520 One of them looking manually and one of them is PwnTools building. 1220 00:46:34,840 --> 00:46:39,320 Mm, yeah, we got a PopRDI gadget. 1221 00:46:39,320 --> 00:46:40,940 It looks like a PopRDI ret. 1222 00:46:40,940 --> 00:46:44,600 So, just straight up prepping for gadgets. 1223 00:46:44,600 --> 00:46:50,640 This is basically manual versus the machine at this point. 1224 00:46:50,860 --> 00:46:55,500 Well, Orgicrout now doing system on BSS. 1225 00:46:57,440 --> 00:46:58,020 Okay. 1226 00:46:58,020 --> 00:47:01,580 And then time.not.sleep, and then they're sending bin.sh, I guess. 1227 00:47:03,160 --> 00:47:05,560 Yeah, we'll see if that drops us in. 1228 00:47:05,560 --> 00:47:06,140 Oh , no , no, no, no, no. 1229 00:47:06,140 --> 00:47:08,280 They forgot the null byte at the end of bin.sh. 1230 00:47:09,060 --> 00:47:11,040 Do you need to manually specify that? 1231 00:47:11,040 --> 00:47:11,800 Yeah. 1232 00:47:12,280 --> 00:47:13,280 Nuntep has no... 1233 00:47:13,280 --> 00:47:14,800 Oh, they put it too early. 1234 00:47:14,800 --> 00:47:16,480 They loaded libc later, I guess. 1235 00:47:16,560 --> 00:47:16,920 Oh. 1236 00:47:16,920 --> 00:47:18,280 Or they type out the libc name. 1237 00:47:18,280 --> 00:47:18,820 Oh. 1238 00:47:18,820 --> 00:47:19,940 Oh, it's just that libc. 1239 00:47:19,940 --> 00:47:20,660 Weird line. 1240 00:47:20,660 --> 00:47:22,780 You just need to help libc, so. 1241 00:47:23,160 --> 00:47:24,640 Oh, this is tough. 1242 00:47:24,640 --> 00:47:27,160 See, this is where manual sometimes can get ahead. 1243 00:47:27,160 --> 00:47:30,400 I think manual should always be slower in this case. 1244 00:47:30,580 --> 00:47:41,420 But in the off chance that PwnTools doesn't work out of the box or has some error, you might end up fighting PwnTools more than you would have to fight just making the RopGadget. 1245 00:47:43,140 --> 00:47:43,700 Right. 1246 00:47:44,040 --> 00:47:44,200 Right. 1247 00:47:44,260 --> 00:47:45,620 PwnTools, you need to go look up docs. 1248 00:47:45,620 --> 00:47:47,420 Well, not docs.man7.org, of course. 1249 00:47:47,420 --> 00:47:47,620 Right. 1250 00:47:47,620 --> 00:47:49,100 But you need to go look up docs. 1251 00:47:49,100 --> 00:47:50,060 You need to figure out how it works. 1252 00:47:50,060 --> 00:47:51,260 You need to debug anything that went wrong. 1253 00:47:51,260 --> 00:47:52,420 Figure out what the return code is. 1254 00:47:52,740 --> 00:47:54,920 This, you're just like, oh, you know, my gadget's right here. 1255 00:47:54,920 --> 00:47:55,400 Yeah. 1256 00:47:56,360 --> 00:47:56,920 This is... 1257 00:47:57,280 --> 00:47:59,620 This is going to be pretty tight, I think. 1258 00:47:59,780 --> 00:48:00,040 Yeah. 1259 00:48:00,120 --> 00:48:00,960 Let's see. 1260 00:48:00,960 --> 00:48:01,260 Yeah. 1261 00:48:01,260 --> 00:48:07,040 Over on OrgaCrow, we just got the error, cannot send a migrated chain, which is one of those usage overhead things. 1262 00:48:07,040 --> 00:48:07,460 Right. 1263 00:48:07,460 --> 00:48:09,020 Because I have no idea what that means. 1264 00:48:09,020 --> 00:48:10,280 Yeah, I don't know what that means either. 1265 00:48:10,280 --> 00:48:12,860 They slid it around in memory, and now it's bad. 1266 00:48:12,860 --> 00:48:14,860 Oh, wait a minute. 1267 00:48:14,900 --> 00:48:15,600 Is that a shell? 1268 00:48:15,600 --> 00:48:16,800 That might be a shell. 1269 00:48:16,800 --> 00:48:18,520 He just needs to click left. 1270 00:48:19,100 --> 00:48:20,600 No, don't control C it. 1271 00:48:23,140 --> 00:48:25,620 Or is he just going straight live right away? 1272 00:48:26,080 --> 00:48:27,320 Does he just... no. 1273 00:48:27,420 --> 00:48:28,440 Is he going live? 1274 00:48:28,440 --> 00:48:29,740 I think he went live. 1275 00:48:30,380 --> 00:48:30,940 Live? 1276 00:48:30,940 --> 00:48:32,540 Cannot append to a migrated chain. 1277 00:48:33,840 --> 00:48:35,160 Still no idea what that means. 1278 00:48:35,160 --> 00:48:35,620 Yeah. 1279 00:48:35,620 --> 00:48:37,820 Why did it work like sometimes, and sometimes it doesn't? 1280 00:48:37,820 --> 00:48:38,400 I don't know. 1281 00:48:38,400 --> 00:48:40,780 Oh, he forgot dot strip, I guess. 1282 00:48:42,480 --> 00:48:44,620 Nope, cannot append to a migrated chain. 1283 00:48:44,960 --> 00:48:45,800 Huh. 1284 00:48:45,800 --> 00:48:47,880 Yep, and this is where it's really dangerous. 1285 00:48:47,880 --> 00:48:50,380 He's scratching his head over on straw hat. 1286 00:48:50,380 --> 00:48:51,320 Yep, all the gadgets. 1287 00:48:51,320 --> 00:48:53,780 So all the gadgets is literally everything you want. 1288 00:48:53,780 --> 00:48:56,840 It is your pop RDR, your pop RSP, your pop RBP. 1289 00:48:56,840 --> 00:48:59,180 So it is literally all the gadgets. 1290 00:48:59,180 --> 00:49:01,980 I now see what that function is. 1291 00:49:02,100 --> 00:49:11,420 So since the ROP chain is going to be so simple here, it might be best to just straight up go for the manual chain. 1292 00:49:11,440 --> 00:49:13,000 Because this is the risk of PwnTools. 1293 00:49:13,000 --> 00:49:14,700 This is why I'm always scared of this. 1294 00:49:14,700 --> 00:49:20,020 When stuff breaks, it's just, you're in a really tough spot. 1295 00:49:20,080 --> 00:49:20,980 Yeah , really. 1296 00:49:21,000 --> 00:49:22,980 Yeah, still having that error over there. 1297 00:49:22,980 --> 00:49:24,160 Still making constant progress. 1298 00:49:24,160 --> 00:49:25,820 But here we're just making progress. 1299 00:49:25,820 --> 00:49:28,940 We're making constant progress. 1300 00:49:29,200 --> 00:49:33,540 And I'm sure PwnTools will just automagically work once it's figured out. 1301 00:49:33,540 --> 00:49:36,040 Did he just delete all that code? 1302 00:49:36,040 --> 00:49:37,320 Or just move it around? 1303 00:49:37,320 --> 00:49:40,600 I think he deleted it. 1304 00:49:40,980 --> 00:49:41,900 Huh. 1305 00:49:42,400 --> 00:49:44,160 And then let's see. 1306 00:49:44,160 --> 00:49:49,580 We got a pop RDI, puts main, quit. 1307 00:49:49,580 --> 00:49:50,580 Let's see. 1308 00:49:50,580 --> 00:49:53,740 Is this really going to go down to a ROP race? 1309 00:49:53,740 --> 00:49:56,540 Yeah, this is definitely a ROP race. 1310 00:49:56,540 --> 00:49:58,140 Oh , stop using PwnTools ROP. 1311 00:49:59,120 --> 00:50:03,480 It's fine if you really know how to use it, but it looks like it's a little unfamiliar with it. 1312 00:50:03,480 --> 00:50:08,240 And left justify, this is some advanced Python right here. 1313 00:50:08,240 --> 00:50:11,100 Well, he wants to load it, make sure it's 8 bytes exactly. 1314 00:50:11,100 --> 00:50:11,340 Yeah. 1315 00:50:11,340 --> 00:50:14,160 So he's just left justify with probably null bytes. 1316 00:50:14,160 --> 00:50:15,580 Yep, that's exactly what he's doing. 1317 00:50:15,760 --> 00:50:17,940 U64, you have a clean load into Python. 1318 00:50:17,940 --> 00:50:18,600 Yeah. 1319 00:50:19,680 --> 00:50:22,560 And we're doing an NM over here on libc. 1320 00:50:22,560 --> 00:50:26,840 It looks like we're trying to get some addresses out of libc. 1321 00:50:28,720 --> 00:50:29,600 OK. 1322 00:50:33,150 --> 00:50:36,510 And we've been told it's a minute to sudden death. 1323 00:50:36,610 --> 00:50:38,230 A minute to sudden death. 1324 00:50:38,230 --> 00:50:38,830 A minute. 1325 00:50:39,250 --> 00:50:41,690 They better start ROPing like they've never ROPed before. 1326 00:50:41,690 --> 00:50:44,130 They have to ROP their butts off. 1327 00:50:44,270 --> 00:50:45,850 That's going to be really tough. 1328 00:50:45,850 --> 00:50:51,010 I don't think these are 60 seconds away, unless PwnTools automatically starts working. 1329 00:50:51,010 --> 00:50:51,990 I don't know. 1330 00:50:51,990 --> 00:50:53,590 If you can append to a migrated chain. 1331 00:50:53,590 --> 00:50:56,110 Oh , it's really close. 1332 00:50:56,110 --> 00:50:57,350 Oh, it's so close. 1333 00:50:57,350 --> 00:50:58,230 I feel so bad. 1334 00:50:58,230 --> 00:50:59,910 ROPing live is so difficult. 1335 00:50:59,910 --> 00:51:00,770 You're just like... 1336 00:51:00,770 --> 00:51:01,630 Oh, gosh. 1337 00:51:01,630 --> 00:51:04,650 You have to keep all of this stack space in your head. 1338 00:51:04,650 --> 00:51:06,790 You have to know where you're stashing all your stuff. 1339 00:51:06,790 --> 00:51:08,850 I can barely pop lock and now they want me to ROP it? 1340 00:51:08,850 --> 00:51:09,410 Yeah, exactly. 1341 00:51:09,410 --> 00:51:10,170 How? 1342 00:51:10,890 --> 00:51:11,630 Nice. 1343 00:51:11,630 --> 00:51:12,330 Nice. 1344 00:51:12,670 --> 00:51:13,910 That was pretty good. 1345 00:51:13,910 --> 00:51:14,830 Thank you. 1346 00:51:15,710 --> 00:51:16,510 Yeah. 1347 00:51:18,050 --> 00:51:18,450 Strawhats... 1348 00:51:18,450 --> 00:51:21,010 Oh, Strawhats kind of paused here. 1349 00:51:21,010 --> 00:51:21,550 Are they both... 1350 00:51:21,550 --> 00:51:22,690 They're both... 1351 00:51:22,690 --> 00:51:24,410 They're both stopped in their tracks. 1352 00:51:24,410 --> 00:51:25,210 I think... 1353 00:51:25,670 --> 00:51:28,570 I think Jordan just went and told them that we're going to sudden death. 1354 00:51:28,570 --> 00:51:29,270 I see. 1355 00:51:29,330 --> 00:51:30,130 OK. 1356 00:51:31,990 --> 00:51:32,890 No way. 1357 00:51:33,490 --> 00:51:42,490 Now, sudden death, as it was last year, and I think as I was told this year, sounds like it's a really, really, really easy challenge. 1358 00:51:43,570 --> 00:51:48,450 Bare gets, format string bugs, what commands do you want me to run, basically? 1359 00:51:49,030 --> 00:51:54,010 Now, those are probably one of the hardest for me because I don't think I've ever done, like, easy challenges. 1360 00:51:54,010 --> 00:51:54,910 So I don't know... 1361 00:51:54,910 --> 00:51:57,510 Like, I don't think I've ever done a printf bug before. 1362 00:51:57,570 --> 00:51:58,090 Really? 1363 00:51:58,090 --> 00:51:58,610 No. 1364 00:51:58,630 --> 00:51:59,610 I don't think it's ever come up. 1365 00:51:59,610 --> 00:52:00,890 Straight in the kernel? 1366 00:52:00,890 --> 00:52:02,990 Yeah, I mean, it's just... 1367 00:52:02,990 --> 00:52:05,170 I've never seen them in real life. 1368 00:52:09,040 --> 00:52:11,440 I've just been signaled something in semaphore. 1369 00:52:11,440 --> 00:52:14,540 Yeah, I don't necessarily know how to read that, but I think... 1370 00:52:14,540 --> 00:52:16,340 Oh, is there a third hint that got put? 1371 00:52:16,340 --> 00:52:16,840 No. 1372 00:52:16,840 --> 00:52:17,400 What? 1373 00:52:17,460 --> 00:52:18,280 What's going on? 1374 00:52:18,280 --> 00:52:19,700 All the terminals are closing.