okay so your question
is about level three finding or toddler
two level three finding the location
of the thread stack
yeah okay um one second let me
[Music]
make sure the twitch stream is working
and let me just quickly uh add everyone
to let them know what's happening
okay and then
huh i think this is working
it's like static though why is there
static hold on
maybe there's always been static i don't
know we'll just roll with it
um okay so we are looking at other two
level three
let me start by launching it and are you
watching the stream also
just so you can uh see my screen
okay um
toddler to level three
okay so in toddler two level three um i
guess we have to
go into team look so we can actually uh
connect
and get the message that it's going to
send let's see here
okay so as you said it says uh storing
the secret in the thread stack
and the question is where is the thread
stack so
we've got a number of options
let's go ahead let's just go straight
into gdb and see if we can um
find the secret so
i launched gdb actually
let me see how that looks
on this stream yeah i think it's good
enough okay
and uh we actually need to figure out
what the um process ideas
so it's 71.
and since we're in practice mode we can
do this actually we need to use sudo gdb
i think
i think we're gonna have to but this is
messing up tmux hold on
71 let me just try it just in case but
i'm pretty sure we'll have to
yeah um
let me re-launch
using pseudotumox
yeah and then
we'll launch the level and we'll
netcat in
and then we will gdb
all right we'll see what the process is
it is process 390
and we will attach to 390.
okay so
let's just try to
make this as readable as possible
okay so the question then is
what's going on in memory so
we can see i think yeah info threads
will show us all of the threads
um which is kind of useful
um
okay yeah there's a question go for it
um
so if you i'm kind of confused why you
can't use tmux but
in theory you could use multiple you
could ssh in on multiple terminals for
the stream i have to use tmux otherwise
there's no way for me to
make things visible but you could ssh in
using multiple terminals for instance if
you didn't want to use
tmux does that make sense
or like you could just disable the um
you could disable the like layout of
this by changing your gdb init
to like not do all of this there's like
a there's a bunch of things you could do
to um make it work however you want it
to work but
how whatever work whatever style you do
for how you want to
work on this problem will be the
equivalent of what i'm going to do
do you have any more questions on that
or does that make sense
okay so
let me quickly
um here one second let me
remind myself of what is going on in
this level
since i haven't looked at it in a couple
weeks let me
take a look
actually something we can do very easily
if i
um if we exit on this thread do we see
that info threads doesn't actually show
that it's gone
which is kind of interesting maybe it
has to time out
let me um let me restart it one more
time
because there's going to be an easy way
that we can detect this
detect where the secret is um
okay
uh we won't quite connect yet
um okay
why is the twitch chat being so weird
for me why does it say
failed to load module
hmm
yeah we'll just mainly manually load the
chat okay there we go
okay so we are process id 506 so if we
do gdb and then we attach
506
okay and i'm not sure why you're not
able to resize it i think it
has something to do with the tmx config
but i don't know
um we'll just do that
and then let me what do i want to search
for
let's look at the program with object
real quick
and type that through less
and look at main
okay in fact actually i know what it's
called so let's just
quickly search there's a thing called
load secret and this is the thing that's
going to load the secret into memory
so in gdb we can actually just break at
this
and that'll show us exactly where in
memory the secrets being loaded
so if we do now break load secret
i've got a break point there
not actually sure how this will work
with threads
but i guess we'll find out okay
and then if we net cat in potentially
that breakpoint will trigger but it
isn't a separate thread
so i'm not sure if this we need a gdp
setting to
enable that but let's see nope looks
like it uh triggered
okay so we can see
um i guess this is in the
accept logic
okay but
red well maybe
what is happening here
let's just sit continue
um
are we in oh yeah we're in load secret
now okay
so we can see that the thread two hit
break point one
in load secret i'm not sure why it was
hanging on except
but we'll uh ignore that for now
okay so we are in load secret
and um i believe rsi
or no rdi the first argument passed in
will be where it is going to load it in
so you can see here
with rdi here that it says that this is
the address being passed in well this is
where the secret is going to end up
being loaded
so if we look at x g x
0 x 7 f 7
e f 4 0 9
c 8 7 8 okay
and if we finish out this function
and then look at that again we can see
that there's ascii and if we x slash
s that that is where our secret just got
loaded into memory
so now something to figure out is
where that is in relationship to things
that we know
so if we oops there we go vm map
um so we saw that this was
at seven f7 this is kind of uh
let's write this off to the side
i normally don't use this uh
this layout actually but okay and i also
don't normally use
tmux so uh it's a learning experience
here but we will just manually type it
out
7ef 409c878
okay and we're interested in
where in the memory mapping this is so
seven f seven e f three
f 409 f4
oh nine
um
did i copy that down right sonya 409
we're looking uh we're looking at vm map
to see
where it's mapped in um to memory
and 7ef400
why are we not seeing it
four zero nine
oh we are aren't we it's in this one
right because this is a huge page i
don't know why i can't select it
um but it is i'll select it one more
time just for uh
people watching the stream
um if you look right here
this address right here that goes with a
lot of space
um our address falls into that range so
we can see that this goes from 7f
7ef 389
all the way to 7f7ef40a
and that address that we can see on the
bottom right is in that range okay
so if we can figure out where that is
then we will have the secret so
one second here let me just uh quickly
check in on
what twitch chat is saying
[Music]
baby race level six level eight
okay uh okay
mm scanner has a bug
that's interesting i'll have to
investigate that um but anyways let's
keep looking at this current problem
um let's see here
we have what so the question is i guess
what memory regions do we already
know from previous levels so in the
previous level
um we leaked out uh the secret in the
thread heap
and now we're leaking it out in the
thread stack
so let me see
real quick here
right
trying to remember what address
trying to decide whether or not to go
through the entire solution of setting
up the race again or not
since we've previously done that or if
we can figure out how to
explain what's going on just looking at
memory
i guess maybe it'd be useful if you
could repeat your question what is your
specific question about this level again
okay so you know where libsy is
okay and your question is once we know
so you have the base of libsy and the
question then
is how do we get to the secret right
okay then that that's a lot easier to
explain then i can
explain that much clearer um
so this address range here which is
where we said the secret was in
is at a fixed offset of lib c
so if you know where lib c is you
actually know where this
is so i can show you that calculation
let's see here if we so when we did this
x gx that was us printing out the secret
and we determined where this was by
using gdb and breaking on mode secret so
we know that the secret is right here
and we know that lib c
is um this address and
typing this out without the ability to
copy is
insane let me see if i can figure out
how to copy here
nope this is insane
all right whatever we'll just uh do this
insane process of just
copying it over in the side so that we
can reference it
seven f seven e f
four zero a one zero zero zero
okay um and then
if we quickly look at that address we'll
see that it's a lib c
because we'll see like an elf
at the start 408100
and if we print this it says elf so this
is lebsee loaded in at the start
and if we then
just want to print the difference so if
we do print
x this minus zero x seven f
seven e f four o nine
c eight seven eight okay
so see how this offset says it is four
seven
eight eight away um once you know where
libsy is
so if we do um if we take libsy's
address
and we subtract this amount
we have where the secret is so if we
show that so for instance this is where
lib c
is we subtract four seven eight eight
and we
x slash s that that is where the secret
is and
just to show let me so that was four
seven eight eight
uh four seven eight eight
if we quickly go in and re-launch the
program just to show that it
is um not changing
exit what okay
and we relaunch and we read netcat in
and we ps
let's see here gdb989
attach 989 um
if we vm map we can see
that libsy is here so we will write it
again
on the side because this uh awful setup
doesn't allow me to copy at least
i don't know how to copy in this setup
uh ba7
b7 bf600
okay and if we
just confirm real quick that i copied
that correct
seven f six
b a seven six
b f c zero we
failed there's a v there
okay copied it right
um minus zero x um if we copied it down
four seven eight eight
and if we print it it's still there so
um we can see that if we know where lib
c is that the libsis thread is actually
just a fixed offset or if we know where
lib c is uh the base of libsy that the
secret is just a fixed offset from that
does that answer your question
um and that's the same for no so every
thread
is going to every time you connect up
it's going to have to
allocate more memory for that each so
each thread has its own stack right
and that that thread stack is in a
different part of memory
um it'll the second thread will also be
a fixed offset of lib c and the third
thread will also be a fixed offset but
there will be different offsets
so this is just for the first thread and
this is also just for my
variant of the challenge there's going
to be some padding differences on your
challenge
so you'll want to break on load secret
as i showed at the start
to figure out where it is
but for a particular thread yeah it's
just the same offset every time
does that make sense
yeah just to get the exact address of
what it's being passed
um yeah exactly
um are you yep this was a question on
toddler 2. so if anyone else has
questions on
toddler 2 feel free to ask
and then but there was also um another
question related to
baby race level six and baby race
level eight and then also
a question on accessing the gs flags
okay um
well the gs flags is an easier thing to
quickly answer
um how are you
i guess what what is your question on
accessing the gs flags via x86
um
so for instance if you're writing
assembly let's get out of all of this
t-mux nonsense
okay um if you're writing assembly
import phone
phone context arch samd64
you can do
move rax say g
[Music]
7 or whatever
oops and uh you can compile that i think
this is optional and i think that's
equivalent yeah it's a cool one
um but when you object whatever i've
always seen these square braces
um right now i'm trying to follow yon's
c code but in x86
are you talking about the um
pwn kernel
where okay so you're talking about
trying to modify the setcomp flag
um
yeah so if you and did you
compile a kernel module
uh where is the tiffs
comp thingy it is always the same
okay so the tiffs comp thingy
is just a bit mask over something in the
current thread struct so when you're
accessing
um gs the the gs
segment register at some offset into
that is going to be
um what is known as current and current
is just the current thread struct which
is basically the current process
um and when you offset or
at some offset into gs will definitely
be
the okay so hold on let me let me
quickly pull up pawn kernel
or bring up the relevant code let's see
github from college
pong kernel
let me pull up this relevant module
yawn has this make root.c thing
um so let's just go
into temp make dirt kernel
stuff
okay and if we look at what this is
at some point he does this
right here um
okay and let me read twitch chat
so for example i do my changes
and try this move by pointer
gs is that where the fly is
okay so the easiest way to figure out
where it is is to compile it
so if i
um we'll actually have to switch out of
this let's do
move kernel stuff into ctf
and then let me launch in a kernel
challenge
so that we can compile it
easily uh we will launch
under level 11 testing why not
okay
and if we now go into home ctf
go into kernel stuff
cat make root we also need a make file
which we will just steal from pwn
kernels
this is going to be slightly off but we
can correct it
okay this is all in the pawn college
pawn kernel repository so now we just
need to
fix this make file
so this yeah
yeah this relates to toddler 2 because
in toddler 2
level 8 you need to
change your set comp bits um
you basically need to take your process
out of set comp is the way to solve
toddler 2 level 8. and the question is
how do you do that so
this is how you do that um yeah so if i
go to opt
phone college
[Music]
and then let's see here
so this will allow us i think oh and we
don't want all of these
we just want make root
and then if we
um if we make
it will build it for us and if we
now object our
make root dot ko um we'll turn off
the r for a second just to show why i
was going to do the
um and then go to less if we
now go to what was that
defined in or i guess we could just
search for like gs or something
maybe we can't easily
hold on that was make roots and we were
calling device octal um
okay
this is relevant this is relevant okay
hold on let's um
just to make this even easier to
understand
let's do make root.c
let's actually get rid of all of the
stuff around it because this is like
optimized code so stuff is like being
mixed in that we don't actually care
about let's go ahead
and just do this because this is really
all we care about
okay and let's make
now it's object
okay so we can see
[Music]
two things that matter basically two
instructions that happen
um the first one is that we take keyword
pointer gs
and it says offset of 0x0 that's
actually as it turns out a lie
i mean we'll see why in a second it
moves that into rax
and then it ends that with this so this
is basically
how um if we look at make root dot c
that is the equivalent
of this that anding is the equivalent of
doing this so it's just kind of a
constant
but the issue is
that that zero that i was talking about
before
is a lie so if we do dash dr instead so
that we can see relocatables
we will see that this is something that
needs to get loaded
in um when the kernel module gets linked
in
so we can see here that it's basically
saying
at offset 15 it's kind of like in lining
it oh that's what object is doing with
this flag it's at 15 which is actually
here
these these four zeros the there is this
um
32-bit or i don't exactly know how to
read this but we're
doing x 86 64. there's like a 32
signed value i'm not sure um called
current
task which is the thing we care about
that's getting loaded in here um so this
zero zero zero is a lie so the way that
we can figure this out or
figure out um the correct value
is if we um
what's the easiest way to do this let's
actually
not do this in the device octal
let's do this in device open because
that'll be easier
to um catch so
the all right um
device open okay yeah because we want to
basically catch this
in
the gdb that'll be the easiest way to
get the value
for our given kernel where current is
going to be located um
okay so this is in device open now if we
do
make oops which we call make
okay and then if we copy this make roots
dot actually hold on real quick before
we do that let me make sure that the
init module isn't doing anything insane
uh it's creating this which is fine yeah
okay
so if we
copy make roots dot ko into
the root directory
and then we go to the root directory
anything that is
in the root directory i could actually i
think we
probably need to
do that i think i think anything that's
sued in the root directory will end up
getting copied into
um into
the kernel so if we now do
launch actually we're going to need to
do tmux again if we do
launch we can see
that and then if we
let's see here
if we do gdb and then we do
targets remote one two three four
okay and then we gotta continue
oops and then let's cat proc
okay all sims uh
tail good enough we're interested in
this device open
for make root so let's break here
and then we can just do that ctrl c it
and then if we break here and then
continue
eventually when we now go to do
let's say let's cat proc
um what is it called
home college root when we cap this we're
going to trigger the
break point okay
um this let's just ignore all of that
let's just print the instructions
ourselves
we can see right here is
um it's no longer zero as i was saying
before
it's actually been relocated in when the
kernel module is linked in
so this is the shell code that we want
if we recall these two things
inside the kernel this is going to
disable setcom for the current process
does that answer your questions on
that weird i've been working with
d zero 0x15d0 and i get bad system
where did you get oh no that is it's
right here so one five
fifty zero zero um
and you've been ending it with this
value as well
and then like reading out of the shell
code
yeah you want to basically i would say
do exactly this
because we know that when we compiled
this
kernel module to do that this is the
code that it produced and once it's
relocated into the kernel this is what
it looks like i would
use exactly this um
do the following take one shift left
eight
times knot it yeah so it's it's possible
i would say that whatever your logic is
of trying to replicate this is just off
um is my guess
because i mean you there's definitely
going to be other ways to do this with
equivalent logic
but compiled and then linked in and
looking at it now this
is code that will exactly work
so i would recommend going with this
okay so let's see here
there was also a question earlier
about baby race level six and level
eight okay
let me remind myself what those levels
are
um so did you have a specific
question about six and eight i can't
solve them for so
let's see here
so i think yeon might have covered
six in one of his office hours i think
i don't remember which one but i thought
he talked about it
and how basically because now so if you
solved five
five basically ended up
where the challenge was calling stat on
the directory that the file is in
whereas six ends up calling
lstat on it and the thing to think about
in terms of the difference between stat
and lstat
so stat will um
so that will follow the sim link
um hold on
don't want to uh misspeak here
so stats will
let's see here check directories.
yeah stat will follow symlinks whereas
lstat will not follow symlinks
and it will check if it is a sim link
but the thing to realize is that
and to think about is that when it goes
and does that check to see if your
directory is a sim link
it's just checking specifically
that exact file that exact directory if
it's a sim link
if one of its ancestors as in something
higher up in the its path hierarchy
is assembling it doesn't know about that
so think about how to
abuse that um
and then as for eight let's see here
um as for eight without having a
specific
question that you asked um one of
the pawn college videos on youtube
talks about um
the asynchronous behavior of signals
basically
um yeah so without a further question
that i would look into that video
okay so then now they're if i miss any
other earlier questions
i don't think so
okay okay so there is a question
or there's a question on could
you go over how to approach baby auto
okay so there's
a number of levels with different uh
approaches
to what needs to go on with those levels
um
[Music]
so baby auto let's start i guess with
level one
since uh we never covered level one and
the extended q a because level one
wasn't launched yet
so let's take a look at baby auto level
one
and i will run it in practice okay
so if i launch baby auto okay so this is
like
some sort of insanity going on oh my
terminal is like
destroyed or something hold on hopefully
that
makes it so i can scroll
sweet okay so it says welcome
teaches you to search for bugs and
software on a large scale
a bunch of binaries to find this
challenge has a list of binaries for you
to find
crash bugs in
crash book okay whatever you will need
to find crashes in them create a
file with the crashing input instruct
the challenge to execute the binaries
with the crashing input good luck okay
so it says we suggest using strings
or pawn tools to find the bugs each
program will be executed as
follows so
it will it seems like it will just
straight up run our program
it's probably a little misleading for
this like bash comment symbol
we're not going to comment your program
but good enough good enough
uh it's just going to run the program so
for instance um
it tells us the current status of a
bunch of binaries it tells us we need to
crash 42 more of them
um presumably this is 42 or more i think
as it turns out it's 50 of them
um you just need to crash it so let's
see
the first one
input a didn't crash okay
um what if we it told us something about
running strings on it so if we run
strings on this level
this thing looks weird
okay let's assume this is uh
the input it's looking for just because
it's a weird string maybe it's not maybe
it is
um but let's see so if we now run
baby auto oops let's uh
run that program and we've passed that
as our
input it says success crashing so i
guess uh
when it's successful it'll just force
crash itself it's the thing to
take away and that's what we're looking
for
and segmentation fault yeah so
then presumably if we were to it told us
that we need to put
our input into a file so if we
copy or let's say
echo that into
temp input and then let's just verify
that if we run
this with temp input we didn't like
somehow mess something up looks like it
still crashes
okay and if we now run baby auto
with this first path
path to program path to crashing input
temp input and now rather than telling
us we have 42 more we have 41 more
because it says
input success crashing and it confirms
that we successfully
pwned this program um and then we've got
40 more
41 more to go so of course baby auto is
all about automation so you're going to
want to
um automate things so let's see how we
might automate level one
um since running strings doesn't
immediately
give us our answer because we had to
like figure out which one
looked really weird and we decided this
one like maybe you could do some
strings and do some weird like
entropy check or something on the string
since random data will have higher
entropy
that might be a little crazy so it's
instead of running
strings strings
inside let's look at object
and see if that is going to
help us in terms of figuring out how we
can
quickly automate this since we need some
sort of structure for all of our levels
somewhere it's probably going to be like
a string compare after
is we can see it's calling string
compare here
we can see that solution is a symbol in
the binary
um it's a global which means there's a
symbol associated with it so actually
point tool sounds like it's going to be
useful
because in pawn tools we can get the
value of a symbol
[Music]
yes let's see if we can use
this so ipython
import poem tools oops import poem
import pwn pawn elf
um one
okay we'll just say that's the elf and
then
elf symbols what did i say it was called
solution yep okay it tells us it's
here so i think that should actually be
at that offset into the binary can we
do this no
you could read the pawn tools
documentation or we could attempt to
guess what it
is alph dot
maps maybe
or maybe elf.strings string
one okay so that looks promising
it looks like maybe at offset one into
the elf it's giving us the string
so maybe then what we want is elf dot
string of this
[Music]
but that did not work oh
symbols solution
hmm
let's see elf search
solution
i'm just guessing probably would be a
better idea to read the punctuals
documentation on how we can
uh figure out how to get the value of
this
um generator okay yeah next
should be an integer or byte slot okay
so
these but this doesn't really make sense
what i'm about to do
um how can we determine where in the
binary this is
i'm actually surprised that search
didn't
work um oh that's like old stuff
um or add that elf dot string didn't
work
okay let's do instead of object let's do
a read elf
and let's see where in the elf
our global data is being loaded
so it's probably gonna be read-only data
no but that wasn't this isn't going at
four thousand
um is the order
name type address
offset so offsets definitely offset into
the binary address i think is where
it'll load it
even though oh right here okay dot data
okay so even though
it's um going to be loaded at address
like hex 4000
all of our data it's actually
at offset 3000 in the the elf
um so we can see that there's like a
difference between the address and the
offset
um so let's just subtract a thousand
that important tools or hex a thousand
um so let's import pawn
alph equals that elf string
symbols that minus
hexa thousand oh that's so sad
we're so close hold on what is elf
symbols
solution again
so it disagrees
with this idea
is it anywhere
okay um let's just then
so we're just trying to figure out how
we can automate um
the solution so obviously we know how to
solve it manually but ideally
we'd like to do this on a mass scale so
for instance actually real quick just to
show that stuff is going to be slightly
different at least i assume it will be
maybe it won't be
elf equals pawn i guess it's worth
investigating to see how different all
of these binaries are so let's pick a
different one instead of 528 let's go to
527
and let's do elf symbols solution
and that is actually at the same offset
okay so in that case what if we
just open this elf and just manually
parse out the solution
as crazy as that sounds that might
actually be the easiest solution
if we can figure out where in this
outfit is
um with or let's say
f equals that let's open it for
reading binary um
and then let's just actually this is
kind of good but let's let's go with
this
okay data
so if we even just like look through
this
now this is awful hold on let's um
when we ran strings we found a solution
for 528
that was the solution i don't think we
open 528 let's reopen
528 got it
close that so this is a solution
so that means that um this string should
appear in data
true okay um
and then so where in it is it so let's
see
um data dot index
of that
so it's there do we still have elf
elf uh string 0x
2004 oh we do okay so
uh somehow we were wrong
on how we were determining this but
either way we figured out where it is
so if we call elf dot string hex 2004
presumably we're just going to get the
solution so let's try another elf real
quick
um let's try 520
elf string 0x 2004
seems like we got another solution we
don't know maybe there's different
lengths to these um strings
yeah it seems to work okay so this means
now
um what we could do is
um let's go with pulling.process
against the challenge
and call that process and then let's do
process process clean
just to see what it's telling us
um actually we don't want to do it that
way let's go process
we want to basically read until it says
not crash so that we can get a path
so let's go with process equals that
process dot read until not crashed
and then we want to read a line um
so process dot read line
so we got that
um so now if we
were to take that previous thing
and we were to do pawn.elf we probably
have to
strip it and yeah let's um
well now we've lost it hold on
all right let's start again real quick
process
equals that read until
and then let's say
buy or binary or target equals
process dot redline
let's just do this to make it a string
so now we have our target
and then let's do pawn dot elf
of target
and then we determined that we could do
this
to get the answer and then we can
with open temp inputs
write as f
right alph string 0x 2004
and then we can do process
thought clean let's see what else we
have to do
um not crashed
and is it going to ask us for our path
some reason it's not asking us for a
path or maybe we missed it
let's just send it our path process dot
send line target
and then let's do process dot send line
temp
input and then let's do process dot
clean
and we can see that this partial
automation
is beginning to work so now let's just
um
put it all together so if we do
oops process
okay so if we do this
and then actually hold on if true
i always forget how to go into
multi-line mode
oh i just messed it up hold on
okay good enough
okay so we wanted to do this
and then we want to read until
we read until not crashed
and then we get the target
and then we make an elf out of the
target
and then we do this
and then let's process that clean just
to make sure that
all of our outstanding data is just
removed from this uh the process pipe
and then let's do
process sand line target
process sand line temp
input and then let's do process clean so
now we have it all
in one thing so that worked for 41 and
then
let's do actually let's do that at the
end
and then let's do that
let's do this 42 times
and let's see if this works
and out comes the flag so that is how
you
can solve level one
with automation is it ctrl
o is that what i always forget control
oh it is control o
okay sweet thank you i'm sure i will
forget again though unfortunately
because i think i have known that is
control o multiple times and
every time i forget that's probably
because i don't really use ipython i use
uh
emacs of course um
but anyways so actually we'll quickly
go to that yeah so that is how you can
solve
level one since you know we've always
demonstrated level one
basically you can kind of figure out how
to solve one of them manually
and then figure out how to automatically
solve that one
and then just kind of run that against
everything the issue will be
um the question is basically how
generalized does the program get so you
can see here in this solution that we're
assuming that there's going to be some
string
at hex 2004 offset into the elf and that
is going to be our solution string
that's pretty like
fixed on what the program might be
this is like extremely specific to
this class of programs
later levels might have things that are
a bit more uh
generic in terms of what they look like
okay and then there's also a question to
look at level two
we will look at level two and um
then we will start yay there's a
question in uh
in zoom go for it
yeah so there's a question in zoom about
level six which will start requiring afl
um how to come up with good inputs
so it's a very tricky question this is
kind of like um
to some extent it's like an open
question in science a little bit
but there are definitely some principles
especially for level uh
six and seven in terms of what you'll
probably want to start supplying
so in general some guiding principles
are that you want
inputs or seeds that are
ideally as small as possible
but exercise as much of the code as
possible
so in level six and
level five and six yeah level five and
six for the afl levels
um you will be fuzzing read elf
and uh when you're fuzzing read elf
basically um the way that you're fuzzing
it
is that there is going to be um
an elf that it's going to be processing
and you're trying to crash radio
the thing to figure out will be
um will be how to supply
afl with an elf that well you'll want to
supply with an elf you could obviously
supply it with whatever
input you want but if you supply it with
an elf obviously that's going to start
exercising more and more code of read
elf because read elf is a program that
of course you know reads elves
so if you supply an elf for read elf
ideally you'll actually want to make
that elf be as small as possible
so a super tiny elf is a good starting
point for your first seed
in terms of fuzzing redelf because if
you
just compile say like some hello world
program it's just like this
relatively big-ish elf like you know few
kilobytes or whatever
when afl goes through and starts fuzzing
it and starts flipping bits and changing
data to mutate it
there's going to be
it's basically going to be an issue
because you have so much
data in your seed that is
not directly influencing control flow
so you can kind of think of it as
redelf is going to go through and it's
going to parse your elf there's only
so many things that are going to trigger
different paths and edge cases
inside of redelf in general a lot of
your code inside
of your binary is actually kind of like
useless from rudolph's perspective
you're just going to be exercising the
same code
but when you compile some hello world
binary for instance there's going to be
um a bunch of code that afl is going to
start having to bit flip on that's not
going to have coverage changes
um so something you can actually look at
in terms of finding a good seed
is let me figure out where to put the
link
tiny elf linux there's like a cool
article that talks about basically this
guy that went through and basically
tried to create the smallest elf
executable on linux that he possibly
could
and i think he got it to where the elf
was let's see here at the very end
he got it to be 45 bytes
45 bytes and it's a working elf that
it will look at so if let me paste this
link in the twitch chat i'll also paste
it in the
zoom i would take a look at this
and reconstruct this elf and that will
be
a good starting point uh so there
apparently was some sort of
crazy raid thing uh
that happened in twitch um
yeah so basically what's going on here
is we're doing a
office hours or actually the last office
hours at least my last office hours and
then there will be one more
um on monday for a college course at asu
this course is open to the public if you
go to
https phone college that will give you
all of the information related to this
course
and anyone can
feel free to participate so we're
reaching the end of the semester so
this uh the streams are going to kind of
slowly die down a little bit
but there's still youtube videos on all
the challenges are still going to be
available and there's also a discord
where we can answer questions
and something maybe to strive for is if
you
go through and solve a bunch of
challenges you can earn yourself a
real life physical yellow belt or real
life physical
blue belt and we will send it to you in
the mail for free
you just got to solve the challenges so
yeah that's
some cool stuff okay so anyways
does that answer your question in terms
of
creating a seed for levels five and six
to some extent
okay yeah so that's kind of like the
first stage
that will actually get you to crash a
bunch of them it won't
quite i think in level six you have to
crash 60 read elf variants
it won't crash 60 of them it'll crash
like
40 or 50 or something of them
the issue is that on the other ones this
super small elf isn't actually going to
exercise enough of the code
um to crash it there's going to be
other weird twists and i am not actually
sure exactly what the vulnerability is
in these later versions of redelf
um but you can actually look around
online for maybe a couple read elf
proof of concept binaries since redolph
you know is a real
program unlike most of the challenges in
this class
there's actually going to be proof of
concepts online that show how you can
use
whatever elf to crash redelf
and if you use something that crashes it
in one version of redelf there's a good
chance that
maybe afl can mutate that into crashing
on other ones
so i would start with the super tiny elf
and then i would transition
into potentially just finding some proof
of concept elves
that crash in various versions and i
would confirm before you start fuzzing
on it that it does crash it in whatever
version it claims
because we'll probably have that as one
of the challenge binders you can use
okay um
do you happen to know if yawn is
planning to do plus minus grades
i think we're
so this isn't a guarantee still but i
think we're leaning towards just doing
pluses i think we're planning on getting
rid of minuses
but again this isn't a guarantee yet so
i can't make any guarantees on that
right now
and then there was also still okay
there's
a clarifying question about level two
and it says i found if we can satisfy
compare rax rdx we can crash the program
rdx has changed to a constant value
but i'm struggling to manipulate rax to
match the value okay
so let's quickly take a look at level
two
hold on before i do that let me make
sure we don't want to run this again
let's quit and quit okay let's
quickly look at level two
and then oops that's not right
ssh
okay so presumably level two is going to
look something like level one in terms
of uh
what it's telling you to do this time it
tells you though instead of strings
and pwn tools maybe you want to look at
object poem tools grepzed
based off of what you were describing
level 2 as looking like that definitely
makes sense
so if we take a quick look now at what
one of these level two binaries looks
like so if we
run this challenge
okay it asks us for an input we send a
failure okay let's see what that binary
looks like
so we can see it does a scanf to get our
input in
[Music]
and then somewhere it's going to do a
comparison okay this is the
compare rex rdx you're probably talking
about
and we can see this insane constant here
that
um seems to be potentially relevant in
terms of what it's comparing against
maybe
meta gaming the challenges the first one
we saw was comparing against the string
maybe this one's comparing against an
integer um
so let's see if that guess is correct
maybe we can send it as hex maybe we
can't we'd have to figure out
what is being passed into this scanf
which i guess we could figure out real
quick with strings
um
[Music]
percent llu so probably not hex okay
so we want um
to just make this an integer then
good enough and let's see now
if we pass this integer
that is the correct answer so now the
question is how do we automate this
and one way that we could start to
automate this is with
a object and grep so we saw
that this does some crazy
huge integer comparison oops
and we can see that that happens after a
move abs
so these programs are kind of small so
maybe move abs is only done here
and maybe this is enough to grip four so
let's see if that's the case
if we grip now for that oops
we can see that that's certainly the
case for this one let's maybe go to a
different one we can see that seems to
be the case for this one
seems to be the case for this one okay
so maybe this is
um on the right track of how we can just
start to uh
automate this so if we um
how do we want to do this so we could
just use python as probably the
easiest way or we could remember insane
like how to extract out this comma and
stuff but you know what we're going to
use python anyways so let's just use it
at this phase
so if we do import sub process and then
we do
subprocess dot check outputs
and we pass it this
and we'll just uh say to use a shell
because that'll just make our lives
easier
we can see that that seems to give us
what we want we can decode this
we can split on a comma
we can grab the next one we can
i think we probably just call into on
that yep okay so this
crazy mess and maybe now we uh
say target equals this
oops say target equals this and then
before we do that huge check output
let's just make this an f string and
pass that in
and now we have uh insanity to do
a basic analysis on this program in
order to determine what
input will crash it and then similar to
level one
um i guess we can just quickly go
through it basically just uh replicate
that but now
instead of caring about using pawn tools
elf to
figure out a string or something said
once we have the target all we want is
this
this basically is our very basic
analysis that uses objdump and grep
which is why it kind of tells you that
and then
oops we can say like solution equals
that
maybe then with open
temp input right
as f and then f dot write
stir solution
and then maybe that's just good enough
um we've got an import pond though
and also we need to change it from baby
auto level one to baby auto level two
and now we see if it works uh
yes it worked okay boom comes the flag
so they're using this
uh basically this one line is our
again remember these are kind of you
know simple simple-ish programs
this is our automated analysis for
extracting the solution
and the next one will be a bit more
complicated i think there might be like
some additions and subtractions going on
and you'll have to kind of like i think
that's what the next level is going to
be
i don't know we'll see you'll have to do
like extract out maybe a bunch of
additions and subtractions and like
figure out how to stitch them all
together to get the solution i think
that's what level three might look like
and then level what's it called
level seven and eight are going to be
more complicated programs they'll
actually be programs from earlier in the
course
that'll be um it'll be
baby rev where
we crank up the difficulty to like 50
and there basically be like 50 manglers
and it's just i mean in theory you could
do like object grab your way through
that but more realistically level 7 and
8 will teach you to use
anger and anger will just symbolically
execute through the program
and solve it and maybe uh
just to quickly show anger since uh
probably worth showing we can actually
look at anger for one of these targets
so let's do this one
i think hopefully anger be able to
handle this
anger yeah we'll see um there are some
weird corner cases that anger can't
handle even though maybe it seems basic
and then there's also just various
limitations within symbolic execution
that prevent it from working but it'll
certainly work for seven and eight
let's see what it looks like to write a
very basic uh
hello world to anger of solve my super
simple crack me
so if we do the first thing we do is
import anger
and then anger is structured such that
you the first thing you want to do is
create a project with your target
and something you can pass into
depending on what's going on is to
basically
make anger not load the libraries so
we're just going to pass that in
it tells us hey this is position
independent you got to think that this
is about to like start
basically emulating our code it has to
figure out
since it's position independent like hey
we need to load this somewhere and you
didn't tell us where to load it so we're
just going to load it here
which is doesn't really matter for us um
so the next thing
uh that we want to use
say that again sorry uh target is just a
random string so we're just
demoing anger against a level two i
would not recommend this i mean you
could use anger for level two
but it's kind of like overkill um you'll
probably want to start to use it on
levels seven
and eight but we're just to quickly go
over it before i end my office hours
uh we will look at using anger on level
two but again
i would not necessarily encourage you to
use anger for level two because it's
kind of overkill
um so we have some random target
we create an anger anger project the
next thing we want
is you know classically called a simgur
but it means simulation manager it's
just the
saving on typing project dot
simjer oops project.factory.cinder
this gives us this simulation manager
and this is basically
the thing that is going to do
our symbolic execution
um uh basically at a very high level
let's just put it that way it's going to
maintain a bunch of states and it's
going to
step them forward one basic block and
you can
anger is extremely flexible you can do
all sorts of
insane analyses to basically have full
control
over how this simulation manager works
and how all sorts of things
work you basically get to like
you can basically write how you want
your architecture to just
work like how you want the computer to
process
data for your analysis you can do lots
of very powerful things
but let's just stick to the very simple
basics of like a hello world anger
script okay so we have
our simulation manager and then
what we want to do um
realistically we can just now call uh
run so let's just do that why not
and see if this works we might have to
go
back to level one because i'm not
entirely sure
um what angers support oh no it works
just fine okay
basically it's kind of tricky to handle
a format string so there's a lot of
issues that happen with symbolic
execution as jan talked about
in the phone college videos on symbolic
execution
and one of the like hallmark problems of
it is path explosion
so you could think that when we go and
do our scanf with percent llu
that there is going to like you're kind
of like running this language and it has
to do this conversion
of like bytes into an integer like this
little
endian integer and there's all sorts of
weird constraints that make that happen
so one way that you can combat this is
basically have
angered like the text hey we're about to
run
scanf let's run our function
summary of it that will do the
equivalent
but can basically just bypass the path
explosion for that
problem and that's what runs and i
wasn't sure
if anger had support for like percentile
you were
exactly what scanf support it had but it
looks like it seems to have it fine
so we have our simulation manager after
we just ran through so we kind of just
explored um the program symbolically so
you can kind of think like we started
with just one active state and somehow
magically our program has two states
which is kind of weird you know like a
normal
processor you have one state you go to
the next that you go the next day you
don't like
somehow fork or something but that's
what simulation
or symbolic execution does so if we look
at now our dead ended
um we can actually look at uh we'll just
look at one that ended zero so we can
see that this is some symbol
or uh simulation states in bollocks they
i don't know
at this address in the program and we
can
do it has this like posix plugin that
basically
handles a bunch of posix related things
one of them
is related to input and output for
instance so you can basically look at
what was the output of the program what
um
what did it send to standard out where
one is kind of for standard out
you could look at like two also that's
nothing was sent to standard error
and you could look at what was sent to
standard in so we can see for standard
in
um it basically discovered hey i send
this input
and it just tells us failure okay so
that was the dead ended state
one or zero but what if we look at dead
ended
one in this state it kind of figured out
hey there's kind of
two paths we can traverse we've got like
this success case we've got this failure
case and if you're interested in the
failure case
this is an input that will satisfy that
and if you're interested in this success
case which of course we are interested
in
this is an input that will satisfy that
so
let's see if it lied to us
um which were we running we ran this so
if we do
this and pass it in input
we can see that it did not lie to us it
was a successful analysis so
magically seemingly anger just like
figured out everything we wanted it to
figure out obviously this is on a very
uh relatively simple toy program
symbolic execution has all sorts of
interesting problems and it's the kind
of a active
area of research especially in our lab
but yeah that's uh that's kind of the
hello world of using anger
you need a project you need a simulation
manager and you run it
so something else just to show one more
final thing here
when we created so we have our
simulation let's just create a new one
new simulation manager
um you can actually do the following
you can tell it to find
something well let's see it's fined
until um cinder dot
run i thought there was a find though
maybe that's an explorer
explore tick
maybe we want explore there's a whole
bunch of docks on anger
and uh i only occasionally use it so
that's why i am uh
kind of sitting here guessing what the
api is to it
let's see here i think this is going to
take in a state
and it's basically going to explore the
simulation manager until it finds a
state
that satisfies this constraint that
we're about to pass
so we if we have a state and we do posix
dumps one and we want to check that like
be correct that the binary string
correct is in it was it correct that it
said
input failure input success if his
success is in it
if success is in our state basically if
the state prints success to standard out
this is what we're looking for is what
we're kind of
telling anger so if we do this now
it's basically going to be the same
effect but for especially for our toy
example
but you can imagine the case where you
have to explore like crazy and there's
all sorts of program states
um it's not necessarily going to hone in
on it but it'll at least like
stop exploration when it finally finds
it being able to like hone in on
something again is like a
active area of research um so
we can see that there instead of being
two dead-ended states we have one active
and one found obviously we're interested
in the found one this active one
the the simulation manager is just done
because we found what we were looking
for
even though there was a split and it
didn't run it until this guy
dead ended so now if we look at singer
found
zero it's going to
oops posix yeah same exact thing
okay so that's another thing that you
can do is you can kind of like
tell anger to explore until it finds
this and there's all sorts of other
things you can uh
do believe me this is just uh just
touching the surface here
but uh anger will be useful in level
seven and eight
where writing like this object grep
uh analysis is going to start to become
a bit more of a pain
and actually in fact so level seven is
um
baby reverse with a bunch of manglers
level eight is
uh baby reverse yawn 85 where you have
to
reverse a yawn 85 program back to
whatever level that was i mean it turns
out that anger can actually like
handle the fact that even though it's
like running this yawn 85 interpreter it
can still symbolically execute through
that just fine
um and figure out the solution
okay so are there any final questions
before i
finish this office hours
yeah so using anger
basically we import anger
we create a project
equals project or equals anger
dot project of some target
oops let's uh keep going and then we
want a simulation manager
which comes from the
project.factory.simjer
uh you can't see my typing
it shows up on my stream
you really can't see this
is it because there's like a stream
delay and you're talking to me on zoom
you can't see it on twitch someone's
uh someone says they can i can i would
refresh the twitch stream i guess
um yeah i would refresh
and then but anyways basically you
create a project you create a simulation
manager
and if you google around for anger anger
is a very used project you can find uh
for instance like ctf write-ups that use
anger and show you how they
used anger to do something and all of
them are gonna at least have
like these few lines somewhere in there
um
and then the final thing as i said
before is
simjar.run and then something else we
can do
is like prince simjer mp
so there's this weird thing called like
mp which is like multiplexing a list
it's crazy madness we can mp
dead ended posix dumps
um one and then
singer mp dead ended dead
ended posix dumps
zero and we will see
that it will run through um so another
thing also that you might i'm not going
to show it in this twitch stream
just because i'd like to wrap it up but
something to google around for
is unicorn and there's actually
a way that you can make anger um run
concrete
uh basically there's not symbolic data
in what's going on
you don't need to symbolically execute
it which is a lot slower you can like
just run it concretely
and there's a way to basically tell
anger to start using unicorn
you can basically add an option to a
state and say hey use unicorn here
and it will run it faster so maybe
that'll be useful you can google around
for or you can ask in a discord and i
can uh
further answer about that but that's
just kind of like a speed up thing
um anyways yeah we can see that with
this
these few lines we can see our failure
case our success case
and then the inputs that lead to those
okay so
all right i am going to
[Music]
um conclude then this uh my final office
hours here for this semester
um hope everyone enjoyed the class yawn
will be having his
final uh office hours
on monday i think he's gonna do you know
a nice little uh
final meme review or something exciting
so yeah thank you to everyone taking the
class it's been
awesome this semester every semester
that we run this class seems to get
better and better and
also the students in it seem to also get
like uh
do better and better at it you know
we've uh
it seems like every year we run the
class we actually double how difficult
it is so you guys are actually running
on
a class way harder than what last year
dealt with and way harder than the year
before that
just so you know so uh hopefully we're
pushing
pushing the state of uh hackers forward
as by
by doubling the difficulty of this class
every year though
i think we're running out of capacity to
continue to double the difficulty to
class but anyways
thank you for taking this class
if anyone has any questions after the
fact
feel free to message in the help channel
on discord or reach out to me
directly goodbye