hello hackers
let's uh get
this rolling on
my ipad come on almost there
every single um
every single stream starts with me
fighting with twitch
on the ipad either twitch or obs
all right theme starts with me fighting
with
twitch perfect all right um
question on twitch immediately is that a
projector screen yes
it's uh i'm gonna be recording some
videos for asu online
over the next couple of months and they
expressed a preference not to have my
video game shelf in the background
so i bought a projector screen to
give myself a nice clear white
background
movie night over twitch on the projector
it's a possible idea
yeah i don't have a actual projector yet
another question is there gonna be a q a
office hours for the
auto vulnerability discovery yes yes the
q
a will be on um the uh
the second and then
uh the office hours i i'll have my
office hours on monday for sure
i i think um i haven't checked with
connor but
i would imagine that it's similar for
him
so it should be good to go
all right um
yeah the lion image lion image is a good
meme
all right let's roll
um
boom okay uh welcome to week 12. you're
still uh you've you still survived and
actually uh
most people are thriving um hopefully
um of course first things first let's
roll into the meme review
um meme highlight i actually found out
that uh
pewdiepie used this idea of a meme
highlight in his stream how crazy is
that
he calls it a meme review anyways um
uh that aside let's talk about memes
so we have good uh some good ideas here
um
first of all a very modern meme cutting
edge from
uh presumably the live stream um
of the true era of time um for pawn
college
um i experienced this yesterday actually
as you
noticed i released the last lectures
at 8 45 a.m or something that is
that was a late night for me not early
morning
um that was a that was quite a
quite an ordeal but but we're getting
there we'll have one more lecture
um on race conditions released for
some of the more advanced levels um
tonight
and uh that'll make up the whole uh race
condition
scenario all right some other good stuff
moloch and malik this is i love this
meme this this guy is great
um recently i actually recently watched
um
the incredibles again good movie
um this is great the corrupted t
cash um i hope that everyone has
truly internalized how badly things can
misfire
if um data that
libraries think is trustworthy suddenly
becomes
not trustworthy um and of course in a
lot of ways baby heap
is intro to linked lists right it is
thinking through the implication of all
of this stuff being
linked lists in memory with no um
verification or little verification
all right um let me hide my
camera for a second to focus on this
meme uh this is pretty good
uh baby heap
maybe wasn't i mean it it it
if you look at the relative difficulty
of baby heap compared to others
um it wasn't the toughest module there
but you should still be proud for
doing a great job and
of course a lot of people were talking
about how
um you know the
push through baby heap constitutes what
is apparently
type three fun um i didn't know about
type three fun
so it's it's good to add a new fun
category
um it's pretty good um
let's see let's see on twitch someone's
saying starting to feel like the only
way to make secure program is to not
write a program
i think that is one of the big takeaways
uh
from computer system security is that
computer systems are not secure
uh every little mistake and now you've
seen how many opportunities there are to
make these little mistakes every little
mistake can have
crazy uh consequences in terms of
security
um i'm glad someone caught my uh
my reference to the the playstation 3.
um this was you know back uh
back in the day when i was extremely
invested in the console wars
um i won't uh
take a side publicly but you can
probably speculate
what part of the what side of the
console wars i was on
um and then moving onwards to a race
conditions
race conditions are gambling there's
going to be a huge amount
of chance of you know getting lucky with
the timing
it's going to be a very interesting sort
of module i'm really looking forward to
see what you think of it
yeah twitch that's exactly the the side
of the
console awards i was on um
[Music]
all right and of course this whole
course is intro to gdb
it it is it still remains true that
ninety percent
of questions about the course can be
answered by
did you trace it in gdb and see what's
going on
all right so let's
um bounce on two very important memes
that i'll
call out separately teaching evaluations
are open um
i'll bounce the camera so you can see
both memes
um of course i modified them slightly
uh your voice matters
right so just like i badgered you to
go vote um up until two weeks ago
now i have to badger you to go evaluate
so um teaching evaluations are extremely
uh
useful for us to understand um
you know are we making this course too
easy
should we make it harder right last year
uh
that seemed to be the takeaway and as a
result um this year maybe it's still too
easy
so please let us know um in the teaching
evaluations also just in general
how we did i'll also be sending out a
more
um college specific survey
to uh you know everyone that that uh
is active on the platform not just asu
students of course
these teaching evaluations are for asu
students but um
we'll have a separate uh thing for
everybody
so that we can get feedback per module
and everything of course teaching evals
generally like you know how
well does this professor convey
materials et cetera et cetera but
please fill this out if you have
feedback that doesn't fit there
um you know all feedback is useful
uh including filling out the
[Music]
um
survey we'll send out filling out these
chair valves these teaching valves
are critical please fill them out it's a
very important part of
the tenure case no matter you know
if you liked it you didn't like it just
fill out the teaching eval it's all very
good
information um and even if it turns out
i have the worst teaching evaluations
in asu this year that actually
is an opportunity to improve for next
year so it's not a case of you know if
you have nothing to say don't say
anything at all
if you have anything to say
sorry if you have nothing nice to say
don't say anything at all it's not like
that
if you have anything to say fill out
those teaching evals
um all all right let's see
uh yeah so the consensus on twitch
a vote for yan is a vote against
democracy um
i like that and uh
class was too easy yeah that's um
exactly
uh yeah i am not tenured i am in my
starting my fourth year i guess this is
my fourth year of
uh uh being at asu tenure
the 10-year process happens in the sixth
year i think you submitted five and a
half
um so yeah exactly
um
evaluations are important uh
also not just these evaluations if you
feel that
again there's not enough you know
opportunity for feedback there
rate my professor uh even if it's bad
ratings those are all very useful
right very useful feedback for me to
improve too and also improve the course
otherwise we just do random stuff and
you end up with uh yan85
all right um and uh keep an eye out for
that
uh uh
survey uh if you don't want to put
feedback publicly somewhere all right uh
rolling onwards um ctf report so
the number of ctf players is dropping
slightly uh
this makes sense i think um a lot of
people um are getting kind of
overwhelmed with the semester
um and other courses but hopefully we'll
get
see these numbers go up more um this
past weekend
10 students played
a bunch of cts i think one team played
like four ctfs which is
kind of crazy um i don't know if it's
something that
i would necessarily encourage as a
as a strategy um i think probably the
thinking was
there be more introductory challenges
spread out across more cts but it's also
more things to adapt to
right uh so i don't know
how well that as a strategy is but um
yeah it's it's interesting boston ctf
turned out to be extremely extremely
difficult
um basically across all of 466 i think i
saw in the write-up's only one flag
grabbed from balsam ctf which is very
interesting
um there's a tough-as-nail ctf the
previous weekend of course
um where we've had a couple more
students
uh play or one more student so it's it's
uh we still have a good solid core in
the corresponding ctf next weekend
um there's a bunch of ctfs as you can
tell the most popular is dragon ctf
um this is hosted by dragon sector one
of the top
uh ctf teams in the world um
they're uh mostly polish
uh although spread around the world um
pretty pretty uh elite people should be
a very good ctf
um there is uh
some talk and
twitch about asu masters program yeah su
does have a master's
um one thing that we're looking at
next year is actually splitting up
someone else mentioned that phone
college should be
four or five credits um we are looking
at
making it actually six credits across
either
either session a and b or um of
one semester or two different semesters
um where the second part is like a
graduate level
class that people that do well and the
first part can take i don't know
we're still tossing that around it'll be
a an interesting
um sort of thing
all right moving on the leaderboard
uh uh this
week on the leaderboard there's a
cluster of asu people in the top eight
um that's uh super impressive
um you're up against some real uh
super super elite people around the
world
so i'm holding on to that um
um those spots is is pretty cool but i
will also encourage all of these lead
people from around the world to keep
pushing
um
keep pushing onwards take that top spot
challenge challenge the
asu establishment i don't know anyways
uh
i think that didn't
meme out as i had hoped anyways all
right so top spot
this week root congratulation ruth i
think this is the real route
because they uh pung me
on on uh discord or slack or something
um to brag uh good job uh
freak mod drops to second neural drop to
third
but we still have some uh kind of very
familiar heavy hitters
oh one tauros
um shadow and narnix i think they were
all in
the top 20 um last time
and then we got hacks uh
moving up the ladder now uh of course
you know the
the top wow the top 18 are all tied
with 100 completion um
and hollow circuit uh of course we're
used to seeing all these now pointer
again uh mk msm
six five five three six uh it's two to
the sixteenth
janitor joe blue shirt yawn zero
trishul is anyone is this the same 20
people fighting it out oh
yeah i think so so far
oh it's a ron
i know this okay cool uh aaron
and flynn oh flynn is nope wow these are
the same 20 people rearranged
all right so good job locking down that
that top
um uh
thing all right hold on guys i'm seeing
in the chat someone's saying
ctf.college is the non-graded instance
that is not quite accurate ctia that
phone college is last year's instance
please don't go to ctl.college go to csc
466.pundercollege
college has like obsolete challenges and
and is lame
go to the to csc four six six point
college
you don't have to be an asu student sign
up do those challenges those are the new
fresh
challenges like race conditions and the
kernel don't even exist on that old one
here everything is uh oh non-x is new
someone is saying
how the name is that wow narnix blew all
the way to 8th yeah
from oh from 19th awesome but still
still uh already uh uh an old hat at
this point
um everyone not in the top 20.
let's give these uh hackers a run for
their money
um you can easily make it there and i'll
give you an incentive in a second
all right so let's take a look at how
this module worked
um the way that we have things sorted
internally
the kernel is always the last challenge
at the last so
so the last module but uh of course we
reordered that because of
um one of the extensions we have to give
anyways
so baby uh heap is right here so we can
see baby heap
falls somewhere between um
toddler one and the colonel in
difficulty
um baby rob seems to
have been easier uh but this is also
actually including people that go back
and make stuff up right so
so that that graph gets pushed up over
time
um uh
let's see let's see let's see uh
if you look here for the great
distribution it looks like let me
shut off the camera again this is uh
baby heap so there were
a lot of people that weren't solving
anything in baby heap and then
um unlike baby kernel it's more of a
of a smooth spread um so it
looks like people either really got it
and got to that a plus
or uh the the big strikes are a plus b
and and e and d for for baby heap um
i didn't look into you know what point
uh like which levels those would
have been stuck on but we'll look at it
after the fact to try to smooth out
um the difficulty curve with you know
kind of more
inner levels that that bridge the gap
between other levels
all right current grades
ah let me move my video over here um all
right so
we uh again started um the
class with 209 students we have 118
still registered that's down one from
last week
110 still trying uh
oops this should have been baby heap uh
my bad
which is up two from last week so people
are getting back into it this is super
awesome to see
the curve remains the same um the
changes
uh we had um obviously this is uncurved
and this is curved
but let me pull up
uh shoot where's yeah here we go
let me pull up this is last week's
grades
and this is so we had 11 24
39 23 9 in terms of grade distributions
we had one person move up from an e to a
d
um we had a couple of people move from
an a to either an a plus or a b
and then a couple of people down to the
c um so
the the heap was a little harder on
people than the kernel was
but um there was uh
uh i think the curve still
makes sense we're gonna keep it like
this for a while as a reminder i won't
make the curve less generous by more
than one percentage point a week i don't
actually see it changing much throughout
the rest of the course but you know if
you need to adjust it
we will adjust it all right so if you
are not doing
so well what do you do um one
again i'm gonna keep saying this don't
forget that the teaching challenges
count toward your grade if you didn't
realize that
and uh that impacted your grade
let us know um we'll try to find the
solution
um don't panic
go back and make up challenges i saw a
lot of people doing that this week i
think that's why you know baby rob
and some of these other ones that are
originally uh
on the harder side are now being more
and more solved this is awesome
collaboration rooms remain open
collaborate to your heart's content get
those grades up um
there's still ctf extra credits still
four percent of extra credit on the
table
um there's still the y grade option if
you need it and of course because
of veterans day and having to modify
uh the
um schedule and push things
later than we would have liked the final
module automated vulnerability discovery
is is going to be
an extra credit module right let's take
a look at
this um new uh schedule
here's veterans day um 11 11 then 11 18
today's race conditions
um that's going to be graded normally
11 25 is going to be complex
localization scenarios
it's going to be graded normally but
it'll be open until the very last day
before grades are due
for full credit we'll also launch at 11
2
automatic vulnerability discovery for
extra credit
it's graded normally it's just now your
grade is divided by
uh whatever n minus one modules instead
of
n modules all right
um there are some questions about
the curve let me back up to the curve
so the question is is a 63 percent on if
if you go to your grades tab on csc 46
that honda college
a 63 percent would be ac yes
it will be between this 55 and 70
um but there's a lot of opportunity to
move up um
especially if you tackle both uh toddler
two
and automatic vulnerability discovery
and again
um all of these we're going to have
open the race conditions as normal stays
around for one week
complex observation scenarios is normal
except for it stays around until
uh the very last day of the course
that's you know
to make sure you don't have to give up
your thanksgiving
um and then uh automatic vulnerability
discovery is
uh also uh normal um
or sorry it's extra credit uh but
uh realistically it's if what we're
essentially doing is
giving you one of these modules as extra
credit the way the math works out right
we just just divide by
whatever 12 instead of 13. um
all right question about how does the
rounding work uh
we round uh typically to the to the
uh single percent so 98.89 would be a 99
and i think that will end up yeah with
an a plus
um okay now
there's a lot of extra credit so
why should you bother doing everything
well one that sweet sweet spot
at the top of the scoreboard i think
there are a lot of people in this class
that are pushing
not just for their grade but for the
glory
and so we thought how did we make that
even sweeter we
often describe pone college in fact on
our very website
as a first stage education platform that
will take cyber security white belts
and train them to become cyber security
yellow belts
right in a martial arts setting and so
if you're thinking
why not make that real and in fact we're
going a
step beyond right we have toddler one
and toddler two
these are massive uh uh steps right in
toddler one you know
the basics of security in toddler two
you are now an advanced
hacker in some sense so you brought your
own white belt conceptually inside your
mind
if you get 100 completion through
toddler one
we will give you a limited edition
embroidered pwn college yellow belt and
this applies to asu students and not asu
students will figure out how to ship it
to you
if you get 100 completion period
including automatic vulnerability
discovery
toddler 2 and everything else we'll give
you
a pwn college embroidered blue belt and
the yellow belt of course
so these are uh
going to be quite interesting
sort of loot um there is no time limit
um for this uh you can finish it
during the course obviously that's the
more badass way
but if you finish uh all the challenges
sometime in march
you know just shoot me an email and
we'll get it sorted out
uh so yeah this is gonna be
awesome we're going to uh and we're
gonna try to keep doing it again
asu and not asu students get those belts
all right any question on belts or the
general state of the course
[Music]
yep we're giving out real belts yeah if
you walk around asu with the the belt
that'll be
that would be amazing you should uh
i don't know we'll think of some
cool ways to have like
get the belts into a
asu culture awesome all right um
hopefully everyone is excited about this
possibility again
don't stress out if you've fallen a
little behind there's no time limit on
the belt
if at any point you complete all the
phone college i mean
including the after we launch all the
modules obviously
um you know we'll give you that belt
awesome all right uh
yeah you gotta you gotta do toddler one
it's it's critical
um
the old hoodies is going to be a a
tougher
uh tougher situation all right so
um race conditions
hopefully you enjoyed uh the the
lectures hopefully you had time to
um see the lectures again i'm really
sorry it
uh was so late this has been a kind of a
crazy
crazy week um
[Music]
but now we are um
you know rolling forward and
are gonna hit toddler two not physically
hit any toddlers of course but but
get to that module with awesome momentum
um i'm actually gonna record those
videos like
like tomorrow so that we don't end up in
this situation again
um all right uh
a couple of things that i need to tell
you about
race conditions and then we will launch
race conditions i
realized that the videos don't really
cover how to use gdb
to deal with these things or how to use
s trays to deal with these things in
fact
when i used s trace in the
um so i have just this uh p trace not
even a race condition as a
multi-threaded binary
what what's going on oh god oh p thread
uh p thread um
[Music]
dot c these are just my my normal
threads
um
so we create two threads that just
basically print stuff out
right we run this i already compiled it
it just boom creates two threads each
thread prints stuff out and terminates
all right i briefly showed an s trace
if you just do an s trace of this guy
we see um
the initialization right so this is uh
p thread initializing and etcetera or
the the binary of course
called p thread not lit p thread
necessarily this is the binary
initializing
um and then we create two threads so
here are the two clone calls clone call
one
sorry clone call one clone call two
before each clone call
this is setting up the first stack uh
the stack for
the first thread this is setting up the
stack for the second thread
and then this appears printed from the
first thread
but we don't see um
you know the the system call in s trace
why is that that is because by default
s trace will just trace
the main thread of the process that you
provided
right s trace does have a very cool
um argument called dash f which will
trace
all children of that program threads and
processes alike
and here we go so at first there's only
one thread
the moment that it calls clone we have
now split into three
well we've now split into two threads so
here is one thread here's the other
thread here is that right
from the main thread which we would have
seen before
here's the right from thread two
and here's the right from thread one
all right so we have
and and you can tell by the process id
of each one or the thread id of each one
so
this is thread uh or
this is the so threads and processes
obviously are the same thing threads are
just processes that share memory space
and a bunch of other stuff
um this is thread id 201
593 and that for sure returns 201593
and then if we look at that same call in
201595 it actually got descheduled
and then it later got resumed so this is
the kernel saying oh
you're done executing for now i'm going
to yank you out we're gonna
put another uh thread in to execute on
that cpu for whatever reason scheduling
reasons
but then when it resumes it returns 201
595. cool all right
um so s trace that was uh all pretty
straightforward right so we just do
s trace dash f instead of s trace oh oh
my headphones are running out of battery
this uh aha hold on
plug in my i suspect that what happened
is the airpod charger
died
all right um
[Music]
so that's for asteroids what about for
gdb
right gdb um is
tricky and honestly i
uh will show you a couple of uh
different capabilities but i'm going to
have to embarrassingly google around
because i realized i forgot to um
practice this ahead of time um and
yoloing is a little hard on
essentially one hour of sleep um anyways
so
we have gdb um of this p thread
guy of course let's um
[Music]
see what happens when we run okay
or actually let's break at thread main
okay so we have a breakpoint at thread
main and then we run
and the point gets hit
um and it switches to the appropriate
thread
right so if you um
put a breakpoint somewhere gdb will do
the right thing
right um when a thread hits that break
point
gdb will switch to the correct thread
and then
you can uh you know examine things just
as normal
here's that first nbr 64 instruction etc
right now what if
instead we want to break at main
okay here we are at main
and we want to step through
this b thread create what happens if i
single step
right now um
right now i
am in the main thread if i single step
uh if i sorry that should all right okay
let's finish executing
i end up in main as well right um
after the call in the next instruction
main plus 59 i
was before at main plus 54. in the
parent thread still
now what if i want to get to the
child thread instead automatically
right um
wait hold on a second
what am i saying
um
well let's try it okay so i'll break it
main
i run here we are at main
okay if we
set follow fork mode child
i have a sneaking suspicion that i'm
full of and this is just for
forking
uh sorry about this when our sleep is is
not good okay so we're about to call p
thread create
next instruction okay
yeah we're in main um
so that's just for forking that's not
for clone
i wonder i guess i've never actually run
into this in practice i always just set
a breakpoint at the
main at the entry point of the thread
so you can do that and that's probably
the easier thing
anyways so if we can break in thread
main
we can run here we are in the first
thread
you can look
at
info threads yes info threads um these
are
the threads that are uh that currently
exist
um you can uh
how do you switch threads yeah i think
this thread
and then you say i want to switch to
thread three and now you're at thread
three you want to switch back to the
main thread you're at the main thread we
can single step
uh let's switch to back to thread one
you're in the main thread
you can single step from the main thread
and then it'll eventually get back
into main
let's finish that yep and we're
basically
back in main on the single thread so
pertinent thing info threads
now the other two are are terminated and
then thread
one two three etc to switch threads that
you're debugging
um and breakpoints work as you would
expect them to
um someone's asking what command line
interface
is this uh this is gdb just a vanilla
gdb
uh not um anything
fancy okay um
my advice when you start seeing threaded
applications in this home
don't panic they're just programs it's
not
that much different from
multi-processing
they just mostly share memory and some
other
parts um okay anything else that we
need to say about um
threads and race conditions
i think this oh one more thing um i
realized
actually someone pointed it out to me on
discord
thank you very much um that when i was
talking about
race conditions and i was talking about
mutexes i have a type on the slide this
should be unlock
and in the source code it was unlocked i
have no idea how that typo happened
this was 7 am after no sleep so
anything anything can happen i'm going
to change it real quick
live on camera
and change the lock to unlock boom
then refresh this
there we are unlock all right
um so
apologies about that about that i'll add
a note to the um
youtube video um so people are hopefully
not confused okay um let's see
it is currently 509 we're 40 minutes
into the class
um before we
so i think we launched the challenges at
six
um or earlier whenever we run out of
things
to talk about this was uh the very
urgent thing i wanted to discuss
so that you didn't feel panicked in gdb
um
any questions about baby heap kind of
rewinding a bit before we uh run in
oh someone has a question about race
conditions perfect let's hear it
um
yes okay so the question was
how to create file system mazes
so as a reminder the file system maze
is this crazy situation where there's a
directory for the maze
and then there is a um
[Music]
a directory with a bunch of depth with a
sim link
going back to the root and then a beader
and and so on so
how do we create this right of course
uh oops i didn't show the slide
um here we go here's the file system
maze very cool stuff
and of course it works uh
because um of of what i'll show you i'll
show you how it's actually resolved
which is
um pretty crazy all right so
um here's our our pre-created maze let's
make a maze
2 um let's go to maze 2.
what the hell that's new
okay anyways uh maze two is empty right
now so the
first thing we want to do is create
something
uh directory called a slash one slash
two etc
right obviously typing all this out is
gonna be a bit of a drag
um also if you just use mkdir you'll
have to do it one by one
because you can't do this it'll say two
doesn't exist you have to
yeah this is really annoying mkdir has a
dash
p option uh
flag dash p means make parent
directories as needed
this is super nice um because we can
just pass in
the whole thing okay
so that's uh one thing that makes it a
little easier
to find here is all of our directory
that we created
um so
uh how do we make this automatically
right so we can go there's a command
called uh sequence uh scq
that can just create uh they will print
out a bunch of numbers so if you print
out numbers one to a thousand
actually a thousand with the backslash
you might start getting
to the path limit let's do one to 800.
it just prints out all those numbers
there's another command called tr
tr replaces uh characters
we can replace every new line with a
forward slash that's starting to look
like a
directory path so let's save this to a
variable
this is our subdirectories
okay and now we can do mkdir dash pa
slash subdirs
okay and here it is we have a slash one
slash two so
right so this is one of our um
things of course we can automate all
this but honestly
it's it's not that hard to do
each one
you can sing the song in our heads
but how would we automate this so we can
also use sequence again
we can use sequence 1 through 26 we can
use tr to replace
all letters all numbers
um no i don't think this will work sorry
no it didn't work obviously because it's
a character by character
uh nevermind uh
we just i mean there's obviously ways
to automate but
will be uh i j k
oops l m
and o p
q r
s t
u anyways that's more than we're going
to use
tons of um
folders that each have very deep
nested directories all right so now we
need to um
create the root links to point back to
the beginning
um here's what we're going to do we're
going to
look at every directory we're going to
pipe that through
um i like to use the parallel command to
um
basically it'll take every uh line
outputted by ls when you pipe it
something lies to something that puts
each file on a single line
and it'll just run on this command so we
can just
echo that line okay and uh it'll replace
this
open close curly with whatever it read
off of
the the input we can do our sim link
so simulink back to the maze
of this line slash the subdirs
oops i made the assembling instead of
echoing it out but
that's fine so this is what we ran for
everything we ran
ln s create a simulink to this maze from
here oops hold on
let's remove those siblings okay did you
see how long that took just to remove 26
files all right
slash root that's what i meant to do
okay so now if you look at a and then go
into all of well this is going to take
forever so if you do a slash
subject there is our
root okay and it goes back to the
parent now we need to uh
make a link going forward into the
depths of each maze
we can do that with parallel as well so
we
ln s into that
the depth of it and then put in
a end so here we go am bnc and the end
and if you look each one goes to the
very end
of this maze and then there
there's a root and then in that root
it goes back to the beginning so now we
can do
this uh crazy stuff remember the linux
kernel will only allow you to
follow um um what's it called uh
40 levels of system calls this is i
think uh
easy way to prevent just a recursive
system call of course you could have a
system call
a system call sorry symbolic links 40
levels of symbolic links you could have
a
recursive symbolic links that just go
back to the parent directory
um and and your you know whatever
process that that tries to enumerate all
the files will get
stuck right so the kernel will prevent
this from happening by having a limit of
40. um
and of course we can
create something like a path that is a
and slash root slash b
and slash root slash cn slash root every
time i'm doing this
it is going all the way through the a
subdirectories
and then all uh and then back out to the
maze and then
all the way through the b sub
directories and so forth there's an
awesome utility called
read link that'll print out the um
actual resolve your link uh resolve a
path
right so if you um do read link
dash m canonicalized by following
every sim link in every component of the
given name recursively
and we do a and slash
asdf this is the actual path
that is that the kernel will traverse
when you
do a and that essentially adfs and if
you do a and slash root
slash b and
oh it it now it resolves it
all together this is the actual final
um
no relink isn't the right thing for this
but basically
let's build this giant path
and sashroot b and slash root slash
c n slash root slash d and slash root
e and slash root slash f and slash root
and
of course each of these is two symbolic
links
so we get up to 20 letters the 20th
letter is what t
um
all right let's do 10 alright so if you
look here
um we're back in root of course now
let me show you so this is the same as
doing ls dot
but i don't know if you notice on the
stream it's slower
we can time this and it's it takes
.125 seconds
a tenth of a second to just do an ls
if you just time ls dot it's nearly
instantaneous
right of course as we add more and more
so there's j and
uh okay and root l
and root um you might ask why not just
do a
and such roots like a and such a and
slash root etc just a loop
you can do that but the kernel might
cache
um these lookups it's it all depends on
the implementation
one sec i'm going to turn on the lights
all right um so it's better to just
keep it as um varied as possible
k l m and slash root and and
slash root a fifth of a second
p n slash root q and slash root 0.3
seconds i mean
you can see it the system slowing down
slash root root
okay we're still good t and slash root
you and slash root yup too many levels
of sabotage clicks
use the 21st letter uh yeah so that was
42 here's 40. almost half a second
just for ls this is a massive
slowdown right and it'll help you win
things quite a lot
um okay did that help
with uh mazes
yeah and so recall this is the path that
you will send to your
um to the vulnerable program if it says
oh give me a
file name you give it this file name
right
and then it'll you know and and and the
crazy thing even if it doesn't allow you
to give
directory names of course you can sim
link
watch this
you can um
let's say here's some secret
we have a secret file the root of the
maze
you can sim link slow secret
sorry dip
sorry that was copy paste there all
right let's uh
here we go you can do simlink
all of this slash secret because all
this goes back to the root of the maze
into slow secret okay
so you have two files you have a secret
file
access to which is instantaneous
and you have the same file a sim link to
the same file
through the file system maze
access to which
isn't allowed because that's 41 symbolic
links hold on we have to remove t
from here
okay
there is no our slow secret w where
where do you see our slow secret
uh why isn't this slow oh interesting i
was expecting that to be
equally slow
hmm
somehow is not a slow axis the kernel
might must do something intelligently
but if you give it the full um
path of course through the fast system
maze
where's that time here
slash secret
no cutting it is
fast
hold on is it as fast okay 0.7 seconds
versus
point one okay okay it's still slower
it's just maybe ls has some additional
slowdown
uh is a bad example but you can see
if you time counting of slow secret that
takes point four seconds point three
point four
if you just cast secret that's point one
right so it's four times slower
to uh
access the symbolic link through the
maze to that original file
of secret than it is to actually access
secret
cool
um yeah on twitch uh
connor saying that ls might be
recursively calling stat on each
directory that's probably what happening
that's probably why ls
is so slow but this is enough of a
slowdown this is a four
to seven times slowdown right so this
iteration took
ten sec seven sec point zero zero seven
seconds on slow secret
point zero zero one seconds that makes a
window seven times as big
um all right uh connor's curious about
ls let's stress os
oops
no it doesn't look like it oh it is
calling stat
maybe just even the one stat is is very
slow
now let's see if stat itself is slow
no stat is super fast wait but if yes
trace ls it's super fast
i mean not as fast as this of course
oops
still four times as slow as okay anyways
the point is um
the file system maze slows down file
accesses
so that you can more easily win races
on the file system
all right any other questions on race
conditions
or the heap um
there's a lot of conversation people
asking about
nine no okay nine talking about
unintended solution of nine
could we go over level 12. let's check
out level 12.
um one thing
okay launch up level 12
open it up in binary ninja
and download it wait did i do level 12
in my office hours
does anyone remember
i think i might have started in on it is
level 12 the first one with echo
oh i gave a hint and off stars okay all
right so let's let's
check out level 12. so level 12 has um
let's just create
all right
level 12 gives us malik free echo scanf
and
quit malik is our
old friend gives us an index and
allocation array
a size um and then malexit
echo
let's just take an index and an offset
and writes it out free
lets us free a page in the
allocation rate so now if that should
have some data
the t cash metadata so if we echo index
one at offset zero
um
it's not printable offset one echo
index one and offset eight there we go
some printable data so this is
the a pointer to the t cache per thread
struct
um so we can leak
stuff out right um
and if we look at
oops the program there's a win variable
right basically we just our win
function if we just get here we win
um hold on ah
okay oh can't see terminal oh god damn
it
did anyone see the terminal at all did i
show the terminal and then
well here was the terminal all right so
using echo
by freeing um a uh
an allocation of course that initializes
that t cache metadata
um and then we can print it out all
right
um
so we need to redirect execution to win
um
checksack tells us that it is position
independent
um
now we get to sit here
while i have a brain fart
so what's the solution let's think
first let's make sure that nothing got
missed they're not like free
echo scanf quit
nx npie
next pie is enabled
so we can leak an address to
let's see what the addresses we can leak
are
okay
okay um
okay okay and now we will send
echo one at offset zero
read until data colon space
oh god damn it okay
it's fine you didn't miss much i'm just
automating this
so this is oh of course this is null
okay t cash next this this is going to
be null because i
only allocated only freed
one guy so free allocate two things
okay so now now the metadata one should
be pointing at two
so t cash next is um
when i really got that metadata um
repeat that read line
then we'll do the same
at offset 8.
per thread adder is this
okay
where did we fail read until
data colon that is correct right echo
one eight data
colon okay let's see
um what happens
unrecognized choice
oh oops i use sand instead of sand line
why isn't it oh i need to quit
my bad thank you boom
okay awesome so here is
our uh t cash next
let's cut out the new line unpack it
uh and i messed this up this should be
here and then this is p
dot read line negative one
okay
and this will be
probably two let's left justify it
with null bytes to eight
characters
okay
here we go two addresses
on the heap presumably
[Music]
very cool alright so we have leaked
two things on the heap
know where the heap base is basically um
i will
bet that these are stable
yeah 160 away all right so
this is a good start but it's not enough
let's uh
let's see where else
what what am i missing this is such a
interesting feeling
oh my god
i even went i went yeah exactly
thank you connor so connor saved me i
went through this
in my office hours
why is it echo and not puts we could
easily
say hey you can give an index to put
sports can take an offset
or we can calculate the offset just as
easily
but the way that we implement
malik sorry the way that we implement
echo is very careful we we set up this
exact ve
call the exact v takes a string table
a bunch of pointers ending with a null
byte and we
create this string table and malloc an
allocation
for this string table right
now of course as you know
when you freeze something of a given
size the next malloc will re
turn that something so if we
make our freeze here
uh make our sizes here 32
instead of 16 because that is oh
because that is um how uh big this
malloc is
the come on okay
now when we call this echo
it's going to allocate
into um
this uh
when we call this echo is going to malik
32
that will get um
this that'll allocate
a chunk that has the address
that is currently still stored as a
dangling pointer
in our allocation pages right
um and then of course we can echo from
it
it'll be this chunk that we um
here's uh the chunk
right the chunk is gonna have the string
bin echo
in its first eight bytes bin echo is in
the binary
it is specifically um
i'm gonna regret double clicking there
it's uh
the base plus hex um
it's going to have this var16
var 16 is just um
uh the word echo uh
no it's the word data colon so we can
change this character constant data um
it's going to have uh
the address with the offset
that we want printed out and this
address with the offset
is um going to be
wow that's messy it's going to be um
this arg1 let's see where it's called
over here
in the echo
echo arg1 is var 118
var 118 is
no no hold on sorry sorry
this is going to be a pointer to the
heap this is exactly the data we're
printing out this is going to be a
pointer to the stack
it is the address of r16 where the
string
data is stored so first word is going to
be
an address of bin data in the data
segment of the binary
and then the second address is going to
be a stack address
let's take a look so here it is
um echo 1 0 so this is going to be
uh data address the address of the data
string
uh no sorry echo address the
the address of the of bin echo in the
binary
um then
it doesn't free
that allocated pointer so let's free it
again
and then we'll do the same thing again
okay and now
at offset eight so this will be the
stack address
okay and now let's print echo address
stack address
here is the address of echo in the
binary
here is the address of the um
stack you can see that's a stack address
okay we're basically um
there right based on this address
and gdb i can figure out
where um
uh the return address addresses of
course
and then based on um
um um
sorry my mind's going back and then
based on uh this address i can figure
out where the win
function is let's actually
compute that address of the win function
equals the echo address minus hex 4010
right
let's take a quick look at binary ninja
401 0.010
perfect okay
plus the win address is i'm looking
binary ninja uh
one hex one three five
eight boom
so this it is likely
i'd have to see it it's possible that
the the data segment is offset a little
open binary but
this um seems like a reasonable
situation let's um actually instead of
sending quit
let's do this let's
let's do this
all right here are the maps that we
retrieved
um here's our address of uh wind that we
calculated
five five a four a a five five a four a
a zero b
eight zero one zero yeah okay we have it
um in the wrong offset we have it offset
it
into if you recall how binaries are
loaded in memory first
um it loads uh
the copy of the alph with all of the um
executable stuff and read-only stuff
ferraro data
and and and uh and that text and then it
loads a second copy of the elf
with um without and mapping anything
suitable but mapping things
writable um
[Music]
so we need to subtract it's
i mean it's going to be at one of these
um offsets probably
obviously right here so let's just
subtract ox 3000 randomly
things should work
we'll deal with it if it's incorrect so
this at least now is
oh wait
oh no i'm i'm i'm full of
never mind
ignore everything i just said uh
when address there we go i was printing
the wrong thing
win
address all right here's the win address
e a
4 f 3 5 8 oh it's perfect it's in the
executable section or a page it should
be good
okay um so we have the win address we
have the stack address
um we
can now figure out where that return
address is
um and uh
figure out uh where the return address
is from main and then
hap override it by creating an
overlapping allocation and then happily
quit
let's just do that while we're at it
since we're here anyways
um oops i haven't been
killing these things p that's online
quit otherwise i'll have a bunch of them
all right
let's um
gdb attach here
okay here we are let's break at the
return address from
main
okay the return address from main
continue
okay here we are at the return address
remain
rsb is here
we are about to return into lipsy
boom here's that address
here is the address
of the stack as we leaked it so if we
oops i copied both if we take
the subtraction this will give us the
offset we need
oops no here's the the stack that a real
stack
my bad that was a lipsy address i just
pasted
so mains stack address when it returns
that where the return address is stored
this is the value you leaked
hex 156 is that stable i bet it's going
to be stable let's just double check
just in case
boom
break at main continue
here's the stack address right now
here we are
oh uh yeah that's the old leaked
version
here's the thing i leaked recently
hex 156 awesome so basically
main return address equals
stack address plus hex 156
okay so now i need to allocate
uh a chunk that will go
over mains um
stack address and uh
allow me to overwrite it okay this is
nice and simple actually i think this
was
kind of overkill i can just create a
gigantic chunk but
we'll do this all right so i know where
main stack addresses our main return
address let's say return rrsp
this is the rsp at mains threat
all right stack adders
stack address awesome okay
cool so um
now let's uh
malik something of a very large size
i don't know 128
malik it again or malik another one
and now we want to free
three and then three four oops
so now the count and the t cash for size
um oxf0 is
or oh sorry ox80 is uh
two and then there is the top one
is this guy in four and he's pointing to
three now
we want to scan scanf
into four
of our
main return
rsp so we're going to override
the next pointer with
where we want the chunk to be allocated
on the stack
but of course this is going to clobber
the 16 bytes
beforehand um
[Music]
will it collaborative can you bite
beforehand it might not let's give it a
try
this the worry is this i'll call it a
canary but let's give it a try
and then we allocate twice
and this second allocate the first
allocation will return
what this had been the second allegation
will return
a chunk pointing to maine's return
address
and if we echo that out
we can see
i forgot to uh
this crashed
um okay so one person saying hey if
you're just doing hex adder don't i need
p64
no because this is scanf that's reading
no you're right i do need my bad uh
yeah lol
thank you
um
still crashed
let's attach as gdp
does sending it on one line even work i
think it should work
this is printable
why is r8 printable
god damn it
yeah do i have a rapper issue
ah okay
uh let's not do that then okay i have a
wrapper issue thank you
okay boom
oh oops i don't want to debug anymore go
away
it didn't crash this time amazing all
right
so now we should have just ah boom
we leaked out
something that i bet is the um
lipsy return address
and let's make sure that
wait didn't i disable gdb here yeah
okay
okay cool all right so we leaked out
yeah this is the library address perfect
so this is the return address from main
so let's just
scanf it we're almost there
scanf into six
churn address of the address of wind
and then we quit and enjoy the glory
boom
there we go
that is the solution to 12. okay
um awesome
what a wild wild time okay so
let's uh we're actually right at 6 pm
oh uh so there's a question on twitch
why is my example flag 31238 i'm doing
this locally on my computer
where of course i have a slash flag that
is 31238
so there's no significance it's just
what i happen to have in slash flag
locally
um cool all right so that was
uh level 12 uh sorry for uh
having a brain dump part way through
there but we got through it
um let's take a break
uh let's do a 13 minute break
until um five
until six ten arizona time 13 minutes
from now
and then oh uh why pick that number on
twitch oh it's
three one three three seven plus one uh
there
i had a 3d one 337 but i wanted to make
sure that something wasn't
giving me old data so i changed the
added one to it it's just it's a random
number there's no significance
3137 is elite of course that that is
significant
all right awesome um okay so
13 uh 12 minutes at 6 10 we're going to
resume
and then we're gonna sit down launch the
race condition challenges
the first couple and then
start collaborating and start rolling
see you soon
all right welcome back to
race conditions um
i got a frappe to get us through the
rest of the uh
class it's gonna be awesome
all right um
connor where are we at
we're launching
okay we are live
let's take a look at what just launched
here we go baby race first six levels
are up
we will launch more levels um i think
we're
we'll end up with less than or equal to
15.
um these will get you started with
race conditions all right
let me um by law and by custom
walk through level one
launch it up hit that inspect
download the challenge
oops crap
okay awesome alright so
it is launched let's take a look
here we go launch baby race
all right challenge allows you to open a
single file
the file open will be sent to you the
challenge will verify that the files
path does not
include flag and it'll verify that the
file is not
a sim link let's see what
this all looks like
here it is here is main let's grab that
decompilation
all right so it needs an argument that's
great
um the
teaching levels of this challenge are
very unique
um because they make the race very
explicit what they're going to do
just for the teaching challenges is
where the race has to happen
they will actually stop and wait for you
to press enter
alright so we'll do flag
all right connor why why do we have
multiple places where this
uh blocks
ah okay so there might be multiple
places where it will wait
but here i i give it a flag and it says
error path contains flag okay so then i
can do add c
pass wd and it'll block
okay so god
damn it all right
um
so it didn't like when i passed flag to
it
said path contains flag so instead i
passed etsy pass
wd um it
uh called lstat so it says i will not
follow symbolic links on the path
um uh and basically l-stat will check
if it's a symbolic link etsy passwd is
not
as well as that does a bunch of things
but including
lets us check if it's a symbolic link um
and then it prints out the um path uh
the file that i requested it to print
out cool
so as you can see this challenge
in teaching mode blocks right after
it does this l-stat what do we have here
okay let's check it out we have the
l-stat
right it calls us that and it
checks the specific flag in l-stat and
if that flag is set it says
hey go away the file is symbolic link
right so let's let's just take a look at
what happens there
um of course we can't do slash flag
that says the path contains flags so
let's say okay
um we'll make a link to slash flag slash
um golf
right so now we have a golf
right here if we cat golf
of course we can't cat gal because we
don't have permissions to it
but we can say give me
galf and it says nope go away it's a
symbolic link
all right so now what did we do
obviously there's a race here there is a
um
check that happens and then the program
happily at a later time assumes
that that file is now safe because hey
it checked it right
but of course there's a race between the
time of these checks
and the time of this use
so let's exploit it in teaching mode
for all of these uh levels this is super
easy
because again teaching mode will um
actually sit there let you win the race
and then press enter when you're ready
so let's take a look
all right so let's remove galv we'll
just make gal for normal file
say okay hit enter okay and then
so this
is where it has now verified that it's
not a sim link
now it's happy when you hit enter it's
gonna print out that file to us
we're going to ssh in a different direct
window
okay here's gault now let's remove galv
and make it a sibling to the flag we hit
enter
boom it happily opens that file
and uh
outputs the flag of course there's my
flag don't steal it
get your own flag all right so
that was
teaching teaching will block for you on
all of these levels or as many as it's
reasonable
to make the race very explicit
to make you practice to let you practice
it
let's take a look at a testing
one that won't do that
let's launch up testing
boom inspect it does the same thing of
course we'll just verify it in binary
ninja
much simpler to read of course here's
that lstat
here's that check if the string contains
a flag of course you you can't really
erase this
it's just a check against memory and
you're you're not operating in this
program's memory
space so this is what you race and then
um it's very nice it's nice enough to
sleep
for 10 seconds to help that race
and then you um
will uh
if you win this race by the time it
opens this um
file it'll be a sim link so let's take a
look uh
ssh back in
okay here's my gal file all right let's
say okay give me
calf it says nope file is assembling all
right let's remove galv
make alpha normal file okay that
works
why is it why doesn't it sleep connor
oh it's nano sleep ah
sorry yeah so it's sleeping for a very
small amount of time
it's sleeping for uh
one
yeah 10 milliseconds okay cool so it's
just just enough to make that race
more winnable but not enough for me to
switch over and do what i did with
testing mode
so what do i do of course what i do
is run this
on repeat
okay and
grab for the flag
in another terminal
on repeat
remove the gal file
and assembling the gal file to slash
flag
boom
it's not going to be happy because now
of course the file is symbolic link
and then a third terminal i make the
file
remove that and make the file normal
again
so
whoa so what this is going to do is
make a gal flip-flop between being a
symbolic link
not existing at all which isn't really
what i want and being
a normal file and if that flip-flop
happens
between the check and the use we win
and eventually if i run
this in a loop that will happen and here
it is
all right so you can actually see let's
just remove this graph
you can see that it gets run tons of
times
often our gal file just has the high
sometimes it doesn't exist at all
because i just removed it
but every once in a while oh sometimes
it sees that it's a sim link and doesn't
like us
but every once in a while when it checks
the file is a normal file that says hi
has high in it and when it actually goes
to open it
it's now assembling and we get it back
all right yeah so doing this in tmox
will be perfectly fine
um i use screen just out of personal
preference
so the question on zoom was can you open
just different terminals instead of
using screen or tmux yes absolutely
it's all the same yeah
yeah so the three commands that i use
i have a you know one bash one liner
that just loops
and continuously um does
launches the program with galv as an
input
i have another uh terminal that is
looping and continuously removing the
gal file
and linking um the gal
file to slash flag making that symbolic
link and i have a third
um um
what's it called the third uh thing
terminal that is looping removing the
gal file
and replacing it with a normal file so
ideally
this runs right before the check
this runs right before the use
and then this gives me the flag
um so yeah
on twitch someone's asking could this be
done in threads in a python script
absolutely
yes
yeah and i agree actually with what
almir what connor just said in
twitch os.fork in python
is by far the easiest way to
multi-process in python
you can if you're writing production
software use multi-processing if you're
writing a hacking thing
import os
oh yeah an ipython let's see yeah it
and might this might crash my python
um okay yes uh okay but but
but if we have an x that
we have if you have a y dot pi
import os
if it's not zero the parent
boom super easy
multi-processing and of course
if you call
oh is that fork twice now
we have four processes running
this is an incredible way to
multi-process
you can even do insane things like
based on the values of these give
yourself an
id
well actually this is stupid
here we go
well what am i doing just randomly
executed something my history here we go
there's your pid this is
i would say for hackers the right way to
multi-process
um so there's a question how long should
it take approximately i mean you just
saw my exploit it was almost
i won the race almost immediately
so
yeah so question about the bash script
history
here it is so i run
the command over and over at the same
time
i have one script that is constantly
symbolically linking golf
to flag and one script that's replacing
it with a normal file
and then the thing that's running it
over and over
has various behavior from giving me the
flag
to failing to even check the file
because it doesn't exist at the moment
you're giving me
uh the high content in the file to
complain
that it's a symbolic link but every once
in a while as you can see
very frequently it gives me the flag
yeah and then of course level two as we
were talking in
in twitch level one
sleeps this radically increases
your uh window of opportunity level two
doesn't sleep if you're having trouble
that's where the file system maze um
can come in useful all right let's take
a look at how people are doing
we have six saws for level one sixteen
shots for that one teaching
level two testing one still has zero
solves
all right
right so the question there was just a
question on uh zoom
in in level one there's a there's the
the golf
file that is a file that i created so um
baby race takes a file name that will
print out to you
etsy password boom it printed out as a
password but it won't
allow you to do slash flag and it won't
allow you to do
a symbolic link
so what do you do
[Music]
of course the the trick is winning a
race
with the uh the file switching out the
file that it's about to read with the
symbolic link
i named that file gal it's flagged
backwards
um and basically i just keep swapping
out gauf
between being a normal file and being a
symbolic link
gaff is an arbitrary name
um oftentimes by the way um in these
situations i see
um
[Music]
there's some
what's the term that i'm trying to think
of there is some
despair on twitch about copy pasting the
flag out of tmox
oftentimes in in this situation where
you're running things a million times
and so forth
make it easy on yourself and uh
t it to a file save all your output and
in fact save all the error output too
boom now everything is in this output
file and you can
calmly grab it for the flag
[Music]
so
um so there's a question on twitch
will are most of these challenges
something we can pull off with bash or
they're going to require python in the
future
uh in later challenges you'll probably
want to switch over to
uh python in the later ones
um let me let me show you how i would
approach this one
in python
so
let's do this
will this work if i only have the parent
print
no just that oh if that fork is not
going to fly
that's annoying that it can't do it in
ipython but let me show you in
modify this is typically how i do things
um
let's create a file called a background
loop
have a command
and here we do a fork
okay here we do a fork if we are the
child
if you're the parent sorry bill will
return
otherwise if you're the child we will
loop
and keep executing this command right
nice and simple we're going to do
background
loop rm
galv background loop
um
ln s slash flag
golf and background loop
echo hi to slash
to calf okay
and in the foreground
i'm going to
use pawn tools
to run
let's kill this baby race level one
now of course this is being super lazy i
can do all of this in python probably
much faster than shelling out
right
[Music]
all right here we go
all right let's see if this works
oh my god oh my god
i forgot to kill the forked
forgot to kill the forked things okay
yeah this is typically why you do stuff
in um like
poems tools or uh and with actual
multi-processing libraries this is
a this is a terrible terrible
um a device that i gave you but
it works all right so we launch off some
backgrounded loops and then um we're
going to
do this and of course i have uh now i'm
redirecting
all output out of here so if you don't
see it we don't need to see it
okay and run and here it is
boom
and now we need to kill all this python
remember if if things get too out of
hand and you accidentally fork bomb
yourself or something
you can always uh restart your container
if you want to see how we would do this
without
python so we have or without shelling
out
um we have a background
unlink where we will while true
or as that unlink gal so this is our rm
golf boom that's taken care of
we have a background
link i'm sure there's an
import os os.link
yep
no os.simlink
yes where's the sim link
source death okay
background link
okay and we have a background
right
um and this is a
all right we'll just not crash on any
exceptions
and now instead of this we just do
background unlink
remove these commands
background link
and background right
and this will work just as well
or not
oh most of those crashed
kill all the pythons all right what
happened here
where's that line link gal should be
perfectly
oh yeah we want it to be there's an
awesome
import context lib you could do
with context lib dot suppress
all exceptions
it's easy it's less code than a try
false
boom or then a try uh try except okay
and here we go
boom and we see it scrolling through
we scroll up there it is
no shelling out
this code terrifies conor but it's good
code
the awesome thing at the end by the way
um
watch this we do a try
finally
when this process gets interrupt when
i control c or whatever when this is all
done running
this is gonna run and here i just kill
dash nine all processes that i can
kill negative one means everything
so now i can run it hit ctrl c
oops that's not what i meant to do
it killed everything in the container i
think i just killed
okay yeah uh not the
intended result um
where's my
okay screen went a little crazy with
that
sorry about that all right um
um
if pid yes zero is what i meant zero
sends this to all children
as well now if we do
buy that pie and we control see it
it kills all of its children and
nothing else to clean up
see this is perfect highly recommended
oh hold on hold on uh can you repeat
that
i just my audio went crazy
uh it'll be less than or equal to 15.
we're still working on some of the
advanced ones
so there's a question on twitch what is
the
man to kill all the python processes
ah it didn't get saved psa x grep
python then i do awk to print out just
the second one
uh the second column which is the pid
and then xrg skill dash nine will kill
dash nine all of them
uh p kill oh yeah yeah p kill also works
he killed python there you go all right
anyways
um alternatively this guy this guy is
great
it'll kill all the children you don't
need to worry
if you feel that this is ugly here then
no problem put this in a
pro main dude
and then here you do try main dude
i'm telling you this is the way to do
multiprocessing
in python um
you want to see what's even more insane
connor connor is commenting that this is
insane
you have to be
uh you have to be very careful if this
is doesn't look forever
if it actually terminates then you're in
some trouble because
when python terminates it'll start
cleaning up resources
and it might close things that are being
used by your main thread
so just in case obviously with wild true
it's not a problem but if this wasn't
the while true
you have to do this
you have to make sure to kill yourself
uh
kill your process before it
can
oh like in os os that exit
if you do exit it calls libsy's exit
hooks
actually i'm not sure about underscore
exit that's a good question i don't know
but this works great
we have a question on zoom how to switch
screens
um with tmux it's control b
and then you release all buttons and
then hit n
and that will take you to the next
screen
we can make this much nicer actually
check this out
yeah all right see this is see now
now conor science will leave
what
yeah but we don't always want to
suppress
you know what i'm saying yeah
okay in my in my current code we always
want to press all right so let's do this
let's do a background loop
let's do this suppress loop
okay
[Music]
boom
what do you think it's pretty good
all right yep it's still working though
that's incredible
all right let's see let's see how else
can we make it better
oh i see what you're saying so we
suppress and
add a lambda here
this is terrifying
i don't have enough parentheses okay
this won't work though with it can i can
i have a width
in a lambda i don't think so
now we can we can we can do this with
this guy of course
with the open we don't utilize that open
so we can do this
no we don't need we don't need a width
we just need to open and close
uh yeah
i don't know how to save it
that's terrifying
hold on hold on hold on hold on ah
i know i know check this out
okay here we go times two now we have
two
uh of these guys
is there something else i can help with
siri just triggered oh what what uh
i could just do a close on this guy
right it's
okay this is going to be insane but okay
lamb
what
oh because basically i don't need to
write anything to it
yeah i just needed to exist all right
but that's kind of cheating a little bit
we didn't
um yeah slightly different code but i
think we could still write something to
it if you weren't
if you were pretty oh sorry yeah
okay that close
okay still works
there's the flag scrolling by amazing
all right not bad
i'm not bad
oh you can write it in gyan85
all right yeah so this
this right here is basically about eight
times better than the multi-processing
module
oh um on zoom how to switch screens with
screen
um that's control a instead of control b
screen was the original and use control
a and then tmux
came about and said well we'll just copy
everything that screen does but change
it ctrl b
this is insane
so
yeah uh interrupt as we'll talk about in
the next
lecture tonight interrupts are
catching um signals in threads is
really hit and miss
it's going to be tough to sorry everyone
on on twitch connor was talking to me
about
handling control c
uh in this uh crazy
homespun multi-processing anyways every
single time i've used multi-processing
i've
had tons of issues and it's been
horribly painful
this my fork bomb your machine once or
twice
but other than that it's great
yeah i i'm running this in my home
directory
but i can run it from anywhere if i
change you know the golf path
to be uh
oh one one very important thing
that actually i forgot to mention
because of these exact situations
there is a special thing that
in slash temp
uh or in any uh
directory that has the same permissions
as slash temp slash stamped has this
special bit
um uh for its directory
um
you cannot root will not follow symbolic
links
that are not owned by root
right so gout can be in a lot of places
it cannot be so it can be in home ct
let's let's actually make this uh
file name
so right now i have it in a
home ctf golf and this works great
so
okay you see the flag scrolling by
awesome
i can put it in a lot of places i cannot
put it
in slash temp the challenge will not
follow symbolic links
or root will not be able to follow some
outlinks it'll get permission denied
if they're owned by your user so you see
i'm i'm running it right now with
tamgalf and i am not getting any flags
that's
that might be why people are having
trouble on twitch actually
don't try to do this in temp
yeah i forgot to um i should add that as
a uh
let me add this as a slide to the
lecture so i remember too
okay the bash loop t in the file
someone's asking
uh man i lost it okay so while true
do the command
done and then t that whole thing into a
file
boom
okay
made a note there
all right let's check in see if anyone
has solved level two yet
oh four people awesome ah
freak mod saul got first bought on two
aeron
uh got second l one r
got third one got fourth blood
level three three solves nice
frick mod got first blood
level four no solves yet
all right
amazing
wait connor has wctf started
are you playing wtf right now
oh
whoa hold on foreign just got first
blooded
nope oh yeah the teaching assault
sure first blood is the testing the
teaching lets you
pause the
the the thing awesome
yeah this is fast these hackers are fast
wait so how long has wc have been live
oh man now we're okay
oh first blood on level four
frick mod dethroned
nice good job
really wants that thrown back
it's so cool to see how many people
are doing so like i mean
hundreds of flags in this class people
have gotten
it's incredible
you know what would be awesome we should
just package this up
in a
easy mp library
and actually put it on on pip
let's do it
um
what's a nice uh
example set up that time
this crazy thing
it is a python wrapper around parallel
uh because parallel is the best man
just like easy mp is gonna be
yeah yeah this is gonna be great
uh multi-processing done
right we could also do threads we can
just do os that clone
[Laughter]
just like hijack python
all right here we go
wait hi mod yeah okay
no it'll call the function
don't you want the the background
decorator
let's use it background
decorator
oh interesting
there you go it already works all right
so
we have the suppress loop
let's just add some sugar syntactic
sugar here
okay
oh in in in here
that's all you need
wait this will be hard with the
decorator won't it
how do you have a decorator
okay
inside here
oh i see i see i see so there's a inner
function here
yeah yeah
yeah let's just
make it easy if suppress
i'm sure there are way better ways to do
this but
awesome
oops i forgot the width
oh well that's incredible
so by default we have suppressed none
okay
now we don't need to test that pie just
just just if name equals main boom
yeah all right
so i guess what what what we should
do is this
and this there
what does what does the walrus operator
even do
oh i see what you're saying uh okay okay
sorry i thought i thought you were
talking about the matrix
operator thing okay
cool um all right but i don't like okay
so this is a
decorator that immediately runs your
thing
this is a decorator that also
immediately runs your thing but
but there's no backgrounding that's
happening here
something is wrong
no but this no no
no no no no no no no no
yeah but this will do background in the
loop we want background to be done
outside of the loop
what we want is
here and this is what this is what we
want
you want to loop it
and here
i'm sorry
yeah here uh this one
oh yeah you're right right yes thank you
okay
and def um this guy is
going to suppress enter
no no no no no this is this is a little
different
let's go do this
and then
right
so now we can um
suppress inner inner
no sorry suppress
exception
loop it oh yeah yeah sorry go ahead
questions about the class obviously
override this insanity
yeah so uh the question on zooms
conceptually what's a good way to
approach
these challenges right um the first step
of every race condition challenge is to
understand
where the vulnerable window is
right so and actually that's the second
step the first step is to understand
what can you impact the process with
right can you um
modify uh do you
share a file system in all these cases
you do
right do you uh share memory
with that vulnerable process and and or
can you
impact its memory through a different
thread in this case
in level one and two and most of these
you don't but some of them you do
right um think through that
and then when
you identified the ways that you can
impact it identify the window
during which you can impact it
[Music]
um
that's a good question
yeah here's what i can do
if this doesn't run it if i just
okay
now
yeah we can always have another guy that
background run
that's true but we can tackle that later
um in terms of conceptual approaches to
the race conditions did that help
for example yes
the memory part is thread exclusive yeah
killing with zero like this just um
tells you
is that process alive or not
it'll assert yeah it'll assert in python
and return an error and see
all right we're at the end of the class
time any
questions from twitch from um zoom
about race conditions or are we
rolling forward let's see what the state
of the challenges are anyone else solve
oh second solve for level four blue
shirt yawn
but cooler
level five is still unsolved
nice
uh what's your question
um so it the question was how
how to approach writing a um
pawn tools script when you're dealing
with like a multi-threaded uh process
um
it's it's tricky right so you're going
to
there are two options one you can write
multiple scripts and run them in
different
uh sessions right in different terminals
um one script that
that you know does one action.script
that does
another action etc the other way is
basically this
right in the background you do
um
one action and and and uh in the main
thread you do another action
right um
essentially yeah
alternatively sometimes you can even
just just do a normal
python process that just you know let's
say opens up two connections to the
server
and just loops through and sends stuff
on both connections
um yeah yeah
yeah exactly
you uh open up two terminals and do
things on both
hold on good
um
so um
the question for for those on switches
it's it's
unclear how you would trigger
behavior of different um
[Music]
um of different threads
from your your python attack script
right uh it really depends on the
program
right so for some programs um
for example in uh my data races lecture
there's a program where both threads
are reading from standard input right so
just by writing to standard input you're
interacting with both threads
whichever happens to be
reading at that time
most of the time programs aren't like
this so programs most of the time will
have
uh a network connection
open right they will spin off a thread
to handle a new or
they'll have a network server they'll
handle a spin off a thread
to handle a network connection and so
when you
talk over that connection to the
challenge
you will be directly triggering actions
in
the thread that's handling your
connection um some of the
later baby mams are like this with
multi-processing
but multi-threading and multi-processing
are very similar right it's just a
matter of
sharing the memory space or not um and
and some other things
there are also some of the baby wraps
the later baby wraps are like this
and some of the later baby wraps uh
maybe not
no no uh one of the later baby do you
remember conor is it a baby rather baby
jail
that we have uh
for things where we can um
practice interacting with
multi-processed things anyways for sure
yeah the last baby ma'am and then i
think the last baby rob as well
all right um
let's call that a day good luck we'll uh
launch another lecture tonight another
lecture video
20 minutes or so and then well not in 20
minutes so 20 minutes long
and then um more processes
more challenges connor will have his
office hours on friday i'll have my
office hours on monday
and on wednesday we'll move on to baby
kernel
sorry toddler two
uh yeah one more what's up
yes exactly symboling creates a link to
any file you're choosing
um yeah so the question is why was
simling created
um it's very useful
to be able to reorganize data without
moving it
that's what some simlink does right a
symbolic link basically allows you to
have
you know a
i mean here's an example right if you
look at
vi right vi the text editor
vi is in user bin vi but that's a sim
link
to etsy alternatives vi because there
are many different
vi alternatives that might be installed
on a system there are many different
flavors of vi there's vi
there's vim there's nvi there's neovim
there's a bunch if you look at sc
alternators ui
right now it's set to etsy bin that
basic
which is the actual binary of course i
can just
not worry about it type vi and get into
this vi vim.basic but i can also
using some ubuntu uh well debian or
ubuntu or whatever
um we happen to be running here i think
ubuntu commands
um change this symbolic link
to point to a different vi distribution
right a different vi flavor
so that makes symbolic links very useful
cool all right everybody
thank you for tuning in um
any questions you got uh talk to
us on discord or email
ideally in the help channel if it's for
help so then
other students can help and benefit from
answers if
you are asking on the help channel but
aren't getting a lot of
luck uh feel free to tag us
in just at zardis or at kanak
please use the um
um um
the what's it called the collaboration
rules
the rooms the collaboration rooms are
open for a reason
um use them to collaborate and uh
good luck see you later
bye