it is uh october 14th
and um this is going to be another
stream
on um putting it all together
the toddler module let me bring
up the twitch chat
on here
zero viewers man
46 years awesome okay um
welcome to uh back to toddler one um
any questions before we get started
no questions
ah okay we have a one question on zoom
about
um uh read code and read my
we'll we'll get to that we'll do some
technical uh
work on gyan85 today um
question how's uh mrs john and baby on
they're doing great
um what did babyon do baby yan
uh decided not to poop for three days um
and then she spectacularly ended her
uh pooping strike five minutes before my
asu101 class on monday that was
really exciting uh um i
i showed up to the um
asu 101 uh
very discombobulated um
that was very fun um
yeah so uh when
when when uh that babies don't poop for
a while they're just they're saving up
their strength
and then it will unleash their energy
eventually
so uh be careful okay uh
and on that rather smelly note
let's roll on to week eight
um all right first things first the meme
review there are so
many memes um oops i should have left
the space for my camera
there we go there's so many memes it was
it was incredible i i i couldn't choose
them all i actually ran out of time
um putting together the this meme slide
so i'll put more in and i actually
sprinkled these two
in the rest of the um the the kind of
status update slide um first of all
obviously we moved on to toddlers
toddler one is a module putting it all
together so the
the way that the uh college works is we
have the baby modules which are
individual concepts you put those
together for
uh toddler modules um so you'll have two
toddler modules this one and then the
last module
um um
there's some some good good memes aside
from that uh
this i really liked just the kind of
generic uh generic meme order four
six six uh 466. um
we have uh uh
you know the type one versus type two
fun pawn college is definitely type two
fun hopefully you will
look back on this fondly um
there's another meme um about the the
mental effects
of this but but it i ran out of time to
put it in i'll get it in
next time um uh
we got uh some political uh
memes going on uh i'm be running on the
platform of course at t
syntax is uh
poopier than baby john's
three-day output
but on a more serious note if you live
in arizona
the voter deadline was changed just
earlier this week to be tomorrow evening
so don't forget to register to vote if
you're eligible obviously um
register to vote you know just just do
it vote
vote for whoever you want to vote but
but you have to register
by tomorrow you can go to arizona dot
vote
to register to vote don't forget
um do it like now because you know
all you're talking about are memes one
awesome um
talking about memes one awesome meme um
is
um that at some point
i don't even know what day days are kind
of meaningless now i woke up to
the um 466 server being down
um and i i panicked and i ran over and
and and uh you know logged in
um and then tried my best to reboot of
course conor handles the
466 uh server um
and and and it's it's it's like an
insane like
insane situation where basically they're
just like
decoy files there if you try to start
like
nginx on the machine it's like a decoy
but it's a decoy that also starts out in
matthew when you reboot the machine so
you have to like
figure that out and reboot it and then
uh
you know it's it's just it's just a
crazy wild exciting thing
um so
uh it's it's it was crazy basically in
order to figure out how to start up the
server
i had to reverse engineer connor's shell
history
on his user account in the machine uh
and conor uses esh so i have to yeah it
was
it was pretty wild it was very exciting
but we got it running uh in the end i
think we had
three hours of downtime um or something
like that or at least three hours of
noticeable downtime
it was pretty exciting it uh that was uh
last thursday
um all right um
uh some other stuff obviously yan85 came
back
back with a vengeance so you have yan85
with uh
you know overflows you have yawn 85
the final level i don't mind saying is a
jit spray
we created yon 85 64.
a 64-bit just-in-time compiled
variant of yan85 um for you to
exploit it and and then if you notice
you know
i'll i'll show you that later but um
if you look at you know that in check
sack you find
all the mitigations are on it is a an
actual
example of how um just in time compiled
uh languages uh could uh be exploited
and
and we're talking stuff like javascript
on stuff like
chrome potentially right um of course
proxied as jan85 um
and a lot of people uh uh for on the one
hand
this module is all about putting code
together from
other modules there are no new concepts
in this module
it is all about reverse engineering a
program
uh finding a memory error to redirect
control flow figuring out where you can
redirect that control flow to
to run shell code and figuring out how
to craft shell code
that escapes whatever jail attempts
that the the program does every single
uh example in this module including the
jit spray
has to do with that
so there are no new concepts
but putting all those old concepts
together is
uh tricky um and of course it all
involves
or not all but half of the module
involves really being able to reverse
engineer and truly understand
not necessarily yan85 or the on 85
virtual machine
right i don't care for you to to learn
about
you know yan85 necessarily even though
it's an
awesome architecture that hopefully will
be adopted worldwide but um
i want you to understand how to reverse
engineer
a um a complex system like that
um let's see what what what
have we got uh catching up on oh my god
if
connor had used emacs that would have
been over i'd
would've been bad news all right um
yeah so someone said on on um
twitch that while uh you're reusing all
of the
concepts and combining them from
previous modules they're all the hardest
concepts
yeah it's uh this stuff is not
easy but once you learn the individual
concepts well it is very very very
approachable um
uh so um
what other things do we have we have uh
this this worries me a bit um people uh
are uh worried about graduating because
of my course that's not necessarily
a position that i want
people to be in um so we will talk about
things that
that we're doing to try to help you and
then of course on a lighter note
instead of starting with a b the
challenge started with a
t and so that up tap completion
for everyone
including us which is an interesting
effect we didn't think about
um so that's uh the meme review there'll
be a couple more memes
sprinkled in let's talk about the ctf
report
um why do i keep
not fixing that so i don't um
overlap with my own text anyways all
right cdf report
this past weekend 19 students played
either second
or second i said setcomp by accident
second or damn ctf for extra credit um
the uh damn ctf uh specifically seemed
to be
everyone reported that it was very hard
um second is a very
neat ttf that has very quirky challenges
a lot of the time
um i wish i had actually
actually this time we're gonna go and
look at ctf time to see what's upcoming
last time i
forgot to do that um and it's i don't
like have a spreadsheet of challenges
that people solved but
uh according to my jotted notes i think
other than people in shellfish um
non-shellfish
uh pawn college team solved a union of
about seven challenges
um so it seems to be harder than uh last
weekend i think last weekend we were in
the 30s or something because of those
mini crypto challenges from boiler
uh ctf um but um
it was uh it was pretty pretty pretty
good stuff um i was actually impressed
with some of the
complexity of the challenges solved um
then uh going forward of course remember
that four person minimum
um and uh keep keep pushing we'll get
um your your grades updated with the
bonus points um
uh just have to um
uh khan has to have enough time to go
through his email and
and and and mark them in we should
really do a more automated
solution connor is there a way for um
ctf ctfd to have
judge approved challenge solutions
yeah eventually maybe maybe in january
or something
we'll um add a uh another challenge
category with weekend one weekend two
week and three and you can upload you
know
maybe a link to your write up on github
or something maybe it'll do something
like that
okay cool um okay
anything else i want oh right right so
let's let's take a look at ctf time to
see
what the hell just happened to my
machine okay
to see where what
that window doesn't exist on my machine
i don't have a new tab
on obs is hallucinating
okay now i have a new tab
all right good so we can go to
ctftime.org
and see what ctfs are upcoming wow
there's a lot
upcoming so next weekend um starting
with hacktober
uh friday to sunday um
let's see hacktober seems to have
uh is it the first
october no what oh it is
okay cool um
so it seems to have the involvement of
the us air force
pretty cool stuff um and one ctf
do they have a rating ah this one ah
organized by null um 48 hour
um ctf um
with a previous edition edition that was
uh fairly good so that's uh
you can click through here um
click through for the previous editions
you can go
look at the votes for
the first edition and see yeah so these
votes
ctf time has a spread of how much um
from uh the weighted votes uh the weight
can
increase every year from glancing at
this
it looks like the maximum was oh yeah
right there 36.6
you can only vote an integer so every
single vote was the
the maximum point very difficult
challengeable difficult ctf
um
so that seems to be a good candidate if
you want a
heavy challenge um my feeling is
hacktober is going to be a little
uh less um
maybe more beginner-friendly i don't
know um not less challenging but uh
because that
as a negative connotation but more maybe
beginner friendly
macaroni and hackaroni however they are
pronounced are
hosting their ctf this is one of the top
ctf teams in the world they uh
you know go to uh compete at defcon and
all of that
um i think i want to say they've held a
ctf before but there may be parts of me
yeah parts of maveroni have held cts but
this is their first as a
as a full team so that is another option
i don't know
i don't know what to uh suggest they're
gonna be a lot of good cts we're gonna
i'll leave you to go to ctftime.org
on your own and figure it out um
and uh
yeah uh let's see
extra credit for um hacked over
participation oh
any of these if you get a team with four
more people or
play with uh shellfish and again not
because
i mean obviously i like shellfish
they're you know my friends and
my my old crew and so forth but uh not
because i like them but because
i have direct connection to the
leadership and i can go
and when people write up yes i
participated with with shellfish
um on whatever ctf i can go to the
leadership and i say
yes or no you know and they will tell me
that you did or not or you just you know
someone just wrote up that they did
for extra credit but um
um
[Music]
someone's asking twitch what if you play
solo and still solve challenges you will
not get extra credits solo ctf sucks
play with the team come on i have a
minimum team limit for a reason
um uh
yeah um it's it's very
depressing playing solo it's like i mean
playing soccer with just yourself
um not that i have ever really played
soccer
well i did not not anyways
not not a not a big soccer person but
it's okay
so yeah so uh extra credit for hacktober
participation extra credit for any of
these
just give me a write-up before monday
all right moving on
uh what if we
solve all the challenges solo if you can
solve all the challenges of a ctf
that isn't i don't want to say not
possible but
like solo it's going to be challenging
um
you uh you might then i'll give you
extra credit
but don't do it um there was a uh
there there have been a couple of uh
famous solo teams
um if you go to teams uh there's no
teams list anymore
that like a full list is there
waiting for ctf time yes okay
so there are a couple of ones i think
the original kind of most famous one
is tom cruise this is a team
um that was uh oh
wow well someone either him or someone
named
tom cruise are still active back in the
glory days
tom cruise um played alone
and won ctfs over and over and over
obviously this isn't
tom cruise the famous uh actor and
scientology devotee
this is um geohart
who is george hotz
who is um a famous rapper
among other things but mostly mostly a
rapper
all right um another uh one of my
uh actually now she's my student
one of my grad students um but
uh a teammate of mine on the um
uh cyber grand challenge uh
and long-term collaborator and good
friend um
she played uh ictf solo and i think a
couple of other ctfs and
that that was an interesting experience
top 20 in the world that's that's
pretty good um so yeah solo ctf does
happen but you know
if if you're on that level then um
uh that's uh
good job um okay um
so let's move on
howard what the hell
stopped functioning oh yeah hold on
okay we're back where's my camera
okay we're back incredible all right
uh there's some lies being spread about
linux and the twitch don't listen to
them linux is incredible
um so i put
one of the overflow memes on here um how
is asu doing versus the world
um asu has uh held on to that top spot
despite a strong challenge from knopnob
goose who skyrocketed from 17th
to 2nd uh frick mod
which i'm sure is frequency modulation
but it it sounds
very vulgar is
managed to grab the top slot by
exploiting
a jit spray an actual like like real
world
no holds barred uh vulnerability which
which is
super impressive alongside 12 people in
pwn college this i i was
so proud to see um this is the first
year that we have the toddler challenges
like i said that's why collaboration is
is on
uh full full blast for the whole now two
weeks
um and uh this is um
um the first year similarly that we have
uh jit spraying and
seeing people solve this and then
you know go on to
by by the end of the course we're gonna
have insane stuff for you
um is very awesome um
there's a question who's at 21 all right
we're going to uh
uh check real quick who's that 21
um
just because you know roadie
is at 21. good job roadie
okay um back to this so um
right now the top ten to get in the or
to get in the top 12
to get into the top 13 you'll need to
solve everything
uh 13 and 14 are only missing uh the jet
sprays
um the teaching and testing um to
but but the top 10 has quite a spread or
sorry the top 20 has
quite a spread that you can still push
into um and of course we'll update this
again um at the end so here's your shout
outs
um let's see
interestingly torah shulk kept
sixth place solid um etsy shadow
moved up uh i i should
go one unfortunately dropped to third
but still solved everything
just um a little bit behind the top two
um
is that like an advertising an
advertisement can you imagine
you you start a ctf team for
uh a security like you know company or
this exists as i uh i i talked about in
some of my videos
um you know immunity uh
or was it immune i'm going blank on the
name but the
the people that created um
i'm going blank on the text anyways i my
mind is
uh a little sleep deprived right now but
but um it has happened that people
participate in ctf
as an advertisement for their their
company but
could be um
yeah and these uh pony devils pawn
devils
pocket gogurt this just sounds vulgar
blue shirt john is is not pwn devil's
not
but i'm guessing that is excitement
phone devils
yeah good job so a lot of the kind of
regular
usual suspects um but we have this
iai iran that that that's a new name
in the top 20. i don't recognize it zero
jumped from 13th to 5th awesome stuff
a lot of people doing a lot of a lot of
uh things oh
i forgot to shout out shout out to null
pointer actually i all
no pointer an email um
i just been too busy to respond but i
will i will respond okay
cool um let's uh
push forward from here current grades
um so we started out with 209 students
in the course
we still have 129 registers that's down
two from
um last week uh let me move myself up
here
um 117
solved any of the baby revs that was due
last week
76 have solved any toddler one so far so
this is uh probably the
um um
least uh high outing
um
on on twitter when the professor laughs
like that looking at grades
that's how you know it's bad um
i would have definitely of course
like to to have seen more people solving
toddler on what i
am trying to understand is where the
um complexity is now as a preview here
expand extending the deadline of toddler
one right
i announced this um uh
in uh in in everywhere i
on on twitch on canvas and on discord
um so if you're extending toddler one by
one more week
to um help the asu students uh
and and the you know global community
that is
also struggling with toddler one to um
get those concepts and to truly master
them um the curve is staying the same
for now
um we have uh
because otherwise if we had stopped
toddler one right now
um over a third of the class would be um
failing or and if you count e and d
as failing it would be half
unfortunately that curve
wouldn't won't do all too much we'd
still have a very
very high fail rate but more on the d
side than the e side
but i want to stress that
in connor's office hour in in
the extended q a last wednesday
toward the end i walked through exactly
how you solve level one end to end right
a solution on my screen uh that
you can replicate
to solve level one this number should be
at least at 117 you open up that youtube
video and just step through it conor in
his office hours
it's friday officers he walked through
the exact solution to level two
that you can follow right away in my
office hours on monday i walked through
the solution of level three
right um
someone's saying the level one solution
wasn't working the courthouse always
gave me the wrong address
but it's
uh
yeah we're gonna have to um maybe we can
revisit
level one just like live on the server
on at the beginning here because i think
it's it's very necessary
to get people started um but
uh i i
i'm confused as to why it's only uh
76 but we'll we'll revisit it and check
it out
right now from scratch instead of using
the the previous one okay
um so what is uh what to do if you're
not doing well
um first don't panic um
remember the challenges are still worth
half points after the deadline
so uh when not if but when you solve all
the toddlers
go back and solve some more um for the
ones you missed
it's and and uh unfortunately
with the extension of this um the the
makeup
weeks are going to be a little tricky um
but uh we'll we'll figure something out
um okay
um at the end we will still have a
makeup week
of course um
okay
let me let me just catch up on twitch
there's uh
someone wanting to go for and onwards
the curve needs to change for this week
uh
okay um yeah so we're gonna um just
do uh uh uh uh oops wait
go back no one saw the
awesome meme that's gonna be a surprise
unless you've seen it
okay anyways um so anyways we'll
we'll we'll play by here what we covered
today one thing of course ctf extra
credit that's still seven percent
on the table still that you can grab um
and of course as i announced on canvas
and discord for the asu students i'm
extending the y grade option again
um i basically just figured yolo
we'll push it out all the way to
december 1st i mean that's
after i think the the last homework is
due on december 2nd
so basically uh at that point all you
have is the makeups um you should
you should be able to figure out do you
want the y grade or not
um sort out the impact to your
requirements with advising please
ahead of time at some point it becomes
very difficult for us to go back and
update
grades in uh um the the grade reporting
system
um so just just let us know um i got
clarification a why grade is not
um y or no credit if you get a d or e
you still
it's still an impact on your gpa but a c
or a b is not an impact on gpa so y is y
d or e not y or n right so
um the the negative
normally you have no negative impact
uh from your
[Music]
gpa for an a sorry
if you get an a obviously but if you get
a b or c that might impact your gpa
if you get a y it won't impact your gpa
let's see
there's some talking about toddler
two um
yeah yawn 85 kernel might happen all
right any questions on wide grades
awesome okay so again the y grade is
um really there if you know you don't
want your
gpa suffering if you get a c um
if you uh but a d or an e unfortunately
still a d
or an e okay um
so the tentative schedule i just
realized this is actually
uh a little wrong so we have to give up
something
right um when uh to extend um
uh this module uh unfortunately
we're i don't want to give up any of the
content so we're going to give up
democracy
originally you had no um
uh you know anything on
um the uh
sorry my mind went blank on 1104 we had
a guest lecture actually i realized a
couple of things one is that the guest
lecture was miss schedule it should have
been on 10 28 because that's the week
running up to voting week um um
but uh
[Music]
we um um
unfortunately so anyways i wanted to not
uh overload you on voting week we still
won't overload you on voting week
um we are going to uh let me update that
schedule real quick because it's really
distracting me that it is
wrong and then i'll refresh the slide um
we are not going to overload you on
voting week but we will
um still give you a little bit to work
on
uh so let me one sec bear with me here
upload updating this
no oh my god
google docs live this is extreme
extreme google docs all right um
okay now we refresh this and it should
work perfectly
yes no
yes presenter view
okay so
here's what's gonna happen we're going
to do one more week here
we're going to do our next return
oriented programming
um that's gonna be an amazing uh module
next week you're gonna
it's gonna blow your mind as i said
during an office hours
return-oriented programming is like lego
it's it's
it's treating a program like uh lego
blocks it's amazing
it's it's it's it's the best ever
anyways cool
then um from there we will
um move onwards to the kernel
so 1028 is the
week preceding voting originally we
weren't going to give you
any work we will give you a little bit
of work it'll be just a couple of levels
just to learn how to interact with the
kernel in linux
not too crazy um not
an insane um amount
security wise it's really tooling up
to understand what the kernel is how to
interact with it
and then what we'll actually do is take
most of the
challenges that we were going to have
here and put them in the week of
automatic vulnerability disc sorry of uh
wildcard
slot 2. um just to
allow you to uh or to allow you to have
a lighter week so you don't have to
worry about
missing uh you know voting and so forth
um and then um automatic vulnerability
sorry wildcard slot 2 is where you will
actually apply that
and um do uh
the the putting put everything together
and have memory corruption
vulnerabilities in the kernel and race
conditions in the kernel and and so on
it'll be fun
um the makeup challenges there are two
um opportunities one is from 12-2
the last day of class to roughly i think
12
14 is when grades are due i have to
check maybe 12 10
um you have uh uh
makeup you know we'll leave uh makeup
open maybe to 12
9 something like that so there's a week
here for catching up after this guest
lecture
and this enter the kernel hopefully it
will be fairly
uh reduced load to allow you to catch up
awesome okay um
let's um
[Music]
roll onwards um what do we got
now we just have walkthroughs um okay
uh any questions uh before we move on to
some
walkthroughs oh uh toddler two weekend
is
finals weekend uh
toddler two weekend is finals weekend
yes
i wonder maybe we'll swap because
toddler two right now as planned
doesn't have um
uh much to do with this
with automatic vulnerabilities discover
maybe we'll swap these two around
so automatic vulnerability discovery is
the workload for the finals week
um
we'll think about it obviously we'll
keep you know
playing with this to to make it uh
reasonable for students
cool okay um
let's roll on
in the twitch making both toddlers extra
credit would be fantastic
yes but we want everyone to
force through the toddlers
yeah all right
so um let's let's roll
okay um
i think what we're gonna do is very
quickly
run through a
couple of of things that are important
for for um
number one
uh end to end to to to you to
solve it purely on the infrastructure
because when i think when i
ran through it the first time uh things
weren't working on the infrastructure
yet
and i had to copy it off um okay so
let's just do that and then we'll move
on to number four
um so um
let me go to
porn college uh
[Music]
challenges
yeah and don't forget collaboration is
open um
and and and you can ask for help etc etc
all right um
so level uh one teaching let's do level
one testing one
cool all right practice is
launched let's go
here
it's a request to show off for teaching
one
uh let's do testing one because teaching
one has a bunch of uh
extra prints and stuff that are are not
super relevant that'll make it a pain
to uh debug um
okay so ah screw it let's just let's do
testing the teaching one
all right launching teaching one
why are slides showing
twice in oh my god
obs is going insane again why is this
thing so bad
okay awesome all right so
all right we're gonna start with
teaching and then we'll quickly adapt it
to testing
so that we just have one out of the way
and there's no excuse
from anyone period to not get one
um but hopefully you understand it as
you as you get it not just
copy my script all right so here we go
uh we can launch
toddler one teaching one and it'll tell
us
give us the stack and says okay what is
your payload size we say a thousand
and we send our payload
and we just
send a lot and
we override everything with a's our
return address
is now pointing 414141 it says goodbye
and then sec falls
boom okay um one thing that that you can
observe on level one is if you
uh run um this multiple times
these addresses are the same so conor
has used insane tricks
to disable uh position independence
so the the addresses don't change
um or to disable aslr rather um
this means however that uh
running it in gdb
as a user uh
in the original sued binary
if you just run this guy and have this
suid
it will not work right um
unfortunately so please make sure for
the initial when you're developing and
debugging your expo and using gdb
make absolutely sure to copy it out
somewhere else
like in temp right so now we have in
temp
the program you can still run it but if
you look at this
we look at the two programs
when you copy it the set uid bit is lost
here this means it will no longer run as
rude this also means it won't get you
the flag but in practice mode you can
use sudo
of course and um
run as root to simulate that
okay so the goal is
we want to uh run
um uh this
um uh what what am i thinking
we want to run the binary we want to
figure out where the stack address is we
want to put our shell code on the stack
and then we want to jump to our shell
code end of story
let's do it um
i python import phone
ah i don't have to say my python
config
uh
let's um instead of running everything
as root
let's make the flag world readable
for practice so this is my practice flag
it is now no longer
only readable by root it's also readable
by um the world
so i can read it hit up ipython now i'm
i have my config awesome
my for my config i have uh
ipython reconfigure to use vi team
binding so i can write multi-line
scripts
reasonably all right um
so there's a suggestion uh to you to run
the program and then using
use gdb attach right um
to
[Music]
figure the program out
yeah so okay anyways um let's let's just
start in
import pwn let's just get a simple thing
that
gets us a crash right we launch
just an intent for now
okay um
and uh we will
clean that will just whatever it
initially sends us we'll discard
we'll send line 1000
and we will clean again send line
a times a thousand uh
bytes and then we will um
wait or let's just read all
and then we'll assert that it
sac falls and it does success
okay um
very cool so now we are uh basically uh
this is just a simple
uh example to to to read it all right so
now we have to determine
um the distance to
from where our input is to where we sac
fault
right um how do we do that
we can uh
just run the the the code
and let it core dump and then
read the core file this is problematic
to rely on because a said uid program
won't necessarily core dump
right
so um
normally speaking if oh first of all
there are two
two problems first of all said uid
programs won't core dump
second of all um
[Music]
um sorry the caffeine is not
hitting as as it should
um second of all normally
when you run things multiple times of
course everything will get re-randomized
right if you for example if if i run
if i run
how did we have problems with the
re-randomization with gdb
right if the reason i copied it out is
if you run it
things with gdb on the set uid binary
no kind of kind connor what what was the
reason we
were telling everyone to copy it out
away
yeah that's right for the dumb
okay that's right that's right all right
the the the crazy reason
so being able
to disable aslr normally of course on a
normal program
like level two these addresses will
change every time you run it
in order to disable it we have to do
insane things the insane thing that we
did
was um again
i apologize for the repetition if you
remember this
that's my
uh
let me log into that okay
um the insane thing that we did was
injecting a constructor that runs at the
beginning
of execution
that and it's this disable aslr function
if you look at it in decompilation it
does
insane stuff that insane stuff involves
creating a memory mapped
executable and um
exacting that uh
memory mapped executable so that we're
now executing a program
that is not set uid so that we can
actually
disable the uh um
aslr uh
this is required because um
we uh of course want to
give you an easier first challenge for
um uh
toddler one um unfortunately it
makes things very difficult for uh gdb
and so on um
for example if we run gdb on this
toddler one
thanks and we do break in main and then
we run
it fails because it starts out
randomized
then it re-executes itself
non-randomized
here executing new program slash mfd
that's connor's crazy trick and and then
gdp gets confused
however this happens because gdp can't
disable randomization for
said uid binaries and so connor's pro
code
will check for that right here
and then try to disable it itself and
confuse gdb if you copy things out
so they're no longer set uid it can
disable randomization
and all is good so if you've been having
okay
so conor is telling me that there's a
way in gdb
to tell it
um to tell it to launch the the process
in a special way
so that we don't need
no i don't think so
okay so conor is going to uh
look into this there might be another
solution than copying it out anyways
so in this specific challenge and we'll
um
going forward now that this is helpful
for you going forward we'll put a lot of
very loud print statements at the
beginning to uh
draw people's attention to this okay so
toddler one level one teaching one the
the copied out
version we will run it
first let's do this let's import
the os module remove the core file
and then we will assert
that this thing dropped the core file
okay great so now it drops a core file
we can open that core file
um to uh um
to um see what happened of course a core
file
is
oops wrong way
the core file will let us look around at
the exact moment the program
crashed so it crashed in here and this
uh
um in this instruction which is a rat
and it crashed on the stack which is
returning now to overflow data
so we can um
uh
we can read
the next eight bytes from the stack
pointer in the core dump
and we can assert that this
is eight a's and that also passes
amazing okay cool so now we can run
this exact thing
um and we can uh instead use a cyclic
pattern to figure out
the distance to
um the stack right so here we do
pawn.cyclic
do a thousand bytes eight bytes at a
time
and now when we load the resulting we
assert make sure that it's still crashed
when we load the resulting
core file um you can see where the
default happened um we can print
uh core dumped
or returned
address at let's let's retrieve that
um see that stack from c dot sp to c dot
s
b plus eight
okay and uh
[Music]
put red adder here and then um
so you see it crashed that paw
which i'm guessing is uh
20 or so bites in um
or 20 or so uh keywords eight byte um
chunks inwards and actually let's let's
see
um distance two
red adder
equals c uh pawn
dot cyclic find of
red adder right
okay boom there we go um someone's
saying their assertion
negative 11 always fails is this
challenge
running in practice or in real mode this
challenge is running in
practice mode
but it shouldn't matter
in fact if we log out let me just make
sure that
this exists okay log out the nice thing
of course the home directory
persists so if i relaunch the challenge
in real mode
that's what i just did
okay now ssh back in
copy the toddler to temp
run i python rerun this
it all still works right so your
assertion negative 11
should absolutely work if not um
you are not crashing the process and
something is is going wrong
um okay so um
we uh have um
now the distance to the return address
right so the the distance is going to be
different for people's different
binaries but a lot of the time
if you look at it you and you can look
at it in
um gydra and you can figure or in binary
ninja or an id or whatever
and you can figure out what is the how
big is the stack where does the overflow
start or you can do it dynamically like
this
whether in gdb or just in pawn tools
if you have access to that core dump to
figure it out it's very very
very useful okay so
um here this is just making sure we can
crash the process
let me comment this make sure we can
crash
the process whoa what's going on
and then here we say make sure
figure out buffer size
before return address
and now let's uh make sure we can
control return address
okay
and we will do that by
doing all of this again but at the end
here what we'll send is a bunch of a's
up until the return address
followed by a bunch of b's
all right we'll make sure that it's set
faulted and then we'll read the return
address and we'll make sure that the
return address
is a bunch of b's
oops what did i do
you cannot multiply sequence of non-end
by non-end of type bytes
oh sorry the distance to return address
not written address
it didn't crash that is
interesting in fact it starts with exit
zero all right
so something went wrong
first thing we can do is just try to
print what it read at the end
um and that is the testing output so
the save return address is pointing to
so we didn't overwrite it that's
unfortunate
um
what if we
add another eight bytes
still didn't crash okay and what was the
distance
distance was 60
seems reasonable ah
i know the problem okay so what is the
problem here
no i don't know the problem
well let's um run this in gdb
instead of in um
outside of gdb so of course one way to
run this in gdb
is you can do pawn.gdb.debug
to launch it in gdb
let me configure real quick my
bandit that's another class
um
that's gonna be annoying okay
there's a number of reasons one uh that
we don't wanna do this one is
it's annoying because i this is actually
why i used my machine initially the
other one is
running things in gdb um
will
[Music]
modify the environment slightly gdb set
some environment variables which
since they live on the stack
will uh
um
sorry my mind one blank since they live
on the stack they will
uh change the stack layout so
we can run process and then we can run
um g equals pawn.gdb.attach
let's give it a try
it still uses the same the same thing
okay hold on i have to reconnect
instead of running screen
on my machine i will run screen
inside the container which probably is
what i should have been doing and then
i can create this binary to
run
pawn tools properly okay
uh questions on uh could you also use
phone debug to find the stack and return
addresses yeah
absolutely um this is just one way of
doing it all right
so um let's run a screen session
why why is
hold on let me
copy my screen rc which is amazing
csc first point college
okay
oh oh
connor why does this why is my shell by
default not bash
so it doesn't matter let's let's move on
um
okay bash um
we'll okay i've been
okay so this will let pawn tools
create a
awesome all right so here we are so what
we did was
we attached in pawn tools
to uh um gdb
actually i think that file was
irrelevant because i just realized it
probably isn't even in my path
so is it in my path
yeah it's not in my path so forget about
all of that that script whatever
if you're on screen pawn tools is just
intelligent and does the right thing and
probably whatever i did was
irrelevant and that's correct here it is
all right
so um what the script did of course
was um create a process
and then attach to that process with gdb
so why is this great this is great
because
um um
we start the process without gdb
everything is perfectly normal
and and and uh completely the same as if
you're starting the process
normally because that's what we did and
then we attached to it with a debugger
you can do the same thing in gdb with
the attach command
but this did it for us so now we can
disassemble
the volume function and we can break
at here
at the red and we hit continue now we're
at the rat
um here
let's see what's going on we didn't
rewrite
anything we didn't rewrite that
then we write this
so let's
uh let's go 80 back
so we rewrote very little okay
minus 80 minus
160. we wrote very very few things
okay so now what's going on um
now we just quit and stare at our
solution for a second
all right so this reassert
is correct this
we get the return address we
do the cyclic find cyclic find
fi returns the the bytes
into the cyclic function
or the bytes into the cyclic input
and then it doesn't crash
i mean it's it's it's way off even if
you do times two it's
no then it crashes
times two it makes it completely correct
oh did anyone else spot the bug
no one else spotted the bug come on lead
hackers
why is this times two why does that make
it work perfectly
right keep in mind i mean it it it makes
it perfectly aligned
this return address is b b b b b b
y times two somebody said
connor do you know
connor connor's we're looking at
advanced gdp usage okay
this here i i always
on 64-bit systems i generate a cyclic
pattern
that is eight bytes at a time so that i
can
uh query eight bytes of it without
causing a crash in
pawn tools i forgot to do this and it
queried it
as if it was a four byte cyclic pattern
and of course that returned um
that cyclic pattern is very different
and it returned um
it was it cleared the wrong cichlid
pattern this will work
right so oops that's the wrong one here
is
the gdb session now we have the sec
fault
and all is good so to summarize i ran
into issues
and all i did was this i added p dot gdp
that upon that gdp that attach
boom it worked okay or sorry it didn't
work but it
let me get to the bottom what's going on
so now we of control the instruction
pointer
now where do we want to put the
instruction pointer
well that is um very easy to answer we
want to put the instruction pointer
into uh
[Music]
to point to our shell code where's our
shelter well we haven't injected it yet
there are two ways to inject shell code
one way
is to inject it to go right after your
stack all right right after you override
the stack
the other way like in the buffer that
you write
the other way is um you can
uh load it into the environment by
having it in a global variable
we're gonna do that because it's a
little uh easier right
um uh just just to to write up
uh there are some problems with with
this method for example if you're
connecting over a network you can't set
global uh
environment variables
but if you're not it you can do it
so you'll do
shell code and your initial shell code
when you're just trying to get shellcode
execution
should just be a bunch of
c's what does this do this will trigger
a break point this is the breakpoint
instruction
int interrupt three um this is how gdb
does break points in many cases um so if
you're just gonna put
let's say 128 bytes of of um
of breakpoint instructions
and you can pass this in
of when you launch a process
so this this next thing is going to be
what the
okay
this next thing is going to be where we
exploit everything
and first we're going to still do this
on the temp one um
but we can pass this in as m equals and
then
give it a dictionary and we'll put the
shell code variable as our shell code
and this will end up
in the uh on the stack where the
environments
variables are at the very right side of
the stack and we'll be able to jump
there
now what is the problem here the problem
here
is this adding um
this into the environment will shift the
stack and i'm going to make
the information we got before no longer
valid so we should actually add it
whenever we launch the program to keep
things
consistent here we go
okay and now we actually want to
get the address of the shell code
so when we load our core file
i don't know this comment is useless
shellcode address is
um c dot stack uh
let's let's say that
index of i
i hopefully this will work that's our
environment variable
shellcode equals and
um insert
that shellcode address
this is shellcode index
from our stack pointer
we assert that the shotcode index isn't
negative one
that means it wasn't found and then um
actually let's let's delete this for now
what i mean elf error
that's uh just
do that okay eof error on
line 16
here
why because it can't
take the shell code as an environment
because this is the only thing that
changed
yeah that causes it to die
why does this cause it to die i mean
let's let's see
um
it all looks normal and these live demos
are disastrous always
every time
here the cent line 1000
yeah the shell current environment
caused it to crash
oh hold on maybe i need to
some maybe this no no
what about this this will probably
break no
i have a feeling that it has nothing to
do with what is actually
with the shell code it's just passing in
any argument
why why does this never this is why we
can't have good things
just passing in an environment
kills it
hmm
let's try disabling aslr yes it still
crashes
that disable slar equals false would of
course disable the slr from the get go
so that the program doesn't re-execute
itself without aslr
but it doesn't work for said uid
binaries anyways
this is an unexpected hurdle
um what if we
what if we just os that environ
shell code equals shellcode
it expects a string
oh here this this this dies
ah
i
i think i know what's going on
i think i know what's going on this
makes an empty environment with only the
shellcode variable
so what's happening is when we say we're
going to send a thousand
bytes uh there aren't enough bytes on
the stack
and shouldn't it shouldn't die but for
whatever reason it does
die
yeah we haven't even said a thousand
days but let's try let's try 128.
see now it doesn't die
uh connor says in my ear that he thinks
that going
off of the stack riding way too far
will um get to a point where the kernel
will um
kill the process it's it's still
confusing that phone tools fails where
when it does because it fails on this uh
send line
of of uh where was she
it was fair oh no it's failing at the
sound of the cyclic pattern yeah so that
makes sense
so be careful how much you write all
right
there we go perfect so we found
this assert actually passed so now we
can say
shellcode is d away
let's do x away from the stack pointer
and that x is
shellcode index okay
2bb that's great
uh that looks better
actually you can also do a quick format
string
pack that hash will do that
automatically okay anyways cool
so um now we um know where the shell
code address is
is um c.s.p plus
shell code index
and we're going to redirect there
so now this is going to be ultimate
pwnage
remember our shell code at this point is
still
all what's it called
our shell code at this point is all
breakpoints
so what is going to happen here we do
this and then here
we will send um
a packed version of course in bytes of
shellcode address
we will wait for um the output let's
turn off this print let's actually turn
off
uh different um let's assert
that
it actually hits a uh
break point which will cause a sig trap
to be fired
which is um signal five
okay run through it worked
sick trap how cool is that okay
um so
uh that means we are executing our shell
code this
means a couple of things one if you're
having trouble with your shell code and
you put a breakpoint in it
you can do this you can say pwn.gdb
dot attach to p
and when this happens you will actually
watch this okay now we restart we hit
continue
boom sick trap where in our shell code
if you're having shellcode trouble
do this insert in three i got
99 problems but shellcode's not one
okay this is the way the best way to
debug your shell code insert on
on at the top of it
at the beginning of that these cc's and
you're golden
cool okay oh my god
pawn tools can't keep up or not pawn
tools um
uh ipython isn't built for these
gigantic uh
single scripts okay anyways so now we're
basically there now we just need a shell
code
um that uh
that that works and we're good so how do
you
make shell code that works um there are
several different ways that you can do
it um
one way is shell craft i guarantee you
with shellcraft you will end up
suffering in this case
so i would actually recommend just
building your own shell code
at some point shellcraft is going to um
not be enough in this assignment
however for the interest of time you're
going to try shellcraft here
so we're going to comment this oh my god
we're going to comment this out i'm
gonna do
wow this thing is going insane uh
how can we keep it from being insane
there's no way it's just it's just
okay i think we've reached we've reached
the end
of what ipython can give us we're going
to
run this guy one more time kill it
history okay history to
x dot pi awesome now we're going to
have our x dot pie
what
the this should write me an extra
pie with my history right
there history dash f
there we go okay here we go
um now i transitioned
smoothly from the um um
from my python to a script that i can
just run
very cool stuff so now here we'll do
instead of this shell code
we're going to do pwn.shellcraft
dot read file slash flag
okay um and in order to do that we have
to tell pawn tools what our
um what we're
running on and so we say contacts.arch
x86 64.
okay
hey python uh sorry
ipython.pdb is an awesome option that
will drop you to a debugger if something
crashes
x dot pi uh we need to disable all of
these uh
gdp guys
yeah something crashed ah yeah okay
so x dot pi disable the gdb
we don't need it right now this is no
longer going to be a negative five
um
let's see if we can do this we're going
to do pawn shot
send fly a read file and then dot
shellcraft
dot exit one two three uh forty two
this should work right connor
not a massive shellcraft user
no it's check faults all right i don't
know it doesn't matter
all right so let's uh let's
just print out the result
we run
and uh there's a
missing colon
boom says goodbye and then nothing
happens why did nothing happen well one
reason that nothing happened
is the flag is read only
and then the um toddler one teaching one
is not set uid that's
exactly the point so what if we change
it to the set uid binary
we run
nothing happens okay so now
oh connor mentions that my read file
flag
one it needs an output file descriptor
on where to read it
it's not out as standard out by default
no that was the wrong
all right so now it doesn't work typical
thing when you are
when you're using shellcode that is not
your own now you don't know if it was
the shellcode is the problem
or what so now we of course say all
right
no problem we'll put a breakpoint at the
beginning of it
run it
and now we should first assert
that the breakpoint was triggered
and it was not even triggered
let's actually
put back the uh file
that's surprising it's not even
triggered in the original file
all right we'll um
again feed that gdp that attach
tone that ggb.attach
okay
continue here okay um let's see where
we're crashing
all right we're crashing part way to our
break point
all right sorry part way through our
shell code it looks like
i mean that what the
no sorry okay so we're here
you're right at the end of the stack
yeah right at the end of the stack
it looks like this looks like could be
shell code
um but what we're looking for is i think
the shell code equals and that's
probably this guy
i i have a couple of of ideas
okay first of all what might um
be messing with the stack um
i think there are there are a couple of
issues one is
when we change the file name to point to
the original
the file name is a different length the
file name shows up in arc v1
rv 0 on the stack and that's going to
up the stack alignment
so one way to do it is create a sim link
called target and we'll just change
where the sim link points
so on the stack there will be target
instead of
um or dot slash target
then we'll point that sim link
so that'll be one thing the other thing
i think is happening is almost certainly
this has no bytes in it let's add an
assert because there can't be no bytes
on the environment that's one
downside um
to uh using um no
pawn tools should start out but we'll
just okay
then we have our dot slash target
dot slash target alright so now we have
a target file
exit out of this
um we'll uh
but now this is annoying
so we will
in our script manage the target file
remove it if it exists and here
we do sim link uh
i forget our order for yeah oh source
and dest okay
um so source is dot slash target
and destination is well you know the
destination
is it the same as in uh
i think it's backwards right so it's
going to be
target and it'll point to slash tab
slash
toddler one level one
teaching one
and we'll do all the same stuff here
uh no here we will
re-direct it to
the real target
okay
let's run it
no crosstalk around
why didn't that accept out
okay so now we create a target to our
copy and slash temp and a target to our
um
normal one
the
oh
okay this should work
there is a freaking target
i misspelled toddler
okay i think we're massively
overcomplicating this
okay here we go
the oh yes
now we're trying to attach to a uh
a uh privileged process
what the hell's going on okay
okay so that didn't work what if we
create again shell code with just a
bunch of knobs
that worked so what's probably happening
is is actually extremely straightforward
and i'll tell you exit
what's probably happening is when we
when we look for the index of our shell
code we look for shell code equals
and then we point our freaking uh return
address there we're executing
um shellcode equals in
as shellcode that is not valid i mean
that
that is probably some valid shellcode
but it probably screws up
um anything for our actual shellcode to
run so we actually need to do is also
skip to the end of this string
so that it doesn't break our shell code
okay now we run this
okay that's great let's make sure that
it is exact
let's have our shell code oh okay it is
exact
um let's just change this
and i guarantee you that it'll work or
i'll scream
ha ha it worked so it worked and i
screened
so here is um our flag for
uh baby one fully automated fully
functional solution let's go through it
one by one
um for toddler one sorry level one all
right first things first
we import the modules we need we're
gonna use os
to delete and symlink files and we're
going to use
pwn of pawn tools um obviously
we create our shell code um
we set x86 64-bit
and we create shell code using
pull tools built-in shell code
generation that'll just read the flag to
file descriptor one
again this will only get you so far on
this assignment but so far is actually
going to be
fairly far
so you can use this my strong advice is
the moment you run into issues
with and you're sure that it's the shell
code in pawn tools so
the way to make sure is to put in a
break point here
and then uh step through it
rather than debugging pawn tool
shellcode just just putting your own in
there
um make sure that if you're using the
environment method your shellcode has no
nullbytes
all right then we delete
and and and create um a simlink
um to the non
sued version the reason we do this
is for the core dumps so that it if a
sewer process will not
dump a core why is this it makes sense
because
these core doms have tons of secrets if
a set uid
process dumped a core it would spill all
its secrets out
that's no good okay cool so then
um make sure to that that the process
can even crash
what we do we uh say okay we're gonna
send 128 bytes
we send the bytes we make sure that the
process set faulted and of course we
have to wait until it terminates so read
all will luckily wait until it
terminates um and then we make sure that
um the core file exists so that it
dumped a core
we open up the core file and we make
sure that we overload the return address
with
all a's to make sure that our
assumptions about how to crash the
program
and what we overwrite the problem with
makes sense then we figure out
how far we have to write before we hit
the shell code we do the all the same
thing
and of course we start this pro program
every time
with the environment variable properly
set
because changing the environment
variables will change the environment
portion of the stack which will change
the stack or how much of the stacked
environment takes up
which will change the offset potentially
as stack
the stack is aligned you want to be very
careful with that
um so always try to be as consistent as
possible in fact that's why we do the
this sim link insanity so that our file
name our v0 can always be the same
um cool so um
uh back to figuring out the return
address we send a cyclic pattern
and then we open up the core and we look
at the return address and we actually
see where in the cyclic pattern it is
make sure in the cyclic pattern
to use the step of the cyclic pattern to
have it
use a consistent step we ran into a bug
because that
by default is four and i didn't specify
that as eight and so i was off by a
factor of two
okay then we make sure that we can
control
the return address right so we send a's
right up to the return address and then
we send b's
okay um the return address of course uh
knowing
we just figured out how far it is to the
return address
by using our cichlid pattern and so in
the new process
we now figure out how far it is and then
we send b's
okay now um the uh
uh also in the same uh so
oh we didn't i deleted this assert
somewhere so at some point so we
assert that the red adder is a bunch of
b's times eight let's make sure that
this runs
oh sorry i should remove this bowl okay
awesome okay so uh we make sure that it
okay so so we make sure that the return
address can be successfully controlled
with a bunch of b's and then
while we're at it we check okay where is
our shell code located
so what we do we look at the stack
starting from the stack pointer onwards
and we find the index of the shell
coding as a shellcode variable
and then we make sure that the shellcode
index is not negative one that it was
found and then we just calculated the
shellcode address off of that
by by taking the stack pointer adding
the index of the shellcode equals
shellcode variable and adding the length
of shellcode equals because we don't
want to execute that that cost us 20
minutes because we are executing
some freaking text inside of our shell
code then we remove the sim link and
re-target that sim link
to the actual target we want to exploit
the set uid binary
we send the padding and
the shell code address of course the
shell code is in our environment
and it works that is now our script for
level one this will solve
every single level one binary please
understand the script so you can then
move on to level two
understand that the difference between
level one and level two
is that level two um actually randomizes
of course by the way get your own flag
here don't submit my flag that will flag
you for cheating and
we will have to throw you in jail
all right um level two so this by the
way will also work for level one
testing one let me show you that to uh
you know convince you um we didn't
actually use any of the the testing is
is good for
you know while you're um debugging and
so forth right
um
so now we're in in testing
uh and we
damn it now we're in testing and
um i can pi x that pi
oh you're right um so when you're
dealing with sim links
things can be very confusing because
target does exist
but as conor said this guy doesn't exist
and actually it shouldn't be teaching
one
so let's just uh x that by
here we go this should be testing
uh
okay
oh and i still didn't copy it into temp
okay boom
it works just with less debug output of
course again
please don't submit this flag you'll
have to bust you for cheating and send
you off to jail
all right um
so this this solves uh
level one now what about level two
god damn it where's my there we go okay
what about level two
let's launch up level two and i'll show
you why it won't solve level two
let's run into practice one
okay and level two
if i run it multiple times you can see
those stack addresses changing every
single time
boom that is bad news because of course
we rely
on multiple executions um
having the same stack address so conor
went through
um level two right connor in his office
hours on friday
um it is the same exact uh
trick as the trick and i don't remember
level seven or eight of uh baby men
um or i don't don't quote me on the
number there's also a baby mem
that at some point turns aslr or makes
aslr relevant doesn't actually leak you
the address
uh when you start it up of course for
the teaching one
obviously the teaching program is giving
you the address you can actually
read out this address from the output
parser convert it into an address and
and use it
right you know at all times like where
the return address is based on that
you can calculate the shell code just
like we did in our x dot pi
but in in the real in the testing
don't rely on that because in the
testing if we
launch up the testing
it's not going to give you the address
right you're screwed
so you need to figure out how to get the
address
look at connor's
office hours
um question on twitch theoretically
could you run the same script you use
um on uh testing one a thousand
ten thousand times until the addresses
are the same for level two
uh theoretically yes but it's way more
than ten thousand times
on 64-bit architectures it's going to be
quite a lot i think there is
um well let's take a look
just as a on a quick uh
quick look uh let's launch up
teaching one again on 32-bit
architecture
yes absolutely and there are other
tricks you could do but these are all
obsolete now
because we're not a 32-bit anymore
um on 64-bit i think there's enough
entropy
um so if you look at just what changed
so basically everything from
the last bit or so of this guy
to the first bit or so of this guy
well just the first bit specifically
this guy will change
that is one two three four five
six seven nibbles so that is 28 bytes
so the highest limit on
how many times you have to run it is
this two
two three one two three 268 million
times
still not impossible um
but you better be sure that your
solution is correct but yes
it's not impossible but um
yeah um but it is possible yeah
so um and connor actually said to oh
okay connor answered the question right
there so i should have just read further
on all right scrolling upwards
let's see if i missed anything uh
oh someone recognized me as working on
anger yes
i'm one of the uh co-founders of the
anger project we're still
uh pushing it forward at asu if you're
interested
in working on research such as anger
shoot me an email
um we'll figure out how to get you
involved
um
oh someone uh said something very clever
said um that there they couldn't get the
read to work
so instead of the read they just changed
the permission on the file
to make it
readable so let me let me show you what
that means
let's launch up
level one again
okay um
what am i doing
over here comment out this shell
code and create different shell code
chmod
slash flag 644
this is octal 644
hopefully this works one shot so before
i run the shell code
the flag is not readable i run the shell
code
oh oops oh oh
644 octal 644
[Music]
similar thing
okay it ran
[Music]
flag is now world readable boom
might be a much easier shell code by the
way
in general then open and send file or
open read write again
don't submit this flag the system will
mark you as
cheating okay let's see
all right i think yeah then i'm caught
up
okay um cool
let's see uh someone asked can we talk
about the later levels
yes let's do this let's take a break
here
we're going to take an eight minute
break come back at 6
30 arizona time um
in eight minutes uh mrs john demands
that i give you
all a break part way through i will turn
on
the matrix for you to uh enjoy
and then we'll be back in eight minutes
and we're gonna i'm not gonna do two or
three if you've done two or three in
all-stars go back
read look at the all-stars connor's done
three two i've done three
i'm gonna do four awesome good luck
oh i mean good luck have fun on the
break i'll see you in
eight minutes
wait hold on i just caught up on twitch
someone wants the bottom of the
python yes i can i can do the bottom of
the python
there you go while you wait have the
bottom of the python
all right i'll be back enjoy my empty
room
all right we're back
[Music]
catching up on twitch catching up on
zoom
awesome um
there's some discussion on twitch that
running the script um 230 million times
wouldn't work
because we used
information from multiple runs the only
thing if you look at the last run
that we use from any previous run is the
shell code address
and the distance so it's possible that
the distance could change but unlikely
the shellcode address will change um
actually the distance might change
i'm trying to remember what the latest
uh i think we might have run into this
problem
at some point um there is some uh
randomization
in in in within the stack now
i think um but
modulo that the only thing that you
use is the shellcode address um
so that this is the only thing you need
to brute force and only at the last
stage
[Music]
someone's asking me why tea over coffee
i drink coffee socially
which means they're drink coffee
i like a good cappuccino in a coffee
shop
specifically in a coffee shop because a
coffee shop is this
amazing like magical
can sit down sip your cappuccino
very specific you know type of
cappuccino have a
very specific order you know you can you
can feel the atmosphere of the coffee
shop
without that coffee just doesn't
feel good you know coffee is a
philosophical experience for me
whereas tea is something that i can make
i make
good tea
you know not that they're not paying me
to say this but
if we go to the new mexico tea company
um
that that is my my tea supplier
very good tea from the new mexico tea
company
you can tell them i sent you i don't
know how but uh they have a lot of
great teas i can recommend i have a
whole tea schedule
um
i'll address some comments in the in the
twitch in a second
i have a whole t schedule all right
between the hours of 8 am and 12 pm or
my first cup of the day all right hold
on these soviet leaders
on the top left are starting to really
annoy me
even though i removed them but obs
stopped synchronizing to my
freaking come on obs
all right there we go no more soviet
leaders back to capitalism okay um
um
all right between the hours of 8 a.m and
and 12 p.m or my first cup of the day
if i wake up after noon which is is not
so rare
although most of the time i had to wake
up earlier for meetings is scottish
breakfast
an awesome tea um very uh
it's a breakfasty very strong um
just a tiny hint of bitterness uh but
but
a good depth um not too fruity
right then uh i wake up then uh between
the hours of noon
and 4 p.m um i i
vary things i used to drink this tea
uh this ceylon uh very very good good
tea but
unfortunately it's been sold out for
months probably due to covet
so i've been recently drinking this
kenyan uh lalsa
um incredibly rich
very easy incredibly strong very easy
to make it over bitter take some
some careful calibration but it works
it's very good
um between hours of 4 p.m and 8 p.m
i drink uh what i used to drink
always which is russian caravan
highly recommended team reminds me of my
childhood
um very very smoky um
uh it's it's it's uh it's rich it is
a very um long leaf tea it's not very
broken up so
you have to be careful otherwise if you
just take a tea cup and and get a tea
cup of that it'll be too weak
um but very smoky rich tea with with uh
moderate bitterness and then
um the evening between the hours of
eight and midnight
um which is actually usually not
really late in the evening for me i
drink um
i follow jean-luc picard and i drink
uh earl grey which is not technically a
pure tea
there i drink earl grey it's very good
old grape so anyways highly recommend
these guys
um question on how i brew my
key i have a
i um way back when i bought a
tivana tea strainer i don't think tivana
even exists anymore
but this is the exact guy i have
user views 3.0
what the look at this review
it's perfect three stars what does it
have to do to give you
anyways it's a great thing i really
like it but you can get
an equivalent of it um and so i don't
use tea bags
um you can uh usually you can get
these in bags from new mexico tea
company but their bag machine broke
but you can buy tea bags from them too
all right
we have a request on zoom to stop
talking about t and move the on to
um
the challenges so
let's talk about yon85 um
all right um yan85
is a virtual machine i'm i'm not going
to talk about yan85
uh in the general sense because
that is uh a baby rab topic
um if you're interested in or well you
should be you need to be able to reverse
engineer and understand yan85
if you go to youtube.com channel porn
college
that's a 404. if you go to youtube.com
channel
pawn.college
[Music]
well connor hack that is just
youtube.com phonecollege
boom you go to playlist
you go to asu reacts to yon85 and there
are
two why is there only one i added connor
could you
go in and like un
unscrew whatever i screwed up and add
the other walkthrough
okay there are gonna be two walkthroughs
in this uh in this
um uh playlist
from um one from uh
uh freak mod here
um and uh one from one of my grad
students so someone in the class i will
not
in the class go all the way through that
listen to it it's it's a total uh this
one is a
condensed one hour and fifteen minute
version the other one that's gonna
pop up that it's on the channel already
it's not like private or anything so
just for some reason not in this uh
um not in in this uh
yeah right here uh it's five and a half
hours so plenty of content
um this five and a half hour one also
has time stamps
of all of the different um
um uh op code
here so on on zoom we have a question
about
stack and stk and stm
sdk is at one minute
and uh 11 seconds or one hour and 11
minutes
um and st
k is at 1 hour and 36 minutes so
if you're confused about sdk and sem
this is the the thing to see okay
so
i'm going to do a
um quick dive into level four
assuming that you have some knowledge of
yan85 again if you
if you're on 85 the the emulator
is a complete mystery to you go back and
look at
at this asu reacts
playlist
wow so
let's um let's take a look go
here level um level four
is where yon85 starts out
we got 24 awesome hackers who have
solved it
but let's let's get these numbers up all
right back to the challenge
let's go to uh launch it in practice
mode
launch it in binary ninja
[Music]
go to maine let's just look at it at a
high level
get an idea what's going on so it says
okay
it says welcome to this challenge you
have to i mean we can run it and see
what this says but it basically says
welcome to yan85
and then
i mean let's just run i didn't see what
it says rather than reverse engineer the
strings
connor could you say something i think
i'm having audio issues
yeah i'm having audio issues
connor can try saying something now okay
perfect
okay awesome um
so um
be logged in we are in level four
teaching one we launched level four
teaching one
all right this is uh the same
um you know
output from uh baby uh
red this this is the new stuff
so all right sorry this is new stuff
so okay by the way this challenge
doesn't allow you to call open via the
sis instruction
so if you have gone and solved level 16
of baby rev you will need to write
what people have been calling yon code
which is awesome
to um call to open syscall
i would say go back and and and um
solve 16 um to
at least understand why this is harder
right normally
you can write yawn code to just open the
flag file read it and write it
right but this challenge disables
the open syscall let's take a look in
binary ninja if we go to uh
interpret cis when we run this
wow that's ugly okay when we uh run
and we look at where the open syscall is
where it should be
all it does is say nope just allows this
call and it calls crash
and crash prints stuff
crash print stuff and then calls exit
cool
so
we can't open the flag
and that makes sense because the um
um this challenge is all about
this module is all about combining
reverse engineering which is how you
understand
yan85 um and specifically i want you to
understand the emulator
not necessarily the language but but you
know you have to reverse engineer it to
find the bug
and you have to use the memory or bug
exploit that
to hijack control flow into your shell
code
right the jail in this case is inside
the emulator
it's not letting you use open so you
have to exploit it
cool
so what can we do we can of course um
write
yon code to um
execute any of these instructions even
if you can't
you know do open with this guy we can
load immediate into the yan85 registers
we can add them together we can
push and pop them to and from the stack
we can
interpret uh or sorry we can store them
into memory
we can load them into registers we can
compare them we can conditionally jump
and we can launch those calls
um the
the key thing
here is to figure out
one where can you put in your shell code
and two how can you hijack control flow
right so let's let's tackle where can
you put in your shell code first
um we do chuck sec
toddler one and it tells us
that nx is disabled that's great
that is actually makes this much much
easier right with that x disabled
we um don't have to worry about
uh a non-executable stack so we can put
our shell code on the stack
this makes it much much easier um
how do we put our shell code on the
stack well it turns out
if we break at
this function called write register
right and we see
again it's hard to explain this uh
challenge
fully without going all the way into
yan85 which is
an hour and a half long video which i
suggest you write
uh you you watch sorry but basically the
right register instruction is called
by for example this um
uh by interpret immediate interpreter
media calls right register based on
the register and the immediate that you
provide
and write register based on the register
that you select
so um this is hexadecimal 2 is a
register code
and if it is hexadecimal 2 um
yeah if it is hexadecimal two it'll
execute this code
and it'll write
a byte into some buffer offset from rax
if you look where rex is rax goes from
israel from rbp minus eight it's a
pointer here
that's var ten if you look at where
var10 is set
it's right here part 10 is set from rdi
so it's the first argument to write
register
is a data structure in which one of the
um
elements is a register
right in the same way if you look at
write memory
much simpler actually i should have just
shown you this
in the first place right memory at some
point writes a byte
um to some
uh regis some some
base address plus some offset plus
some fixed um offset usually when you
see this sort of pattern
usually this is the address of an object
this is an index of a buffer
in that object so that object has a uh
so it's a structure a c struct that has
an element
that is a buffer like a char you know
10 24 or whatever char 256 um
and then this is the index into that
character array
um so let's take a look our our ax
comes from our axis it comes from ea
except must be yeah we should okay so
eax
comes from this var14 var 14 comes from
dl dl is
the lower uh byte of edx
edx come from ecx ecx comes from esi
esi is the lower 32 bits of rsi which is
the second argument to the function so
the second argument to write memory
ends up making its way
all the way down and actually this
probably looks okay if we
just decompile it yeah super sim
well uh
the second argument this rex 2
ends up making its way from the second
argument in the function so this is
conceptually you have three arguments
the first argument seems to be
the address of the structure
the second argument is an offset into
that structure offset by this so this is
the structure that contains
memory this is the offset of memory in
that structure and this is the index in
memory where you're writing
and this is what you are writing right
cool um
you're right on twitch that is a sock in
the door
i apologize
there not now you don't have to worry
about my sock
that's gonna be a meme later all right
anyways um
so
right memory takes three arguments one
is a structure
that structure is offset to get the
memory uh region
of yan85 memory second argument
is the address in that memory region and
the third argument is
what you write okay
so let's see where that is called go to
main
um or right let's trace it back
right memory is called from a few places
one of them is stm this is the store
memory instruction
it calls right memory first argument is
arg one argument is the first argument
to
interpret stm so it's just pass all the
way through
this is actually very common with uh
like a state
structure that's passed all around the
program or
in object-oriented code the uh object
whose method you're calling usually ends
up a pointer that object usually ends up
in
um rdi which is the first argument all
right so that's
interrupt stm who calls interpreter stm
over here we see
um who calls it and it is interpret
instruction
interpreter instruction has this big
check on which instruction is uh is
being called and then it calls
interpret the various instructions
server sdm takes arg1
here arg1 is the first argument to
interpret instruction who calls
interpreter instructions while
interpreter
loop calls interpret instruction in a in
a loop
um and uh
it calls it right here our one is passed
again
from the arg one that it itself is
called
who cause interpreter loop main calls
interpreter loop we finally made it all
the way back to main
and we can see where interpreter loop is
called interpreter loop is called with
one argument that's the argument we're
interested in arc one
it is a pointer to what var 418
var 418 is
previously used as the argument to read
which evidently
is where your yawn code is read to so
your yawn code
is read to the stack and is then passed
to this interpreter loop you read ox
2fd bytes of yarn code
or you're able to write 2x 2fd bytes of
yawn code
and this constant sounds familiar
because
if you look at right memory
here it is again in when when you're
handling the stm instruction which is
storm memory it takes the the
state that's arg1
that you passed all the way in from main
and in main
you um read you you
you can set the first uh hex 2fd
instructions in store stm or
in in write memory that's called by
interpret stm
and and interpret sdk for push
and or for store and push you can write
after that
conceptually you have your vm state
and in your vm state you have uh
hex 2fd bytes of
code and then the rest is memory
right or amount after that is memory why
hex2fd let's take a look
my python hex2fd
is 765.
that's interesting 765
is um
every instruction is three bytes there's
that operator
operand operand so divided by three
255 instructions
sounds like someone playing it safe and
having a buffer of 256 and reading one
last bite for some reason
all right cool
um so
uh where were we
right so now we have a vague idea of
what right memory does it writes to this
memory region which is
hex 2fd into our vm state which is
pointed to by ag one
but in main we can see that it is
actually on the stack
and if we go um
promise to write uh the yan code i
actually have to reverse engineer
all of this which is going to take more
than the 15 minutes
we have left in the class
but conor can go through that in his
office hours um
on friday maybe to write young code
um but so we have a
um so okay
then now we know kind of what's going on
let's start looking for a bug
first of all this var 418 right
let's look in assembly on let's get an
idea of
how much space we have before the
uh our yawn code starts overriding our
return address right sorry
thank you um here is main
actually super simple it uh
let's actually look at an assembly
it basically calls
read this var uh a 418 is the buffer
and then it it it reads in this 2fd the
question is
does that overflow so how big is var
418 var 418
is rbp minus hex
4 10. right
so um between
the address of
this structure
this is our vm state that's passed
around everywhere
between the address of this structure
and
the return address there's hex 418
space all right so
can that overflow using this read which
is 2fd
no the read will override the first two
fd
um bytes of
the stack uh frame of main which is
the um or of at least this part of the
stack frame
but this part this variable is gigantic
this buffer
or the structure is gigantic so even
this
2fd will not overwrite it you still have
um hex 100 something left over let's
take a look
so we have hex 418 until we hit
the return address or actually really
until we hit the save that bp but
whatever
that's within eight of the return
address we read 2fd
we have hexadecimal 1 1b left over still
before we overflow so that's not
that's not the the bug or that's not the
javi hijack control flow with a uh
you know overriding the return address
from maine
um can we do some crazy thing
in right memory um
for example uh let's take a look at
what what happens in right memory right
we have
um our uh
vm state here
passed in as rdi we have in esi
which goes to ecx ecx or td dx why does
it do this dl
gets written here this is our memory
index
and al comes from e dx
e dx is the third argument and this is
our
memory value okay um
so can our memory index cause an
overflow
right the memory index is a single byte
dl
that single byte can take um
values from zero to ff
slash or 255. so can that cause an
overflow
and of course when we write we we can
rewrite this is the vm state plus
our single byte which is from zero to
255
plus 2fd so can we overflow is that
enough
in in inside this function so
418 minus 2fd minus
hex ff no still 28 bytes left
that is unfortunate
sorry messed up my key bindings okay so
not in right memory we could go back
through all of this
and see what else um uh
would let us overflow one very
interesting thing is
cis we can't call app open but what else
can we call
well there's one thing that is um read
code
and you can see um uh
that based on the the debug output and
teaching mode
another thing is
wait if we scroll
further down is read memory and a third
thing is right
fourth thing is sleep fifth thing is
exit
those are the um um different syscalls
that we can make within yon85 let's take
a look at what they are exit
of course just calls exit right okay
that makes sense
sleep will actually call sleep
get the return value of that c returns
uh something moves it into e dx
moves
never uses that again uh
really just discard the return address
oh that's funny
doesn't matter um that is a a minor bug
on on a completely
irrelevant path uh right what does right
do right does a bunch of stuff and then
calls right
of course it prints out stuff you know
if you have solved jan
uh if you saw baby rav level um
16 you have written yawn code to write
out um
stuff uh to open the flag file read and
write right so this is just the right
then
we have stuff read memory
and read code and
this both of these call read
right of course read will read from file
descriptor into memory
huge source of vulnerabilities as you
know so this seems interesting
okay so now we need to understand
what the difference is first of all
between read code and read memory
and then second of all how you can um
you know how that is
significant so first of all read code um
you
we grab let's see where the rdi goes
okay this is our vm state and this
is um whatever our second
arg and it looks like the second arg is
is uh checked all over the place so
if the second arg is something the
second argus
ah with this offset into the second arg
is something else so this encodes which
um
cisco we're we're using um
and uh any other
no okay perfect so no other um
argument so this there's second arc plus
ox2
and second arc plus or x1 here but what
we're really interested in is this read
right so the vm state
um we read that into rax
we move
the address of rex plus 3fb
so that's an interesting location
let's take a look on the command line
3fb is um
uh gosh
darn it come on my keyboard is going
crazy okay
if we add
what we know so far about
um we have 2fd of of uh
instructions and then hex
say 100 of memory right
from 0 to hex 55
or hex ff so i'm fading we end up with
three of d
and right in three of d
is where we read stuff out of inside
read code
if you look at read register we see 3fd
again
well you see 3ff here 3fd here
3fc here that is the part of the
vm state that stores our registers right
so look at interpretations
read code so we read some register so
let's name this guy
i can't name this guy so it reads uh
reads some register
okay this will read another register
3fe
okay this will read that
first rate and this will read a third
register so
we don't know which register this is we
need to do more reversing for that but
let's
give it a nonsensical name we'll name it
apple
we'll name this guy orange
and we'll name this guy mango
okay this is register mango
orange apple actually that's just uh
make these smaller so that they don't
break up lines
hate how it goes to the beginning of the
function
okay
awesome apple orange what is this again
again
apple
okay
we move register apple into eax
get just the lowest byte john 85
registers on one
byte long this changes in level 8 for
yan a564
of course we move that into our dx
we move 2 into rax
we do a bunch of
we subtract now if we shift
our x by 2.
we subtract okay we load the effective
address of
this plus 2fd
we know 2fd 2fd is where our memory is
this offsets into memory
and this goes into rdx and then
what happens to our dx our dx is
compared against
stuff somewhere
rdx is
rdx is added to our ax
and then rex is added to rsi
so actually let's let's look backwards
from the read
right um
let's read the high level il
i think i i think we just found so what
i intended to do is go down this uh read
code
uh branch and show you that there is the
difference between record and read
memory but i think i broke read code
when i was building
yande5 there wasn't supposed to be a
vulnerability here but i think there is
it's a little more convoluted um
this is wasn't supposed to be here so
when we call the read
here uh
how are we supposed to
wow okay we call the read
from some file descriptor
which is in a register
so that that's simple first argument to
read is
uh coming from here here here's
reed there's a bunch of crazy casting
that binary ninja does
first argument of read fundamentally is
coming from a register
super you know just figure out which
register this is you control the first
argument read of course you want that to
be zero
standard input then
there is this uh crazy amount of uh
[Music]
you have the argument plus three times
this rdx4
so this arg1 is the vm state let's just
rename it i don't want to rename it
it'll refresh the screen
and then rax19 is the size okay what's
your name
this guy is the vm state um
do i have a horizontal bar no ah
this this could use some work okay
so vm state our dx4 is um
index uh
but it's then multiplied by three
because it's just added
three times to the index and then this
is the
amount red or the bound to read so that
uh
amount to read
okay so the amount to read um
is capped apparently if it's too big
it'll uh
cap it um
rdx3 is the maximum amount
to read
and um
the maximum amount to read is
we take the value of this register
whatever is at 3fd and we
read that and then we
[Music]
do some wild math and then add
this amount
and then the index just comes straight
out of this register
okay so it looks like we are trying to
limit
the amount that we can read into code
but
here's what we do we read the index out
of this register
whatever 3fd is i think we named it
orange
and we pass it as the first argument to
as the second argument to read as our
buffer
so if that register was zero
actually i think i don't think there is
a bug here if that register was zero it
would be right at the beginning of our
vm state
uh structure what's at the beginning of
the vm state structure
somebody on on twitch or conor or
someone in zoom
we read into the vm state structure
right into the beginning of it
what is in the beginning of the vm state
structure
is our code so read code will read
from a file descriptor of your choice
and
and and read that into the code so read
memory sounds like it should
read from father scripture of your
choice and read into memory
and it looks like it does first it it
gets from the same
uh register the first argument no sorry
that's
right okay here's read memory same
writing the first argument to
um to read uh
to the read call is some crazy casted
version
of this um the register that has its
value stored at
three fc into the vm state
and then it
uses an offset
into the register the second argument is
the register
um 3fd plus
the address of vm state plus 2fd
right so offset into memory
and then the third argument is this
register in three f e
and the crazy thing is there are no
bounce checking okay
this looks like ship and it's a pain to
reverse but we can make it better
we can say hey let's
change the structure of this guy
we'll define first we have to create it
all right where are the structures
we create a new structure
how to be creating your structure
create new type okay so let's create a
new structure for our vm state
um in
this structure this is just in c
format we have our um
first we have our
code yawn code and that is
as we know ox2fd in size
then we have unsigned
char our memory and that is ox that is
256
bytes so this is 700 uh
768 right x
hex to fd why is it 765
okay 765 256
and then we have um unsigned char then
we have the registers
apple
orange mango
mango grape we'll start with that all
right so now we created the state
it is somewhere if you scroll up you'll
find it
where is it yes here it is
and then we go back to interpret sis and
we say okay we're tired of that code
looking like
let's change the type of vm state
to be a vm state
type
now we're off by one this should not be
there should be a register so
because we expect that to be a yawn 85
register right um
so let's go to our vm state actually
let's rename this
to vm state t so that if you don't
confuse it with the vm state register
i think this is actually 255 in in size
okay what
250 please let me change this create yes
okay and let's uh
go to back to this all right
this looks a lot better so we
get vms
oh come on
it still doesn't make any sense so
hold on i think i broke binary ninja
this is no longer big enough to have an
lxff
okay i'm going to copy this i'm going to
delete this state
i'll create a new type state
t2
create that
go back to this code
change the state of this guy
okay here we go if you read we go from
vm state apple vm state orange
plus vm state plus 2fd
and then vm state mango and this is both
this is in read memory
this is in right so read memory and
write both seem to be acting
on the memory write writes it out read
reads it in
whereas in read code
we are just
writing to vm state
um to to the code right
but if both of these things are on the
stack
we have this amount to read argument in
um write in read code the amount to read
is
checked and there's a maximum that's
cool
the amount to read here is not bounce
checked there is no maximum
now this isn't quite the end of the
story
but an unbounded checked
um call to the read syscall
is a bad news
cool
awesome all right so a couple of things
that that might make things
a little easier on you is uh one using
um
using guitar might be a little easier in
this case but i highly recommend
creating structures like i just did so
you can understand the code better
to go back and read the yan85
walkthrough
to understand what's going on um
three uh
try solving baby rav level 16 first if
you haven't yet
there you write yan85 yawn code
um without having to worry about where
the bug is or there's
there is no bug it's a shell coating
thing right
our yawn coating problem now baby wrap
level 16.
then tackle this awesome
okay as a reminder we have one week
in two days connor will be doing his
office hours
on monday i'll be doing my office hours
and we'll do our best
to um push
through uh get you the
the the knowledge you need hopefully
level one
is solved for everyone now understand my
script
and figure out using the changes in the
binary between level one and level two
how to adapt it to level two
of course level two has um aslr turned
back on
so you'll need to figure out how to leak
the address you'll need to do that in
one
um one shot if you restart the pro
uh process it'll be re-randomized
and then um let's uh tackle this
of course level four by the way it has
aslr disabled again
and if you look here disable aslr
so for level four you don't have to
worry about stack offset
level five is this but you have to worry
about the stack offset
cool
all right there we go
um
so we have a question about six and
seven um
yes so there's a difference between six
and seven
and that difference is um
um six has a memory error
seven does not the solution for seven
will actually work for six as well
seven is an intense reversing and yawn
coding problem
you truly need to understand how the
emulator works
you get one syscall in seven and six
right um for
seven my hint is understand
exactly how the emulator works on a very
deep level
um how can you with one syscall
and on seven of course read code is
disabled because that reads extra on 85
code
um with one
syscalling your yawn code how can you um
fix it
my hint is the intended solution doesn't
mess with
you know injecting new yawn code at all
or
escape excuse me escaping from the vm it
is
valid yawn code but you have to
understand how the
um vm works um my salute my
my hint for level
six is
to throw out your assumptions
and look for
the memory error that is not there in
level seven
yeah um as someone on twitch just
mentioned uh they can hear the baby
crying
that is a message that i need to get
back to my parenting duties
um thank you for calling in i know this
uh assignment is tough
you can do it just remember it is
putting
the lessons you learned
all of the same concepts into
uh together to
reverse find the bug exploit the bug
get command execution and get the flag
good luck and
happy hacking