all right uh let me bring up um
the chat
no why are computers so bad
okay perfect it's happening all right
um let me um tweet for
people that rely on twitter as their
calendar
first
okay boom done all right
um let's roll
i do need a 30 90.
someone on twitch says i need a 30-90
they're absolutely correct
okay um
as do we have a question on zoom have
you fixed the doorbell
um yeah i disabled the zoom doorbell
i have three devices to manage this this
is the only thing that can stay logged
into
zoom for some reason then i have twitch
chat
on the ipad because otherwise linux
explodes
it's awesome all right um
very cool uh let's
roll onwards i have a question is that a
mechanical keyboard um
it is not a mechanical keyboard i'm not
i'm not a hipster
i am actually an old person in disguise
this is
a one of those lenovo it's like
you take a laptop and you tear a
keyboard out of it
that's what i use i used this so much i
i use this to play video games i play
counter strike with with this stupid
thing
um i did it so much that i now have to
wear
my tennis uh elbow brace this isn't
because of of
too much tennis this is because of too
much uh
using the mouse with with the finger
there's
real real deal all right um
so um
pawn college um today is going
to uh be the start of
something really cool is our first
module of uh
putting together um
the uh the concepts that we've learned
so we've learned a lot of building
blocks we've learned how to reverse
we've learned how to
uh you know corrupt memory how to leak
memory
now we're going to start building this
putting things together to build
exploits um as you as i mentioned in the
videos this is a hard thing to teach
because there's so many different
situations
so we prepared a number of challenges
for you to get at these situations
because
this is a um well we'll get to that
later let's actually start with
um the state of the class um
so first we have our our meme highlight
let me move myself
over to some unused space um
the the memes memes were pretty good
this year uh this
week we have um some uh endangered
canaries i like this
i like this uh meme template the text
doesn't come across super cleanly
actually i should have made it bigger um
but it's it's pretty good the concepts
that we
discuss when we're hacking is uh
is um
is going to be interesting are
interesting probably to
to lay people um
um and then uh this is great as as the
challenges get harder and harder
people are uh happier and happier with
with
you know whatever they they are able to
achieve
it's good it's always good in life to be
happy with what you are achieving and
to always push forward so that'll be um
an
awesome uh
lesson for for this week all right um
we got a lot of canaries um we
tried to start you out with a lot of um
assistance no canaries no position
dependent code and then gradually as
you've observed
um throughout the levels this these um
kind of helper things go away um by the
end of the modules
for this week you'll be exploiting uh
basically fully protected
uh jit compilers um which is what this
meme is about
people dreading the jit it'll be fun
don't don't worry
uh and then this uh this meme format
uh is pretty good i don't quite get the
meme
maybe maybe this is an age thing um i
think our server crashed at some point
while someone was writing up a python
script
oh but it's uh it's it's pretty good
um all right
that is the meme templates keep those
memes coming they're memes
uh meme channels for asu people non-asu
people
um it's i'll i'll put the best memes on
the highlight
um and we'll we'll go from there all
right
ctf report um this weekend i think uh
people were more
busy than um
[Music]
they were previously only 14 people
played a ctf for extra credit
that's okay uh hopefully it'll go back
up but
um there's a really cool concept in uh
the boiler ctf um which was crypto world
there was a series of mini
challenges um that people
uh were able to you know just just
tackle one at a time and there's a bunch
of them one team solved 12 mini
challenges one of the
cse 466 team so that great job that that
is awesome
i think that team got eight uh non-mini
challenge flags uh if i remember
which is incredible um so that's that is
uh
really cool to see um essentially a new
ctf team form and
and and start getting better and better
and better um
it's actually the same team that that
snag 12 team the 12 flags last
week which is which is really great um
all right uh oh and of course there is
still
uh time for i think seven
or eight more um percentage points of
extra credit
that can easily move you between letter
grades
right um so it's it's it's very cool uh
cool stuff um is connor on
the ch uh chat or is he is he on the
zoom
oh yeah uh connor are we um we had
planned to put like uh flares
from uh ctf uh for the ctfd instance
for write-ups oh the flares are there oh
cool but
um yeah we need to add two weekends um
of stuff how do i see the flares
oh ah who is a flare
slash user oh awesome
oh okay etsy shadow has flares let's
let's let's do a live
oh cool here you go here your flares on
on uh ctf time very awesome very awesome
all right um
radiger wait why can't i find your name
all right for some reason i can't search
this list okay
cool um moving on let's uh
go onwards to um
the scoreboard overview since you're
looking at the scoreboard all right
so how did um asu and the world do
um this week so were baby mam asu snag
the top spot
back um but then
the four people afterwards the rest of
the top five
were uh from around the world non-asu
students
um someone
someone uh fell back a bit because they
got more sleep this week
exactly um uh so this week
we have i think now eight of the top 20
um are uh from uh
worldwide students from outside of asu
um 12 are asu students so it's very cool
to see that competition
uh continue to evolve and uh
you know obviously i am biased i don't
like seeing asu on
the top but um of course this is all
uh hands off though there's no issue
last week we had hollow circuit
take the victory this week 01. um if we
take
my camera away you can see that in order
to get
to top 20 or we're still at the at the
place where
top 19 have solved everything um there's
one
thing that rent hasn't solved yet um
otherwise all top 20 would require
perfect solves
but that's an interesting thing the
inverse of that is
that only 19 people in phone college has
um has uh
[Music]
pushed through every single challenge
which is which would be cool to see
more people as we have more time for
makeup um be able to to get that
perfect score on the scoreboard all
right
uh grading so we started the course with
209 students we're
um we have 131 still registered
out of those 14 um have stopped um
doing uh the challenges so i i think
they're just
waiting for the drop deadline uh
withdraw deadline because there's no
real rush otherwise i guess um compared
to
uh baby via uh sorry baby rev
baby mam had um fewer
uh ease and then more uh b's
and and a's and so forth um so actually
um whereas
baby uh rev had uh everyone
tended to hit a wall at c uh uh
at enough points you get a c which is
the yawn 85
challenges here people seem to have hit
a wall
at the um getting enough points to get a
b
um the curve is tightening so people are
are doing well um i'm pulling up as i
said i will not pull
these cutouts by more than one
percentage point per week
i'm pulling out them up one percentage
point um so
uh last week the cutoff for b was 78 cut
out for c was
64. kind of for d was 50. 50
now it's 51 65 79
so we're pulling them up a bit um
this is the grade without the curve let
me get rid of
uh myself here there we go this is the
grade
without the curve um we'd have something
like 15
of the class uh failing with the curve
we're down to
i think it's this is like eight or nine
uh students something along these lines
and we have this very nice uh not so
much bell curve but a
a linear increase um
especially when considered that a plus
is basically a subset of a so we have
the what is what ends up being a
traditional uh
pawn college exponential
rise and grades as you as you get higher
um
again um
things are oh yeah someone on twitch
says d is failing i don't actually know
the requirements i guess d probably
doesn't count for your
the the term is c's get degrees right
not these get degrees
um but yeah
um let's see
okay uh someone said on twitch uh
frediger
and um uh
um and one of my graduate students uh
actually the captain of shellfish
uh created a um
walkthrough video uh two different
walkthrough videos on how to approach
um yan85 so i guess this is actually
part
of this uh what to do if you're behind
so don't panic the challenges are still
worth
have the points and everyone's now
staring at number four um i'll talk
about that in a sec
um the challenges are still worth half
points um
and you can um go
now to youtube
go to playlists there's an asu reacts
yan85
there's a playlist oops
here we go all right two uh videos on
this playlist
um one is um
[Music]
wait where's the other video why is this
one out of one
okay hold on let's back out and just
look at videos
two different videos i guess i i
up the playlist i have to add the second
one
so we have um
one uh
one video from a student in this course
and one video from a student
not in this course one of these is
an hour and 15 minutes the other one is
five and a half hours uh
two different approaches to reverse
engineering yan85
go uh take a look and um
and and uh
um
if you're if you had trouble approaching
on 85 this will hopefully help
awesome um yeah so
uh freak mod mentioned uh
i'm guessing frediger is freak mod but
that's that's just a guess but
uh they mentioned on twitch that um okay
awesome they that uh
they're so this
video the one hour 15 minute video is
made after the fact you saw
i solved it and then went back and and
uh made the video this one is a live
attempt at solving it if you want to
see how uh you know the various it
includes you know various dead ends and
so forth that were followed
um i think class who made this video
did a uh
went through and actually put time
stamps if you are interested in
jumping just to specific things so this
is him
um reverse engineering the ad
instruction for example
um okay cool um
then what else we got uh
there's still ctfs credit this is
incorrect this is eight percent i messed
up
and then um i decided so someone asked
me why is the y
uh grade deadline why was it last week
oops
um and uh
this kind of stuck with me it was i made
it last week because
the suggestion was to make it earlier
rather than later in the semester
um and and the semester the the i think
at some point someone said try to aim
for october
uh but i realized that
the first combo module is actually a
um great uh
um place to
make the y grade cutoff so uh
we're going to extend the y grade option
until next wednesday which is when the
this combo module
is due so give it a try if you feel like
you can
um that like you need that y grade uh
safety net as a reminder y grade is
accounts as an
uh a c or better it doesn't impact your
gpa
but it probably doesn't um
count for certain requirements i don't
know confirm with your academic advisors
now and then email me before the due
date um
to to switch in if you want um after
that
it'll be too late final final deadline
if you switched in
and you're not regretting you want to
switch out email me before the
the um the 14th as well
okay awesome um any questions on
any of that let's actually catch up on
questions in general
uh oh someone's asking having our
semester shortened by a week do we still
get a week to make up
for what we missed so far um
we might get a shorter time to make up
i'll have to look into the
the exact schedule um that's remaining i
never
really counted the finals week that i
i'll have to look into it
um okay another question nine percent
extra credit yeah this is incorrect i'm
sorry i made a typo i forgot to update
this
uh slide it's eight percent now is left
eight or seven
all right and then people on twitch are
discussing horrific setups
to allow them to use windows to hack
man who uses windows
all right cool um
with that we're moving on to
exploitation scenarios
uh this is gonna be an awesome module um
where we'll put together everything we
have learned
um but first any any final questions
about
baby mam
someone's asking um in terms of uh baby
mam
in general how deterministics how
deterministic are malik
and map um in general they're actually
very deterministic with the exception of
where the they're based right so let's
take a look
all right let's take a quick look and
we'll we'll um
give kind of a half hour to this and
then
wait it's it's five it's almost five so
we'll do
um all right we could probably even do
an hour
with this stuff okay so um let's
take a quick look at um
map right so actually
this this is the memory map of cat
right um if you look at where
so mmapp starts at some randomly chosen
offset
in the linux kernel and then walks by
the linux kernel right
the kernel chooses your your your um
uh base address for for memory mapping
and then
for whatever reason and this changes
depending on um
the kernel version and so forth uh
you start when as you progressively
memory map more and more
uh pages you just step backwards from
that
um chosen offset so you can see the
offset that's chosen here was this 7fe
9
and then progressively
mapped stuff just just keeps filling in
behind
to the left of that in memory right um
all the way back
to you know the the last one that was
allocated was this stuff is
seven fe nine two two uh one six easier
sure
but here you can see it's from c0 to e0
then there's another
mapping from e to c another from c
and that's now it's a different one than
this c
so this is 6 c 0 0
1 6 c 0 0 this is f 6 c 0 0
and then from f 6 c 0 0 we go to f 9 1
zero zero from f9 one zero zero we go to
uh 1090 and so on right so we're just we
have
just basically a contiguous a bunch of
memory
um this means that if you leak
out any pointer here at all
you can likely figure out where
everything is
that's a weakness
there are certain academic approaches to
addressing this weakness but but we
don't have a good solution
currently if you leak a handful of
addresses generally speaking
you can't tell where everything is
in terms of memory mapping
then uh
a couple of other mapping locations one
of them
is um the binary the binary
has the location of binary has nothing
to do with with the location of these
mappings
i'm just completely different somewhere
somewhere else right i
usually add uh five five or five six
okay that's the binary then the heap is
at yet another location
it is near the binary but uh i don't
think that it is uh it shouldn't be
directly related to it so let's grab two
of these guys and then
we'll just give this a shot let's
subtract the base address of the heap
this is where stuff goes when you malloc
it
from the base address of the binary
and there's there's no way but now i'm
doubting myself so that's that
base address of the heap
that's the base address of the binary
yeah
uh different offsets but as you can see
they're much more similar they both
started with
five five c e d uh
no five five c e e and then one is d
and one is f um
so so there's some relation but they're
a kind of a different uh distances from
each other but if you look
at the distance from lib ld to ellipse
it's always going to be the same
so let's let's do that
here is the the loader label d
and here is lip c
okay and obviously in hexadecimal
that ends in because it's it's the
distance between pages and every page is
ox 1000 in size let's take a look at the
same thing
over here
ld libsy
ah see we have to continuously
stay up to date so one thing that that
has changed
um is this let me let me
make sure that i'm not about to say
something completely incorrect
okay that is six pages
and this
oh this is six so where is the
difference coming in
is there unmapped regions ah there is
some unmapped regions okay
interesting so it looks like there are
now some unmapped regions between
lipsy and libel d
okay that okay that this must be lipsy's
data yeah there's some unmapped okay so
this
must vary slightly could be i'm
not a hundred percent sure
obviously i i didn't keep up for a split
second
and something
changed in the security posture of
mappings
now where does the difference come come
from did i just
paste the wrong thing all right let's
try this again
we're taking the base address of
libel d
subtracting the base address of lip
lipsy
okay that's the two one two let's take
the base address of libel d
again
and subtract the base address
of libsy
okay i screwed it up the first time they
are exactly
uh equally offset but the the thing is
there's no reason why this has to be the
case right i mean you can map these
light these libraries have nothing to do
with each other or they they they
access each other in the same way that
your main binding acts as the libraries
in a position
in an offset agnostic way right um
you could uh conceptually
map them at completely random places in
memory and it's not
i'm sure there's a reason why uh linux
doesn't do it but i
i don't exactly know um why
so um
um
map is very very predictable except for
this first address right here or this
one right here
right if you know that address then
you can figure out exactly how um
a map goes on from there um
malik on linux is the same way
malik is fully deterministic except for
the location of the heap
but otherwise if you have the same
sequence of allocations and
deallocations
you'll have the same offsets off of this
sequence
um and you both of those
concepts have been touched on now in in
baby men
cool um
someone asked on uh twitch is the state
of the art
of stat canaries really a single eight
byte value that never changes for the
lifetime of the process
sadly yes there is some academic work
on uh updating the canary every time you
fork or something along these lines
and there's actually no reason why we
can't just go in and randomly
um re-randomize the canary
but um probably
what is holding us back from doing that
is is this concept that if you have an
exploit that
that can get a round the canary you
likely
can get around a replacement canary as
well
right um so
i think optimally
an approach that can go and randomize a
canary at fork would be great
and again academically there are
papers written about this and and
implementations of it but they've never
really been adopted
um
generally speaking we have this and i'll
get into this
much more in depth and when we talk
about heap exploitation
but generally speaking developers are
fairly dismissive of security
researchers because
developers just want to build and
make it work and have it work fast
and then as security researchers we come
along and we say hey
wait up wait up wait up wait up we need
to uh implement uh
stack canaries and a secondary is going
to add
two memory operations three memory
operations
two right uh one right and two reads
four memory operations
two three reads and uh and the right
at every single function invocation
right so you could
say okay but you're adding all of this
overhead and there
canary has measurable overhead depending
on how your function is written right if
you're just
calling a function depending on how your
program is written if you're calling a
function in a tight loop
function does nothing um then a canary
is going to have significant
overhead percentage-wise right
likewise a lot of security in
in malik and so forth has overhead and
there's this constant battle between
security researchers and developers uh
about what level of these sort of
mitigations
is correct for example i don't know if
linus still has this view but linus
store walls
um had uh this view that
um you know we just shouldn't have bugs
and then we don't care about security
because there are no bugs
there are no bugs to exploit everything
is great
um all right let's see
um other discussion
someone's asking if i'd ever try temple
os maybe i'm
actually running a highly themed temple
os
just make it look like linux to fit in
all right um then there are specific
levels
one person said level eight
and then there is a level 11
scrolling up in the twitch all right
let's take a look at a couple levels and
then
we will uh move on
all right
people are requesting yawn walkthroughs
of yan85
it's pretty good all right let's uh
let's launch out the teaching in the
meantime um
well i guess connor's generating um all
of the
the levels for the next homework so
we'll
probably in 30 40 minutes we'll start up
um oh
uh one thing actually since we're
on that subject before
before we um get ahead of ourselves
i mentioned this uh briefly somewhere in
some announcement
this is the first time that we tried to
do this combo module
right in the past we explored these
individual topics
and then the class ended
so we are a bit
worried that it might be more difficult
than
expected um it's very hard like i said
to teach how to combine these
these concepts through anything but but
practice so what we're gonna do is
um we're going to launch
collaboration hours all week for this
module
so everything that you normally do in
collaboration hours
um you can do it you can you can uh
chat through um you know on stream
uh you can you can
you know chat in the in the
collaboration text chats
and so on um don't share code and don't
share flags
but if you you know if you're sharing
your screen and
and someone copies your code don't do
that
but you know try to try to share
concepts on screen and otherwise um yeah
the rooms will be open
all week the collaboration rooms
yeah don't don't
share the flags then we have to start
reporting you for uh
academic dishonesty and so forth um
well um
freak mod showed uh the econ 85 flag on
stream but that's okay the flags are
unique
per student so i will just keep that in
mind when our
uh cheating detection system starts
alarming
um okay um
cool let's take a look at at um
at level eight and some of these i went
through um
in office hours so uh if there are
concepts
that you're missing refer back to them
um
so let's launch this guy up
cool that's shn
all right so level eight
uh there's no win variable right you
have to execute
the win function on your own um
there is no canary
uh and
i i don't remember which one level eight
is
um
the win function has this this uh check
that you have to jump over
hopefully but that's not the that that
was introduced well before level 8.
[Music]
and
ah yes i remember
this is the thing we need to fool okay
so so
the the teaching challenge the
walkthrough says hey
the challenge is going to be careful
it'll allocate a correctly sized
temporary buffer
and then it'll copy that in
to uh to the stack all right so i'm
actually going to
go a little more in depth than i did in
office hours because now
the assignment is over um let's take a
look
at level 8 testing because it's way
easier to reverse without all the prints
um and i'll show you what's going on
ah yeah there's people on what the heck
why did i get logged oh because i'm in
incognito mode why am i in the cognito
mode
hold on i have to get my binary ninja
password
okay here's vault i love these little
ponable binaries right you're
it's so often you go and and and end up
reversing some giant monstrosity like a
virtual machine that some wrote
but uh
when when you open it up and it's just a
tiny
um virtual machine it's great
or tiny not very much tiny challenge
that you can just
look at it's like this is what you get
there was a challenge in octf
that was like i don't have a total of
seven
bytes in the text section and it had a
you know a very cool bug that you had to
exploit
all right um so here's what it does
right it i you can see it says send me
your payload
and then uh it calls a read a sterland
and then something else
to get a high level idea it's good to do
this dude
you do the no one's telling me that they
can't see my screen
oh yeah yeah okay
hold on it's uh obs went crazy
there i don't know why obs went crazy
all right please sorry if if you can't
see my screen and i'm talking about
stuff holler into my ear on zoom
okay cool um
so this is this is the uh the thing
first
it does this uh malloc right uh well
first it asks us for our payload size
and
scan asset into this variable and then
mallocs this
so this is the payload size so this
looks legit
right it it asks us for the payload size
it match the payload size and then later
it will read
that same payload size no overflow on
the heap because that's a different
module
okay um here
it makes sure that malik returns a
non-zero and you can see this is
actually named temp
input awesome so here's our temp input
okay so if temp input is zero it fails
so obviously
it'll be non-zero um
uh then it tells us
send our payload and it reads the
payload and it reads the payload
to temp input of the payload size and
this is the return
address of read so this is the amount
that was read
okay so far so good
then it checks the length
and make sure that it's less than 6b 6b
is
the size of our buffer in this case um
108 bytes for this testing one of course
we can determine that
back in the graph view
by looking at the assembly so
eventually actually hold on we i got a
little ahead of myself
uh if the the string length is less than
6b
um if it's not less than 6b it'll assert
out if it's less than 6b
it'll mem copy to this var 10
which looks to be a pointer to var a8
so this is a pointer to buffer
and this is buffer okay
and mem copy of course takes a pointer
another pointer
and then um the amount that was read
okay so make sure the string length is
less than this
and then it it
copies it so let's go look at that mem
copy
here's the mem copy okay we call this
mem
copy um with this pointer to buffer
let's go look at pointer to buffer
so here's pointer to buffer it's at rbp
minus
hex eight um and we
get the address of buffer which is
minus a0 so
the next thing um
after
a0
what are all of these variables that it
detects
ah binary ninja misdetected a bunch of
stack variables
but basically um
we start from a0 and then we'll we write
up to 6b so this is small enough not to
overflow there's probably some other
variables here and some padding and so
forth
and then um that's it right um
so at first glance this looks
perfectly secure right but obviously
this challenge has
solves in fact this challenge has over a
hundred solves
so it's it's definitely definitely very
exploitable um
often times in these situations you have
to sit back and say okay
what are the possible
vulnerability vectors right um
possible vulnerability vectors is the
buffer is too small the buffer is
smaller than 6b but we just looked and
that's impossible right so we eliminate
that we're sherlock holmes here
eliminating the impossible
so what's uh so so there's enough
space on the stack for 6b what's another
possible security uh
vulnerability vector the malloc was too
small but we
looked at that the malik is correct it
reasoned the exact amount
um it's not too small so we eliminate
that as impossible
uh we
say when we mem copy here
we'll overflow this the stack because
uh
this is somehow bigger than
than the the stack buffer size
but at first glance it looks like we
check it here right
but are we checking it because this says
amount red
amount red is never checked what is
checked is
the sterling of temp input so it seems
improbable
that they'll be different but
kind of in a sherlock way uh
sherlock holmes sort of way once you
eliminate the impossible
whatever remains is probably the
vulnerability
pretty sure he said that once um
so let's take a look at how this
could be different from this all right
let's take a look on my terminal
and actually i'm going to take a look in
ipython
ipython has an awesome module os
and here you can just do system calls so
um
it's it's it's pythonified
actually let's not do that we'll just do
you know
confusion dot c to look at this source
of confusion
um we have a buffer and let's read
into the buffer from standard input
128 bytes
and then we will
print f amount red
okay and then we'll print f
sterling
okay and we put some new lines
okay we put in a new line
amount red five sterling six that's
probably because
i have on some uninitialized data here
that's a
preview for another challenge all right
so we initialize that properly
okay amount red five sterling five
okay so then we try to do something
a lot of data and it's only going to
read 128 of these bytes but
we'll give it give it a good uh boom
so it read 128 and
uh sterling was 128.
so when in doubt try random why not
i mean of course we should sit down and
think about it but we could also try
random stuff um
what did i just leak someone said clip
it
what was just leak i don't think i
leaked anything
anyways um okay
so how do you get some random data
there's there's a couple of ways one
bash has a special character named
random that every time is something
random but that's that's that's not so
useful because
you know it's just random bytes of
course the number might be a different
length but but
you know no good um there's also
an awesome device in linux there's a
slash dev file system quick linux
lessons this
everything in linux is a file you
interact with almost everything in the
file system by opening a file
uh almost everything in the system by
opening a file and talking to it
now if that file is you know your
password file or the flag file of course
that makes sense that it's a file
but that file can also be your sound or
video card so
um dev dsp is how the world has changed
in my time in in ancient times dev dsp
was my sound card if you're also living
in the stone ages and have a cd-rom
deaf cd-rom you can uh if i do
cat deaf cd-rom it'll actually stream
data from my cd
drive this is a workstation happens to
have a dvd drive
i don't have a dvd in there right now um
and so on one of the things here is a
pseudo device
and dev random this will print out
randomness but like true randomness from
from an entropy pool instead of you're
not going to go into that you random is
a pseudorandom number generator
i can pipe this through hd and here's
like a bunch of
random data all right so when in doubt
why don't we try some random data
uh that's this confusion
right away we see something interesting
sterling is much much smaller than a
mount red
ah here it wasn't wasn't here it is
again
so let's let's do this we can do
um uh
instead of catting out debut random
which would have never terminated if it
wasn't for this confusion guy
well actually we might as well i'll do
this all right we use the t
uh t is a utility that'll take standard
input write it to a file and then also
write it's a standard output
so we'll do t um random stuff
all right confusion no good no good
no good good okay what is
at offset 69 what's 69 in hex
hexadecimal 40 um
um um five uh
so if we hex dump random stuff and go to
well this dumped a lot and go to
hexadecimal 45
40 41 42 43 44
45 it's a null byte
so why does
the null byte messed this up
it's in my lectures null is a special
character
for string operations it means this is
the end of the string
sterling doesn't check how much data is
there that's a nonsensical question
when you're talking on the uh binary
level
the data that was
the data that was uh returned from read
or what read it did was write data into
a buffer
that already had some data in it anyways
right nothing magical happened uh
to create a new buffer or anything like
that
right so what stirland does is it goes
through
a it it has no concept of what data was
there what data you just read in
it actually has very little to do with
um this read what stirling does is it
goes through the same buffer
and it looks for the first null byte and
it returns its index and that is the
length of the string
and so if you sh back in
[Music]
uh
okay good so if you have stage back in
and we
echo uh
let's say 1000 then a new line
and then we
give it a null byte it'll immediately
see the null byte
sterling returns zero and then
the mem copy happens with the original
size
right so let let's take a quick look
actually before we do this
so we're going to read in one null byte
at the very beginning of the buffer and
then a bunch of data
we overflow this uh or we don't overflow
things here because we're reading it
onto this
to the heap into a an allocation that is
properly sized for us then we do this
stir land
sterling sees that null byte return zero
could have a null byte a little later
as well just as long as it's earlier
than 6b
then we do the mem copy with a pointer
to the buffer uh
to the real buffer and we copy it from
the fake buffer
sorry from the heap buffer and we copy
the full amount not the string length
not the the amount to the first null
byte which is what we actually checked
for
we copy the full amount that we read and
boom
so let's take a look
why didn't this this crash
all right connor what uh
what version of ubuntu are these guys
oh interesting so bash bash supports
null bytes and environment variables now
right
yeah but it not in uh not in arguments
oh obviously no
no what am i saying i'm saying stupid
stuff guys ignore me of course it
doesn't support
how it okay okay
but i did get it i had some work on uh
let's just use pawn tools
or just python
so we're going to print our 1000
a new line a null byte
and then a thousand a's
okay boom
that's frustrating
okay here we are look good
boom a null byte and then and now we're
going to
pipe it into the chat into the challenge
segfault all a's
we are golden from here we've overflowed
the buffer there's no canary you're home
free
you just gotta redirect execution
okay
you can't hear me okay all right good
awesome all right did that help with
level eight
so that is that is the the the part of
level eight that is different
um than than prior levels by the way
i keep saying um the
you know this is the part that's
different and i do that by
looking at it and and so forth but you
can
do this semi programmatically right so
let's
uh grab level eight conor what is the
the challenge that is closest to level
eight
let's take a look at level level a
testing one actually download this
um and then conor will tell me which one
is the closest
okay but what i'm gonna do is is
dump out um
baby mam level eight
should this this probably will fail
horrifically but
we'll give it a try
actually
so here's the volume just the volume
function this might might work better
and
know because all the offices will be
will be different
never mind um i might make another video
for
um a poor man's diff
of uh of of two programs um
yeah is there a good open source binary
diff tool that's kind of missing maybe
there is for ghidra
guitar extension tuning ah uses bender
anyways i will look into what
there is in terms of free binary uh
diff things but if you disassemble
uh let's say level 8 testing
and we go and get level 7 testing so
this is what i just did here we get
level 7 testing
and uh you won't be able to see this
level seven and level eight
okay now we need we need some
so we disassemble it right obviously
all of these offsets will differ because
there's you know more more code or less
code
so we can use said to search for
everything up to a colon and remove it
all right this looks better now this is
level seven
we do the same for level eight
okay and now we can diff ah diff
is bad for this there's a utility called
meld okay i'm just gonna yolo this
level eight
yes okay so let me see if i can uh
share this screen in a reasonable way
alright this is going to look
where is where's the meldius here we go
this is a diff of the two assembly files
right so you can see there are some
things that are similar but there are
other things that are
um that are are a little different and
you can align so here
is where it calls fd open and and sure
that this offset is different but that's
you know because the binary is slightly
differently laid out
but then you can see this highlighted
stuff that's very different
this is the added part of
um of this challenge that that you can
look at so if you have two challenges
that are very
close to each other um or you have two
binaries that are very large but have
very few actual significant differences
something like this can help there are
better tools to do it
um that unfortunately mostly are not
free
but if if we can figure out a good free
solution we'll um
put up a quick tutorial on that
okay awesome
well that wasn't too bad in terms of uh
changing out what i'm sharing right away
all right um let's see
uh let's do this let's take a 10 minute
break
right now um
my wife insists that i
give everyone a break and then
when i come back we will dive into
what it will be known as toddler one um
con are we ready launch
we'll launch when i come back okay cool
at the end of the break 5 45 arizona
time
we will launch toddler toddler one
the first toddler uh um
set of challenges awesome see you soon
do i have something maybe
i should have a a matrix
yeah i'll have a matrix
wait wait wait i think i already have
the matrix one sec i'm gonna spend half
of the
break trying to build a matrix
thing in obs
yes
oops okay
be amazed
oh hello hackers all right
let's uh resume um
wait i sorry
everyone on zoom if you were just
speaking to me i couldn't hear you
awesome okay um we're back
connor are we ready to launch
all right i guess we have technically
one minute left
let's uh let's let's give it up
i guess start typing
okay so there's a question how many
challenges will be
uh launched this week that's an
excellent question
um we are starting with
seven and there will be
and then less than or equal to ten um so
we're going to launch
uh actually probably less than or equal
to nine
um we're gonna launch two more tomorrow
it's the
the things that are launching tomorrow
is the jet challenges
um because um
i just need some extra time to debug
something basically
what i'm building for you for the the
jit spray
is yan85 64.
it's gonna be awesome
all right we are up um
let's uh let's roll um
if you refresh well i should have been
opening the collaboration
if you refresh the first seven levels of
toddler one
are up um
let me go on
here and unlock the collaboration
rooms
okay send messages
connect speak video
and connor reports that we have a bug
what's up connor
oh i thought we uh we got it
working
okay so we have a quick uh
cutting edge bug that is making level
one
harder than it should be that's only
level one right connor
yeah so let me show you um what's going
on
with um level one um collaboration
room uh is is up
by the way let's make sure that people
are streaming in
yes people are in very few people
go go this is gonna be quite a thing
hmm
yeah i think that's a good idea okay
yolo okay um
[Music]
trying to figure out what m9 havoc means
by the name badges
oh this yes
um yeah these are my uh
this is this is this is very little this
is just what i've uh
accumulated that i haven't uh combined
with my other
badge tree yet um but i have like
academic badges various uh
government program meetings defcon
badges
hitcon a lot of good stuff
all right anyways
um let's take a quick look
at oh what's the coolest badge i got
what is the coolest badge i got
i'm a big fan of this badge i mean i i
have to look at
my bigger battery i'm not so good at
defcon always has really good badges ah
this is cactus con actually not defcon
yeah i i these uh contest badges have a
special uh place in my heart because
they're basically a reward for
uh almost dying hosting def gun
okay um let's uh let's take a quick look
at
level one teaching one i'll i'll explain
what it's doing and then you can
um go through there
yeah yeah
well i don't even have to use set arch i
just run it and then it'll it'll look on
my computer
okay um one sex let me
let me get a discord invite for somebody
here
real quick
um
oh so connor toddler one will just crash
automatically
i see yeah yeah so so level one is is
unstable but we're we're fixing it on
the fly
okay so i'm i'm downloading uh level one
teaching one
in fact i or toddler one toddler one
level one teaching one
um i have already downloaded
so let's
all right it's super easy you run it
ask you the payload size look familiar
asks you your payload
and segfaults all right looks super
familiar so far
um connor there's a student that pinged
you
um about a discord invite if you could
get them the
discord invite i think they would
appreciate that
but uh fix this and then get the discord
anyway
okay so um let's see what what happens
right we overflowed everything so
um if you think back to the memory
errors module great
let's redirect to the win function and
and be done with it
but it's not that simple
um if we oops if we
pull up the challenge in
binary ninja
and we go to volume
okay this this looks familiar right this
is the testing
crap and then you know you sent
data and so forth but but here's a big
problem
there is no win function when function's
gone
nothing in here is going to open read
and write the flag for you
so now what how are you going to solve
this
well recall the shell code module
the shellcode module said hey
you can inject code into processes
and have that code be executed and
if we look at
the results of checkset it says hey nx
is disabled
if you recall that nx the the data
execution prevention
lecture this means that um
you can write shell code to the stack
jump there and execute it one more thing
if we run this multiple times
that those addresses always stay the
same
this challenge disables aslr on itself
how does it do this this is insane
conor figured out some crazy crazy way
basically
as a constructor where when it starts up
it goes here to disable aslr
let's disassemble uh decompile that some
crazy stuff it uh
basically uses this personality syscall
to disable aslr et cetera et cetera this
is
um what more or less what gdp tries to
do
but this works the way conor wrote it
even for set uid
program so even the said uid program
will have aslr disabled for level one
this is what's currently crashing
um this means that in the
the stack will be at the same location
and that means that you know where your
shell code is
and that means that you can jump there
very easily
awesome
yeah so right now level one is only
gonna work locally
um or yeah only it's only gonna work
locally not even with sudo
level two has aslr on
also zero solved
i think this is the longest that level
one has got well obviously one's
broken so yeah
no sobs yet level seven no sauce oh
level seven is amazing
these challenges are gonna be great
you're all gonna have so much fun
two is not broken two works
only level one is broken right now
has anyone ever played dwarf fortress
dwarf fortress has a good definition of
fun that i think is very similar
to the type of fun that you have
while playing while doing these these
challenges
my advisor has a cool definition of fun
um he is fond of saying that there is
type 1
fun and type 2 fun and type 1 fun is the
fun that you have while you're having it
right while you're eating candy or
something it's immediately fun
this is type 2 fun you look back at it
and think that was fun
but while you're going it might be
painful all right
conor reports breaking news level one
works so we run this challenge
sshn
connor is the server getting slammed
is my computer frozen server's getting a
little slammed
bear with us
one of the problems with uh the pace of
this course is that we have half an hour
every week to do server maintenance
i think the next time we're down and we
should
reboot with many many more cores
any idea was
hmm
okay so let's um
oops it's toddler launch toddler one
note that the stack is now always
the same toddler one doesn't have aslr
what's the difference between toddler
one and toddler two let's take
okay sorry about that
so toddler one we launch it every time
it's the same stack location this is
incredible it's like it's
1999 and we're exploiting buffer
overflows
in bind which powers the world's
tns servers um which had a stack based
buffer overflow bug
i had them like every three weeks in the
early 2000s
but now we launch level two
okay and the sshn
and we run it and every time
it's different
but it's okay you are used to
add your space lab randomization from
baby map you can use the same techniques
to tackle the location of your shell
code
here
also if you notice now we have a canary
all right let's take a look at
the collaborators all right we have
man some rooms for the global people
that
have no one in it the heck
now we have some good collaboration
going on
looks like torch and sandwich sandwiches
back
person sitting in flynn one person
sitting in verge
all right so question on zoom can you
explain
how we know we have to use shell code
well let's take a look
let me turn on the lights
okay um
when we run check sec whenever you
approach
a a security a binary from a security
angle
it doesn't cost you much to run checks
act right away right
so you look at check sack on toddler one
level two teaching one and you see okay
has um full railroad we haven't talked
about railroad we're not going to talk
about railroad everything has full
railroad
which is a protects against the class of
one abilities that are basically
obsolete
um it has a stack canary
it doesn't have nx
and it has segments that are readable
writable and executable
what does this mean this means that you
can write
code into memory and execute it
and that's how you know that you could
use shellcode if you can find a way to
redirect control flow
into memory that you have written shell
code into that is also executable
let's actually take a look at at how you
would do the um
that for this challenge um actually
let's let's do uh
level one
there's a level one testing one
run into practice mode
you know occurs to me that grapes are
a very good you could you could even in
in-person classes you could bring in
like uh some grapes and just give
every student a grape and it's like a
good little snack unless people are
allergic to grapes i guess
i don't know if that's a thing all right
level one testing one of course
outside of the the um teaching testing
etc there is no um
um um what's it called
sorry my mind went blank um there is no
uh stack dump so let's just uh
get in here actually what if we do this
paste a bunch of stuff in here
okay segfault can i enable cores
did we get chords working connor
core dumps
ah okay so said you uh
i'm gonna show you how to use something
called a core dump to
uh make your life easier um
this requires the file that you're um
uh exploiting not to be set uid but
that's okay you can
copy it away from here or you can just
in practice mode
chmodded to 755
and now it is not set uid now if
i run it
and i give it
and now it's set false still no core
ah maybe ah core dump okay segmentation
fault
core dump oops
there is a file named core
the core is an elf core file if you
recall elf really is just a collection
of segments
that describe where data is in memory a
core file
is a collection of segments that
describe what and where data was in
memory
when the program crashed and the awesome
thing
is that i can use gdb
to resume why do i keep typing code in
circle
exactly where the crash occurred how
cool is that
right so this is where the crash
occurred i can see
what was the um instruction it was red
what was the stack it was a bunch of
stuff this is
some printable stuff that i copy pasted
randomly
from my terminal
that i guess that was here okay so so
this is a very powerful technique and
the awesome thing
is that you can work with cores
programmatically as well so let me show
you how to do that
um launch up by python
import phone all good evenings begin
with import pwn
now we do poem.process
actually let's write this in one script
okay so
pulling that process why is the twitch
shot talking about
surgery and grapes where is this
happening what's going on
okay anyways um
that bite was too big
pulling that process all right slash
toddler one
then um we write
send line 1000 let's not do 10
000 that's a lot and then we will
send a cyclic pattern
of 8 byte chunks to overwrite the
return address of 1000 things
and then let's make sure that
we wait on it and make sure that
it is
it it crashes with signal 11 which is a
sec fault
okay boom
so crash with signal 11 that's why it's
negative
made sure that uh that that happened and
then
the um so so now we should have a core
dump let me remove the existing cord
down to make sure that we have a new
core dump
boom we have a core dump where
it looks like part of the metadata was
uh
on on um the stack was overwritten with
our uh
with our uh cyclic pattern
all right so anyways now we have a core
dom so now
we can do this really awesome thing and
open up the core
dump file using tone tools
and this is where magic starts happening
so this is where we crashed um this is
the value of rsp
the value of rip etc right so
you can do a lot of different stuff on
this core dump
if you hit tab there's just there's a
lot
a lot of stuff you can for example see
okay what was the canary
or was there canary i guess it should
have a canary
if it um let's see
what do i want to do i want to get the
stack pointer
okay that's cool
what else do i want to do
i want to uh get the memory
um
the memory contents add the stack
pointer
get
see that stack
so these are
what
how do i just query memory obviously i
don't use this as a regular
okay so we have c dot stack
from c dot sp to c that is p plus eight
so the next eight
bytes on the stack
was this
and now we want to
find this in our cyclic pattern and it's
at
position 104 so let's
turn this into a big script
boom so this is our offset
to rip awesome
okay offset to our ip is now 104 so
there's 104
things on the stack and then there will
be our
um the return address
all right
so
what does this mean this means that we
can
launch another process send 1000 things
and now we send
1000 a's or sorry 104
a's plus
eight b's okay
so we make sure that it crashed and then
we load the core dump
and we just make sure that
the contents of the stack where we're
about to return
uh rather the return the save return
address is now
a bunch of b's
success it's a bunch of bees
okay all right let's do a search here
amazing all right so now we can uh
control it
fully but first let's put um
some uh
shell code at this point
you can write a lot of shell code by
hand on your own
i think it is now acceptable to start
relying more and more on pawn tools
for shell code generation so pawn tools
if you set up the architecture
correctly this tells it
we're on 64-bit x86 and here
you do pawn that
[Applause]
assemble pawn dot
shellcraft dot
read oh come on
what is it
um i see this tab completion doesn't
work
read file slash flag
okay
read the file to standard out
so this is opponent tools has a
shellcraft module
so you don't have to write shellcode
yourself
much easier to write shell code yourself
in my experience well
it's much easier to debug your own shell
code than to debug pawn tools shell code
just as a pro tip um but you can give it
a try
and it might work all right
um sorry let's uh let's start a new
section here so we've made sure
that our assumption was correct so now
we're going to
instead of um of all b's
we will redirect our execution to
some to
immediately we put our shell code
immediately after the save return
address and then we have
the code jump immediately after the
saved return address
um we're going to do this we
pack
see that sp plus 8
okay and now we can print
p that read all and if you're very lucky
that'll contain the stack
uh or sorry the stack the flag for one
thing let's
because we removed suit access we have
to make the flag
world readable we can do that because
it's in practice mode
for another thing obviously um
something broke here
sounds send
let's um
what if we do 112 it should crash at all
a's right
no it terminated happily
why did it just terminate happily
okay if we do this it'll crash right
why is it terminating happily
oh no okay here it crashed but if you
don't do p
that wait it'll miss that crash
connor do you see this this is insane
okay so
uh no i i think i know what's going on
okay
so it didn't work
something something is bad let's um do
this let's
open our file with our input
and instead of this send line we're
going to write
this to the file and then we're going to
[Music]
okay and then we're going to gdb so we
have fresh core dump here
we're going to gdb toddler with this
core dump
no it's it's still
it still didn't crash
okay anyways here's our input file
this contains our a's and the shell code
produced by
pawn tools all right give the gdb
toddler one and
we run the shell code it crashes
somewhere here right
but let's let's um disassemble volume
and we'll actually break right at this
red
okay now we round it with this input
okay here's the break point right before
the red
instruction
okay this is going to demonstrate a
common gotcha
when shell coding um this is where we
are returning to
this is our um uh
current stack pointer
and why
this is more than eight away all right
step
yeah this is way way wrong so already
we oops we screwed
something up
oh because we're in gdb and the stack is
different
no problem um
we can uh do better than that
um i mentioned
a way to start up a uh program
and have it um uh
wait uh for you so if you're gonna if we
do
let's make a screen session oh wait but
my
okay let's kill this
okay uh let me make a screen session
here and just
ssh in
that way i can okay anyways so um if we
make a screen session
um
and uh let's get back into our python
here we are all is good
uh we make a fifo
and then we run the program
with the fifo
all is good now the program is waiting
now we can gdb
toddler oops i forgot to shine
now we can gdb
toddler okay
we can attach
okay this was
we can attach to this guy
what oops what
but toddler one is running
what the hell
oh yeah
okay no this is this is all stupid let's
just do this
let's wait for input here
before moving on and then we will
tone tools will launch the process we'll
check its pid will attach to it
from gdb and then we'll go here or
let's just use pawn.jdb dot debug
sorry guys that was a brain brain fart
on my end
okay here we go pawn gdp debug and then
we'll send all of this
and then um see what happens
what's going on could not find a
terminal binary to use
hold on
now we're just going to do this on my
machine so i'm not
dealing with multiples okay on my
machine so i have
toddler one level one teaching one
goddammit but i need my history
all right we have a bit of a live
meltdown here
don't panic it's gonna be okay
talk to myself
copy that paste it here
oops
god damn it why why would it do this
nope
okay this will work
no come on
yes okay thank you awesome
all right so slash toddler one doesn't
exist but we can do dot slash toddler
one
ah i was using testing one let's
download that
okay
not marked as executable
man guys being a hacker is hard okay
all right finally we created a
we launched our thing in gdb um
and now when i hit enter here it is
going to send
in the data um
let's um info proc map uh
disassemble the volume function here it
is
and let's break at this rate
continue and enter here
what's it waiting for
cannot insert breakpoint one
i know what's going on don't panic
all right remember how connor disabled
uh aslr
in a crazy way now it's uh now
it's
now it's hurting us our feelings here
okay oh i see what it was waiting for
okay
so let's uh
run
will it then not relaunch itself that's
right okay
all right for debugging we'll just do
this slr equals false
of course this might not work still if
this binary set uid but we copied it
actually off of the whole container so
this is fine all right
so now we disassemble
vol v break
here continue all right
here we go we're about to return
um we're about to return
to from 4f8 to 490 same problem
okay let's get offsets from gdb
in here okay forget the gdb
that was a mistake we're just gonna do
on that process okay
we'll do the pawn.process and then we'll
wait for my input
so that the input function in python
will just sit and wait for input okay
now here we're going to
okay there's an awesome utility called
pgrep just gives you the
pid of something that matches this query
and here we can do gdb toddler one
one testing one with the pid and it'll
automatically attach
amazing okay now you can disassemble
volume
break here
continue hit enter
boom here's the break point
our speed goes from four seven eight to
four nine oh we still have a problem
that's interesting
am i doing anything different between
the two
uh
so where do we get our stack one from
the core dump of the previous one we can
do this because aslr is off
otherwise it would be different we'd
have to leak it from the program
okay let's see what what this thing
thinks
okay stack pointer graph seven ever for
the
488 but when we actually
why are these
nice okay hit this
connect
here
okay no
so it thinks it's at 488 but it is not
at 48. we forgot to break
at red
here's the pid connect to this
i'll set the same space spot
so here we go continue enter
but it's at seven eight not eight eight
but this is crazy it's launching it the
same way right conor
it's got the maybe it just has the wrong
stack pointer
i'm running it with aslr false here but
that shouldn't matter
the address is changing by hex
10.
okay so we're experiencing an
interesting situation where
the stack is changing a little bit but
that's okay
here's what we're going to do we're
going to deploy a knob sled
you remember in your um
shell coding there was a shell code
where we jumped part way into your shell
code
at random and you had to create a
a sled of knobs so that if you jump into
any of the no ops
all of them will execute in sequence and
then or the rest of them will execute
and then your shell code will execute
we're gonna do
the same thing here we're going to
create
a bunch of no ops let's say
128 of them
and then here instead of jumping to
everything to the
to the next instruction we'll just jump
i don't know part way into that knob
sled
okay and then let's just see if this
works
and it did there's the flag okay
so when in doubt if you are
jumping right before or part way into
your shell code
and there's just something going on of
course try to understand what's going on
but if you are
streaming to the world and and things
are getting increasingly embarrassing
you can say okay screw this we're just
gonna put a knob sled
and we'll go um
oh the other amazing suggestion that
uh from twitch is disable aslr in the
process that generates the core dumps
so that it doesn't have to disable its
own slr
let's actually try that
and see
maybe maybe something it shouldn't
change
it shouldn't change anything but it
might so let's
okay so here we are let's break at
continue all right
yes yes exactly and then it works all
right uh there was a question on zoom
thank you um stone dant for
that but anyways
the the knobsled um there's nothing
embarrassing about
using an obsolete every once in a while
um all right um
there's a question on zoom uh would the
return
always be where you inject your code um
so i guess the way i'm interpreting it
here i overload the return address and
then right after that i put my shell
code this is a terrible idea actually
because if your shell code uses the
stack it's going to overwrite itself
right if it pushes anything or pops um
your shell code you can get away
because of send file most of the time
without actually writing anything to
memory anyways right
unless you want to exact something but
for leaking flags in this
class you're probably fine um
without uh needing to write memory
but i'm almost certain
that the way that pawn tools does this
is
uh reads the flag is it first reads it
to the stack and then writes it out
um so
it will likely if i didn't have this
knob sled here it would have likely
collaborated but as it was
um it will instead clobber now so that
after i've already executed it
this this is not what you want what you
usually want is to put your your shell
code
let's say here this is the the the
neatest
way to do it let's let's show you how
that works
um so say our shell code is going to be
this so here
normally put shell code let's
get some precision by
saving slr in all cases from the get-go
again
level one will disable the slr in itself
and restart itself
um but uh
you don't have to rely on it why do so
what is crashing 24.
oh okay
okay so that still works
um so now we have this shell code
now let's actually put it up here
we know the offset to rip if we have
this shell code
and then we just left justify it to this
offset
it'll make put our shell code and then a
bunch of
let's say more knobs or whatever null
bytes
all the way to our our um
um return address
and so now we can put this here
and put it here
so now we have our shell code there
actually let's um add
our now slide here
let's assert that the shell code is the
right length
make bytes here can't concat stir two
bites
what is the stir that they're talking
about
is this really a string
oh oops
there we go i was trying to assemble
that
all right assertion error
that is equal
so there's probably just too many knobs
what the
okay there's that shell code is pretty
big
um all right we don't have a lot of
room for knobs that's fine so we have
our shell code we can put our shell code
here now our shell code is
in the cord dump somewhere we can
actually determine where that is
so we can look at c
dot find
right now what memory
find
find stack
see that
stack dot can you guys
connor are you still here just in case i
need
god damn let me just okay good no i'm
just checking my my
headphones were making weird weird
noises um
let me
uh co chord okay see that stack that
find
good we can look for where our shell
code is
in our core dump
okay and here we can see
that it's not in there at all
we just sent it here oh no
what the why why can't it find the
shell code we sent it
waited it crashed
okay that's fine instead
let's put
we'll put a bunch of x's and then we'll
find
those x's
oh
because it's by the time it crashes it
is before
okay perfect i know what's going on
okay here we go
we start at c dot sp minus
ox 100 okay
i don't know what's going on
here's our shell code and then where is
it
in
why wouldn't the shell code turn up in
the core dump
this is just a couple of bytes in the
shell code that i'm looking at
it's in there
oh that's ominous
here it is so this shell code
in this guy
no it gets it gets up so one risk
with what i just did where i put my
shell code
into my um
into the stack frame is that as the
function does stuff between the overflow
and the return
it'll corrupt your shell code um
so solutions to this have a very very
tiny shell code
um so there's you know less of it to
corrupt or
do what we did before and put it after
the stack frame
although that's not always viable um or
you might need to write shell code that
can jump around
corrupted bits so for example in the
middle
of your shell code you put a jump and
jump later i'm going to
take the route of
writing a
or connor mentions if you're running um
your code
locally you can always also put your
shell code in your environment
so if you create shellcode up here uh
we don't have to let justify it here if
we just
take our shell code here
okay um and we create an environment
where we have a shellcode variable
that is our shell code
that environment when you run recall
that the environment gets put on the
stack
so that shellcode will all be on the
stack
you can pass it everywhere because of
course that shifts offset so you want to
be careful about that environment equal
shell code
environment equals shell code
environment equals shell code all right
and now here we'll be able to
find our shell code on the stack and we
don't need to send it here we can just
send
our usual stuff
what environment keys must be strings
oops and vehicles shellcode and vehicles
and
and this overrides the environment
variable with which you are launching
stuff
and every
thing is not good
oh it's not supposed to be
no this is something else this is in
sending the cyclic pattern oh
probably there's not enough um
let's try that
send less data yeah awesome okay
now we don't need this assertion
boom okay so where's the shell code we
have a shellcode address
we know what the stack pointer at the
return is but that doesn't matter
because what we are overriding
this with now is the shellcode address
and here is our flag
cool so what we did to summarize
put created some shell code using phone
tools
put it in a environment
dictionary that we passed in when we
launch
the process so we set that environment
the environment goes on the stack that
means our shell code's on the stack
since the stack is executable here
we're good to go we send a 256 byte
cyclic pattern to see
in the core dump where we crash right
then we send
actually let's simplify this a little
bit we can see in the core dump where we
crash
and we can
get the shell code address from here
boom perfect so we see in the core dump
where we crash
um we get the the offset to the return
address we also
find where our shell code is in
memory we print out both and then we do
the exploit which sends
the padding to overload the buffer
and then the address of our shell code
and our shell code is already on the
stack because we passed it in as
in the environment
this yes now this will still work
because it no longer depends on
on the exact positioning of
the stack at function invocation
cool so um this is uh
aslr um
off level one teaching one um i'm sorry
that we took so many dead ends i wanted
to show
little tidbits that ended up being uh
tar pits um now aslr is off
what if aslr was on of course you would
have to leak out aslr somehow or
figure out how to partially redirect
execution although
that's unlikely um to work because your
shell code is on the stack and execution
uh generally sticks to the main binary
and libraries so
a partial address override won't
redirect you to the stack
um but you'll have to either leak it out
in level two
or do something well you'll have to leak
it out
and you're used to that you've done this
in baby mem
in the previous module
cool let's check in on on um
wow everyone moved to team verge team
verge is uh
it's going crazy
cool
all right people are are working through
it let's see
people on on the collaboration are
discovering that the shell code
created by pawn tools is not optimal
fourteen solves on level one
and only two thousand level one testing
and no solves otherwise oh dear
so to to stress that these
um these challenges
will require you to put together uh
the concepts learned in multiple modules
so level one
is memory errors plus shell coding level
two is memory errors plus shell coding
level three conor's basically oh memory
errors plus shellcoding plus sandboxing
right um level four is going to be
reversing plus memory errors
plus shell coding level five is going to
be
reversing plus memory errors plus shell
coding level six
is shell coding and reversing and memory
errors and level seven is just shell
coding reversing
super fun
that's right yeah yeah i guess there's a
bit of a jailbreaking
um throughout the the whole the whole uh
that basically it's it's a combination
it's scenarios of exploitation
so conor may be based on this start
maybe you're right so uh just to catch
everyone up conor has been
urging fewer levels for this uh
this module he's been looking out for
you all
maybe we'll do less than 10.
but i have so many other ideas
no we definitely have more than seven
the jit spray is not up
we have at least eight
so
all right let's see how people are doing
so
oh my god there's someone on discord
just ping me saying hey i have a
question and then they're
asking me i figured okay it's from the
collaboration
group they're they're they're you know
they have a question about
something and then they're asking me
right now
questions about a network challenge
apparently it's for cse
365.
um yeah fish and and and jed
are teaching it
unless you have way too many cyber
security courses
you should just
just pawned college
yeah reminding the whole undergrad
cs curriculum just pulling college
all the way through
the opinion on twitch seems to be that
asu doesn't have enough cyber security
courses
all right usually we are um
answering questions to the bitter end
people seem to be
deep in thought
[Laughter]
this meme is definitely going in the
meme review
next uh next week the big question
for us now connor is um
do we make everything after this toddler
or do we go back to baby for the
individual concept
gotta go back to baby
so connor and i have been talking about
making a um
freshman level edition of phone college
starting from the very very basics
and the question that just came up was
what do we name the challenges it might
have to be like feed us one
fetus c but that that just sounds weird
we might have to graduate everything to
toddler here
and then the the toddler one will be
like i don't know a young adult one or
something
when the analogy is falling apart
yeah another
[Music]
last job last year i want oh my god
um
oh there's a baby to infants to toddler
yeah but an infant's a type of baby
isn't it is the baby like the category
that includes infants and toddlers
yeah yeah we could do that infant baby
toddler
yeah we should do the freshman course
and then like you said the
there's another idea for a follow-up to
pawn college where we just like pick a
real world target and over the course of
a semester
find the bug and exploit the bugs in the
real world target
i think that would be pretty cool
yeah awesome everyone is uh
hard at work it still worries me that
the amount of collaborators on the
collab hours have kind of
dropped in the last two modules but
people are
people are surviving i mean the average
grade of the course
actually went up um
this week
yeah yeah i think
the uh
countermaster on twitch is asking if i
have any experience in breaking drm
for academic reasons i actually have
extensive experience breaking drm
specifically for academic reasons um
let's see how can i copy paste this
here we go
how do you add do you add people and uh
oh yeah you do wow this is just like uh
just like irc
did my microphone just pick up brooke
talking to the baby
i think it did yeah yeah
that was mrs yon
okay
yeah so awesome thing about that paper i
just linked um
for breaking drm um basically that paper
had an enormous amount of reverse
engineering a lot of
the sort of dynamic um not uh
kind of shell code injection we
basically um
injected a lot of logic into
applications to monitor their
uh the flow of data between buffers to
identify when
data was decrypted in memory um
and it also had vm reversing because one
of those programs
spotify used a virtual machine
based uh anti-debugging measure
uh someone's asking me to read georgia
on the twitch i don't read georgia
unfortunately
everyone is shockingly upset that the
challenge starts with a t instead of a b
now
embryo embryo is not a bad embryo is
is it might be a good a good name
for uh the baby baby challenges
because that is that's that's yeah
that's good this it's much less awkward
sounding than fetus
embryo yeah
maybe that was the remaining hurdle to
creating 194.
that'll be such a huge amount of work
i am teaching asu 101 this year so asu
has a um a course to introduce
incoming freshmen to to college right
basically you know
what is college what is being on your
own like what is uh
you know etc um and i
am teaching uh several sections of it
and i'm trying to
uh make it also useful technically
so we're in in in asu-101 we're going
through the bandit series of war games
uh
challenges right which is basically like
how to use linux
starting from how to cat a file and it
is
shocking like it it's very easy to take
what you know for granted
right like i i i know
you know how to cd and how to cat and so
forth but having to explain that
from first principles to uh incoming
freshmen is really hard
i think that our freshman year upon
college thing is going to be
something very similar someone was
saying
ah someone's asking isn't asu 101 taught
by tas
uh i think it maybe used to be they try
as hard as possible to get enough
professors to
to teach it it's much much more
because part of it is also about getting
the
the students comfortable with professors
and interacting with professors
opinion on twitch that the freshman
college course needs to be sophomore no
absolutely not man
the whole point is get started right
away imagine if instead of wasting time
on java
boom x86 assembly because at the end of
the day
x86 assembly if you learn it first is
simpler than java there are
seven variables or whatever right rax
rbx rcx rdx
done there's actually less boilerplate
it's just underscore start
colon and then your code
much easier
yeah that would be interesting connor is
saying in my ear that a module focusing
on c plus plus reverse engineering would
be interesting
it would be they would the
the promise the the step-by-step
challenges right so
we would what level one would be just a
simple
c plus class level two would be
you know it might work as a combo module
reversing and then
memory errors in c plus that could be
cool
but you know given the various research
projects that we've been
running lately i'm thinking looking at
the twitch chat someone's saying there
are kids out there that are writing
x-boys for chrome
absolutely and like actually chrome and
acrobat
specifically acrobat acrobat is
so amazingly vulnerable right
um we could definitely have a
follow-up to pawn college for you know
sec second semester seniors or whatever
where it's an independent study
group type activity and i'm positive
that we could
find real bugs in acrobat and get adobe
to fix them
there are 400 level i think there are
400 level topic courses
c plus the the c plus reversing idea is
not very popular on twitch
connor just fyi
one cyber security class per semester
that that's that i can see how that'll
be good but man if i
lose another semester of sleep steve
jobs will murder me steve jobs talks to
me through my apple watch
other than telling me to wash my hands
several times a day
he's telling me that i'm dying of sleep
deprivation
all right we have six minutes in the
course i guess everyone is is busy
verge is the last surviving
collaboration room
everyone is busy collaborating
still no solves on level two
why man maybe we made these too hard
maybe you should have had a level 1.5
connor
so conor's pointing out that um
my original plan for this module
had no level one level two was going to
be level one con
actually went insane into
like if you look at that disabled aslr
uh
function it's insane i still am like
90 of the way to understanding it but um
conor wanted spend like hours on that
thing and then when i said no we don't
need it he refused because he spent so
much time on it that he made it into a
level
uh without aslr for you so uh
yeah man only two solves on level one
testing one
no but i just walked through level one
testing one just like
a second ago so if you understand that
solution you got this
how do you dump that core file on the
server two things
let me just walk through it maybe uh
it might make a good clip if it's fast
enough
here we go i'm sshing into phone college
all right i have my uh
actually hold on let's this one is
already disabled um
i'm launching up level one teaching one
in practice mode
sshing into the server
look at toddler one teaching one it has
a set uid a set uid binary will never
dump a core
so if you uh
chmod minus s to remove that set uid
it's gone now this will dump a core uh
the only remaining one
uh problem is one i need to be in a
directory where i can write to
which is my home directory so that's
fine
but when you first have sage you're in
slash which is not fine
um and then you need to
set your limits to have an unlimited
core file size
and then you're good to go so remove any
existing core
run toddler one payload size
1000 and we just put in
a bunch of stuff to overflow the buffer
okay overflow the buffer the sec faulted
i put it
and it says core dumped put in too much
stuff
but that's fine and here is the core
core dump is here
the gdb toddler core and
now we can look around in the core
that's the string that i pasted in like
crazy
okay does that help
wait where did uh where did i see this
oh yeah
that was on the on the twitch
cool
uh someone on twitch saying this is
midterm week i thought last week was
midterm week
oh i see so there is no midterm week
it's basically whenever
it's distribute it's a distribution that
centers on
between this week and last week
now but this module okay it's if you're
having some
slow progress starting it but that's
fine
we'll get it i believe in and you all
you've made it
this far you have all the concepts
you've done all of this in pieces
now it's just time to put it together
well what do you mean multiple midterms
oh i see you i don't understand
tests
screw tests no tests
ctf only
[Laughter]
twitch everything onwards level four
is yan85 fml let's get on 85 man
[Laughter]
the only tests are the testing levels
those those are good
i remember when we invented teaching
levels that was insane
the whole class was failing
like a 90 percent fail right there like
ah
testing levels and boom
beautiful beautiful passing curve
oh someone saw level two
level two teaching one has been solved
oh
great job zero first blood
first blood on level two
awesome that's still testing
yeah exactly that's still a level two
testing one technically you could
solve that by leaking out the by reading
the the stack dumped but
you can uh you can do this
that's like all right how about this
that's that looks like a cannon but it's
a whistle i mean that meant to be
all right my audio cues could use some
work
okay um
we're at the end of class uh if
someone has something else speak
now otherwise good luck on this
so collaboration rooms remain open the
whole week
please take advantage of this this is a
hard module and your
fellow students are also pushing very
hard
jump into collaboration and collaborate
away
um
uh sorry i was catching up on twitch um
a lot of these concepts are tricky but
once you get the concept
the execution is just making bits line
up
you can do this you have done the memory
exploitation in baby mam
you have done the shell coding in baby
shell
you've done the jail breaking in baby
jail
just put it together and you've done the
reversing in baby rev
um again yan85 now has youtube
walkthroughs
go to my uh the phone college youtube
channel
and um uh take advantage of those
walkthroughs
look at at you know the the one and a
half hour
walk through by freak mod uh
who has a you know kind of looking back
at
how he solved it and then one of my
graduate students um
never having seen it before just started
the webcam
and went for it um
so and that and that that one has time
stamps
where if you just want to skip through
the very relevant points
you can um
all right um let's uh
get this as a reminder conor's office
hours are friday at 2 p.m my office
hours are
monday at 3 p.m collaboration
room is open there's also help probably
we won't monitor closely the individual
collaboration
text chats but if you want to ping us
from help go ahead and ping us
or um write and help we monitor that
pretty closely keep the memes rolling
we've got already have some materials
for for the meme review
it's gonna be pretty cool um
awesome
good luck
and i will see you on monday
i feel like i should say something else
encouraging because
maybe something like
the program has its internal state
and it has internal thoughts
and it has its hopes and dreams right
and his hopes and dreams
don't include the flag in any way shape
or form not
one of these uh challenges opens the
flag file
by design right
but it's up to you to change its mind to
to
mind-meld with it perfectly so that your
thoughts and your hopes
and your dreams become its code
and when you achieve this perfect
synergy
you'll get the flag i believe in you
good luck