let's um let me tweet that we're live
okay can you see um
my
video i guess everyone asu people
hello
awesome
okay why
is audio so quiet
can someone say something
perfect okay i'm just gonna hop on to
the zoom link
uh on a different device
to turn off the doorbell and then we'll
get started
where is my
reading settings turn off the doorbell
doorbell is off okay awesome
so is my audio going at like two frames
per sec or my video going two frames per
second on zoom
why
this makes no sense how about uh the
video on twitch with me
okay so some sort of a weird zoom issue
bueno okay cool
all right awesome and now i'm
in the zoom
chat in the
twitch chat we'll give a couple minutes
for
maybe one more minute for people to
filter in and then we'll get started
all right
so let's um
oops let's fire this up
all right so we're going to start real
quick with a
state of the course
um
the state of the course is don't panic
if you're panicking stop panicking um
we're going to start with
a very important thing meme highlight
um so these are some of well these are
literally all the memes i saw about the
course but i didn't see all the memes
but
the ones i saw i liked so good job um
especially like von neumann over here uh
and um yeah
blue shirt yawn uh unfortunately could
make it today
to stop me from launching this homework
assignment so
that's what you get all right um
oh question on twitch where to post
memes this is a good point i'm going to
um uh tweet the discord
link for non-asu students
um so we have one for for asu students
one for non-asu students
uh it's important to use the right one
otherwise the discord will get
screwed up and we will probably have to
kill it so
we are going to not paste the wrong one
[Music]
and that's where we'll do the
collaboration hour today
on college collaboration
okay so i've now tweeted the um
[Music]
discord for um the non-class
[Music]
just same discord different setup
so there we go all right now we're let's
roll
there's also a memes channel there for
everybody
um and then and then um we'll go from
there
all right so uh
where are we in the course we finished
up the intro
fundamentals and um
um the set uid assignment hopefully
everyone enjoyed that uh the assignment
is designed
not just to show you uh
the security problems that can arise if
you give
you know too much access to different
programs and those security
problems are very real as you've seen
it's also to get you familiar with
uh linux on the command line hopefully
everyone has a better understanding
of the command line and linux than they
did when they started this assignment
um if not we can
launch some other crazy stuff for you
all right
let's see um
why their discord
links flying around all right cool so uh
very cool uh today we're moving on to
shell coding we're going to
uh hopefully you have already all
watched the shell coding videos
as a reminder the course is designed
so that here in this lecture we talk
about videos so two hours before this
conor streamed all of the shell counter
videos that are also on
youtube i'm going to just go to
youtube.com
um so that you can see that they are
there
let me first find it because i am
a bit of a noob
actually here let me
all right this is pawn.college
you go to shellcode here are the videos
all right
um i'm now assuming that everyone
watching the stream has watched those
videos if you haven't watched the videos
i mean you can
top it out on the stream but if you um
want to
uh you know go and catch up on those
videos and then watch the stream this
stream is an extended q a
culminating in uh one or one and a half
hours
of collaboration session on the uh
next assignment right now as we speak
connor is hard at work um posting the
next assignment
um and uh so the module two challenges
the shellcode challenges
should be up shortly cool all right
sometime while we ravel uh let's move on
uh real quick slight change in the
course um kind of times
i added this uh um pre-class lecture
stream
um at 2 30 and then at 4 30 we do
what we're doing right now which is
watch me uh use
um uh
try to use twitch uh on on on twitch we
have uh someone reporting that what they
learned actually someone in the top 20
of cohn college right now
judging by the the name maybe
um uh that they learned that there are
millions and millions of hex editors and
viewers
um and we're gonna run through some
uh common strategies um
i forgot to make slides for those but
we'll babble through
all right so um moving on
right now uh with pawn college open to
the world you can see
how asu uh performs against the world of
course there's
you know the asu students have to do
this in order to
pass this class and graduate people
worldwide
don't necessarily have to do it but
right now asu is
giving a very strong showing all of
these uh pitchforks that's
you know the asu mascots uh weapon of
choice i guess
um and uh
yeah so right now in the top 20 we have
two
people from outside asu hopefully we'll
see
um uh
more more competition there the question
is when we start getting to harder and
harder and harder concepts can asu
uh stay in the lead that'll be
interesting to see
all right um let's talk about module
one results so 157 out of the 209
students that started this class
uh asu wise made it through module one
congratulations uh great job actually
this is
probably the best performance on module
one that i've seen
on this course um this is a great layout
um of of
uh all asu.edu email addresses
registered in phone college um we have
uh not yet developed the functionality
to pull out the ones that are actually
in the course but but that will happen
today tomorrow
we were kind of uh developing in
production live
um you know just in time development
um but
i think it's safe to say that the people
that did really well
probably aren't the the people that that
dropped and so
as a whole if you just add up be super
optimistic and add up the
top 157 asu email addresses
the class is in very good shape so many
many people have a perfect score right
now of course
modules are going to get harder concepts
are going to get harder
but we'll adapt through that um
i want to get a quick feel for
how people are finding
um whether on twitch or on uh
what's it called zoom or whatever
how are you finding uh
[Music]
comment on zoom shell coding is about to
hit us like a truck
that's right um all right how are you
finding the
format of the course so my hope and
actually one reason i think
people are doing well um is that you can
go back and
and watch you know all of the very
specific uh concepts and so forth
um all right someone on on zoom saying
the format is great
uh love the gamified version of it all
right
let's see cool if you have any feedback
um someone's really excited that we had
100 challenges
we'll try to have more for you
exactly
cool one thing that i observed i'm going
to run this by
kind of the live channel um i observed
that it's a a painted ass to
record these 40 minute long hour long
lectures
um the the the videos for the modules um
i am planning on splitting them up quite
a lot more
something like that initial shell coding
one will be just like i don't know five
or six different
10 minute videos instead of one you know
40 to 50 minute one
um that might be
uh uh
one route forward
um okay so the the concern i'm seeing
from the zoom chat is uh
that 100 is going to be a lot of
challenges if the challenges get harder
and harder and harder
[Music]
uh um it's it's so the challenges will
get harder and harder and harder
i don't think we're gonna hit a hundred
again um
there are some challenges where we'll
have some modules where we'll probably
have
50 60 um
but i don't think more than that 100
because these are
this is by far going to be the easiest
homework it was
uh if if you assign less than 100
of these problems it becomes very very
easy right i think everyone
uh probably very quickly reached
30 or 40 and then they had to start
being creative
um people are requesting 99
on on zoom
all right question on twitch how long
did the first assignment take you
um i think connor are you on zoom right
now
yeah connor's on zoom what what do you
think uh let's say how how long would
that assignment take you
so the question from conor which is a
little bit of uh
looking ahead at discussing um
how to to do this assignment is is the
question how long
is it going to take conor's script or
how long would it take connor
right so when connor and i wrote this
assignment uh
the evening before the first day of
class in 2018
um i think we sat down and we
got 40 points in like what 10-15 minutes
and and
and probably solved would have solved it
in
an hour or two uh my personal best
with a very simple script is
i don't remember 200 something um
i don't remember kind of how do you do
you remember how much like a simple
script gets
yeah so um with this assignment uh
[Music]
scripting is is very powerful right
um
let me let me let me show you something
here
okay um how can i show it
i can go to all right
here's one one route to getting flags
let's say um
collect connect up
i think i had a this in practice mode i
did not let's go
to phone college and set it up in
practice mode
so we're gonna just start up bin cat in
practice mode
just so i can use sudo instead of
having to uh
someone zoom says dang i only got five
it's a
hard challenge um
okay so user bin
is full of oops you can't see that that
at all
okay user bin is full of challenges
right here they are
here's what we can do ls user bin
this gives you let's do ls
dash d everything here full path
use parallel to execute the binary
slash flag
and actually let's see what
the flag is so this obviously will just
give
one flag but if you do this
and script pipe through
own college or sorry
grab phone college actually let's grab
it outside of
god
[Music]
what's going on here
so one one interesting thing actually is
to grab dash a
one interesting thing that we can
observe right away is there's an
enormous amount of crashes of these
programs look
i run this program a student of mine
came to me about this like
hey i'm finding oh
finding a bunch of programs that just
just straight up crash
so obviously in the real world and the
real
challenge you don't have pseudo this is
in the practice challenge and the
the the the way that you would do this
is pull down the doctor container that
connor
um announced or or installed all of
these
um packages on your own
um um
machine or whatever which is probably a
crazy thing to do and then
run this offline figure out the
solutions and then apply them
online right instead here we're just
going to do sudo
instead of running pseudo a million
times or just pseudo parallel
all right um and
we hit enter hold on let's do
grab dash a
lot of chord dumps
um
parallel hitting limits connor what is
what are our our limits here we
i can have 100 processes let's do four
at a time
because and and proc is going to tell us
i have 32 cores that's what's going on
okay
um so let's do four at a time and let's
do
um a random sword
mbr hold on me remember how to
do a timeout with parallel dash dash
timeout nice and easy okay
should have actually run this to
practice
okay so right away we have one flag pop
out
right so this was some program that
just by running it with slash
prints you the flag so let's keep going
i just realized i'll probably end up
deleting the flag at some point that
won't be good
okay
let me ssh in to make sure the flag
wasn't i haven't deleted my own flag yet
okay you're wondering what's going on
why haven't
why isn't this working i'll show you as
soon as i get
fight this to get my terminal back give
it back
okay guys um this container is is
pretty hosed
okay there we go all right let me show
you what happened with the flag
[Laughter]
so all of this has happened with the
flag so the flag was converted into
a million different formats and then
eventually replaced with a directory
that um a bunch of crap in it all right
so
obviously you need to uh be careful
about
destroying probably a better way to go
would have been
uh what i i'm about to do but we're
doing this
live so for example let's let's look at
what flag.o
is some interesting stuff um let's
grab phone college
ah all right let me restart the the
container
that was hilarious
okay connect back in
all right
what happened here why is it suddenly
yellow and red as my flag back my flag
is back
connor can you speculate on why
my ad is suddenly yellow or green i'm
colorblind
okay anyways we'll deal with later
okay connor is the server under heavy
load because or is my internet bad
okay anyways let's let me re-do that
parallel find where it is there it is
all right instead of doing this we're
gonna
we're gonna make the flag readable by
everybody so now we can do this without
root access
what is going on
maybe everyone is probably everyone is
running these scripts at the same time
okay let's not worry about this uh let's
run okay so now the flag is just
readable in practice mode of course
let's just do this without sudo
so now there's no hope of the flag
getting
destroyed from out from under us
here's one there's two
uh and my console got screwed up
okay we're back hold on let me reset
what's running as my user nothing i kick
it um
let's okay i've wrapped this directory
pretty good
that's fine um one sec let's do this
new plan grab that shaepong college
tam slash flags
okay so now
parallel is gonna lock to temp flags
oh i must have run something that makes
my bash prompt very
attempt flags
what's going on why isn't finding it oh
it's it's
randomly choosing things
it is hanging
oops
all right we're very quickly approaching
a
point where return on investment
is is decreasing let's do this
okay so you see if you run it we
immediately start getting things out
um
and if we actually do the grab inside
just don't understand why it is so hard
to kill it connor can you look at the
load on the server
is it just destroyed
okay let's do this we'll do the grab
here
and then we will do
dash v for parallel
just to see there's making barriers all
right so
we're running everything with slash flag
and somewhere in here
a flag might have shown up oh no
interesting
my internet connection is not very
stable right now
but twitch is fine
okay and a lot of these are probably uh
oh
here's another one lwp request
here's one from strings
and so already in i don't know the 30
minutes that i've been
fumbling around with the command line we
have like five flags
right uh there are nine thousand
programs here
for some reason this locked up and is
not timing itself out properly
but with a intelligent script possibly a
more intelligent script than i am
writing here um we can
uh get quite a lot of flags just
from oh where did my timer go
let's do double timeout time out
you know one second and then here
timeout two seconds
oh there was another one that just
scrolled by here's it
my terminals up gosh so
you can see tons and tons
and my terminal is really really broken
because of whatever just happened all
right
tons of flags and then probably
there are tons of flags in here
oh low yep
two more or one more flag that oh no
that's just
this i'm like um could be some
flags in this automatically created
insanity
all right that's the scripting route and
notice all i did
was command slash flag there's a lot of
things command
dash f slash flag command um
dash dash file or something right um
we haven't even started down the road of
um
putting in the um commands to execute or
libraries um this um
module was the base of a
um ctf challenge at defcon ctf
um actually
20
so this last defcon ctf qualifiers
if we look at um
this challenge this was based on
this homework assignment but to see who
could get the most
uh challenges uh initially when the game
started
teams would have to submit 9 000
solutions so
those of you uh comparing
um or complaining about 100 think about
9 000
in the 48 hours and by then that
threshold degraded
down until it was solved at a
pharmaceutically about
800 900 um solves um
by one team that that had 800 900 all
together all the teams at defcon ctf
found 1870
different programs with which they could
read the flag
cool
cool okay some questions on zoom how do
you know which program
leaked the flag let's uh let's scroll up
my terminal got screwed up so i'm going
to have to do
this
and let's just log into flashflags all
right
so if you see what is running here
it ran html to text and that leaked the
flag it's all the same flag because
right now this is a practice session of
bimcat
right so you do this in the practice
session of bimcat
and then you um can figure out
you can launch up a real session of html
to text
run this uh command and it'll give you
the flag
pretty cool huh all right
so that
um is kind of an easy mode way of
getting
a ton of flags just in those whatever 10
20 seconds again that i was running this
i got
6 7 8 9
10 programs that 11 12
programs that could just be gotten with
slash flag
cool um
all right uh
let's see catching up on questions
catching up on questions oh
can't see on twitch god damn it all
right sorry guys
i ran it again um
the question was how do you see uh
what command that got the flag so you
can see it from the output from parallel
if you do parallel dash v it'll print
the command before printing the output
and you can see which which command got
the flag so v
cat can get a flag inline detox
can get a flag cpp7
can get the flag and just i i ran this
for 10 seconds
and and it spewed out a lot of flag of
course
if you know this coming in and are good
enough at scripting coming in
to the assignment then it's it's not as
fun now
you can script this and see how many
flags can you get
um but
if you came in with it you know yeah you
could ace this assignment but it won't
help you
learn how to misuse these uh these
things
all right questions on zoom
uh yeah so many were pretty simple
uh even if not just trivial like passing
things as a config so in the same way
you can run these scripts
with here with like dash dash config
flag and so forth um if you have
a you know let's say you wanted to
figure out how to
leave the flag with ls i don't think
that's possible but who knows
um you can do dash dash help
you could actually write a script to
parse all of these
uh options and automatically run
command dash dash option flag right
um it's uh it's pretty exciting stuff
all right
yeah so someone on twitch uh said uh
they didn't realize the practice site
has more
permissions that's the whole point of
the practice side it gives you root
access
so that you can debug um
awesome okay
cool cool yeah so uh someone on twitch
said they tried to
create a set uid cad binary in their
home directory
uh this does not work can i check mount
yeah so if you look at mount
and you look at where slash home is
home ctf has a mount option called no
set uid
this specifically means that you can
create a cat with
set uid and then launch with other
programs and try to read the flag but it
will not work
um
cool
okay any other questions
what is the name of the docker image is
a question connor what is the name it's
it's
pawn college
baby sewage you can pull down this
docker image
oh r um you can pull down this docker
uh container it's uh like 16 gigabytes
um and uh play around with it
oh how did you get to the practice okay
again you put in that same uh the
correct path and then you hit get pre
uh practice challenge and that'll launch
the challenge with
60 with a pseudo access
cool ah fudge cannot see
i need to get better at this um all
right
again the container is right here
on college slash baby suet and we have
we'll be pushing like
other containers that'll help with um
with with working on stuff like this is
the base of uh the the challenges
um for for
for this for for for uh the future
challenges of the
course um someone asked on twitch do you
have any recommendations for learning
resources
on linux scripting um
it's been so long since i learned linux
scripting that it's
tricky to say i haven't followed like
tutorials recently um anyone
on zoom have recent experience on twitch
yeah so someone on on zoom said do all
the over the wire
challenges but script each one so over
the wire
let's pull up war game nexus there's a
a list of uh different war games
you can start with over the wire bandit
it's a you know
big war game for learning to use
linux and so forth yeah
cool let's uh let's move on
all right um
some uh of the solutions i wanted to
showcase
specifically uh let's look at
was it key keygen
yeah actually i have to go remind myself
which one it was
i posted it as a hint for people
all right okay so um
there's a couple of tools that will take
a uh
module a plug-in right uh one of the
let's say um view
if you look at the help of um view
um you have this
a load plugin named file it must be a
shared object
right this means that you can have
this program with a command line option
load any shared object you want
right and as we if you remember
let me get out of that if we do cat
flag dot c so here's a cat flag from a
main
in the same way oh connor you you showed
this on on stream right
um on your office hours
okay so um
let me search for the constructor yeah
there we go
so i've shown this uh
in one of my fundamentals lectures how
to create an ld
uh or a library where the moment it's
loaded it will run
code even with no actual functions in
that library being invoked by
the the code using it it's just a
constructor
that construct that uh invokes code
right away
to you know initialize state well you
can do this
right you can get the flag
very easily on module load by creating
something like this
let's compile it catflag.so
catflag.c we um
scp it
okay let's sage back in
and actually let's do this um let's do
this on
a real
real uh instance not a practice instance
just to drive home the point
okay sshn
okay so we have catflag.so
we can't cat slash flag permission
denied we do um view
and we do a um
i forgot now dash p for the preload
we do our cat flag
oh dot slash cat flag
oh invalid argument hold on
uh commands
this dash well there's a hell probably
won't do it
huh dash
v is yeah how about that module preload
let's take out this
module preload invalid argument
i wonder if it needs something
so here's a good example of let's figure
out what's going on we'll do the
practice challenge
i'll do it in practice mode rather ssh
in
we will of all the things installed on
this
ltrace isn't installed on it all right
we'll just install the random stuff on
my machine
and i'll trace it
and see what it is trying to do
with my
okay this might be a little more complex
than what we signed up for
why not let's just give it access
um can we have no trace is not as smart
as
ashtrays here hi hold on deal
ah maybe this is what's going on
we don't have a pure start possibly
let's let's just
get okay i know it's something
i mean let's just put that in just just
for
fun
still invalid argument all right we went
off off
script and it screwed us over as usual
well that's fine
that wasn't looking enough from there
why isn't it even loading my
cat flag guy
all right come on what's another
let's grab another
vdr is another one
okay vdr
i'm just gonna okay
so what was video are saying
wow can't access video directory
is there something that's like video
directory
oh search for plugins in this directory
and for sure there's a plug-in aha
plug-in
okay
i there we go video directory
so we want the plug-in directory and the
video directory to be
our home directory
was that capital v or lowercase v
lowercase v right
yeah video directory and we want to load
a plugin how do we load the plugin
dash
p
uh-huh so let's uh make cad flag data
seo into what it wants it to be
we need a vdr plugin creator in cat flag
data so
all right yeah there's a request on uh
twitch to move on to the this week's we
will do that in one second
i just want to solve this
you just create oh oops yeah
get the right thing hello
where's my flag
all right we're gonna move on there's
some uh
thing i still have to debug i will post
an update
when i figure out what the hell is going
on and we will
try not to go off off script but
as you know i'm very prone to going off
script all right
um
let's f's in the chat
let's move on to um coding any other
questions on
this assignment
all right everyone wants us to release
the the challenges let's talk about the
challenges
um for the shellcode con are they up
okay
level one is about to go up so you'll go
um
to pawn college as normal um
the challenges are going to show up
under baby suet as baby shell
um and you will learn to shell code so
hopefully you
you watched all of the the lectures
anyone have questions
about the lectures i there's one
question that i have queued up to go
into detail
any others
how many levels for homework uh
i think we have 11 levels with a
teaching
variant and a testing variant for each
challenge when conor brings up level one
i'll show you what
that means um
and uh that's no sorry
i think we have 13 levels
where is the discord link uh the discord
link is
on twitter
hold on there's some uh strange baby
noises
i'm gonna go check them out i will be
right back while conor gets
this uh running okay
all right
all right we're back sorry about that uh
the baby was uh
uh there there is a baby yawn
um uh
awesome yeah baby on uh what
what if the baby did teach baby sued
yeah exactly
um all right cool
um connor how are you doing on uh
level one um yeah awesome
okay
so baby shell is now
up um if you grab
teaching one and we hit play let's play
on a practice challenge
ssh in
didn't work didn't say it worked
is this okay now it says i can connect
yeah i think we might be getting um
hit by a fairly heavy load
connor i think it might be time to
increase the size of this instance
do you got it
all right i'm gonna show it on my
machine so luckily i was
able to download it
all right you need capstone to run the
teaching challenge and i will show you
why
lit capstone three
and it's nice and simple so literally
watching the
um lecture you should be able to get
like levels one through
you know three or four probably because
they're all
small variants on just write a shell
code
let's launch baby shell the
um challenge the teaching challenges
will help
guide you through their um solution
so this teaching challenge for example
maps uh your shell code somewhere into
memory
uh at some random location you can uh
see it in this one actually maybe you
can see it
in the in the testing one too but it'll
walk you through
what what it is doing um and talk about
everything then the big thing that the
uh
teaching challenges will do is if you
put in a bunch of
shell code right then
you end up with uh
it'll it'll disassemble your shell code
and show you what it is about to execute
right so it'll show you this
it'll execute it and then this shell
code just pushes rx on the stack a bunch
of times and crashes
if we do this yeah pop rcx
and crash cool um
yeah connor more reports on twitch of
flags not being submittable
oh perfect someone asked me what did i
just install i installed lib capstone
three
um are teaching one and testing one
parts of this assignment
yes um
baby shell will have something like 26
total instances across 13 levels um
and you will have to
solve it in teaching mode and then solve
it again
without the the hints all right so
i want oh someone already solved level
one awesome
who solved the blue shirt yawn amazing
good job
all right let's uh let's chin one other
thing
you might say you know uh
i you might notice when you download it
the challenge it gave you a binary file
you don't know
how to look at binary files yet you know
what they are from the fundamentals
lectures you know they're full of
assembly
but you don't know how to reverse
engineer them well
we know that and as soon as this gets in
awesome um if you go to slash
there should be source code here
connor
okay we're going to reboot it real quick
and then sources will start showing up
and then i'll
show you the source code of a typical
challenge
will we ever need to work outside of the
web instance
um it's a question on um
on on twitch
it's going to get more and more of a
pain in the butt to work completely
inside
the phone college instance you're going
to want to set up linux on your machine
whether in a virtual machine or a docker
or whatever
set up linux and an environment and
go from there cool
someone on twitch says they actually do
know how to reverse engineer binaries
thanks to the pawn devils oh
one thing we forgot to talk about is uh
last
weekend ctf report so let's uh while
conor gets things rebooted let's go here
we go to
[Music]
ctftime.org
amazing all right last weekend there
were a number of ctfs there was
uh specifically i i suggested to my
students
uh the asu students in this course that
can participate in cts for extra credit
that they can participate in either f
word ctf or
in uh gas etf
[Music]
and 29 students did i am very proud of
you
[Music]
this is an awesome awesome result um
i got 29 individual write-ups i think
across six
teams or so um some people played with
uh
asu's ctf team um or
the security club at asu the pawn devils
and they
play as team shellfish on the world
stage
um and some of the students in this
course joined them that was awesome to
see
other students formed their own teams
and
solved stuff this is incredible i think
there was on the
among the the non-shellfish people there
were
a union of six solutions um in f word
ctf which is super cool reading your
write-ups was um
was was very awesome um
someone on zoom asking if they can join
uh
in with one of the the students make a
post on canvas
and look for a team um
so all of these people that submitted
write-ups got one percentage point
extra so that is equivalent in weight to
uh something like by the end of the
course probably seven or eight
baby sewed no no probably close to
15 or 20 babies with instances but they
got that extra to their
final uh score one percent we haven't
calculated that in
yet to to these uh these scores here uh
but we will
all right um
[Music]
next let's go on to some questions about
baby sued
oh no so for the next uh upcoming events
there are four ctfs no sorry three ctfs
next weekend
um i'm not sure which one of these will
have the more
introductory um
questions or problems that that you can
work on
from the look of how many teams plan to
participate
alou's i'll ctf is gonna be um by far
the most popular so if you're looking
for a ctf to do next weekend for extra
credit
uh hop in to a ctf
cool now question about
shell coding all right um i have
this uh shell coding
um module
uh video that i where i talked about
common challenges that you'll run into
in this assignment i'm gonna reiterate
the video but i'm gonna specifically
answer
um a question that someone had
well i already answered over email but i
want to also
get that to the whole course that answer
all right so
uh i talked about
multiple ways to achieve the same thing
using uh
shell code or using different
instructions right or different
combinations of instructions
and specifically one student had a
question okay but if
i here i do move rex 10 and you can see
in the binary well the hexadecimal
representation of the binary
representation of this assembly
when you assemble this it looks like
this there's a 4
a 4 8 byte a c7 byte a c0 byte a 0a byte
and a bunch of null bytes
if you're using something like gets to
read an input and you can't have a new
line
then this might be problematic or this
will be problematic and so you need to
avoid having a new line in your shell
code
well you can uh say the same thing as
move
the value 10 into rex you can do the
same thing by moving the value nine
into rax and incrementing rax
right so then you end up with this
situation right so instead of
a zero a byte you have a zero nine byte
because you're only moving nine there's
no more 10 in your
code and so you don't no longer have a
new line the sooner outsider question
why does this
end up longer than this well it ends up
longer because
this is two instructions this is one
instruction
right so this is just move encodes into
a very long instruction
uh because it is a moving a a
a large immediate value and this is that
large immediate value
right um in little ndn zero eight
zero over here
here is that move and then afterwards
there's another instruction that is inc
rax
cool um more questions
um
[Music]
more questions on uh shout coding
no question on shout coding connor have
you rebooted
okay perfect so let let me uh go back to
point college and spin it up
sshn
actually while we were rebooting what we
should have done is increase the the
size of that
of that instance
oh i see i see cool
they're still pretty slammed huh okay
uh no no it launched the plunge my home
directory is a disaster
oh thank you
all right my home directory is a
disaster i'm going to
this is from running that crazy script
half of this is owned by root
okay
yeah this is on by root amazing okay
fine
we'll deal with that later oh i'm in
practice mode good i can do it here
awesome okay let me relog in so that
it's not so weird oh
i just realized connor probably the
reason everything is so slow for me is
whatever ended up getting installed into
my shell when i was running every single
binary
in a loop okay anyways we're back
so we have baby shell
level one and there is no source code
oh and slash challenges okay and slash
challenges
baby shell we have the source code of
um of the different challenges
that you have so here is level one
testing one versus level one
teaching one i think for level one
there's not much
difference um and it's super simple it
it welcomes you it uh
closes all other file descriptors then
standard out and standard error just so
you don't do any
crazy shenanigans um zero's out the
environment and arguments so that you
don't inject data that way
and the only way you can inject data is
by um
uh sending it
shellcode right here where it'll let you
read
for level one um
uh ox four thousand uh
bytes of of shellcode let's you write
that in
then it'll just execute it it jumps to a
function pointer pointing at your shell
code and executes it
that's it um for level one
uh the difference between level one
teaching one and level one
testing one
is teaching one will disassemble your
shell code
and print the oops print a bunch of
other
uh you know helpful stuff but
mostly disassembling your show code um
that right here
for level one the um
shell code you developed for the
teaching challenge
will likely work on the testing
challenge uh some of the level
later levels are not so um
um uh
easy or not so nice um but generally
there's not like a lot of hidden data
for
shell coding that exists in you know
that that you wouldn't know ahead of
time
um in the teaching assignments right so
realistically whenever you get a
solution for the teaching
you will likely um be in a very good
shape for the testing point is though
the takeaway
there is um the source code
for the different levels in slash
challenges
i will update the description when you
like click in ctf in our ctfd instance
here
[Music]
connor can we put a description here
check out the source code and slash
challenges
awesome awesome okay can you push a
couple extra levels and we'll get
started on the
um we'll do an hour and a half of
collaboration
um
awesome i guess the
earlier ones are the same is the ctf
instance much
much bigger
i see
well let's start the collaboration and
and and go with that all right
um a couple questions to catch up on
uh
a question about redirects on the open
web
so if uh off topic of course but
let's let's look at it if a
[Music]
website that you don't want directing
redirecting to you
redirects to you uh what can you do
about it
this is a legal area the likely answer
depending on
what top level domain that website is
coming from you can probably do
relatively little um
but yeah it's it's more of a human
problem than a technical problem all
right
one problem number one it was shellcode
from stdn but my
shell code raw isn't std out friendly so
let me show you
how this can work all right
here we are in baby stewart and and in
this container or in baby shell this
container gcc will work again
so we can we can even reasonably do
stuff
let's write some shell code just very
easy
easy shell code let's
bring in our standard preamble
all right uh
let's rewrite the shell code that just
doesn't exit
so this will exit um
with a 42 gc static
dash no stdlib dash o
shell code elf shellcode dot
s sorry about that
okay and now we just run our shell code
elf and we see that it exited with 42.
we can s trace our shell code out
and we see that it exited with 42.
all right then we can opt copy
dump the section out
here's our shellcode draw so the
question
was if i capped this shellcode raw
it looks like right it it
is it just has a bunch of h's so an
interesting thing you'll you'll find
when you're
looking at the essentially ascii uh
representation of your shell code for
amd64 you'll see a lot of h's
h is an instruction preamble that tells
the processor that this is 64-bit these
are this is a 64-bit instruction
um which is pretty interesting and and
one thing that you might have to
soon think about is what if your shell
code can't have an h
in it all right so
um
connor someone on zoom is saying that
the challenge direction is only the
testing challenges
not the teaching challenges
oh okay yours might not have generated
we're still working on generating
um all of the challenges
where's my mouse my mouse is dead nope
oh
my mouse ran out of batteries
huh all right let's put my mouse on
the charger
we're back all right um cool
uh what do you do if you can't copy
paste your shell code right of course
this uh program it reads things from
standard in
so i can type it in here but i can't
copy paste this guy if i copy
i mean this could potentially work but
most likely it won't
yeah so it didn't work um
no problem uh linux supports
redirection of standard input you can do
it in
two ways the more common but
will potentially piss people off if you
just cat
this just like you do but if you
actually put the pipe
you can redirect into
the uh um
into a different program and and when
that program reads from standard input
it will actually be reading from uh the
contents that you are piping into it
that's the the verb and there you go it
executes the shell code and you can see
it exits 42. if the s trace it
oh yeah so if yes trace it it does all
this closing of file descriptors
um and then it uh
does our exit 42. very cool so that's
how you
get shellcode into this program this
uh this is what's called an unnecessary
use of cat
and some people that are purists get
upset at this you can technically also
redirect
uh shell code redirect input like this
so this says
uh redirect input from this file
boom same thing you can also redirect
output
but
it shouldn't matter
i have no idea why output wasn't
redirected there
i have no idea why that doesn't work let
me show you on ls
that obviously works right register i'll
put an ls into a file
um again uh this is kind of
some of the stuff that the course
assumes you come in knowing but but
you know if there are gaps you can uh
uh fill them in all right
question do we have to do both teaching
and testing yes
can you talk about position independent
shell code
all right i can talk about position
independent shell code
let me show you
um shell code that is all right
so let's say that i had position
dependent shell code i can
and and in fact the the default way i
teach you to compile
to assemble shell code creates a
position dependent stathy linked
uh program where if i run the shell code
elf
break and start that's always going to
be 4x4010
if i run it here we are
let me show you the nexus
let me show you the next instruction and
it moves
42 into rax you can
make these uh gdb less wrong set
this disassembly flavor
in oh hold on let me just copy that out
my gp in it
there what did i miss about disassembly
if you put this in your in dodgy be init
in your home directory
gdb will be less wrong but hopefully you
installed one of the
gdb um fancy gdp things that that i
recommended like phone
debug um all right let's do this again
great start
display the next instruction and then
run all right here is 42 being moved
into rax all right
and it's always at 401 000
right so we can take shellcode.s
and we can say okay um
at let's let's say we wanted a
a an exact sys code
[Music]
that is exactly
59 how do we figure out what exactly he
is
very easy we go to ryan
a chapman just google for in a chapman
syscall and there's your syscall table
amazing so then you search for exactly e
and it's 59. uh that's not very visible
on there
here we go 59. awesome all right
so we're writing a shell code here that
will trigger syscall 59 exactly takes
as an argument the string obviously we
can't just put it here
um to run so we need to put it somewhere
let's put vin sage here
and i of course talk about all of this
in depth in the the lectures
and then here let's say we um
uh let's see if this will work
and then we move rsi
zero move our dx zero let's compile that
okay let's look at what
it now it looks like
okay so this shell code is reading
from on a direct address
this uh 40101f
into rsi and actually what we we don't
want it to read out of that sorry
we wanted to load that effective address
so we load the address of the string
into rsi so let's compile this
i've done so same thing loads the
address of this string
that is in memory in the text section a
little lower
right what this looks like when we run
is a direct memory read
and this works because
uh this binary is in uh
the right space in memory right so now
let's let's extract the binary
[Music]
um
let me see if i have yeah
all right so we extracted the binary
uh and you know if you just run it
it
what's going on
exactly no no no no
oops rdi
no one caught that come on
okay if we run it gives us our shell
great if we uh opt copy it out
and then we cat
that into baby shell testing
we get a illegal instruction
now this says core dumped
conor the core wasn't dumped
can you make sure the core uh format is
correct
on the server
anyways let's uh we'll do something so
we can
run it in gtb in the meantime
we can run with the input of
shellcode raw all right so it crashed
right and it crashed here
so why did it crash here
um let's
this this unenhanced
gdp is annoying let's look at the
registers rsi
zero are the uh x is zero so those are
the
second and third argument to exactly e
rax
is uh a negative number that's the
return code
return code negative 14 from exact ve
let's s-trace this so you can see
exactly what happened
uh
this is what happened we passed in a
position dependent
address of our shell code
in our shell code that we got that was
correct
when um we were looking at
the shell code in the context of a
position dependent statically compiled
valve
right this and this
synced up because the whole binary
when this runs gets mapped here
that's bad news um
when the binary is not mapped there as
we can see here
or when the shell code is not mapped
there
absolutely man
illegal instruction it didn't even claim
to generate a chord number now
um all right so
uh let me regather my channel
so the position independence that's bad
news now we need to
uh figure out how to make a position
independent
and someone on the the um
twitch is a real deal shellcode pro
because they know that amd64 added some
amazing functionality
which is to uh
offset in a memory load or a memory
uh address
load effective address the instruction
pointer if we do this if we do
rip plus bin sh and we compile this
or assemble it and we opt dump we see
something completely different now
where there was a hard-coded address
there is now
an instruction that instead says instead
of loading the address directly into
rdi just take the address
take the current instruction address or
next instruction address
add 16 to it so the next instruction
address is here
so this is 0 1 2 3 4
5 6 7 8 9 10
11 12 13 14 15
and here it is 16 is right here 2f
and that's it it's that simple right so
now
with a change of 4 bytes this shell code
is
4 bytes in the assembly this shell code
is positioned independent
we can opt copy it out and we can run it
oh fudge it oh yeah yeah
okay so if you ran it you see it exact
bin sh all right now here's your next
problem and i mentioned this in uh my
office hours
stream um we're counting
uh something very redirecting input into
this guy
and then when bin sh runs
it reads it in a command from standard
input standard input no longer has
anything inside it
so it exits so we can solve it in one of
two ways we can
put cad here so what this does is
it'll first redirect the output of
cat shell code raw and then redirect
output of just cat which
reads from input and then writes out the
output so here it is now we have a shell
uh why oh because bin sh
you don't want ben sage bin sage will
drop privileges
um let's actually go into this real
quick uh
[Music]
bin sh has been used in so many
um
[Applause]
[Music]
of these sort of attacks where you have
a set uid binary and then you
call bin sage that bin sh checks
if it is being run uh from uh
an suid
parent process so it checks if it's a
effective address is different
than its real address and if that
effective
effective uid
then it's real uid if the effective uid
is zero the real uid
is non-zero it'll actually drop
privileges by default you can
um add an argument so instead of running
bin sage we can run bin
sage-p but then we would have to work
with um
this uh
[Applause]
[Music]
the the second argument and so forth
it's it's a giant pain in the butt
my advice um create instead of running
been sh
run slash
home csc 466 slash cat flag
let's get our create a cat flag
send file one open slash flag
zero zero one thousand nice and simple
cat flag.c okay and then let's just run
uh let's gcc the shell code obj copy
the shell code and
we shouldn't need this anymore so now we
just
figure out why it's no longer working
what's easier debug here illegal
instruction
what did we do oh
that's afterwards also it's much easier
if your shell code
actually cleanly exits so you don't have
to debug
what went wrong um you can tell that
something went wrong when it crashed
instead of leaving
instead of wondering okay this seems
good as straight said it tries
to run cat flag and there's no such
thing as catfight
oh it's home ctf my apologies
okay gcc opt copy
we run okay perfect so now
as you will see
we're on our shell code
it will run our
[Music]
where did it start okay
here it runs cap flag then cat flag
will try to open the flag but of course
it doesn't have permissions
so a good way of debugging this to make
sure that you you have the right
permissions and so forth or you have the
shell code correct it's actually trying
to open flat correct
launch this thing in practice mode did i
do that yes and now you
you can um you know chmod
the flag to be world readable to make
sure that your cat flag works to make
sure that your shell code works
then make sure that your full end to end
attack works
boom it works our shell code ran open
the thing it's now position independent
of course you can make a position
position dependent shell code that
will happily work at this address you
just need to compile your
program in a way uh that
um or or manually specify
the the memory read address it's
actually on x86
position independent shell code was
harder on 32-bit x86 on 64-bit x86
position sorry yeah position independent
was hard on 32-bit
on 64-bit position dependent shellcode
is almost harder to write
if you want a specific position right um
so just use this it's called rip
relative addressing and it's all good to
go so anyways now we got this
practice flag this doesn't do us any
good in terms of points on the
scoreboard
um if we go
[Music]
and launch up which one is this testing
one
we launch this for real now ssh in
the home directory is preserved that can
just literally hit
up enter hold on
now it's ready i've reconnected
what the is going on
okay there we go uh and uh
why isn't my history whatever cad shell
code
raw
baby shell and boom and this is the real
flag that's my flag
don't use my flag get your own flag
but i'm gonna submit my flag so you can
see that it works
boom okay and now i have
baby shell testing one um
[Music]
let's catch up on questions yes sh drops
privs as someone in
in uh and zoom said um
someone asked can you just use a
different shell do they all draw
privileges
they do not all drop privileges um
different shells
uh uh like k shall last i checked didn't
drop privileges i don't think
that k shell exists on here
no but it might be worth installing
connor
um but you can also use the
the um like okay
question why was it harder to use dash p
in the assembly
um let me write a c program that runs
sh-p and you'll see
[Music]
here's what we have to do we have to
exactly
then sh and then and i'm going to write
something that doesn't look like c
we have to give it arc v 0 and r v 1. so
we have to give it our v 0
and we have to give it r v 1. this
roughly speaking
is what uh it looks like of course this
isn't valid c
so now we have to have a char star star
arc v
and we have to have a um char
uh let's see this chart v uh
that has two things in it one of which
is
bin sh one of which is dash p
right and again we're still in c uh if i
got my syntax correct
let's see
oops i almost got it i also have to null
terminate
this uh argument list
uh now what
no we didn't know terminated oh yeah
that's because
i have two so i actually need three
things in here
run it boom that works all right let me
show you
uh let me just uh
yeah so let me show you what this
monstrosity looks like
this with some setup
with some setup now we've turned a very
simple thing
into this insanity right um
where we have to set up all of these uh
uh structures in memory and in c it's a
pain in the butt
right this was took me a couple minutes
in
assembly it is going to be a bigger pain
in the butt
right so we have to have one string
that is bin sh one string
that is dash p
and we have to have our null
i'm sure there's a better way to do it
but i keep forgetting what is the eight
byte
constants called one two three four
that's the eight by guy and then we have
to set up
somewhere on the stack um
so here we do bin sh rsi needs to point
to
um so let's do this load into
rbx rip plus dab
bin sh this is arc v0 the name of the
program we're gonna uh be
um executing we will push
that onto this stack
yes um
then we will move that
now we have to do it backwards uh we'll
first
we don't need the null bytes what are we
doing we'll first push
null bytes
then we will push
this dash p
then we will push this bin sh
not move with load effective address
and then we'll move
uh point rsi at the shell
and i think this might work but we'll
we'll have to debug probably
okay
oops the show shall good elf
okay shellcode elf holy crap
who is impressed i am so impressed with
myself right now
one shot uh okay
let's see my thought i'll
catch up on that later okay so
kill that okay so now we have something
that will run
sh-p but you can see
how much longer that is
my old shell code was beautiful all of
this
uh all of this was one line right
so that's why i would recommend just
having your own as
like replacement that will cat flag all
right but now if we opt copy this
oops why did my history not save
something's wrong anyways okay if we opt
copy this
dump section um into shell code raw
from shell code elf now we do
shell code raw baby shell but of course
we need to cat here
boom running as rude
oh oh that's interesting so
yeah yeah yeah yeah exactly yeah
effective uid zero
all right that is uh how you use shell
code that will
work with having sh run um
okay um
[Music]
uh let's catch up on some questions and
then we'll
move on it's exactly time for the
collaborative uh
connor how is level two doing did we
generate it yet
okay so we'll add um all right what have
you got
um okay so i'm starting from
oh can you show the cat flax c program
again
here it is
[Music]
zoom fps so low i didn't see him in all
that list i'm sorry about that the nice
thing is the lectures available on
twitch immediately
um and then it'll be on youtube very
soon um
some people saying that
asu 330 didn't quite prepare people for
this
uh
is 3 30 the computer organization course
oh it's the last course i see i see i
see yeah
how do i save my code in the server all
right
we have a query when you log into the
server it drops you into slash
this is the root directory and you don't
have write permissions to the root
directory
if you just type cd and enter it'll go
back to your home directory
which is home ctf here you can do
everything you want
and it will save it across all
of your challenge instances so you can
actually use this as a workspace we will
do our best not to accidentally delete
anything
um all right this time looks like it's
going to be rough
well i i faith in you you you can all do
it
um are you going to pose the solution
for level 1 no
in fact the the shell code
um if you go through the videos the
shell coding videos that shell code will
work for level one
not the bin sh one but um the uh
send file one or if you just replace
bins h with your own
file all right um
cool let's catch up on twitch and then
we'll go into the collaboration space
is pawn tools on the instances conor's
pawn tools on the instances
sorry brain dump yeah looks like pawn
tools on the instances what is prone
tools i
discuss it briefly in my videos um
basically pawn tools is a library
uh python library python module
for
[Music]
exploitation dev and and you know with
an application to ctf specifically
um go
use it um it has shell code generation
capability
my advice to you is not to use that
because that will not get you
farther than i don't know level some
level
in this homework right and then you'll
have lost out on you'll have to probably
go back and learn everything and redo it
manually
to tackle and go further um okay
um oh someone on twitch
mentioned this command cd dash it'll
switch to the last directory you were in
it's very useful
um someone's asking how many levels i
don't remember i think there's going to
be 13 levels
um okay let's um
start
collaborating um okay so how many people
do we have under we have 91 participants
on zoom
however i think discord is going to be a
much better collaboration
tool um let's see
how we're doing on discord uh oh wow
the memes have been active this is good
there's some good memes i'll i'll i'll
do uh more meme updates
okay that's great uh anyways
uh let's uh let's dive in um
the uh discord link for the world is on
my twitter
um and the uh
um discord link for
the asu students is on canvas
please choose the right one that'll help
you uh
uh get to the right place on discord i
create a bunch of voice channels
join the voice channels you can you know
stream your your video
and and um your
[Music]
screen if you want to collaborate i see
a few students piling into
one channel uh you can do that
but it it'll probably be nicer to
uh have smaller more dedicated groups
for collaboration so as a reminder
this collaboration hour everything is a
go in terms of collaborating on this
shell code
um assignment uh try to get through
those first two levels
um and then uh
give yourself a good head start i'm
going to
um
answer one more a couple more questions
and actually i'll probably stay on
twitch answering questions but the
stream's gonna
get decisively less interesting um
if it gets really really less
interesting though we might just uh
end the stream okay quick query um
asu people on zoom do you want me to
keep the zoom open
and create breakout rooms or does
everyone want to collaborate on discord
instead or rather
speak up if anyone wants to keep the
zoom open
no zoom love am i
am i still do i have audio on conor can
you say something
okay i saw a body on good so it sounds
like no one wan
i will keep zoom open anyways um what i
will do
is um stop screen sharing on zoom and
give everyone rights to screen share
this
please don't you know make me regret
this so now everyone can screen share if
people want to
collaborate on zoom otherwise um
homework
uh module 2 is live it's due 4pm we'll
launch
all of the the challenges uh
over the evening it is
well we'll launch at least 10 to get you
started at least 10 levels
um it is due um on
wednesday at 4 p.m like the previous one
uh good luck and i'm still here
if you have questions i'll be on zoom
audio and i will also
hop in to different discord channels and
you can
ping me um
first three levels are launched all
right twitch
question should we copy the code to our
local machines and work on it there
um uh
i for this one probably you can you can
do
fine my advice is approach the the
teaching challenges first in practice
mode
so you have sudo you have everything you
need in sudo you can install
programs if you find something is
missing right um you can set up
a development and exploitation
environment in that home directory
and and and uh be perfectly happy for
this assignment
long term i would recommend having a
local
uh you know dev and exploitation
environment
oh you're right uh sorry
connor mentioned you don't have network
access so you it's actually
hard to install things you can sap in
you know
uh local uh installation of stuff
but um that's probably
more of a pain than you want to uh
deal with so if
i think for this assignment that
environment is probably
sufficient and if you have requests on
what to install you can install it
for you know next times um
but in general i would recommend
um um
setting something up offline uh
and and working on it there
cool all right
the my asu link failed for zoom i didn't
see this before okay
checks channels for each voice channel
okay i'm creating text channels for each
voice channel on discord
this is uh
okay torch has a text channel
rest has a texture oh
i see i can't move text channels into
the zoom shot okay
swarm
you
okay all
on the asu side of things
things should be
text channels should be created i am now
doing
the
world side of things
okay
as a reminder if you're having discord
issues um
we can keep using zoom as well
uh there's some good memes good memes
someone on twitch uses parrot os what is
parados we're gonna search
the internet
parrot linux all-in-one
framework for cyber security software
development and privacy defense
based on debian testing
ah
victim of the system d
war
so parrot is like kali uh question for
twitch people is paired like kali in the
sense that
there's a lot of very broken software
um because of how it is installed and so
forth or is it
is it like debian with just some things
added actually i don't know if modern
kali has that
problem
give me advice for the buffer overflow
challenge we'll get to the buffer
overflow challenge in two weeks
be patient
oh those on the zoom if you're waiting
for a breakout room
you don't have to wait for a breakout
room we can uh
use the main room
do
someone colonel panicked their system
running our docker container
probably this yeah baby sue daca can do
some weird stuff
all right so a common question on um
discord that i'm seeing as i bounce
through here
is uh how do you get started
on uh the homework
um let's let's take a look
right so here here's
let's go start start to uh finish
pretending we are
completely um lost
i'm not not very rare that i'm
completely lost it happens
definitely happens okay um
oh and conor we're putting up more and
more challenges right there's someone
solving these challenges live
good all right so let's say i open this
up
open up phone college and uh
i see level one teaching one hit play
same practice mode
all right i can connect up i will now
ssh
ah one sec let me share screen on zoom
again
okay there we go i'm sharing screen on
zoom
connor the server is uh getting slammed
okay
so um i get dropped
into this uh container
uh note connor can we make um
the home directory the default when we
drop in or is there
a technical reason why yeah yeah let's
let's add that to the to do so
we can work on it tonight all right
go into my home director here's all my
old stuff but we're gonna pretend this
doesn't exist
all right cool okay
so we're here fresh we go looking slash
and we see
uh baby shell level one teaching one and
in slash challenges we see
under baby shell the source code of the
challenges
all right so i look at teaching one
and i see that this source code what it
does
is it seems to memory map my shell code
and i know this is repetition from
before i'm just trying to uh
give a walk through it i
made sure that that memory map was
successful and that it got mapped
here
[Music]
it reads in my shell code
or it says that it will and then it does
right so reading
from standard input into my shell code
mapped memory that is
readable writable and executable best
case scenario
and it reads uh quite a lot
of bytes right like 16 kilobytes of
stuff
[Music]
and then it makes sure that it read
something
and it jumps to my shell code okay so
obviously
my uh task is to create binary code
that will jump that
the program will read in execute and
the task for the challenge is to
read slash flag right and the slash flag
of course
is only root readable and this
baby shell is set uid root all right so
i need to make baby shell
read my flag by giving it shell code all
right so then i can start
doing stuff like this this
seg faults hi in fact doesn't
disassemble to anything
bad news okay um
and the the teaching version of baby
shell it will disassemble your shell
code
this on in homework one
in level one i mean you can disassemble
your own shell code right when you
generate it and you look at it with
optional
in future levels this is going to get
harder and harder because uh the levels
are going to mess with your shell code
uh and so you know disassembling
your shell code is going to be um
tricky trickier to see what the state
will be right when it executes
but the teaching challenge will do it
for you it'll do the mangling and then
it'll
disassemble your shell code cool
uh connor can you double check i'm
pretty sure
that
yup okay
the one second second sec
all right the asu discord link just got
shared on twitch
so uh i killed all the
all of the discord links
yeah okay
what message
oh well it's it's irrelevant now
uh let me create an updated link for the
world and
if there are any asu students that need
that link um ping me
and probably what we'll do is after this
call we'll just wipe that discord and
resend out the
link
um all right let me
[Music]
i guess we should have expected that to
happen
oh yeah that's a good point there was
one person and uh
six minutes ago that joined
yeah cool cool cool all right anyways
uh can you create a new link and then
respond to my
twitter my tweet with that for the world
all right um anyways let's go back
to uh this one
all right so now i have uh this
challenge of having to put in shell code
that will
get me the flag um that
is uh that can be done in
in a number of ways but we're gonna
write it from scratch because we are
awesome
so then i re uh watch my own lectures
and i see that we can
write assembly
actually let me back up just a little
bit
what if we do get our old old
cat flag that c
right here's catflag.c
and we just compile it nice and easy
we're just compiling a c
program what happens when you compile a
c program
what actually happens is first
gcc involves the compiler
gcc is actually a big wrapper around a
lot of
different tools that are collectively
called gcc
first it involves the compiler the
compiler
will compile cat flag
into catflag.s
right catflag.s
no come on dash capital s sorry
a lot of these tools will do more than
they
should all right so when you compile a
program
the term compilation it
originally generally means generating
assembly code
so you end up with this assembly code um
that is generated there's no way to make
this in proper syntax it use at t syntax
unfortunately
internally but that's okay
but of course we could rewrite it with
uh intel syntax the proper syntax
so now we have this then we then it
assembles it
so it assembles the shell code to cat
flag.o
and now we have an l file
and then it links
cat flag.o into cat flag
this isn't gonna work because i ld takes
some arguments
um that i
[Music]
don't uh remember off the top of my head
but we can simply replace that
with gcc and it calls fdld properly
right so this is the multi-step process
to create a binary
um file right in the same way if i was
lead enough i could literally
sit down with a hex editor
and write my shell code right
kind of we should add a hex edit to the
things we want to
install on this challenge box
um but and and i've known people that
that could
write a couple of things you know i i
i have several uh assembly instructions
memorized
for example in hexadecimal ebfe
will do a tight infinite loop it's very
useful when you're trying to debug some
shell code all right
um but i'm not going to write this in
c so i'm going to write an assembly in
assembly as you saw
in our cat flag assembly
there's a whole bunch of this sort of
metadata that that's generated or not
meta
like metadata that describes the file
describes what section describes a lot
of stuff
right we don't
need all of this stuff but we need some
minor amount of things so that the
assembler can function
right um so now we go shellcode.s
we and and we do the same thing we write
the file
that the compiler would generate and and
the minimal
that i've determined through like trial
and error and googling is is this we
need a
start symbol that is where execution
will begin
when we uh assemble this when we do the
as
step um similar to what we did with cat
flag
and that starts so we say there is a
start symbol
in this binary and that start symbol
points right here
and everything that's going to go after
this is in an intel assembly syntax
technically speaking if you're willing
to write a tnt assembly
i wouldn't recommend it you can remove
this but
here it is and here we can start writing
our program
right so actually if you want
um i have no idea if this will work
but if you want we could try to take
cat flag
and actually move
this stuff so here's cat flag
i wonder if we can just move this
this is going off script might be a
terrible light it's probably a terrible
idea
um move this into our minor our minimum
shell code
so let's move here here we do our
preamble
of course in the normal you know cat
flag
compilation process it uh the the
the assembly specified a glo main
instead of a dot start and so forth um
but we don't uh uh
we're just gonna put this directly in
the entry point of the binary and hope
it works
um there's a couple things we don't need
um one of the
uh specifically this these directives
are for
uh control full integrity they are
actually to prevent exploitation
um they'll they insert some additional
stuff let's take this out
um this lc0 is probably the cat flag
[Music]
path whereas lc0 here it is yup
so we're going to take that put it here
and this this is a t assembly syntax for
instruction pointer plus c0 so from this
you should hopefully understand why a
dnt assembly is
unusable in intel assembly it's just
rip plus lc2 much easier all right this
should be our
uh cat flag exactly um
uh done except for this return there's
nothing to return to this will just
crash
might as well remove it because there's
there's not no function that set this up
there's no function that called us rat
returns from a function call um
i honestly don't know if this will work
but we're going to try
so in the same way we can assemble
shellcode.s
into shellcode.org
sorry this no longer makes sense
because we uh uh are not using intel
in there okay we assemble it it actually
assembles
we'll link it into shell code elf
okay yes and now we are having trouble
because
there's an undefined reference to main
so let's instead
say okay try this as main
i realize i misspelled global so i
wonder if
you need that line all right let's
assemble it
it actually compiles shut if we run
shellcode
actually let's since we're in practice
mode we can make the flag
world readable so that we don't have to
worry about the suid and stuff
let's run our shell code elf and it
works
so what we just did we took cat flag
dot c this we compiled it
uh into assembly
with dash capital s you can also you
don't have to run cc
you can you can do gcc uh
uh dash s okay this just compiles it
and then um uh
there's also a gcc dash
to just do the assembly without the
linking i forgot anyways
um you can use as so anyways we compiled
it
into assembly so this is the assembly
that is equivalent to our c code that
our c code compiled into and then we
extracted this
into our minimal shell code and we wrote
the shell code with it basically and
here's our shell code
and our shell code will do the same
thing that our cat flag does
of course just to summarize our shell
code looks like crap because it's an
atm z assembly and afterwards it'll
crash
but actually we had red in here if you
put red back in
it won't even crash it will return from
main properly
let's
assemble that shell code and we can just
use gcc for all of this
um right so so we can actually gcc
shellcode.l uh that shows shellcode.l
from shellcode.s
directly right like we do like i talked
about in the slides and previous
lectures
then if you launch our shell code elf
amazingly it actually works and that
cleaner turn makes it
golden all right so now
things are a little bit harder because
we can't do our object coffee trick
because this isn't the only
assembly in the uh
in the binary right because this is an
actual normal binary but but
shows us the life cycle of everything so
now
we have to convert shell code
that s into actual shell code that will
run if you just export the raw bytes
and pipe it into a
into a program into your shell code so
there's a couple of problems one problem
is this
call send file this is a library
function in libsy
that we don't have access to when we are
uh and and actually this open
and we'll be we'll talk about all of
that
a little later about you know what how
library functions are resolved and so
forth but bottom line is your shell code
should really
uh for the purposes of this module hold
on i think i just lost audio
let me
can somebody say something oh yeah i
lost audio
great one second let me reconnect my
headphones
the joys of linux
all right we should be back uh
can someone say something i'm zoom
hold on let me fix my audio and reshare
connor can you say something on zoom
connor's either dead or uh i don't have
audio on zoom anymore
okay people can hear conor but not
but yeah of course you can still hear me
because my microphone isn't
the freaking uh airpods all right
uh pretend that i
well which is now true i can no longer
hear anybody
it's a zoom issue it's a zoom issue
interesting
one sec let me let me start sharing
again
connor can you say something
yup can you say it again
okay perfect zoom just needed to be
shaken up a bit okay we're back all
right oh wow it got dark i didn't
realize
let me turn on lights
and sorry about that
noise taking in my
fancy studio
uh rigged up light okay cool so the
bottom line is
your shell code can't call into library
functions
there are a lot of technical reasons
that we'll get to
later um bottom line don't do it
um so what we need to do is make system
calls that'll call
open and send file instead of library
functions and then
we can convert change this to dot start
and once we have that we can compile
this as our
um um
[Music]
uh what's it called our uh shell code
right in in how i i talked about in the
lecture
um so
uh let's start converting into shell
code one
all of this push rbp move rsp rbp
this is i'll talk about what this is
more in the reverse engineering lectures
um this is basically function setup it's
called the function prolog
and down here is the function epilogue
you don't need this
we don't need this stuff in shell code
right so we can remove this
we can remove this um moving zero into
eax before returning this
does the return zero uh eax
and of course that extends into rex is
where the
um
return value lives of a function we
don't need this either we're not worried
about returning
um now and and again
hopefully this will be the only time in
class where you'll see me work with atnd
syntax but we're just going to stick
with it
so we need to change this open and this
send file
to system calls so how what do we do
well
we're gonna uh first there'll be a
syscall
instead of this open
and two we need to figure out
uh move l some number and this is again
a t assembly
here this this e x
we need to figure out the syscall number
of open and the syscall number of send
file how do we do it someone on zoom say
it
connor how do we find syscall numbers
ryan a chapman okay we need two numbers
we need open
open is syscall2 nice and easy we need
uh send file
send file send file send file send file
send file i'm going to search for that
because i already missed it
send file is 40. okay
so we're gonna do two oops
two into rx here or eax and then zero
sorry back to you and uh 40
here okay so we
started with catflag.c
we uh went to cad flag.s
by assembling it we extracted that file
of that the the assembly here
put it in shellcode.s
we had and and that had these open calls
i commented those out
and i changed them to system calls and
now we're going to
compile it
with our no stdlib because we're no
longer using libraries because we can't
use libraries it went as shell code when
we actually inject it
with a static elf just
so it's small uh in this case actually a
static have a smaller it's easier to
work with
okay that and then now we can opt dump
see what what happened and end dash d
shell code
dash elf here's our shell code
here is the this is that string here's a
syscall
here is cisco pretty amazing right at
start so
let's s-trace execution of it
and something got screwed up so we open
the flag properly
and when we're sending the file we put a
zero
instead of a 1000 somehow so something
got lost uh ecx
so probably ecx isn't actually
yes so this is a difference between
calling a
user space function and calling a
syscall possibly i'm
too tired to set out the top of my head
with authority but the fourth argument
in a syscall is r10
i'm guessing the fourth argument in a
normal function as rcx is
oh that that might be true um
all right so let's move
into r10 this uh 1000 and this uh now
has been moved q
assembly syntax is not very nice okay
now if you compile it again now we s
trace it
and now it works we fixed it up
boom so again we started with c we
compiled that c into assembly
that's what happens to any c program you
compile it'll uh
become assembly um eventually then
um we uh assemble that
into uh or then we pull out that
assembly translate it to fix some stuff
up so that it's valid shell code
and then we put it in this file now
we can extract it with opt copy
and now we can cat that
to baby shell and it's actually
oops what is all this
here's shellcode elf
here's shellcode raw
yeah that's correct
and this is fine what is all of this
where did this come from
okay
okay i've no idea what happened oh did i
catch shellcode elf
no
yes i did sorry i ca classic mistake
i sent my entire l file as my shellcode
that is not
my shell code all right my shell code is
actually the extracted version boom and
you can see it ran
let me show you uh but of course we have
flag in practice mode we uh
if you see a smart let's make sure that
this will work in real mode
it works even if the flag is 0.600 let
me log out
rerun go back here
go here run start it in real mode
okay i think that's ready sshn
let's make sure i know i was yep awesome
no more pseudo access
then i just do the exact same thing and
i have the real flag
again this is my flag please don't
submit my flag you will end up
getting knocked for cheating all right
correct
cool does this did this help
awesome people piling in
that it helps okay so basically what you
are doing
is kindly out of the goodness of your
heart
extending the functionality of a
vulnerable program to implement
a feature that unfortunately the
original author is neglected
to add which is a feature you want which
is reading the flag
or if you are less benign
uh infecting the you know
victims computer or if you are you know
[Music]
the the possibilities are endless when i
talk about this
in um interviews with non-technical
people
i say it like this you're taking a
program that just knows how to dance
sorry i that up you're teaching
you're taking a program that just knows
how to walk
and you teach it to dance all right
that's what this sort of exploitation
is um about uh you're dancing with the
program
baby shell uh all it does
is read in content that's not
that that's its functionality it reads
in content but
because it also jumps to that content
you can make it do anything
and you make it do anything by um
initially thinking what do i want to
achieve you can write that in c
assemble it and go uh step by step
through that or
eventually you can just
um start directly from
the assembly global start
underscore start that's where the
execution will begin
intel syntax no prefix
and now the world is your oyster what do
you want to do
you can do anything
typically if you're just doing this live
you just do
60 uh into rax
42 into rdi see i'm affected with atm t
syntax now and syscall and you exit
exit stage left
static dash null stdlib dash o shellcode
2
alph shellcode2.s
and we exited 42. cool
so you can you can start from c and then
move into
assembly but eventually i'd
encourage you to think in assembly
uh in some sense we leave the c behind
when the program's compiled what is left
is not
c
but if it helps to start with c then you
can do that also
that will get you through level one for
sure then things start getting a little
harder actually this shell code will
probably also work for level two because
it's position independent
um but things will the first couple of
levels are actually very very similar
right they're just meant to explore
sliced subtleties
of your shell code if you happen to use
them
but starting from like level five you're
gonna start having a worse time let's
take a quick look at level five
just look at the source code directly
level five um interestingly enough
if you want to figure out what the
shelter is doing the source code of the
testing challenges is much easier to
read
than of the teaching challenges because
the um teaching challenges have a bunch
of like
debug and so forth output that's a
little hard to get through so here's
that
memory mapping um here is
uh it make sure to map it at this
address
reads in your shell code ox1000 of it
and then it looks like it filters
something
uh and i can recognize that this
right here is a filter of
um the
assembled represent the binary
representation of the syscall
instruction
so you can no longer do syscall now how
are you going to
read from memory oh sorry how are you
going to read the flag
right so it starts getting harder and
harder
cool all right i'm going to check in on
discord
dang we had a massive downfall of the
sandwich channel on discord
what happened here
ah crap connor
we uh may have forgotten to
take out level three
it's the buffer overflow
that's two weeks away
um can you take level three down real
quick
all right students um i'm actually gonna
add
uh well hopefully they're all watching
the twitch stream still
um we're gonna remove level three real
quick um
because we we meant to update it with a
different
level so for now there won't be a level
three
uh sorry about that if you can solve it
then you're kind of ahead of the curve
we'll cover the level three
um uh
material in two weeks uh with the memory
corruption module or
three week three weeks um
yeah sorry about that focus on on the
shell coding
nice i see uh someone starting to
execute shell code
on discord
some good memes
yeah so we'll replace level three um
with i'll just replace it with a freebie
an echo uh the flag is this channel
uh challenge and then we'll so then
there might be a total like
14 levels instead of 13.
are bad okay cool
okay we're nearing the end of the stream
any uh any final uh
questions no level four and five
connor do did we forget do we still have
buffer overflows in level four and five
that we don't no we don't
yeah yeah i think level three was the
only one
let me sshn and uh look at the source
code
yeah yeah so we had that one
buffer overflow
level three testing one
ah my bad yeah that's that's a
that's let's go now we know we will fix
it
okay just to make sure all the rest have
one two four and five perfect yeah
awesome
okay
um so whoever is saying uh i spent five
hours working on level three on the old
site
that will be useful in um
uh fratiger on on twitch that will be
useful
in the memory corruption module we'll go
straight into that
um
any other questions before we uh
we change ah okay uh
someone on zoom uh submitted my key for
level one
uh that's uh very bad news
uh connor can you unsolve level one for
this person
okay yeah please don't submit my uh
my flags off of stream
we have seven more minutes for questions
and then we are out of here
all right i think we are
pretty good any questions on life
connor do you have any questions
how did i get started on all of this
that is a question
um
i got started on um
on hacking so i got started computer
science when i was
five or six years old when my grandma
got me a book
called professor fortran's encyclopedia
it's in my office at the university
and it was a a children's book
and whatever first grade me read reddit
cover to cover
like a million times obsessed with with
computing and then i was hooked on uh
like the concept of computing ever since
right there's an
awesome book for kids um then i got into
hacking in high school in the typical
way you do you start
messing around with linux and then you
have a linux server and then you give
your friends access to that linux server
and they give you
access to their linux server and then
one day you
log into your server and they rooted it
and you're like okay what the hell
happened and how can i get them back
for this and then this leads to
[Music]
continuation of constant building up of
knowledge
um the other reason that i'm doing
this on this level is that
uh i went to an undergrad
institution rensselaer polytechnic
institute that was extremely
serious about this type of
computer science education our in fact
this class
at least through you know i don't know
week
module four or five was our computer
organization class not this exact class
but these concepts were were forced
on us in computer organization rather
than in our senior year um
and uh rpi actually has one of the top
undergraduate hacking teams now um in
the world which is super cool to see
they competed at
the uh world championship of hacking
defcon ctf
um so yeah it was a combination of
of uh my friend hacking me and uh
good good undergraduate please um
question why does asu take so long to
uh get us to the good stuff um it's
tricky to get
this stuff um you have to be willing to
kind of let if you introduce this early
a lot of people will fail that course
right um
and you can have a
viewpoint of you know okay you
a lot of people fail but that's just
life they'll have to drop out of the cs
major and so forth
um and that was when i went to college
was the viewpoint
that rpi had right um
it's not quite the viewpoint that we
have we're trying to be a bit more
inclusive but they're balanced
sacrifices and compromises that have to
be made um
so instead we tried this ramp up
approach
uh but maybe there's room for like an
alternate track where
you know people that understand what's
involved
will try to you know push through much
harder classes
or something on those lines
question on the twitch how good is asu's
hacking team on the world scale
all right so asu has a cyber security
club called the pawn devils the pawn
devils
hack on the world stage as team
shellfish let me show you uh
the defcon ctf so they're definitely ctf
is one of these sort of the
world championship uh event in um
in uh computer hacking
uh if we go
to defcon ctf 2020 finals so
defcon ctf is run by me and uh
mike and and colleagues and friends um
as
uh the team the order of the overflow
that's what this
uh t-shirt is all about um
last month we ran the final the the the
championship event of 2020
um and a team one called aoe um
a0 from china um
shellfish is right here seventh best uh
at least in
in this uh championship hacking team in
the world
right so uh not not all of shellfish
is asu people um and
uh um
so on but but asu is a makes up a
significant chunk
of this team um alongside uh
friends from uc santa barbara um
and and uh places around the world um
so yeah i guess uh seventh
um an interesting
testing ground is coming up uh
which is called seesaw
so see saw undergraduate
ctf
uh but rather than the other saw ctf
so seesaw is one of the biggest
educational
cyber security competitions around and
it is happening next weekend
this will be my officially uh sanctioned
possibly mandated
ctf for extra credit for for next
weekend and
uh i know shellfish is going to um
uh try to push hard on uh qualifying for
seesaw
um so they've been uh talking a
lot there's a lot of confidence in the
in the talking um
so hopefully hopefully uh they will
get there it's very hard to qualify for
the final event only very few teams
do on the zoom someone mentioned don't
forget about devil sex asu actually has
two cyber security clubs um
one is the pawn devils that's what i oh
i've been talking about um and
if you go to pwn devils oh my god what
is this
all right if you go to pawn devils you
know if you scroll down there's
the discord you can hop on and chat with
some shellfish folk and then there's
devilsec
which is the other uh the other it's a
it's
a a cyber security club at asu you could
all say clone devils is the other club
double-sided club but there are two two
clubs
um double sec focuses more
my kind of an internal
categorization of this uh
phone devils is the club to go if you
want to develop exploits
if you want to break crypto if you you
know
if you want to uh find
new vulnerabilities in in software um
devilsack is the place to go
if you want to understand the security
of already created already deployed
systems
uh and and find uh for example
configuration flaws
and and understand how to ensure that
the configuration is correct
um and that you know the software is is
updated and so forth
um
so with the takeaways asu's um
cyber security uh
course uh cyber security scene is
pretty strong um definitely definitely
quite active
devilsack competes in a different set of
competitions uh called the
ccdc um the the cyber collegiate
defense competition i i forget what it
stands for
um so yeah then
and and that uh season starts
very oh this is 2019
stuff but presumably similar dates for
2020 as well
um someone is talking about the
pawn devil css this is the brand new
phone devil site
come on look look look at this
this site is beautiful
also look at this guy huh it's a good
photo
okay anyways um
any thoughts on how samurai did this
year in the finals during defcon ctf
yeah samurai did awesome um let me bring
up the scoreboard again
i think they were fifth
sixth samurai played as the unicode
character for samurai um
why okay yeah it's just just taking time
um they got six so they they
beat shellfish for example by a
reasonable margin as well
um i was super impressed with
with samurai's performance on a
challenge that i wrote for defcon which
was a machine learning challenge
where you had to attack a machine
learning
classifier
[Applause]
[Music]
and and basically do an adversarial
image generation attack
in a black box manner at first that is
you don't have access to the classifier
just to its output
and then a white box manner where you
got access to a classifier on the second
day
and they uh dominated that challenge
they
uh we had a mechanic in defcon where
where when kind of the top team scores
600
flags from a challenge uh that challenge
would be closed
as if they killed the challenge and
samurai killed my challenge
very very effectively so that was super
awesome
yeah all right let's see
what do we got oh okay we are actually
four minutes
over time um so thank you for joining
the stream
um sorry about uh
spending so much time trying to get
flags on baby suit but hopefully i got
the point across there
um if you have any questions on
um baby shell
please reach out to us sooner rather
than later if you're
reaching out over email please email
phone college asu.edu
not me personally or conor personally
because if you email one of us but not
the other
there's a much higher chance that
something will get dropped so email the
mailing list
um or if you're
an asu student you can also post on the
discord
[Music]
otherwise good luck we'll launch the
rest of the challenges
today and early tomorrow
and again they're due at 4pm
if you run into and wednesday and we'll
next week talk about sandboxing and how
to escape
some sandboxes have a good one
keep hacking