week of asu cse 466
oh no i forgot to turn off the
annotations one sec i have to reshare
welcome to another week of asu cse 466
otherwise known as pawn college
um i have to connect from my
tablet real quick otherwise my students
will draw on my screen
it's a quite an unfortunate scenario
bear with me
students exactly
you just guys just need you you have
this need to meme
you're always memeing kids these days
man
all right meeting settings
oh no no that was the the chime okay the
chime is dead but
where's
why why is zoom constantly
broken in new and exotic ways
share is it because i'm old is this like
a
connor says i'm a boomer i don't really
know
i don't really know what that means
we should hold class on irc
okay disable participant annotations now
to share screen again to actually get
rid of them
all right the ipad was a lie i don't
have to join on the ipad
okay but i will join twitch so that i
can um
annotation chat on twitch oh my god okay
awesome we are live on twitch on
everything okay
influencer life it's happening um
okay uh we're gonna get started with an
overview
we're gonna get started with an overview
um because uh
we will um
um that's what we'll do
um of the course where we are right now
so that
you know people who have uh
concerns about their current
performance can uh either be assuaged or
maybe maybe a more panicked depending on
what happens um
all right there we go let's roll so we
are now
we have just finished up week two so
that should actually say week three
i'm sorry about that i think i copied a
slide and forgot to update it this is
week three
despite what's on the screen of 466.
um let's see what is happening first
uh meme um highlight
let me uh close my
i just move my my video up here yeah all
right
um meme highlight from last week so this
uh showed up on the the various memes
channels
um it's my favorite memes from last week
probably my favorite one
is this uh level three meme
of course we launched shell coding level
three with a
[Music]
incorrect assignment basically um
consider just taking it out
but then there would have been 15 levels
with like uh some random level three so
we
slotted in uh or 14 levels without level
three which is weird
so we slotted in a new awesome exciting
shell code for you
for level three um
oh someone says on switch the new
podcast is awesome thank you
i guess let's let's real quick go on a
complete
tangent and uh talk about
not that that
talk about our new podcast my colleague
adam
and i launched ctf radio
um this is really adam's baby i'm along
for the ride um
it's it's pretty exciting stuff go here
and listen we have we're talking about
this week what is ctf future weeks we'll
have
i mean it's just a ctf uh everything
about ctf we'll have ctf organizers
we'll talk with ctf players we'll talk
with
you know fellow defcon organizers uh
we'll we'll talk about
you know how we got into cgfs how you
can get into ctf's educational materials
uh ctf memes um pretty pretty exciting
stuff
um yeah so uh
you can you can you can get quite amped
um any i mean
what can you possibly have questions
about that just go and do it oh i
just realized i'm on a
terrible input device aren't i is that
better is that the same
maybe i was already on it okay it's fine
it's not not a big deal
um so cool um
that is ctf radio just a quick plug and
now we are back to previously scheduled
of uh um
material the meme review a very
important part of the class
so yeah so uh um
we ended up with with a nice fun
challenge for you
um i i like this this shell this is good
um the knob sled there was actually a
ctf team
uh way back when called the european
knobsled team
they're defcon champions they're they're
very good
team but they kind of knobsletted
um you know
good hackers don't die they just not
sled away
so they not slid it away um and then uh
yeah
yeah some good good avoiding null bytes
memes it's pretty good
all right um
catching up on twitch we're all pretty
good maybe uh yeah
so twitch is speculating how to solve um
level 14 with a single stage i do think
it's possible
um but we can get to that in a sec all
right
uh i i uh our reference solution uses
two stages though
um okay of course change log uh
people were really requesting like hey
can we talk about old solutions can we
talk about all solutions and i was
saying no
because it is um you know still an act
of course i want people to figure this
out but the moment the deadline passes
all the challenges you can still
complete them for points but they're
only worth
half points from then on right um just
for for
for makeup um or actually don't quote me
on that connor is that how the formula
works
oh there's a there's an extra makeup
assignment so they're really worth one
tenth of their previous points
um or whatever one divided by how many
assignments we have um
but uh
is that true no they are worth half
points that is how anyways
it's not important um you can it is
important we'll figure it out and and
send out an announcement but basically
you can continue to to solve all
challenges
and hey if our discussion on solutions
helps you
finally figure it out and solve that
challenge more power to you
um so there's there's a good amount of
makeup that's possible
in this course um by going back and
solving the
old childs don't let them flatter all
right
move on to uh another thing that you can
do of course to increase your grade is
extra credit um
we of course give extra credit
um for uh students who play ctf
the first weekend of the course uh 29
students played either f word ttf
or gactf f word was a really awesome
introductory ctf it turned out they
they're asu's cse
466 students that aren't playing with
shellfish because
it's hard to track who solved what on
shellfish uh
because they're also playing with a you
know very
you know slightly less noob players um
the other players they uh
solved the union of six challenges which
was super awesome to see i mean for a
lot of people this was the first etf
this uh weekend 24 students played uh
my hypothesis is people did well enough
on baby suet that they weren't as
worried until baby shell hit
or baby shell was so hard that people
were focusing
exclusively on trying to get more shell
coding challenges done and didn't have
time to place etf
which is admittedly a flaw in the extra
credit uh system but
it's a flaw with every extra credit
system people that are spending all
their time in the course don't have time
to do extra credit
but as a reminder um you
have to put in eight hours or solve one
non-trivial challenge that's it right
and then
write up a good write-up your team has
to be a minimum of four
uh players a maximum of eight players
unless you're playing with asu's cyber
security club
they play as uh team shellfish
um along with you know students around
the world including at ucsb and so
forth but i know the leadership i can
confirm with them that you
have um individually participated and so
forth
uh make sure your write-up is a in-depth
individual right of clearly showing your
contribution
um so that we'll count it um
so hopefully this doesn't er this is a
lot of extra credit right
um we'll you know throughout the
semester you can get
15 percent uh or 14
in the class don't forget this route you
don't have to
actually win the ctf you just have to
participate um
and and your write-up shows that you're
you're you have to participate
um enthusiastically um
all right let's see what we got uh
questions
all right someone said um didn't that
they didn't like
rat ctf rat ctf was a little bit of a
strange one
um it was um
not a traditional ctf and maybe i should
have mentioned that when i sent out
the um the ctf list for the weekend
[Music]
um
let's see what else we got someone
couldn't even figure out how to register
for it
um and then of course the problem was
the other ctf of the weekend al ctf was
extremely
uh challenging um so
that that was kind of a it was a weird
weekend for ctf but again you don't have
to solve things you just have to make
progress uh
show show dedication and so forth uh let
me check the zoom chat real quick
it's going through a lot of memes and
zoom
oh someone said rat ctf was a ton of fun
awesome that is great
um someone asked how do you want us to
do the write-up if you're doing it with
the pawn devils club um
specifically people doing see-saw with
them this weekend
[Music]
right do the rheto just what you did
during the ctf who you worked with what
you worked on it should just come across
that you
put in a good amount of work
um and and did great this weekend is um
seesaw it is probably the uh event of
the year for undergraduate
um ctfers uh
go and uh register and play um
and uh we'll see if asu can qualify um
oh if shellfish can qualify
that's asu and ucsb and a couple of
others
to go to the final event
um
all right let's roll onwards
um how are we doing in terms of asu
versus the world well the world
seems to be catching up asu is uh
holding on
to the top slot on pawn college right
now
uh thanks to janitor jeff um apparently
of affiliation gogurt
uh you i don't know if gogurt is means
something else in modern slang back
in my days there are these tubes of
yogurt that you could grab on the go
it was pretty good um so jenner jeff
good
job um uh zoom
is telling me that they are still uh
gogurt
um so it's pretty good uh all right
uh and uh the the top of the scoreboard
is is is shifting but it's still very
recognizable you still got neural
uh blue shirt yacht one of them is uh
affiliated with phone devils and one of
them is familiar with not bone devils
um shrimp uh rose from 12th
to uh sixth um and but then you know
and knob knob goose uh is holding on to
top ten slipping slightly and then
things start getting a little
a little different um down uh further so
it's pretty exciting uh
changing the scoreboard but definitely
the world is starting to encroach so
let's see if
if people can can hold on
let's look at current grades so this is
a great distribution
uh for the asu students uh watching that
are concerned like
you know will there be a curve if class
ended today
there would not be a curve so right now
we have um
48 uh students with a perfect hundred in
the class
um 22 with a's
uh 14 with b's 17 with c's and it's a
fairly good distribution so we would
keep it
as is this doesn't uh account for the
extra credit
um so probably there would be uh there
are a lot of people on the boundary that
extra credit would
uh bounce them up we will we're working
on a way to
actually automatically have the extra
credit show up on your
um grades tab in phone college um
but otherwise your grades tab is is your
grades tab
no curve if class were to end today um
all right for the actual module
let me um
run some numbers real quick we got them
a little too late because they're due at
uh four and then we take some time to
actually do the data processing
so it looks
it looks like
we have
50 students that got a perfect score
solved every challenge
14 students that got an a
six that got a b
12 that got a c
six that got a d
48 that failed this assignment
and 16 that um
didn't score didn't solve a single uh
challenge so
this was definitely a much tougher
assignment um
than uh baby sued if uh
if we if we keep seeing that
kind of uh performance throughout the
course uh
probably there will be some curving
going on but we'll have to see
um uh
yeah some a couple of comments
that people are saying
um wish there was more time to do these
challenges
i agree with you unfortunately with this
once a week
schedule that we're on this semester um
it's a little tricky
to uh support
you know week and a half long um
modules and so forth and then there's
also not enough time
in the semester to cover all of the
awesome concepts that we want to cover
so we're going to try to keep going at
the space
if it becomes very very clear that this
space is unsustainable then then we will
reevaluate um
the another comment more fun than sued
i agree shell coding is super fun it's
my favorite part of
um hacking is shell coding um
here is the the schedule um we're going
to
uh change things up a bit we're actually
the current plan
uh we're still developing this in our
minds is to shift around these wild card
slots
um into combo modules
so a module where you have to uh exploit
some
you know reverse engineer something
that to find a vulnerability to
inject to do memory corruption to inject
some shell code
to a cheap code execution inside a
sandbox
to um and then escape the sandbox using
a set uid binder or something it'll be a
pretty pretty
pretty wild and exciting um
let's see uh someone asked how does this
module compare to the difficulty
of the average module um in
my opinion i actually think this is one
of the more difficult ones because it
introduced
like a a completely new concept writing
assembly and understanding assembly
um other modules that will
kind of blow your mind the reverse
engineering one might be
a tricky one it'll be but it's it's an
extension of
assembly that we do shell coding before
reverse engineering so that
you kind of get familiar with looking at
small snippets of assembly before you
have to look at
whole programs of assembly um heap might
be a little hard for some people and the
kernel is going to be a completely like
you know shift of perspective um someone
said is assembly going to be a big part
of things going forward
uh yes yes it will um
we have so far been providing source
code and we will provide source code for
uh this uh homework as well
um starting from binary reverse
engineering and
all the way through there will be no
assembly provided
uh sorry there will be no source code
provided you'll you'll have to
reverse engineer binary challenges
um to drive this home um
so you need to know and be able to read
assembly code um someone said they
didn't see source code for this one
connor
is that uh a reasonable
yeah so look in the slash challenges
directory
um okay
uh someone asked about
um level 14 so why don't we take you
know 15 levels to look at level 14 or 15
minutes
to look at level 14 and uh
and see what's up all right
let me launch up
level 14.
we watch it up in practice mode so that
we can
look at things um so level 14 had 71
solves so that's like 71 people that
likely got a perfect
um score on the
course good job um
sshing in here
all right level 14
baby shell level four it's reading six
bytes
our shell code has to fit into six bytes
that is the whole challenge
right so what i kept um telling people
is
look at uh do it in one stage we'll
we'll see we'll try
look at um the state
of the uh registers and memory
when the challenge launches when you're
sorry when your shell code starts
running that's absolutely critical in
this challenge six bytes is not a lot of
space
you have to look and understand that uh
that there are certain
registers that you might not have to
zero out because they're already zero
or something along these lines um
there's a good meme that just popped up
in zoom
so you're in computer science with the
the the gru
uh name every assembly that's pretty
good
um someone on twitch says i have six
bytes they just don't do anything
uh
someone wants to uh train a classifier
to steal my palm college
password that's awesome
okay connor quick lock my account oh i'm
just kidding
um
[Music]
what are we doing we're doing teaching
one okay
so um how do you do can you do it one
is you can launch gdb
break at start run and then
kind of you know step step step step
step until
you uh
[Music]
you know hit your your your executing
shell code and then step into your shell
code and so forth
in this case if you send nothing the
program will crash and that's nice and
easy
oops i logged out let me let me
gdb continue
run give it nothing the program crashed
uh actually all i did was give it an
enter enter is not a valid assembly
instruction that's why this failed to
disassemble
and then it crashed and now i can look
at inforeg
that's one way to do it another way to
do it that i mentioned in
my debugging assembly lecture debugging
child code lecture
is um where's my shell code that is
uh take my shell code
and just create shellcode that is
uh has an int 3 in it this is a single
byte instruction
um
[Music]
that triggers a a break point and g
that this is actually how gdb does break
points in most cases
it actually replaces instruction where
you want to break at
with an int 3 instruction
[Music]
here's my shell code elf i can opt
copy and then let's if i hex dump
shellcode.raw here's my cc instruction
so now i do gdb
and i run with an input of shellcode.raw
and we have our our break point
right so in this case it crashes there
anyways and drops us into a debugger
um with a six with a sec fault here we
have a sig trap
um which uh is cleaner in some sense
especially their shell code afterwards
this also works for debugging your shell
code um
if you're very lazy and don't want to
actually deal with setting breakpoints
at the correct memory address in gdb
you say i did a pop reacts i'm doing
some other stuff
and then before the syscall i want to
break to see
what i'm about to launch so i do that so
again
i do stuff then i put in a breakpoint in
my own shell code and then i
do i can continue so i can
uh gcc opt copy gdb
run uh shell code raw
here is my breakpoint then i can keep
stepping right
so pretty cool stuff um
but for now let's just use it to
break gdb
all right here we are
inforeg here's the register state
when um the program runs right so
uh we'll start with the the two-stage
shell code first and then we'll talk
about
maybe making this a single stage um
[Music]
uh actually real quick there's a
twitch conversation zooming by someone's
asking have you ever considered
starting the course slightly more basic
like the structure of a now
um etc i actually do have the structure
enough in the fundamentals video if
you're interested
and the answer is yes the the problem is
we need to get through a lot of awesome
content
what i am thinking about is creating
another course
that is like introduction um to these
these concepts
right um i learned most of these
concepts at my in my
computer organization course in my
undergrad but that was uh
quite a long time ago that i don't want
to actually
speculate on how long um
so i am uh anyways i'm thinking of
creating
a freshman course that that geared
toward people that
you know don't know the the underlying
concept
underpinning this that people can take
uh
i'll keep everyone posted if they're
interested and probably i'll stream that
one to the world
as well but um we will see okay um
cse266 i'm actually thinking csc166 how
can we
just like uh take people that
don't know what c even is and
get them to the point where they can uh
do module
two let's say the shell coding all right
let's let's roll on um so what is our
our register state here
our register state we have zero and rax
so all of your shell code where
all the time you're zeroing out rax
x or ex eax for the shortest way to do
it
you didn't have to rax was zero
already right um other interesting thing
our dx is pointing directly to our shell
code
so we don't actually need to put our add
the address of our shell code we don't
need a load effective address
of uh rip plus anything
we have rdx right here um what is
um rsi pointing to
let's say let's see or let's see our di
what is our di pointing to
our ds pointing to some data that data
is a blank
looks like oops
r di
sorry brained up rdi is pointing to
null bytes our si is pointing to some
string
what is this string the string is the
executing shellcode string
very cool um what other relevant things
rdx
oh yeah that's pointing to our shell
code why is it pointing to a shell code
well it's pointing to our shell code
because
if we disassemble main
the way that
main works the way that it executes the
shell code
is it does call rdx right
and and that's that's the the call in
the source code of that function
pointer if you look at challenges
slash baby shell slash level 14
oops teaching 1.c that
execution of our shellcode memory
pointer that's how
it looks in assembly um
just call rdx so our shellcode address
is already in rdx
um alright so
um
cool um all right
what does this imply
this implies that uh a couple of things
one is
the um the address for where we want to
write is already
right here so all we need to do in our
assembly
and rex is already zero so all we need
to do in our assembly
is load the syscall number for read into
rx what is the syscall number for read
zero you don't have to do anything for
um to load the cisco number for reading
alright so it's already there
all we have to do is load the number one
into
uh uh rdi
load the number um
uh some large number into r dx
there's already a large number to rdx we
can totally call a read call with
one three three seven oh bytes that
it'll try to read it
we'll just give it less bytes and
we put uh into rsi the
um address that we want to read to so
all that we should really need
is move rsi dx
the address our shell code is already in
rdx and we're moving it into rsi
and actually this is a long instruction
this is three bytes long
let me use my tools
on my machine so move rsi rdx
uh actually i'm just gonna scp
csc466.collar so we have a nicer
environment here
uh baby
awesome okay so now i have it locally
okay um i have a local flag that's my
just fake flag on my local machine that
i
uh saw so that i can see if things are
succeeding okay
now i have my uh
assemble function if you're interested
in this function
go to github.com shelltools um
i had a bunch of scripts laying around
and uh basically i just updated them a
bit so that
in case they're used to laura's connor
said all of the young kids nowadays they
use uh
pawn tools exclusively for all of this
so you don't have to do all the gcc etc
these various tools will do it for you
all right
so let's say we need to do move rsi rdx
this is three bytes that's insane we
don't want three bytes
uh we it happens to be that we can do
move
esi edx right because
um uh the address
if we scroll back uh it wiped my history
uh
write the shell history the terminal
history okay
we just run boom zigzag info reg
the address happens to fit into 32 bits
so we can use edx so
we can move the sie dx
that's fine other options push um edx
pop esi this this has the
sorry r dx and rdi this has
this will transfer all 64 bits either
one of these is fine let's just
stick with this and there are other
options you can do anyways
we won't okay then
um we need um
next we need to so now we have our shell
code in rsi we have our syscall number
in rax
uh we need a standard input
in rdi so we could do xor
edi edi right that's where we're going
to read from so that's two bytes
um do we need that um
so if we just do gdb we run okay it
crashes around the beginning of our
shell code
is there an easier way than xor edi edi
which takes two bytes
to uh zero out
rdi um rdi right now is this crazy
monstrosity
what is on our stack i mean i don't know
if there is ah
no on our stack is some value oh that's
no good
um
probably not so we're probably
yeah yeah okay and basically now we are
all set to do
syscall so this is now shell code
that'll
call read of course in my space here
it's null because i don't have it
initialized
uh properly the same way that it's
initialized on the
remote machine and
a null here but when we run it on
the other server it will work so let's
change this to output the bytes
and other binary run this
s trace this guy
yep so it read
a bunch of bytes to uh it
had a lot of bytes to um
maybe s trace f
there's a way to give it a different
config
dash sorry i'm going off on a tangent
here nevermind a board
there's a way to turn off this um
automatic uh purification and
lookup of arguments in s trace but
basically this is reading
the stage two of our shell code and it
is exactly
six bytes long if you look at our
analysis
awesome and then stage two of our shell
code
is basically it can be our our cat flag
or whatever we want it to be
and that's how you solve this uh this
challenge so
in office hours on monday i showed off
how to do this with very long shell code
i didn't take advantage of the current
state
um the fact that rax is already zero and
so forth um
here this is this is the actual solution
uh
for the stage one um
okay uh what else
oh yeah someone is talking about
exchange
that's an interesting syscall so you can
also do
instead of for this you can move
you can swap data between two registers
you can exchange esi
e e d x
for example x
change um and it'll have a similar
effect
on the remote host we have this output
just the bytes
put it in and let's trace that
here's our read again just a different
number we read but this number can be
very large and that's fine
as long as we will sell send less
for our stage 2 and it'll be less um
how do you deploy stage 2 without pawn
tools
that's a good point all right so let's
write a stage two real quick
do you have a stage two do you have a
stage two here
stage two that s all right it's just
it'll it'll
it'll launch me a shallow obviously you
can change that with your own stage two
um so i have stage two that raw
here's stage one then
i pause to read extra in uh to for an
enter from the user
and then i do stage two
raw pipe that through baby shell
okay it's executing shell code enter
segmentation fault type that through s
trace
okay it's it's reading so here's my
oh hold on my shell code is reading
answer of course it reads the shell code
for my stage 2 which is 38 bytes long
because
it can be anything um or you can also
instead of read your sleep one um where
what is the problem why
is this uh crashing because it reads
that shell code
if you look at um where
if you look at so i put our dx into our
rsi that's where we read the shell code
into
um if you look at where this is pointing
to
to that the beginning of my shell code
so i'm overwriting
um i'm overwriting things i've already
executed with the beginning of my shell
code the beginning of my shell code will
never get executed
so i have to put in a bunch of
null bytes into my shell code um so
let's do this
knob knob or not not not no byte sorry
not instructions
knob knob not not at least six right
because that's how
long my stage one is two three four five
six
that's seven one for good measure so
this will override my stage one
then i'll execute probably the first
knob so this is
my bunch of knobs knob is
hex 90 that's a single byte instruction
and here
i can cut both stage the knobs
and then stage two raw and boom let's
get out of
s trace here's my shell
oops what's going on oh
and then i have to
what's going on
oh sorry
it's
it's executing this is all right here's
here's what we're going to do
we're going to keep this simple i'm
going to do the send flag
rather than debug whatever is going on
send the flag
now send flag or cat flag or whatever
doesn't have to be
called cat flag it can be called x just
just for ease of use
stage two i can execute
x instead of um bin sh another
thing that that was useful to know for
this assignment is relative paths versus
absolute paths
you don't need an absolute path from
slash blah
blah blah for exactly if you just give
it
x it'll look in the current directory
for x alright
ah let me just assemble stage two
that s all right
it's assembled and it'll try to exec the
x awesome um and now
we can just
stage two that elf or that draw
perfect
there it is flag okay
cool um
cool cool cool okay let's uh let's move
on someone asked about
um level 10 we have 13 minutes and then
we really have to move on to
sandbox um escape uh let's talk about
level 10 what was level 10
does anyone remember
let's just stage in oh unique bytes
sure do you notice
my stage one shell code is unique bytes
that's level 10. there are
many many other ways to make unique by
shell code other than the two-stage
shell code
right um but the more
different instructions you use um
you know in this case we didn't um
we used the the uh
the initial state you don't have to
let's see what we can uh
so here's here's our our stage one shell
code um
what did we leave out we leave that we
left out
um xor our ax reacts or eax
eax let's see does this uh
create a non-unique byte yes because we
used xor twice
what about
um
i'm drawing a blank move eax
0x11234
okay these are all unique still
right obviously i didn't say oh wait but
i need that to be zero
no no no no no okay
let's do this xor eax eax here
now we have this problem 31 and 31 so
here we need to
do something like push eax
pop edi
rdi push and pop
works with 8 bytes in 64-bit mode
here still unique uh anything else that
we didn't um
initialize oh yeah this um
edx
so now we need to
um get the the address of our shell code
right to read a stage two and again you
don't have to do
a stage two thing here in fact it's
probably much easier to do an exact v
based one so let's do that
move al 60
great 60s exit 59 okay
still unique looks like it so now we
have
so now we don't need ed uh yeah yeah so
we need
uh push rax pop rdi
what is missing uh the file name
for one
um
so for the file name that's nice and
easy we can push
uh some file one one two two three three
four four
or zero zero zero
yeah one one two two three pop
or move esi rs
rdi rsp so now we have rsi pointing rdi
pointing at the stack so but we've used
our
single uh 48 byte so now are we almost
done what else do we need to do we need
to zero out
rdi and our
uh our
our si here we need to zero out r
dx right that's all that's left
push ah yeah we also don't want this to
be non-printable
so let's just do 414141 this is three
a's
okay now we just need to zero out
this guy
uh how do we do it without
um we already pushed rdx
so we can
we already did the xor we can do this we
can
move e
d i e d x
boom ah but now this isn't unique
because rdi and edi so
easy we can push
instead of this we can push edx
push rdx pop rs r
sorry push rsi pop rdx to put a zero in
there
are we still unique somewhat confirm
i think so
and this oops wrong wrong thing the
other way on push
rdx pop rsi
i think you're still unique no
ah yeah okay okay okay okay abc
come on this is just uh hold on hold on
i'm uh confused why i'm popping rsi
twice
this should be push rsi
okay pop rdx
and then we set this al later so we can
play around with that zero
this should be unique
it's kind of a new way of doing it i
admit
um someone said your file should be
named a
instead um that is not quite
the case here's what happens if i name
the file a
oh no okay yeah because it can use push
push push button
of course yeah so yeah the file name can
just be a
so then if i copy excuse me
if i copy uh you know my x to an a and
then it'll execute
or you can name your file um
one one trick that might make it
possible to
um
[Music]
solve 14 with a single uh without a two
stage
is that file names can be a lot of
different things as long as there's not
a forward slash
um you're you're pretty much good to go
um so you can
and any you can just find
a uh
some string in the state have rdi point
to it and
you're good to go all right
cool
can i add a thin horizontal split under
my terminal
um
next time yes i'm not gonna mess with it
live
we'll uh we'll figure it out all right
cool okay um
let's uh move on to shell coding uh
we're always happy to uh
uh
um talk about things more you can send
us an email again
all of these are still kind of there for
for half points
if you want to go and solve them um
someone on zoom is confused about 14
doesn't work
if you have the same solution it should
work but yeah maybe your
uh you didn't knop enough in the
beginning if you overwrote
the uh the old the the instructions
you've already executed and it wasn't um
executing um
okay um
moving on to shell coding uh sorry to
sandboxing
uh hopefully everyone has watched the
sandboxing videos
otherwise um we're going to
[Music]
uh have kind of problems when we
uh dive into in 30 minutes no
when is this class over 7 15 yeah so in
in 45 minutes we're going to dive into
uh the collaborative hour um connor are
the shell coding problems up
uh sandboxing
okay they'll be up in the next couple of
minutes so um
with sandboxing concepts we talked about
the the
core concept of sandboxing in general
right we talked about
um this is in the module videos we
talked about
uh sandboxing um
um as as it's done with ch root
sandboxing as it's done with sec comp
and different ways to break out of both
and the takeaway kind of the setcomp is
pretty pretty damn secure um but there
are still things that
that can go wrong when people use it
incorrectly
because of which you can you can
sometimes escape uh
a sandboxed second jail a takeaway i
want
you to to um have from this module is
there's no such thing as a perfect
protection
i mentioned in the lectures that even if
everything goes perfect a vulnerability
in the kernel
can uh ruin your day still unless you or
make your day depending on your vantage
point um and
let you let an attacker escape from the
sandbox um
this is very real if you follow that
link and looked at the write-ups
there's a lot of kernel vulnerabilities
in there
also a lot of you know sandbox
misconfigurations and so forth
later on in the course we'll also have a
module about kernel
vulnerabilities where we'll really
escape some perfect sandboxes
that'll be pretty cool all right
um
any so let's open it up to questions on
the sandboxing
please tell me you all watch this i'm
gonna go to youtube right now
and see how many views the sandboxing
videos have and you can
see me react live if they're not a lot
of views
ah what if you watched it on stream uh
all right it might be the stream views
all count as one conor you're robbing us
of views with your streams
okay sandboxing 107 views
if they all came from sandboxing.com but
they all came from
asu that's that's that's not good that's
a lot of students that aren't uh
aren't aren't watching it
come on okay um
maybe one person watched them a hundred
times okay
um question on uh zoom if you have
root permissions in the sandbox and you
escape you have root permissions
in the you know outside of the sandbox
in the sandboxes we'll be exploring with
setcomp and
um um um
what's it called uh chris yes but let me
show you
another i wanted to add another video on
namespaces linux namespaces and c groups
um c groups are more for resource
constraints with name spaces has to have
some
pretty um trippy effects
uh let me let me show you one of them
right um
i'm guns i'm in a bunch of groups but my
users id is 100. there's a command
called unshare it's a bash utility
that'll run programs in a different
name space which is a linux's way of
achieving
kind of these split personalities for
security reasons
it's kind of crazy let me um show you
how it works it works in two ways one is
the clone system call for i mentioned in
an earlier
lecture in my fundamentals lecture that
the only way to create a new process on
linux is to fork or clone to to to split
off of an
existing process clone is a
much much advanced version of fork that
allows
um um
a a bunch of options to be specified one
of them
is uh you specify
whether you know your child should share
like the same
file system information uh like a ch
root and so forth one of them
lets the child uh no not this one
run in a uh
new name a new namespace of users
like just just made up users that have
nothing to do with the
uh or are mapped to the user that
spawned them in the original namespace
let me show you what i mean by this
so you use the unshare bash utility that
uses the
clone and unshare options
dash r is a an option here that says um
give me root inside a new username space
and you can run this as a user
i'm running this as yans
[Music]
and i do bin sh
okay who am i i'm rude so did i just
hack the system
turns out no i didn't just tag the
system i'm kind of a fake made-up route
all of um
the usernames all of the users in this
system
uh can i do this
there's a way to force this
ah
let's you do the game users user games
i see that that that doesn't quite work
good good
uh that makes sense actually so i'm the
the root user inside this namespace but
if i touch
a file called something and i log out of
this
uh shell and then that namespace
and i look at this file still owned by
me
so all of the users in that namespace
map to me right or you can actually
try to remember if you can make the map
to
other uh users as well um
if you have uh done
um like name spacing
if you have used docker and done like uh
there the docker has a lot of name
spacing options
um
for example
you can run in your same
uh pid namespace your same process id
namespace
what i mean is here is uh for example my
gnome terminals
that are running inside well i guess
there's one that spawns off a bunch of
threads
um this is running on my machine and and
and so forth
if i do docker run
an ubuntu image this has its own
process namespace it doesn't see my
other other process you'll notice that a
ch root
sandbox does not have its own process
namespace but if you use
unshare no you can't use on share if you
properly launch it
with yeah of course it's too late at
this point if you properly launch it um
a
[Music]
oh yes i can set a user id so check it
out on share
dash uh dash
u for a new no dash u for a new user
name space
dash uh 4242 4242-42
finn sh
never mind
lame okay now mine i'm not gonna debug
that live um anyways
the namespaces is how um
uh things
um i need more caffeine
namespaces is how modern linux sandboxes
work
like docker right it's it's a very cool
feature
all right let's uh roll i'm gonna do a
walkthrough of the first
challenge connor are you sure you didn't
um screw up the first challenge somehow
because
already 12 people have solved it if you
really have such
heavy duty pros i mean if
if if it is messed up you're gonna have
to fix it all right
so here we go let's go level one
teaching one
17 solves already okay connor there's
something something is wrong
two solves on level two oh my god okay
now let's see run it in practice mode
let's take a look at what's going on
all right challenges i'm going to give
you a walkthrough of level one
uh and in fact starting from now i'm
going to try to do a walkthrough of
level one in every uh extended q a
class like this right so that we can
help you start approaching these
these problems so let's
uh drop to the terminal
connect up
are we getting slammed connor
this seems not very good
uh question on twitch how is baby yawn
baby on is great she's uh
not teaching the course today um
she's doing uh doing well she was i i
was teaching
asu 101 earlier today which is an asu
course for like incoming freshmen to
teach them
about how to be a college student and uh
probably in the background they could
hear her
screaming as my wife tried to uh
calm her down um okay
so here we are level one testing
let's um run
slash baby jail so here's what it
tells me right welcome to baby jail the
challenge will see a truth
in the directory somewhere in slash
templar's jail with a bunch of
numbers um we'll be able to
read a fake flag file inside this jail
but not the real flag file outside of it
if you want the flag you're gonna have
to escape let's look at what just
happened in slash 10 when i ran it
uh nothing oh that's because i need to
give it a file so let's do slash flag
okay
so it runs it creates the jail
it's ch roots into that jail so here is
the the
random identifier so if i look in this
jail
i can't but i um practice mode i can
here's what's happening in that jail
there's a flag file
and if i cat that flag
fake flag okay so that's no good if i do
slash flag
where's my shell history
okay weird all right um if i do
uh oh i wasn't rude okay
so yeah someone asked are you in jail
when you start
the challenge uh when i ssh in i'm not
in jail um but when i
run the challenge after this
after this line i am in the jail
when by the time it starts creating the
fake flag i'm in the jail it's too late
um and then it reads the requested file
slash flag so
on the face of it i am kind of screwed
right
zoom uh text meme college is kind of
like a ch route i like it
um oh where did the terminal go
no come on no
obs
obs has failed us
okay we're back all i did was move my
mouse over obs and it wigged out
are we are we still live on twitch
i'm oh no i'm good okay good excellent
all right
um obs uh is crap but we can still keep
going so that's
baby jail uh level one i have to take a
bio break
i'm sorry uh when i come back we will
show how to
uh solve this in the meantime um
let's see who has the best memes while
i'm gone
very bad actually
put you on mute in case my microphone
isn't
is that incredible
i'm back so um
no i was okay anyways
um
baby jail level one all right so
this thing isn't let's look at the
source code when in doubt
check the source code challenges baby
jail
baby level one
teaching that c
all right here it is nice and simple
it creates a temporary jail directory
it ch roots into it make sure the ch
root succeeds
and of course the flag is usually only
real is read only but it creates a new
flag file
um called uh with flag fake
at slash in that directory as i
mentioned in the lectures
ch root changes the meaning of slash
and then it sends files the
[Music]
uh or send files the requested file
right back to you it's very simple but
as i mentioned in the video and as
people are mentioning on
zoom uh
as as people are mentioning on zoom um
aside from the conversation taking place
on twitch right now as people are
mentioning zoom uh
the correct way to use ch root as i said
in lecture
is ch root and then ch dear because ch
root
does not change the current directory of
the process every process has a current
directory like you have a current mood
processor current directory what does
this mean this means that
we're in our home directory here
and i have my shellcode.s right that has
code you know that i was playing around
with and i run
baby jail and i i try to cat slash flag
that's that's a problem
if i cat shellcode.s
i get my shell code but my shellcode is
outside of the jail
that's okay because so is my uh home
direction in fact i can cat
arbitrary stuff
um i can cat
basically anything on the system
catflag.c also my
current directory i can do
that slash catflag.c also works
here it is i can do dot dot slash
uh what do we got uh obviously not dot
dot slash because that's a directory
although you can open directory just
like you can open files just send file
doesn't do anything with them
i can do data dot slash etc
password or passwd
and here's however much of passwd that
comes across with one sent file call
uh with whatever arguments i i i had put
in
that's cool what else uh can i do well
of course i can do data
flag and here's my flag again this my
flag don't submit my flag
otherwise the uh
[Music]
it will cause complex complexities for
us and it's also practice flag so hands
off my practice flag
get your own flag super simple
cool
um any questions on
ch root
uh okay someone asked and actually
earlier someone else asked about a brute
force approach what do you mean by a
brute force approach
um in order to solve these challenges
you have to understand what they do
what they do that's different from the
previous challenge
and how you can exploit that difference
so for example
if we go to slash challenges
baby jail cat level one
teaching actually
it's often easier if you already know
all of these
uh the text to look at the level one
testing
slightly less uh superfluous stuff
here's what this does you look at level
two here's
sorry look at level two
here's what level two does
what's the difference between level two
and level one there's an awesome
utility called diff
level one testing one and level two
testing one
the difference is very simple uh
there you go
connor what what the hell is this level
right so level two
we uh let's just look at it rather the
diff that actual
uh file so we um
open up some file that is not the flag
file
uh oh no follow what does this do well
you can look up the man page for open
connor we're still minimized
okay you can run on minimize to
re-enable the man pages inside the
container
but only in practice mode because it
needs to be sudo we'll we'll unminimize
the container
uh sometime tonight hopefully if you
look at no
follow what does this mean
it means it won't let you do a symbolic
link
the open will fail that is intentional
so that you can't just link to the flag
cool um
all right
so it uh opens a file that you specify
and then it um ch roots
makes a fake flag and then it executes
your uh some shell code
so this is shellcode running in a
sandbox
right and so on um this none of this
should be brute force
um yeah
uh someone asks on zoom
all shell code will be executed from
within the jail right yes
yes this is a jailbreaking um
challenges
yeah randomly trying sequences of bytes
until success
that sort of brute force is going to be
not not very good
other questions
awesome yeah
what else did we want to say about
sandboxing
that we didn't already say how do i
linux
um it's a valid question how do you
linux this class assumes that you linux
but maybe you don't um
there's a uh my asu101 students
i told to uh we're gonna do
over the wire bandit this is a good
um resource to linux to learn to linux
right starts from how to ssh into a
server
and then goes through how to read a file
and and more and more and more and more
and more
right um
you can linux by going through
all 34 levels of over the wire band and
if you get stuck
there are youtube walkthroughs it's very
cool
um connor uh someone asked how many we
have in total
um do you have a
yeah there's 13 or 14 again
all right someone is asking for escaping
the sandbox is it generally the same
approach
with windows um some windows is
completely
a very different game some of the
underlying
concepts are similar i mean in both
cases if there's a kernel
vulnerability you can uh
you know leverage that to escape
sandboxes
for example um windows has
a lot of kind of exotic mitigations um
for exploitation uh i might
actually maybe i'll try to weave some of
those that
information in to later modules as we
start talking about more and more
um mitigations i'm not as big
of a windows expert as i am for linux
not that i am a massive expert anyways
but uh
i i know linux much much better than i
know windows
but i'll try to uh get some good
information for you
all right the solution um for
uh level one someone asked to see it
again
again baby jail asks for a flag i can
give slash flag
but it gives me slash flag inside this
jail
so if i do since i'm in practice mode i
can do pseudo i can catch this flag
that's this
again so here's this fake flag right
so what do i do turns out since it
doesn't change there
my current working directory is still
open uh it's still pointing to outside
of the jail this is this
this is everything it's critical this
means siege route is broken or
this specific invocation of siege route
is broken for example i can still
uh cut out level one
testing dot c because this just says in
the current directory
cutout level one testing.c um like
dot slash right and then the same way i
can also just say okay let's dot that
slash dot dot slash
flag because that is that that slash is
root
and flag excuse me is the flag and so i
can
see the black cloud actually let's do an
s trace and see what happens here
in sudo so you can see me doing the flag
so here it's saying i very about see it
root it's ch roots
this succeeds it opens uh
a flag slash flag in writable um
mode writes the flag to it
closes it okay and now it's reading my
requested file
does uses something called open at
openhat is an interesting system call
that can open relative to
the current working directory and
so it just does or relative to any
directory actually you can
open a directory like you do a file and
then use open at to open files relative
to it
um and relative to the current working
directory
happens to be in the real root flag
and that's how you do it um question
from
somebody on zoom can we start work on
makeup
uh challenges right so so all the
challenges from previous modules yes
it's auto graded as soon as you solve
them
your grade updates with the makeup
homework the way that it works
actually is the makeup homework is an
additional um
homework assignment and then that
includes all
assignments so you're already in some
sense making up
homework as you solve it ahead of time
um
can you still get help on shellcoin
challenges and off stars
yes as long as there is time so if
there's time we'll do it
[Music]
um
what's going on
uh someone on twitch is saying by the
way
this whole framework is running in a
sandbox
you're in docker containers right now if
you can escape out of this docker
container
then uh you might be able to submit this
real bug
you can definitely get extra credit uh
at phone college by emailing it to us or
you can
[Music]
submit a security issue to the docker
team
i would say unless you're done with
these challenges and all the challenges
and have nothing else to do
it's not a good idea to spend time
trying to break out of this docker
container
cool all right um in five minutes
we are going to start the
collaboration hour uh again as before
we're gonna
use discord so hop on to discord
for students in the course there's a
discord link in canvas
for students not or students not at asu
i'm not taking cse 466. uh
go to pone.college and then there is a
discord link right here uh connor does
this
still work looks like it
oh can you update it with the latest
public discord link
cool we'll update it in a second if it
doesn't work
um make sure to use the canvas link if
you're in the class
that's extremely important
the canvas link doesn't work
great
and you're you people that are having
link problems aren't on
um shouldn't have expired aren't on uh
uh
you're not already on the discord
so
oh that's weird
try putting an invite there um one
second i'm gonna
i'll update the announcement
how did this happen okay i'm about to
pay something into
zoom can you check
oops i hate how zoom auto switches to
respond
okay can someone confirm whether or not
that link works
i somehow managed to fail at copy
pasting
okay that invite works okay perfect i
will
push an updated announcement
sorry about that
oh oops i totally forgot i did that
one sec okay i sent an announcement
on canvas with the right
link let me uh
change the
permissions to allow
message history connect speak
video and send messages
okay there you go
you should have activity
the ability to you might have to rejoin
the voice channels i think that
might not um automatically
change permissions
oh there was another good uh zeroing out
of a register
sub e-a-x-e-a-x in a meme that is a good
one
all right everyone rolled into sandwich
again remember you are
very very free to spread out into
smaller groups if you want but you don't
have to
um if anyone has any trouble like one
tries to go live
and and can't go live um please let me
know
i'll fix that
um no love for eyelid
trust or current um
same for the global um
hackers uh did i also change up this
category
oops did i screw everything up
okay send
and speak
okay for global
hackers you should now be able to
collaborate um in the collaboration
area in the hack the planet area sorry
about that
totally forgot um please
holler if you still don't have um
speaking or typing permissions
zero on twitch sorry that was my bad
about no one being in the
global collab channels now it's up
oh team trade is is almost as big as
team sandwich
that's incredible
a lot of people rolling in this is great
okay if you're an asu student and you
aren't in the asu cse 466
role please holler that is a problem
who who is talking right now
what is the voice in my head what's your
discord id rather
okay and you join the discord through
that link
let me fix it
uh
i don't see you on this discord at all
hold on hold on hold on
don't panic
so you don't have chat permissions to
anything any uh
everyone should be able to chat in this
channel
just say it says try say something
hey someone on twitch is thanking us for
making this course public you're welcome
okay um if you let's let's make this
easier if you do not
if you have permission issues send me a
dm in discord
because then i can right click on your
user
if you're in the discord but don't see
any groups
send me a dm on discord
all right let's see what the current
state of the scoreboard is
this will be interesting because you
always look at it then what about the
fastest
actors in the west oh
holy crap asu full top 20.
impressive
go arizona should we replace the
pitchfork with a cactus like a saguaro
what do you think connor
but maybe maybe like uh but we can't
modify
the sparky logo or they'll murder us
forbidden topic
okay okay okay i'm getting dms that's
good
ah okay if you're seeing group one five
and voice one five you joined with the
wrong
uh disk disk disk disk
you joined with the wrong link this is
what happens when you join with the
wrong link okay
don't don't panic don't panic you can
figure this out
dude how this is not very functional
okay okay okay
okay
next
okay i think this is a problem of the
wrong
not following a link
okay
why okay
perfect
someone doesn't have permission to
listen to group audio
oh no
what do you mean listen listen isn't
even a permission
it's connect
where's my discord uh setting for
oh my god
i might be too old for discord
no why is it trying no it should be good
okay
definitely good hello
oh perfect that works all right i'm
gonna hop back out
okay as far as i can tell the
collaboration channels are working
properly
okay for those on zoom but not on
discord i highly recommend getting on
discord
but if you um
if you uh
want you can of course also collaborate
on zoom right here
super simple
and if you need uh me to jump into one
of the collaboration channels and
and help clear up a question or anything
um send me a dm or holler at me or
or or something along these lines
let's see 36.
look at this battle here wait
connor something happened in my
scoreboard temporarily lost
um
you're you're the best web developer
you've got
hey a non-asu student climbing up the
rankings
encroaching on top 20.
there's a asu student that wants to join
the discord
they're student but not enrolled in the
course email me from your asu
email address
what is my setup looking like what setup
do you mean
like my computer my computer is the
crazy setup conor can
can confirm
my computing setup spans two desks
two webcams two monitors that are
showing the exact same thing
uh a microphone on a long boom arm
that hits me in the head sometimes a
lamp
so that i can record in the middle of
the night it's pretty good stuff
i think the question is more from a
software perspective
uh i'll post a picture to discord when
it's not
so crazy messy um
yeah from a software setup i run um the
only true
things that a hacker can run linux vim
i use neovim currently um
all hackers should be using them if
you're using something that's not
vim you're you're you're hurting
yourself
actively like not not maybe not
performance wise but deep down in your
soul
you're causing damage i have students
that you know
don't use them very emphatically
and they uh they suffer on the inside
you
can't always tell but
um an opinion of of emacs um i don't
i don't really know what that is i'm not
really into like pokemon um but
emacs um uh yeah
i would just recommend vim for all
things
still having discord issues for some
people let's see let's see let's see
oh someone has near them tattooed on
their forehead that's pretty good that
is pretty good
all right all right all right did anyone
break
everyone's stuck on level four
it gets tough man i'm excited to launch
the second oh no threesome oh yeah okay
not level five um
someone asked why is there uh a
um testing and a teaching when the same
solution works for both this is uh
the same for baby shell and baby jail
one is to get you used to the difference
because
in future ones the testing ones will be
significantly easier
they'll give you an internal state
information and so forth two
if you want the challenge if you don't
want to you know see what
if you want to understand what's going
on just from the the code instead of
from the print statements um you can do
the testing
first this might not be the best
strategy for grade you know grade wise
in the core in
the asu cse 466 course but approaching
phone college as a hacker might be a
really cool idea
yes as a reminder if you need me to hop
into a voice chat just add me at me
on the um uh corresponding
text channel and uh i'll hop into the
voice
um
yeah all right all right let's see
oh yeah we're talking about connor using
windows i i learned this last night i
was shocked
it was a oof it was an oof
no dude look look i got i got
linux native linux linux on the desktop
2020
is the year of linux on the desktop you
see what happened
i can ssh but it's ssh localhost
and telling you i it's actually uh
next year is going to be my 20 year
anniversary of using linux
that's that's how excited i am about
using linux using linux on the desktop
that's true i'm i'm i'm almost 24 now
exactly
uh yeah yeah the ti the ti
calculators are that those were good i i
read that
um the new ones you can't um code
directly on them that
that that was yeah
they got rid of the the editor yeah i
mean
according to a headline i didn't
actually who is articles come
on um but i saw it i scrolled by and
read it and i was outraged
um
yeah that is but just sitting in class
tapping away on the calculator and
actually you're
writing video games that was awesome
oh windows refund day someone's talking
about
windows refund on twitch yeah that was
all the rage i wanted to
submit refunds for my whatever laptops
came with windows
that was crazy but man windows windows
is
is i i don't know i don't know how
people can can use it it's it's it's
very very difficult
very difficult i actually have a
machine that that technically has
windows installed on it now
um you think connecting to airpods on
linux is hard
try try um
try doing anything and with those man
it's impossible
why is everyone in trade
all everybody's in trade
two connor what did they mean something
is it is this a meme
no i i i don't see a meme i think the
meme is that everyone is in trade now
what happened to sandwich sandwiches
there's two people in sandwich
you're even betrayed
dang are they talking in there is it
actively uh
it's pretty good
do i feel disappointed every time i boot
the windows machine
uh yes i feel i i feel
unclean um i feel like linus is gonna
come to my house and
curse at me
man everyone is oh my god more and more
people are going to trade what is going
on
wow we have a we gave a good amount of
time to collaboration hour this time
let's refresh the scoreboard
oh one person solved
wow they're really far connor they're
tearing through these challenges
we have a solve for level five
yeah we'll maybe uh we'll push yeah
yeah that that's gonna be interesting
um someone's talking about windows
subsystem for linux yeah that is
pretty cool but you're still you're
still not
you can still tell the difference it's
like when you're eating like uh
you know there's these like plastic
fruit that you see and you start eating
it
you can kind of tell the difference
between the plastic fruit and the real
food
it's like wsl
although wsl1 was super cool wsl 2 is
conceptually less cool
yeah that's a big problem that's
that's kind of a negative
yeah apparently uh i just realized that
there's only one side of this
conversation showing up on on
twitch but yeah wsl 2 doesn't even
doesn't free memory with their docker
configuration
just pretty good stuff
still one student unable to get into the
discord chat
can you pm me from your new account
so
we have a question on twitch what
plugins
do i use in neovim
and then another question are we
listening to the mick on the boom arm
you should be
hopefully listen to the mic on the on
the boom arm
let me uh double check
yeah you're listening to this guy
awesome it's a maybe i should i should
plug
the mic company i'll say it's a
yeti yeah it's a yeti
um let's see what was the other question
oh what plugins do i use in neovim
alright i'm glad you asked let's talk
about plugins in
neovim um
[Music]
where's my terminal okay
this is this is this is great this is
good good
educational material okay so we're going
to run
log back out we're going to go config
nvm
uh plugins no bundle
yeah all right these are my neovim
plugins um
i use uh file line so that i can
um open files at a specific line this is
very nice to
copy paste from
like a grep so let me show you how that
works actually
so grab move
star
uh well actually now i forgot grab dash
on yes
i can copy paste this
boom oh apparently i
uh have not used it in a while but it
works
so now i'm online for awesome okay
ignore those errors that
that just happens sometimes it all
breaks all right
that's a good one um i actually use it's
a very simple setup
i use neomake um just to to
it'll run um
it's like a basically a linter but but
better
and it is uh a little
nicer with new of him it'll run in the
background which is nice
um vim repeat it uh
enhances the amount of things that dot
will repeat it's very nice
and wimps around although i don't really
use this a lot unless you replace
like parentheses and stuff in fewer
keystrokes
the star of the show of course is my own
pep 8
um module uh what is fuckfit paid i'm
glad
you asked
one of my other very strongly held
beliefs
is that uh the correct indentation
character the semantic indication
character is a tab
space isn't for indentation it's for
alignment of code tab
is indentation historically tab has been
used for alignment but that's
a crazy idea and i don't know why people
should do it
um but tab is uh
is is the thing if you think about it
you're writing a python script and you
want to
indent you can hit space like four times
that's like four bytes in your code to
say one thing to say you know
indent you're gonna hit tab that's one
byte indent
all right then you can hit you can also
set your tab space whatever your
preference is you're gonna say okay tab
space is actually gonna be eight
if you really like it very wide task
based four
awesome tab is is the way to go all
right
then um
exactly uh oh someone says smart tabs
yes my tabs are great and all
until you try to arrow through them
you know if you're on the command line
and look what i can do look look look
look
oh thank you connor always looking out
for
the the truth here all right
no e-max e-max doesn't do it
okay
awesome all right this do you see this
i'm moving my cursor one
one step wait where's the key
one step boom
can you do that in emacs or can you do
it with smart taps
no because why why would you okay let's
say i was doing spaces
like like a crazy person
okay this why would you want to seek
into the middle of your indentation
it's insane to me
because like i say i'm doing this i i
want to
um i don't actually have a good answer
for that
but you might right doesn't it annoy you
that that you you can seek into the
middle of your indentation
um
yeah so that that is a
my philosophical issue so in order but
of course
python programmers on the whole are
wrong
and like to use spaces fine
unfortunately
we have to work together with these
people so when uh
i was writing um the the early uh
you know parts of the early anger
prototype uh
for those that know anger is a binary
analysis system
um that was born uh
as an effort from me and my
collaborators
during my graduate school at uc santa
barbara
we're still improving it new and and
awesome things as decompiler now
awesome stuff um um
everyone hated me because i was using
tap so i'd push
new files with tabs i would you know so
people didn't like that
so i wrote a plug-in so that on disk
someone actually mentioned this concept
in twitch just now this is exactly what
pep 8 is
on disk um
i i i have four spaces to a tab but when
i load it up it automatically
detects you know how many spaces to a
tab this is the detect indent plug-in
that's not my work that's someone else's
awesome work
and then it'll reflow the file properly
with tabs
i can edit pretending that everything is
tabs all along when i save it it'll
convert it back out to spaces
it's incredible um
so yeah pepe of course as uh neovim
evolves and vim evolved i mean vim
doesn't evolve but
as new of him evolves um
then um you know it slowly breaks so
right now it's partially broken i just
kind of work around the broken part
but i don't know if you want to use it
um that's that's the nice thing about
vim as what's new and vim is is stay
with never changes it's like
you know it's it's like math it's just
just the truth
you know
um yeah and someone is saying isn't
there an edge case that doesn't work
there's absolutely many edge cases that
don't work
sometimes it'll it's just compromises
that you have to live with to do the
right thing in life sometimes
one of these compromises is that
sometimes it'll completely
destroy your file and there'll be random
spaces and tabs everywhere but that's
fine
all right let's check in on the students
someone jumped in uh thanks for
pushing putting the class online
and oh my god like everyone is in trade
people in trade why why not spread out
you can spread out
holy cow okay that was a fast run so who
just solved
so let's see who solved level seven
testing one
blue shirt yawn good job
um that puts blue shirt yawn
squarely at the top of the scoreboard i
i mean these challenges are definitely
not as tricky as the shell coding ones i
expect this to be an easier assignment
uh good good job on winning the race
actually
in our uh early concepts for this course
connor and i talked a lot
about you know having people race
um in class but that that has a lot of
complexities to it um because you can't
really have i mean you can't have that
graded but then
then then there's there's a lot of
complexity that that comes into play
um but this is a good compromise right
so we have uh
most people collaborating and then i
guess two people racing like crazy
very cool
oh year one our first year running this
course had an
absolutely bonkers grading system that
uh only the fastest hackers could
actually get
eight pluses uh
or actually yeah only the fastest
hackers could what was the grade at
which
you would have you got if you weren't
that's right yeah yeah everyone could
get 70
just by solving challenges but to get
above 70 you had to solve challenges
faster yeah that was a
that was a crazy grading scheme we had
to add a lot of extra credit that year
oh no we abandoned that grading scheme
right
part way through
oh yeah it wasn't speed it was points
that's right that's right you're right
so it was everyone um
but that that actually helped people
because when when no one solved
all of the challenges yeah it made it
too easy
yeah blue shirt yawn barely beat out
frq mod pretty cool
question really enjoying the class
since i graduated this semester what do
you recommend for someone that wants to
continue learning this kind of material
and general hacking concepts as well
what i recommend is ctf
without a doubt ctf is the best way
to learn to hack
go to ctftime.org there are
ctfs every weekend some are more
introductory some are less introductory
seesaw is a great one and macaroni is
hosting a ctf this weekend as well
um probably so seesaw is aimed at
undergraduates
or at least has undergraduates in mind
with the
the uh ctf design
plan by far this is the best way to
learn about cyber security con
uh concepts because if you sit down to
seriously play a ctf
and suddenly you open it up and this has
happened to me i open up a challenge
a reversing challenge and i see verilog
and i i think i did verilog like for one
week in one class in undergrad
right and that was already a decade
earlier
and i'm just well i guess i'm going to
learn verilog now
and i i in within several hours
in the course several hours i learned
enough verilog to reverse engineer
compiled verilog code it was insane
um then the follow-up question is even
as a single
individual right it's uh a little
trickier
as a single individual um ctfs are hard
there are ctf teams that are open to
everyone one of them is called open to
all
right you can literally show up and say
hey i like ctfs
and you have a team to play with there's
it's it's
there's zero way that you you know
don't have a ctf team uh to play with
um yeah definitely going alone is very
hard i would not recommend it
i'm a type of person i can't work alone
very well in general right even if
there's just someone sitting next to me
like uh just watching my screen and
nodding i'm much much more
effective than than alone i get
distracted alone
um probably some sort of a
reason for that in my mind but um
so having a team is great even if it's
an online team uh
if you are at asu of course there are
two separate security clubs
um and one of them the pawn devils uh
they uh make up
a large part of team oh man this page is
still broken
i need to think about that um make up
a large part of team shellfish and
that's how they play
sometimes team shellfish uh
scores in the top 10 in the world
definitely when i was
playing with team shellfish but
obviously without me
things are a little a little bit less
fun but you know it's okay
connor's alluding though so i i hopped
in to a ctf last weekend all ctf
and uh completely crashed and burned and
failed
it was pretty good but it was really fun
those are some good challenges
um anyways uh if you're at asu
hop in to with the phone devils
you can go to pawndells.com they have an
open discord server
your server you can even hop in there if
you're not with asu but they're going to
be
a little reluctant to um
pull you into the ctfs themselves unless
you kind of show some
identity information i don't know
whatever talk to him
um someone said the oh defcon
ctf was very hard
yes so defcon ctf is
kind of positioned as the world
championship of cts to even go to the
final event
you either have to win other very hard
ctfs
such as plaid ctf hitcon ctf various
other
they vary every year or you have to do
well in the
defcon ctf qualifiers
defcon ctf is organized by
the order of the overflow there's the
shirts that i keep wearing
um the order of the overflow uh was um
founded by uh myself adam dupey
another professor here at asu tiffany
bow another professor here at asu
um uh
professors uh from uh eurocom in france
north carolina state university purdue
like a lot of basically
it's kind of a start uh started out a
lot of us
are kind of shellfish retirees we did
our
uh phds together at uc santa barbara
played a lot of ctfs
um with shellfish and then when the
organizers of the afghan city have
stepped down decided to host and then we
pulled in friends from around the world
um uh one of the organizers
uh one of my teammates uh uh
very core contributor is a the
co-founder of the team oops
that you know i showed when shellfish
was
top 10 um
they were right above us um so a lot of
awesome uh people but
our goal with jeff kennedy have to make
the hardest ctf possible that's a very
wrong ctf to learn to hack on
but yeah point is i would not recommend
going alone if you're at asu
uh check out the phone that was if you
are not at asu and you want to be at asu
depending on um where you are in your
life
uh our lab
um cefcom uh this is our research lab
where we do all sorts of research into
program analysis vulnerability
exploitation
web security all sorts of crazy stuff
you can see our recent publications if
you're interested
we also have an apprenticeship program
so you can
uh and i'll give the covid disclaimer in
a second
you can um if you're interested
come and work with us do an
apprenticeship
and in arizona for six months to a year
um all the fact is here the frequently
asked questions
uh caveat with covid
right now um it's this apprenticeship
program is more or less on hold
um but email me if you're interested and
i'll let you know when things resume
when um you know hopefully covid
gets more and more handled
someone's debating changing their
master's contribution to cyber security
because the course is so fun
that's amazing to hear i'll challenge
you
with one hire what about a phd in cyber
security
there's a security lab here at asu
cefcom we do awesome research and
prioritize
ctf and learning as well um if you're
interested in doing research with us
even as a master's student reach out but
a phd is an awesome way to
get really heavily into these topics um
i actually um
so i did my undergrad at rpi learned
a lot about cyber security as well and
then i went into industry
and kind of went away from academia and
one day after participating by accident
um in a uh almost by accident a ctf with
a friend of mine
who had happened to be a member of
shellfish so i played with
shellfish out of nowhere in defcon quals
i got hooked
said i want to do ctf i want to learn
more about security i contacted
giovanni vina uh the the founder of
shellfish a professor at ucsb and i
asked him hey
can i come do a master's at
ucsb because i want to learn more about
security and
and and do research in your lab he says
no but you can come to a phd
and that's why i'm a professor now um
so i'd recommend uh giving it a try you
can always
quit out early with a masters if the psg
doesn't work out
or it's not your your speed but you
might find that you love it i did
you'll have to email me exactly see a
question
about my ctf d server
um we run some insane
um mod of ctfd that connor
uh wrote himself even though he doesn't
really know css or javascript or didn't
do you now would you say
connor says he still doesn't know
javascript or css
so the to paraphrase with cottages i
have the reason that
he chose ctfd for the front end is
because there was already a bunch of
javascript in css so he didn't have to
write it from scratch
the first year we launched the whole
class it was asu only
the whole class ran over netcat right so
you netcat in and it'll say you know
welcome to module 3
and there's like a text menu and we
didn't have a file system we like
echoed into like uh files on on or
if you didn't have a database
we echo stuff into files and like slash
scores
it was pretty good
good times
is this updated now oh yeah this is
pretty today
nice it's quasi-updated
awesome and you can of course reach out
what the hell is this phone number
yeah why do we have what is this phone
number
i'm gonna call it wait no what if it's
someone's phone number
no it's an asu phone number this is an
asu uh
i'm calling it it's just some random
person i bet
oh it is pizza hut no i'm just
kidding
well my phone isn't working so
it's a disconnected number
all right anyways that is a
also what the hell is this are people
going to mail us anyways we should have
like
amazing we should we should put some
email addresses on here and twitter
handles but that's
that's you know later
exactly
cool okay um we have
stuff 25 minutes and uh in the class we
are making good time let's see let's
check in on the oh my god why
trade it gets bigger every time i look
at this
but okay they don't seem to be needing
me oh one person
person
connor can we uh launch more channels
okay yeah so the challenges that the
remaining challenges
just to give you a peek behind the
curtain um the challenge generation
framework used to be written in python 2
because either me or conor are massive
noobs i'll let you
guess which one okay okay
connor has piped into my ear to uh
mention that
i am the python 2 shill i am i'm now um
[Music]
you know on the python 3 bandwagon
because i was forced
forced to join by f strings
um but anyways basically our channel
generation stuff used to be in python 2
python 2 is now dead so we had to uh
port it to python 3 reporting it
like week by week module by module and
uh
this takes some time so we still have to
make sure that
the remaining challenges actually work
uh like when we ought to generate a lot
of these
um challenges and and when we do
everyone gets like a unique binary and
stuff it's not as important for
these modules but it becomes critically
important next week
for um reverse engineering and and
onwards
[Music]
when we generate these programs we
actually make sure that they're solvable
we have reference solutions for every
single binary that we generate
i'm very impressed with uh with the
speed of
it's good
got some real pros
um there was a question on twitch did i
start my phd
uh before age
30. uh yes i started my phd at age 25
um but i have students that have started
their phds after age 40.
um it's never too late to do a phd
you can always contribute awesomely to
the areas
of uh of science that you're interested
in um
yeah i so i did my phd at age 25
um i uh
spent a long time in my pg took me a
little while to find my research
direction and then it took me
uh longer because the darpa cybergun
challenge happened
um most of the way through my phd and
basically i
focused fully on the darpa 7 grand
challenge
for a while at the expense of graduating
um and uh
that was uh that was a very very fun
time in my life um there's nothing quite
like a phd it's it's a time when
you have very
little responsibilities other than
science other than doing the research
that you are passionate about
um i i
it was you know some surreally
amazing uh period in my life just you
know being able to
work on things that i was just super
interested in
go home sleep show up work on super
interesting things
um the whole time it was it was awesome
um i highly recommend everyone to to try
it out
uh question especially if you're
passionate about some topic like cyber
security
um question on twitch do you have
specific
cyber security topics of interest right
now yes
so right now i am um so so for the
cybergun challenge
i don't know if you've seen we're gonna
do a live just like google lecture
darpa cyber grand challenge
um i don't know if you've heard about
the cyber grand challenge the cybergun
challenge was an event
uh in why why is this
such bad resolution whatever was an
event
in 2016 where um the um
defense advanced research projects
agency
uh in the united states funded a massive
event
to explore this concept of whether or
not full
automation could um
uh you know perform
like human hackers right can you
automate
hackers um
so uh one of the the teams in the cyber
grand challenge was team shellfish
uh i was the captain of this team at the
time and we
created the mechanical fish uh what's
called a cyber reasoning system one of
the first seven these are the seven
cyber reasoning systems
uh in the world that would just
automatically
hack um and uh
it it took an insane amount of time
actually let me show you something from
youtube
final preparations
where where is it hold on to me let me
try to search on my
youtube
i don't understand why it doesn't come
up if you like failed at ssc somehow
my videos yes i know preparation okay
the night before the cyber grandchild so
for the cyber grandchildren to qualify
first and we qualified
um as one of the top seven teams there
were like a hundred something teams
entered much much fewer had actual
reasonable
um solutions and we qualified
as one of the the top hundred
um oh sorry one of the top seven
uh winning for shellfish the hacking
team like a prize
of uh um
750 000 just for qualifying it was it
was
crazy cool um suddenly we started having
you know
sushi dinners in our hacking clubs
instead of pizza stuff like that um
but also you know that money funded a
lot of really awesome
uh research um
then uh we had to prepare for the final
event the final event was live
what i showed you the photo of earlier
was the stage in las vegas on which
these machines
were held um i mean this this was uh
this insane uh
setup there were thousands of people
that actually came and watched
this uh these machines basically blink
lights because i mean what what what are
you gonna
you know see on a machine hacking and
then a lot of visualizations and so
forth
it was super awesome so uh this is the
the
final night of preparations before they
physically cut the ethernet cable with
scissors
um to make sure that no one interfered
no humans interfered
there's there's me madly uh
putting finishing touch we're making
insanely huge changes right up until the
the very last second
um and uh
it uh was uh
super super fun so the cybergun
challenge showed that yes
automated hackers can perform to some
level at least
um they fought a cyber war against each
other with a lot of very cool results um
the uh we won third place winning
another 750
000 the first place team would actually
then pitted against
defcon ctf players so like
potentially the best hackers in the
world um and
uh lost uh it got
um torn up pretty bad but i mean that
was amazing like it actually
started uh uh hacking against
top players why am i saying all this i'm
saying because
a lot of my research there was a
question uh on twitch if there's a
research area that i am interested in
a lot of my research um is in the field
of cyber autonomy the automation of
cyber security uh can we make autonomous
systems that that
you know do cyber security do what cyber
security professionals do
um and there are a lot of challenges
here in this
um this field that are not currently
well addressed so that's where a lot of
our research is for example
given an arbitrary program not a program
sp in a specific format prepared for the
darpa cybergun challenge
but an arbitrary one something as
variable as
um apache internet server or
postgresql or
you know some some streaming platform
can you automatically analyze it for
vulnerabilities
and turns out that's extremely hard and
then that's what we're working on right
now
if you're interested in the cyber grand
challenge and and what we did there's a
write up
cyber grand shellfish
that we uh wrote in frack uh frack is
one of the oldest kind of most famous um
hacking magazines uh designs like fully
online designs
and this is um a write-up that we wrote
um this is me and my whole team
and giovanni are our fearless uh
mentor and and leader um
at ucsb and and this is all you know
work
in my doing my graduate studies and we
i mean this is a lot of text we wrote up
about everything
in our um system like the exploitation
component
how we found the bugs
uh there's how we patched the bugs
you know the mechanical fish would
automatically fix vulnerabilities
um and everything and then you know just
crazy
crazy amount of stuff the whole like
orchestration layout uh analysis of what
happened in the
competition this is uh
our strategy general strategy um
very very awesome a lot of a lot of good
info if you're interested
cyber grand shellfish
um all right uh someone on twitch asking
um
they've always questioned the phd since
they've never been interested in doing
cutting edge
research doing cutting-edge research
means different things in different
fields
in biology it often means
you know tearing spines out of rats and
then
preparing different mixtures into
different petri dishes or it can be
something
much crazier and more um
outwardly exciting let's say uh like
creating uh i don't know
like the end result of being able to
modify someone's genome or something
and and any sort of research is like
that cyber security is very much a
research field
of badassery like all right so
if you sit down and you create a tool
that is just like
so badass that it finds tons of bugs in
real code
that you know were missed by existing
work
and um you know have some fundamental
properties that
make them only able to be found by your
tool
that is what cutting-edge research is
cutting-edge cyber security research
is to kind of butcher a another phrases
indistinguishable from hacking in in
some ways in other ways it's very
different
but you know i did most of my
phd in the ctf arena
uh although
that i it also took me a while to do my
phd it took me seven years so probably
if i didn't ctf so much i could have
finished it much faster
um what would you consider prerequisites
and skill and knowledge to enter a phd
program
focused on binary exploitation uh
this course i mean you don't have to be
a massive pro
just get through pawn college and you
have more or less the
background knowledge to to there's
there's part of your phd that is
catching up to the state of the art
right and then you have to surpass the
state of the art catching up the stage
of dart is a lot of learning
um and you can start from this course
you can start your phd and then take
this course you can
learn all of this material on your own
there's no hard prerequisites the psg
requires
kind of grit and dedication and passion
uh past that you can pick up all of the
concepts
um
question does ch root fail under
debugger no
you have to have root access though uh
so it will if you just try to gdb the
pseudo by
set uid binary as um a user
in practice mode you can just use sudo
to become root
and then gdb things
yeah which is what everyone on okay
any tips for three someone on zoom said
um and the tip for three
uh quoting connor i realized that there
are
that's level three in in um and for
the sandboxing module realize that there
are lots of system calls in the linux
kernel
and that means there are many ways of
opening a file
all right we have 10 minutes in the
course any final uh
final questions
so at the end of these 10 minutes um
we'll stop the
the stream we'll probably let the
collaboration continue for another 15 or
so minutes and then
um cut off the collaboration as well
um close down the collaboration channels
uh we'll have office hours
on monday as as normally scheduled and
office hours on tuesday as normally
scheduled
um and then we'll launch lectures for
the next module reverse engineering
of binary files without source code
this weekend um
have i ever read the intel programming
manuals
yes not end to end cover to cover
uh but but yes unfortunately i've had to
do that
um as a good way of learning x8664 no
don't do it why that's that's i mean you
can read that's like
reading a dictionary to learn the
language um
uh question about discord channels uh uh
the disco chats are not wiped
the history stays if you want to scroll
up and and and uh
see what's going on there um
what's asu's cybersecurity masters and
phd program
look like well a masters and a phd are
two extremely different things a
master's is taking a bunch of courses
right um asu has
that's true okay so connor um just uh
spoke up and mentioned that there's also
a slight element of research
and that you do a thesis um you can you
have the option of doing a thesis you
also have the option of not doing a
thesis
for a master form just taking a bunch of
classes but
if you do a thesis you have to do one
research project the problem is
it takes several years to learn how to
do research how to do impactful cutting
edge
um kind of top of the line
top tier research and
if you are very exceptional
you can do cutting-edge research as a
master student but usually
you don't have the time to learn to do
it and you you do something
as your thesis and then and then uh
you're done
as a master as a phd student you take
some classes
um and then you can focus
for years on just making amazing stuff
it's just it's it's an incredible um
opportunity to just just expand your
your
um expertise by
expanding the capabilities of the human
race
um
so the phd programs at asu and elsewhere
are very heavily focused on
research that's that's that's the most
important thing then there's the class
component that will you know teach you
some advanced concepts in in many
different fields but you're really
focusing on your research that's what
the phd is about
my personal opinion is that
for students that have the requisite uh
you know skills to work in their field
the phd should have zero classes in
certain areas
of the world png's don't have courses
they usually require masters to enter
but
you know it's uh um
it's a valid um
belief that phd students shouldn't be
taking classes at all they should be
focusing on research on making the world
uh a more capable place um
what is asu's program like specifically
um for the phd program uh we
have much more of a hands-on focus
we unlike
unlike many other places we actively
encourage our graduate students to
participate in ctfs to sharpen their
skills to get ideas
i've gotten many many research ideas
from ctfs for example
um and and just to you know have fun
in the process
so that makes asu a bit unique
it's not the only school that does this
ucsb is another example of a place that
really values ctf but there are
universities that don't that actively
discourage their students from playing
ctf as kind of a waste of time
right
someone on twitter's that sounds so
tempting do it
or you know when uh the apprenticeship
program
reopens postcovid um shoot us an email
it'll be uh the apprenticeship program
is low risk
uh the apprentices are uh the
apprenticeship is short six months to a
year and we pay you
roughly as much as a grad student works
so you can kind of use it as a
preview of grad graduate life
the apprenticeships are paid
all right did we miss anything any
notices on zoom
nope
good times okay so
again keep an eye on the twitter
make sure that um you you see the
reversing uh module as it drops the
reversing module the most important
thing is going to be knowing
x86 a 64-bit assembly which you
all have already been forced to learn
from shell coding and you will learn it
more and more from the reversing
side of things um
it's going to be pretty good
all right we got some enthusiasm about a
potential phd
in the chat yeah reach out i mean not
just to me i'm only one of
uh numbers of large numbers of
cybersecurity professors
many of whom are even more exciting than
i am um but i'd highly recommend
you i mean the world needs
more and more awesome cyber security
process
progress all
real the world also needs a lot of other
stuff so you can
there's many ways to contribute
awesome
cool
connor do you have any questions for me
are you listening to the to the trade
channel i i
i had to definite because i couldn't
concentrate
oh yeah oh
let's see
what do you mean why vim it's like
saying like
why oxygen you know like we could just
uh
possibly just like replace our entire
bloodstream with some
crazy stuff that's not oxygen you know
and then we wouldn't have to breathe
and we just like have a machine that
that pumps
lisp into our veins but no
it doesn't sound incredible it sounds
like a dystopia vim
vim is the true tool of
the brilliant hacker
it's the hacker with a shining spirit
hacker that
that you know to truly capture the flag
you have to
you have to be on the same wavelength as
it vim allows you to tune your
wavelength
in a way that that is hard on a more
practical note
i'll tell you a true story one time we
show up
um to defcon ctf or this was 2011 or
something right
um maybe 2012. we show up to the to the
finals
of defcon ctf shellfish rolls in and
shellfish
has this mini rack um well i mean
yeah mini rack about hip height stuff
full of servers and that's the
infrastructure
and and there's one server that runs
launches all the exploits there's one
server that
you know hosts all the files there's one
server that does all the fuzzing to you
know whatever
so we roll in with um this rack of
servers and we
set it up and we plug in to the game
network and we boot up
and and everything is earned then all of
a sudden our
attack machine dies that's weird we
reboot it
and then maybe an hour later it's it's
like slows molasses and
okay either someone hacked it or
something's going wrong and look at it
and something is wrong going wrong
what's going wrong emacs
freaking emacs is using up 18 gigabytes
of memory on that server
why i don't know i don't know i don't
i don't
yeah i don't think it was because there
were big files uh the emacs enthusiast
in the uh team there were several
um but we had one that's now on uh
actually ordered overflow bibo he had
some crazy emacs plug-in
that ate up gigabytes and gigabytes of
ram and he thought this was a normal
fine thing until it brought down the
server several times
so um yeah that's one example
one example
uh
[Music]
that is an interesting question
i think that we will
the problem is that hacking challenges
are so varied right like last year
uh at defcon not like this summer but
previous summer
we gave every team an xbox and that was
the challenge right
uh a game running on the xbox uh
adapting cyber reasoning systems to this
is
is very tricky um
[Music]
oh there's a question what is the most
craziest challenge
you have solved uh there's several
candidates
we don't have time because the class
just ended i'll either talk about it in
a future
wednesday lecture or maybe in a ctf
radio
podcast if you are interested in
ctfs i guess probably most people are
you just started a podcast as i
mentioned earlier
in the class grab ctf radio and you can
keep the party going
once this class ends by
reading listening about uh watching
what is ctf
this this way
all right connor uh says that um
i should say uh like and subscribe so
you know
you can do that if you want i need to
get adam to say it
yeah all right
awesome stuff um
can i link in the chat oh yeah
ctf radio for that one all right thank
you for tuning in
i'm going to stop the um stream now
uh and then we'll get this uh lecture
uploaded
to youtube as soon as it is done
exporting and whatever
um otherwise look out for the
additional shellcode uh sandboxing
challenges tonight or tomorrow
and um we'll try to get them up as soon
as possible
uh for those that plan to suffer all all
night with
uh these things and then look out for
the reverse engineering
uh lectures this weekend
see you next week