it's been a
a weird sort of couple of days i i've
been uh
going crazy getting the toddler uh
two challenges up and running
and uh as a result we are
i got i was trying to exploit it
anyways lost track of time had a meeting
at the same time when i was
uh anyways i'm here now
sorry about that uh
let me share
my screen on zoom
this meeting is being all right
okay here we go let's uh bring up
twitch
why is it not seeing it live
there we go live all right
we're back okay
all right awesome stuff
let's uh
let's see if anyone's got any questions
what's up
level six everyone seems to be very
interested in level six
let's take a look
all right here we go so let's see what
the drop-off is from level
five so level six whoa
level six is the hardest one
this seems kind of low
okay let's talk about level six
apparently the hardest
uh level in this uh module i'm going to
do the teaching one you can extrapolate
of course
to the testing one i'll talk about um
wait so level six has actually kept
someone from being tied for first
see if you can figure out who it is
oh maybe
maybe not all right anyways oh who
ah freaking out again over here
rethroned um
cool all right oh no one told me my
audio was really bad because the
microphone is across the room
here we go audio is good oh today's a
crazy day
but you know why it's crazy it's because
of toddler two um
i i toddler two was insane
i i yeah it's insane
all right um
let's talk about level six
finally all right we launch it
and uh
then we jump over to the terminal
and the ssh
not 566 by the way
just a little preview there it's likely
that we're going to have
um it should be approved soon a
follow-up course to phone college in
spring
it's going to be all about finding
vulnerabilities and exploiting
and then of course responsibly
disclosing
vulnerabilities in real software um
it's going to be pretty interesting
it'll
be open to anyone that hundred percent's
prone college
as in gets their blue belt all right
so here we go
baby race right
it needs a path obviously so let's give
it a slash flag
path contains flag it doesn't like that
so
let's um of course do our typical thing
uh let's make a level six directory here
and then let's make a sim link
to slash flag
boom it says oh file is assembling
all right how do we get around the file
being a sim link
right level five correct me if i'm wrong
should also
have the same check let me double check
ah question on twitch is our 500 level
course it will be a 500 level course
uh instructor approval required for
everyone to sign up so let me know if
you're interested
um and i i haven't figured out a way to
make it
actually world um approachable so
for now tentatively speaking it's only
um
gonna be open to asu students at least
for that first run
for next semester um but it should be a
pretty interesting course
i'll share out the syllabus as soon as
it's fully approved
and and online all right um let me
pull up level five off camera just to
make sure that
it has the similar
actually let's just launch level five to
make sure that we have a similar thing
oh
what the hell i'm leaking the source
code of
baby shell that's annoying no one saw
that
damn that was uh obs going crazy so now
i'm gonna kill
all known terminal to make sure obs
freaking obs
all right gnome terminals are all gone
ah man there we go
how does that happen how software does
bad
okay
all right level five let's do level five
testing one let's just spin it up to
convince ourselves
that it does the same thing right so
we go to level five
but okay here's level five and we do
asdf and it says okay file is assembling
so how did we uh um fix that
we can
we can instead trick it with a
directory right here's a directory a
with an asdf file
so a slash asdf is a sim link and of
course if we say
a asdf it's not going to like it
so what we do is we create a directory b
and of course b hdf is perfectly fine
hold on oh
no one can see my screen all right um
no hold on now i'm
going okay that's right that's right all
right um
let me rewind to level four i think
i really i want to walk you through from
first principles but
um let me just
remind myself of the advancement sorry i
was up
uh with toddler two until 8am
was insane
but don't worry we're going to make it
very approachable
it's going to be awesome
hold on let me uh okay
okay never mind you did a little bit of
a
all right
so there's a a
a level missing that we should have had
to more smoothly transition this level
um
fours is different level five of course
requires that this directory or the that
the file is not a sim link
and it requires that the directory
is owned by root if you actually take a
look
at level five um in
binary ninja we can see these checks
so what we should have done first is put
a file that
uh put a level that is uh just checks
that the file is assembling
without this root check um but we'll
we'll fix that for next year okay so
um we make sure that
there's no flag in the file this there's
no way to race condition this it's just
you know a check in memory that we don't
have any
impact over um then
we make sure it's not a sim link then we
make sure
that um the directory is owned by user
root and group root
um and is not writable
by other users
and then we just open the file
and need it to standard output
so when people like me start using the
word yeet you know it's dead
i just killed it it's over all right
let's go um so b
even though b slash hdf is not
a um
actually this is a good ls-lr it's a
recursive ls so there's
directory a and b and then there's asdf
which is a
link to flag and then there's bsdf which
is just a file
this isn't good enough because b is not
owned by root
right all right what is owned by root
well a lot of files here are old by root
at c pass wd is owned by root
but actually it's more important about
the directory directory is owned by root
and
uh other users don't have um
right access to it see is great let's do
etsy
so we can
make a link
oops i have typo make a link
to etsy
oh my god sorry guys all right
so uh i made a link
to slash oops
we remove b we
well uh
have b that's a link to at c so now you
can look at b
pass wd this um
is a owned by root
if we actually look at
the or sorry this is not a sim link this
is a normal file
slash chat c of course is owned by root
so when when this program does stat
it um is going to be
happy that it's uh owned by root
now um we
create a file a pointer to slash
assembling to slash flag and a slash
passwd
so if you cad b slash pass wd this is
the normal pass wd
a slash pass wd
what oh yeah permission denied because
that's pointing to the flag all right
so what do we do now of course if we
say hey give me b slash flag
slash pass wd it'll happily do it
right what did it do it checked if
um uh
the
directory is on it check that the file
is named flag it's not it checked if the
files are simulink it's not
it checked if the directory is owned by
root
but because it used um
stat
right it uh follows symbolic links
and it actually is looking at
slash etc which is um
owned by root and so it's perfectly
happy and it leaks out that file all
right
now i'm going to relaunch this in
testing mode uh sorry in teaching mode
so that it pauses so we don't have to
uh stare this race
here
right now we're talking about level five
yeah so let's uh run it
all right
here we go let's uh let's attack the
teaching
all right so we again have b that's a
point
uh assembling to slash etc and a and
then we have
both a slash pass wd which is uh
assembling to flag and b
pass wd which is a normal file if we
run a
baby race on b slash pass wd
actually let's let's make this easy we
have a sim link
named c that'll go to b
so c slash pass wd right now is pointing
to
uh the etsy pass wd
if we run baby race level five on c
pass wd
it's it tells us what it's going to do
it tells us it's blocking
right so okay it it checked lstat
on the uh file it checked stat on the
um uh directory
and now it's happy and it read it out
all right so what can we do here
it's uh waiting um
blocking boom it called elstad
it calls that all right
now
sorry now we have c
and we basically
just change c
to point to a instead of b
all right now when this program opens
c such passwd that's the flag
but it already checked that the file is
not assembling
right now boom oh
still needs the directory to be owned by
root
okay that's not a problem
oh hold on hold on hold on
let's s-race this guy and see when it
does
okay so it did the lstat
it did the stat
oh i see there's a
it prints stat
before okay so what we want
we want to win the race after it
actually calls stats on the second block
until input
all right of course it won't be blocking
when we actually
do this attack okay boom here
i think this should actually be printed
out here
um connor if you're listening can you
open an issue so we don't forget have
this printed
down here okay anyway so it
just called stat now we change this
to point to a
and boom here's our flag all right how
do we actually exploit
uh level five um
uh in practice uh sorry in in
on the testing let me launch level 5
testing
oh connor you're there awesome while
you're uh opening issues could you also
open an issue for an
added level um for the directory
uh the the not assembling concept in the
first place
i think we can just make this much
smoother in general
all right so here we are we are in
testing now let's go back into our
um thing here um
of course the whole thing here is to
have
um
sorry mine went blank for a second um
okay so we
we just loop removing the sim link
that's there and then we'll have two
other loops
that uh make the ceiling to a and make
this something to b and then eventually
we'll win that race
all right here we go let's see what's
going on here
whoa
there we go c points sync to b c
pointing to a
and that must be a race condition with
ls itself
where by the time ls went to see where c
points it's gone
all right and now we just do baby race
on c slash pass wd
and
if we just do this
eventually we should win and if we don't
then we'll have to build a
maze but that part i'll leave as an
exercise for the reader
okay seriously what the hell
you're gonna have to build a maze
do we have time yeah we have time do i
have a maze built already
damn i don't have a maze build
i think it was 800 i decided 600.
okay
the subdirectories
all the way through t
let's do this
let's just make it all under maze
maze
okay let's see
awesome okay so now we have
that let's just do
i hate not having my shortcuts okay
um
okay
okay here we go
hope too many levels of model clicks
yes awesome okay
let's do this guy now
make it
awesome okay perfect it gets it's still
getting swapped in the background over
here
now let's do this maze
no where is it
um so we build until t there's a
question because the
there's a limit to the amount of
siblings the system will follow that's
absolutely
correct yeah um so it's it's happy with
this but
um this is 40 base t is the 20th letter
and then for each letter we have two
symbols one to the end one back out
um i'm trying to figure out
why this is failing to get the file
status repeatedly
let's give it an s trace
oh it's getting file as filo's
assembling errors
follow the sim link
but this is almost exclusively
let's just try one
ah so it does it does hit this
every once in a while okay
um
let's just do this for a bit maybe this
is enough oh
let's see yes
well all we needed was a small maze
success
um there is a depth limit for each uh so
there's a
there is there a depth limit for each
there's a maximum size of a path in in
linux
um someone on twitch asked if there's a
depth limit um
and that's four kilobytes uh one page
so that's what i've been assuming is the
depth limit of
um the
[Music]
yeah that's what i've been assuming is
the depth limit um
of each directory depth but now that i
think about it i'm not
so sure that that's um
that that actually is is grounded in
reality all right
so that's level five finally we can move
on to level six don't
submit this flag you'll get flagged as a
cheater um
uh so the question was can i share the
script for 10 seconds um
so all we did was do uh
the basically the maze
[Music]
to slow down what level five does and
then we
swapped a sim link c between a and b
um a or b is just assuming to slash etc
so that stat on it uh works um it shows
that it's owned by root
in there there's a the normal etc passwd
file
and then we race so that after
uh level five verifies that b is owned
by root or that
c is owned by root we switch where c
goes so that it becomes
um points to a in a
we have a uh well now we have a bunch of
garbage because our scripts went crazy
but we have a past wd that points to
slash flag
all right so someone in twitch says but
level six does not
follow sim links and you're absolutely
correct
so level six let's run level six
testing one
all right now when um
you saw that uh in level five
level five wasn't following siblings
what did you do
you said oh okay no worries i can beat
it with the directory
right
so that's what we're going to do again
all right let's reconnect the l here
you're just going to abstract one level
higher and it's going to be awesome
all right so here we go level six uh
teaching one again
we go um b slash
or let's do a pass wd it says okay
lstat on the path it's assembling a
slash passwd is assembling so let's do b
slash passwd
okay okay now
the directory is not owned by root all
right
that's uh
[Music]
fine we could have um run our previous
attack
except for we call elstat
on the directory right the directory
now cannot be a sim link but what
directory do we call elstat
on so if you trace it
we call elstat on b right
okay what if
there was a directory
x and y
hold on i think my airpods just died
all right they're back um
let me plug them in actually in case
they die again i think i forgot to
charge the case
that is no good
okay so
if we move a into x
and we move b into y
and then we
hope there's no more b slash path of u
and then you do x slash b slash past w d
oh sorry y slash research pass wd
okay
we call elstat
on y slash b
y b so the question is does staff follow
any symlinks or does it just
it does it only refuse to follow that
last symbolic link
right does it will it follow
why if y was assembling and
uh the answer is yes
so let's have a z that goes to slash
sorry if we do
stress on z slash etc wd
it works right
and of course now the challenge is
identical
we have z slash uh etc
wd
then of course we can have
x slash etc
wd which is the flag
so we have these two paths one of which
is accepted by all of the checks the
other one
gets us the flag and of course in the
background
we do that same uh
link shuffling and we're golden
add a maze and we can win the race
cool huh
uh so the question is since sibling
indirectly the flag won't work we need
to assemble into a directory in root
which goes to flag that is not quite
it you need to assembling to a directory
in root that will pass
all the tests but then
as you after you pass the test you swap
out the sim link
and uh get the flag so let's just do
this here right
so i'm not going to write the the whole
uh
um thing so okay
z goes to slash this means that we have
let's remove y because it's no longer
relevant z
has everything that's in obviously if
you look at z you'll end up in slash
so here's our baby race we can look at
etc
pass wd and we can cat etc pass wd
note
and the binary is happy to cat
etc past wp boom
all right now if we get
to that final check so all of the checks
are now good
we swap it out
let's just um
okay so now z goes to x
and x slash etc
d all of this is just directions we
created
we created x etc i just did it
right like uh five minutes ago this goes
to
flag now if i do z slash
etc wd it points to the flag
i hit enter here boom here's the flag
so the question is why does lstat follow
the first
sim link um
it is just how else that works
l-stat does not follow the last symlink
um but it will
uh it is actually very hard to say in
linux like nothing is assembling this is
plagued with uh race conditions right
because the way that off the top of my
head maybe i'm not aware of some
um
better way to do it but basically you
just have to go step by step in your
path
and check if every part is the same link
right of course
normally every single part of that is
uh prone to race conditions um
the way that you could do it probably
safely without race conditions
is by using open at right
so you start from your you know current
directory and then you just
open at in that directory the next
directory and the next directory and so
on
and to open you can se uh pass a
nofollow flag
so it won't follow the symlinks and
you've seen this before
in other challenges
so the question why does zelda follow
the first swim link
it l-stack only refuses to follow
the last um um
semi so same with uh nofollow
that that's uh how it works just in
linux
right i wonder if the
yeah so uh lsat not following siblings
isn't the security measure
it's a uh way for you to get information
about siblings
cool
what's your question
uh okay so the question is
seven teaching versus seven testing
um
because in seven teaching of course
it'll it'll help you
win that race in seven teaching it won't
um let me take a quick
look at seven i don't remember
exactly what everything is
all right so
um
seven teaching is listening on uh the
network
port one two three seven
okay asks for
so we can make multiple connections to
it right
and we can log in log out
sudo flag and quit so flag seems
interesting
okay we have a flag but it says we're
not logged in
we log in all right now
of course teaching will block until
input
let's go sudo
oops pseudo tells us unauthorized
all right let's look at the binary we've
kind of exhausted
what we can um look at
on the com on the command line
okay let's uh just just decompile this
guy
all right let's go to handle connection
let's go to volume all right
sudo where's sudo sudo is right here
sudo just tells us unauthorized unless
we're root
that's not and and get eid or sorry get
uid
returns the real user id if you recall
so we really have to be
root bomber there's no way to use sudo
so we're screwed right we can't
get um our privilege level to two
which is what's required to read the
flag
um
uh so it would seem that we are
um wait where's where's the the
flag is
right here right oh this whole thing is
the lag all right so
if
if our privilege level is zero it tells
us we're not logged in if our player's
level is not
uh one so if it's two
for example it'll give us the flag but
it's not two
but it doesn't have to be two it just
has to be not one and not zero
what else might it be well obviously
there's a bug somewhere otherwise this
13 people wouldn't have solved it or
however many people solved it
and the bug is right here where
basically if we log out
we will uh
what's it called sorry my mind just went
like if we log out
we will uh uh uh uh um
decrement the a privilege level
wait a second connor you might have
noobed this
up
no okay okay okay okay okay phew all
right so
uh oh okay here it is here's the whole
log out man this is a confusing
command loop okay um
so yeah yeah so when we try to log out
we'll check if privilege level of zero
if it is already zero it won't do
anything but this
is a lot of instructions with system
calls and everything
anything could happen here so obviously
there's a race
the race is between uh
starting to log out and checking this
privilege level and another thread
logging out for you
so then the other thread checks this
passes this check as well
decrements the counter to the privilege
to zero and then we'll decrement the
privilege level
to negative one all right
let's just give this a try
run it connect
connect log in
no block okay that's fine log out
all right it's about to drop one
privilege level but before it does
we're gonna log out here boom
privilege level zero boom privilege
level is negative one
and of course negative one is neither
zero nor one
all right um
so that's level seven
now what is level eight i'll give you a
hint
in the hint
you're just gonna do the hint and binary
ninja
the hint is that this works very
differently
than level uh six did basically it's not
a network server or donelson it's not a
network server at all
it just says hey
welcome so it's not multi-threaded
we can't get a race condition between
the threads
but what is different here what does
this have that the previous
level does not and it's this
we have a signal handler
so go back and look at
this lecture signals in reentrancy
watch it all the way through pay special
attention to what happens here
and solve level 8.
yeah what's up
all right so so the question was would i
recommend
um doing this on the shell or in
python with pawn tools i recommend doing
it in python
um
although honestly the shell for this is
also fine
right um
the real
trickiness here is um
typically when you
race um these race conditions
right um especially with multiple
threads
you want to end up in a situation where
[Music]
both threads have a lot of data to
process
before they trigger system calls
because system calls trigger contact
switches
and then these contact switches give an
opportunity for the kernel
to um go over to executing a different
process
right so you want um
to let's say for example cue up as much
data as possible for each thread to
um crunch on
so if you were doing what i was doing
right then where basically i was
going login log out in different fl you
you could
just flood two or three different
threads with login logout
and then in your in another thread just
do flag in a loop
for example but try to give them a lot
of data
all at once to
basically the
less that each thread spans waiting on
input
the more time that they all spend
running
concurrently and the more chance that
there is
um to uh have a collision
um yeah
yes well okay so if you're creating
netcat process and pawn tools something
doesn't make sense pawn tools allows
you to make connections pwn.remote
so you can make three connections but
keep in mind that if you do
if you create three connections or three
netcat process but don't do that
do use pawn.remote
[Music]
if you uh create those three you want to
use them in in different threads
concurrently you don't want to send
data on one then send data on another
then send data on the third
that won't cause the race condition
to do that you can use fork or
different just separate scripts honestly
all right yeah so the question is how do
you use multiple scripts if you're
attacking a network service usually the
way you do it is you
just run the um the process itself
on the terminal and then have your
scripts just connect with phone.remote
yeah yeah just use phone remote
um how should we use remote here well
listen we're talking about level seven
right now we rewound
um there was a a twitch question
um so you just launch let me show you
are we on level seven yeah you launch uh
level seven
okay listening to four connections in an
ipython session
here we go
okay r dot send line
login and then of course because this is
uh
teaching it'll uh block so i have to
send the dot to get past that or
something
and here privilege level and so then we
can just do
boom and then do it in the same thing in
a different script
boom
oh i forgot to log out
okay here we go
there we go there's the race
all right there's confusing acronyms in
the twitch stream i'll ignore them
is there a class size limit for this
phone college follow-up
yes so i i i'll reiterate the pawn
college follow-up
it's not messing around i will not
um authorize you to take the class
unless you are you have full completion
so right now we'll have
uh and i have to figure out non-asu
students probably wouldn't
wouldn't be able to do this
unfortunately so right now we have one
two three four
five six seven people potentially
um or you know i mean people have
gotten 100 pound college completion uh
in prior years and so forth
so i don't think that would be a class
size but i think it'll there will be a
natural
very heavy limit
and of course the reason we are doing
100 is we are gonna move
fast into real stuff um
all right um
switch question about level four uh
we have not yet focused we had not yet
done level four so let's uh let's take a
look
let's rewind
to level four
uh let's just do teaching so we don't
have to
do anything hard
okay
level four uh let's say let's okay
actually teaching will tell us
what's up partially let you open a
single file
file open will be read in it'll verify
that it doesn't include flag
it's not a sim link and that the file is
not larger than
256 bytes
cool so that this sounds very promising
let's take a look at what happens
opening the file in binary ninja
so there's a win function that's cool
all right here we go
um
we uh make sure that the file doesn't
contain flag
we uh check to make sure that um
the file is not a sim link
then we chill out
and then or sorry along with our l stat
here
once we confirm we get this var 68.
oh l-stat
writes a struct over the stack so this
is
this binary ninja probably doesn't do
this
do we have structures for elstat
yes stat awesome so let's uh
no no what are you doing
come on okay here we go so let's
change this to a struct stat
yes haha awesome it actually worked
it was incredible but now i can't bring
it up
okay now it stopped working all right
anyways we'll we'll
take what we can get so um
we have a stat struct which elstat fills
out for us
and we look at the size this is the size
and bytes and we check if it's
um
hex 100 so it's less than 256 and if it
is
less than 256 it'll open that file
and into this var uh into this buffer
which is hacks 198
away from the return address
this is um if you look at
the assembly
oh oops
okay i'm saying this doesn't look like
assembly uh if you look at the assembly
files the sim link file is too large
boom here we go we call read
uh rdi comes from eca this is the return
uh uh value of open great so this is the
the file that we just opened that that
we confirmed was less than the maximum
size
and then this is rbp minus x 190
but we read an entire page 4
000 bytes obviously this is an overflow
except for we checked
right we checked that the size is less
than hex 1000
or hex 100
so on the face of it there's no overflow
here but obviously there's a race
and this race is exactly here where we
block until input
this race is obviously
to make a file that passes this check
and then redirect the sim link
or or replace that file with a
gigantic file that will cause an
overflow here once you have an overflow
we can
[Music]
of course um
to a check sack
you have no canaries home free
once you have an overflow opponent
remember there's a win function
and
there's no pie
cool
all right there's a question on twitch
um how can i get the private key
you don't need a private key you just
need to upload your public key
if you create an account here go to
settings
go to ssh key paste it in there there's
a clip of connor doing it
then you can start
[Applause]
going for it cool
all right sorry i started late today um
it's just just a crazy day trying to uh
get toddler two finished up for you all
but it's going to be an awesome module
we're going to have a lot of fun
and we'll see you on wednesday thank you
for joining