my the twitch chat i'll be right back
let me get my
ipad
all right as you can tell we have a
professor baby yan
with us today it's a bit of a crazy day
um so let's see
all right let's um open it up for
questions
who's got questions
no questions i guess everybody's busy
working on
toddler two which is exciting stuff
we'll have a second drop of challenges
for you tonight
i know it's uh more delayed than
usual it's uh uh
it's been a
quite a week the question
are are the kernel challenges going to
have yan85 yes they
are kernel challenges will have yawn 85
not all of them
but we will have a yawn 85 at least one
yawn 85 kernel challenge
inside the kernel there's something
called um
ebpf ebpf
oh my god what's going on okay my screen
wigged out for a while ebpf
is a um way to run
programs inside the linux kernel um
the programs are usually uh filters in
fact this is what your setcomp filters
compile down to when you specify them
but aside from sitcom filters
this is the same uh mechanism that uh
does ip tables uh rules um
and various other uh kind of you know
um things that run in the um
linux kernel um so you can
basically create a bpf um
program and then run it in the kernel
and it can you know intercept cisco
you can do a lot of cool stuff um all
right um
and then i guess i've never actually
seen this ebpf.io
page uh the ebpf homepage i didn't even
know ebpf had a homepage
um but it's very cool right so you can
do networking you can do
you know sec comp you can do trade like
there's some amazing stuff if you're
truly interesting interested and if
you're interesting
um yeah bpf uh question on twitch what
is stanford stands for berkeley packet
filter um
hold on i always have trouble finding
this this guy
um this uh io visor project is super
interesting there's
a lot of um cool
tools based on bpf that they have
there's one
a set of tools that that you can just
get out of the box
that
just have a a bunch of um
bpf tools for example a very cool one
is
um open snoop
for example you can see uh uh
something like this what processes are
opening what files in real time
there's like a lot of very cool um
stuff that uh is pre-implemented for you
and a high-level
language with which you can implement a
lot of very cool stuff
right um such as that open snoop
um anyways the new ebpf
is yan85 we're gonna have jan85 a secure
interface for
running stuff in the kernel it's gonna
be awesome
so yeah we'll we'll see how crazy we
we will get um
and how crazy our infrastructure allows
us to get i think
uh i don't know if if we'll be able to
finish it up today but
um for the future it'd be very cool to
get like a sec comp
like a true set comp like interface
yankomp
would be very cool but uh maybe that's
future work
um hopefully everyone has watched
the um uh
video on escaping saccomp not this video
this this one yes um
where you know it turns out actually
it's
very straightforward how uh setcomp is
invoked
in the kernel right there's this uh data
structure
and then in the syscall it uh
uh handler it calls this secure
computing which is
sec comp of course and then it just
tests the flag
and then runs the filter very cool stuff
um i wonder it wouldn't be too hard to
actually change up the source code
to instead of running a second filter
run a yan85 filter
that would be awesome but something
something we have to think about
a little more carefully
ah um by the way questions don't have to
be
um confined to uh
[Music]
uh what's it called yon85
you can you can ask questions about
anything
all right questions on it to be combined
confined to toddler two
[Music]
i think that was a question
advertising on discord um
see what else what else what else what
else
yeah we'll just chill out until someone
has a question
all right for the class that i'm
offering for some of the pop top people
is this something we can do even if you
are graduating this semester
this is a good question um
i am still trying to sort that out um
uh
yeah i'm not sure yet um um it's going
to be basically
the same for people that are graduating
and for just global students
um so if you
uh what did she do if you are uh
not an asu student currently uh like as
of next semester
it's gonna be identical
um yeah so i'll have to i
i'm still sorting out the
you know uh what what we can do about it
um so we'll see
all right um there's a question on
on uh twitch um
from a four plus one cyber security
student that is asu's accelerated
master's program five years
uh masters um
would i have some advice on how to get
started master's thesis
at asu um i think the
the key thing is to reach out to the
security faculty
right so asu has a bunch of um
security faculty off the top of my head
obviously there is the um
cepcom lab that's the
the lab that uh um
my colleagues and i run so there's five
of us in
that lab you can reach out to us uh
we have different um
um research interests etc etc
um you can
also look at other security faculty at
asu for example
stephanie forrest
is a professor here
that explores the intersection of
security and biology right so so
um or really you know bio-inspired
security you can
easily consider um
[Music]
we're teaching here you can consider
uh viruses and antiviruses right is the
easy term we use a lot of biological
terms anyways
um there's obviously a lot of biology
um uh that comes
into play for example address space
layout randomization
right every instance of a program has a
slightly different
memory layout it's kind of analogous to
a different genetic
code there's been programs inspired by
stephanie's work
um there have been government programs
to try to diversify software so you take
a single piece of software and you
create multiple different variants of it
that are all slightly different
that's similar to different genetic uh
predispositions or susceptibility for
diseases
um is maybe differently susceptible to
exploits um
very cool uh sort of stuff so that's
stephanie forest there is
um um um
judd crandall who does a lot of uh
he actually just moved
[Music]
he just moved to asu um he does a lot of
very cool
work with you know networking and
censorship
detection um and this sort of stuff
um there's a comment on twitch
that stephanie sounds badass she is very
badass she's uh
responsible for a lot of the kind of how
she's responsible for a lot of the
fundamental work in the field she's
she's a
very uh very distinguished uh professor
and researcher
and and mentor um jed crandall
uh it just started this year he's
teaching 365 this year
along with fish um and uh he
is or this semester uh that's about to
end out
um he is uh he researches a lot of like
networking
censorship and stuff so if you're you're
interested in in
uh queering and researching the uh yeah
exactly on
on twitch someone said the great
firewall he has done
work in that and it continues to do work
in that
um there is uh a new
hire um a professor young provider just
joined asu
mee trio um she does
uh uh crypto research specifically
um privacy preserving computation um
she's an extremely successful researcher
in that field um and
generally in security um so
uh and she's
actively looking for students highly
recommend reaching out to her if you're
interested in
math crypto um and and this sort of
research
it's um
she does really incredible work much
like this baby
who is uh
really taking charge of this class
um yeah uh
so reach out to me if you're you're kind
of math
inclined um there's a lot of amazing
work that can be done there
um if you uh
yeah um very cool stuff all right uh
there is hey
we might uh have to uh run for a bottle
in a second
um who am i missing i'm missing
paulo i'm gonna misspell his
name um
[Music]
paulo does um like a research is the
dark web
and uh this sort of you know underground
communities um
super interesting uh uh
work then there's a comment on twitch i
was laughing at
little yon is is free when
given an invalid allocation this is
exactly and she's trying to abort
this class um so
um yeah apollo is another
uh professor to reach out to um i apollo
might be
on leave um making a
crazy cool startup so
um but reach out to him if you're
interested in
underground economies and dark web and
this sort of stuff
uh and then there is
he's a networking researcher but does um
security uh as well um
and he his website is not loading
asu is down okay there we go um you can
reach out to him his lab is actually
right next to our lab
um they do a lot of very cool network
security stuff
um there's a question on
twitch will knee be helping teach 598
next semester she has her own 598. so
598 is actually
a generic um
[Music]
598 is a
generic uh number so there's there's
gonna be five
at least five five nine days mine hasn't
been posted yet
we're still working out some details um
uh we're still working out some details
um
and uh but she has her her 598 highly
recommend you take it
it's going to be like focused on on her
research
um it's going to be super interested so
if you are interested in crypto
at all take this uh 598
for sure um ah
okay then hold on my ear pods are being
stolen
then um okay they're gone no no
those are edible or not edible rather
um who else am i missing i feel like i'm
missing a security faculty that's going
to be embarrassing
um ah
sorry guys i'm being attacked by the
baby
okay um so someone uh
uh oh yes steve yao
ah no that's mine um
there's steve yao uh
someone just mentioned him on on twitch
[Music]
he is a our senior security faculty
member
um you can also reach out to him
as well um he's still actively mentoring
students and
everything it's pretty awesome um all
right someone on twitch
said something uh that that
must be addressed that i'm aware of the
insane math needed to understand crypto
so i'm hesitant to take classes like
these don't
hesitate the math to understand crypto
is actually super
simple i taught rsa in basically
um you know 40 minutes as uh
in a guest lecture at an adam's class
and i think people understood right the
math is not hard
um like fields and so forth of course
there's a lot of different types so
um elliptic curves are trickier
um but yeah don't
uh let the mad disturb you you'll pick
it up
all right um i'm going to take a quick
break to try to
pacify this baby uh and then
i'll be right back
yeah i will be right back to take
questions so we have a question on zoom
um but we're going to um
pacify the baby first i'll be right back
okay
[Music]
uh
oh
so
all right we are going to
try to uh
feed the baby into a nap
okay let's catch up on twitter and then
start taking questions
i did not yell [ __ ] at ipython
i don't know what anyone is talking
about i don't think that's on tape
uh yeah question on zoom
go for it
uh
yeah so so for toddler two for those
first eight levels the race conditions
are the same for every challenge um
they're very similar um if you just
reverse the
the binary it's extremely similar right
um
the only difference of for the first six
levels is where the secret is stored
that you need to find
and then the latter two levels have have
differences
um level seven specifically adds a quit
action
right um so um
[Music]
so that's in terms of the race condition
so the race condition that i go through
in my uh slides is exactly um
you know how the the challenges work
right um
did you also notice that i
i put up um i re-recorded the live
lectures
um based on confusions that i saw
uh people having i i tried a different
approach
um to to do the arbitrary
uh the controlled allocation so uh
re-watching those might help
um yeah and then from there
the key thing is once you have an
arbitrary read and an arbitrary right
it's all about memory sleuthing
right once you uh you know figure out
where things are in memory and how
they're related
you can get that secret
cool let's see
yeah let's do there's a specific
question on level three
let's tackle that and then we'll um
we'll go on to other challenges uh
okay level three let's pull it
up
oops level three
[Music]
trying to rock the baby to sleep now
okay
um
level three let's roll
all right so toddler two level 3 testing
gives us of course malik free scanf
printf
and send flag and it's it's
basically our awesome message server let
me
go to um binary ninja cloud and log
in and we'll take a look at what's going
on
[Music]
one second
copy password
boom okay
that's weird
all right check out the
um so the question is
for these ones how do we get the flag
uh there is a send flag
option when you send flag asks us for
the secret
and then it tells us to go away oops
here's my terminal where i did that send
flag
access for the secret then it
tells us not authorized let's take a
look at what is going on there
um we go to volume
we do a decompilation
here's not authorized here is authorized
so it
calls the secret correct function on our
input
the secret correct function uh
loads the secret into a stack variable
and uh
compares that against uh
the um
the secret that we are trying to
uh that we are trying to guess this arg
one um
deletes the secret and then uh returns
uh returns
a um the result of the stern comp
okay um so the secret is uh
loaded by load secret into this variable
which is a
stack variable you can see it actually
may be better in
the assembly um where
we call load secret with rdi
uh being rax and rax being the
uh effective address of rbp minus hex20
okay cool load secret what does it do
it will um
basically see the random number
generator based on the value of the flag
all right and then um
it will uh go through and generate a
secret
all right um and this whole thing of
course is
wrapped in a uh a mutex
um because we um
this isn't otherwise threat safe code
um
all right so oh where did the milk go
okay all right so
um
the the point is the secret gets loaded
onto
the thread stack right um
now how do we solve this i of course
you know from um the lectures
how to get the address of the return uh
value right the address of the return
value
um is on the stack
or the return values on the stack so
that address points to the stack
everything else on the stack is going to
be constant offsets off of that
right so you can get at
uh
there you go yeah so you can get
add the value of this secret
from um by you can compute it based on
values you have leaked from
okay based on of course the the same
process
that you use to understand where the
return address is
did that make sense then there's a
follow-up
right so you compute the address um
on whatever thread stack of this secret
then of course you have to leak this
secret you can only leak the secret
using a race condition between the time
it's loaded
and the time it is overwritten with all
zeros
right
alternatively you don't have to leak it
you can overwrite it but either way
that's a race condition
this data is only on the stack and used
while this function is executing
you have to raise like two other threads
or or a point an allocation here and
race a
uh scanf or whatnot
against the execution of this um
code
all right let's
do a non-toddler question
there was a non-toddler question on zoom
no more non-toddler questions oh here we
go
level 14 for rob is the question
on zoom so let's uh
oh uh real quick i'll i'll answer a
follow question on twitch is overriding
or leaking more likely to win the race
um so actually uh think of it that way
is is
not what i would recommend i'd recommend
think of it as winning the race
um
wait uh you can't win the race by
leaking it's too late
right so you have
the way that it works is you have vol it
gets
uh the flag and then it calls secret
correct
and by then you've already provided your
your secret
so you need to win by overwriting um
so there's no overriding or leaking but
the key thing is
you can pre-position if you know where
the address is going to be on a given
thread
you could pre-position the allocation
over the area that the secret will be
loaded into
once you pre-position into that secret
then
all your racing is just that single
scanf
that's very winnable rice
[Music]
okay uh
so follow question a little more about
this all right so
let's let's actually spin this up in gdb
and break in secret correct
right so uh we run
let's connect we'll do send flag
it asks for the secret i sent asdf and
now we hit a break point in thread two
right um
my break point at thread two the stack
pointer is
something oh sorry
stack pointer is something right
right here um
um so
uh
and this is the stack of
this thread um that of course we sent
that uh send flag command on all right
let's hit continue here
let's connect from a different um
session so here we are in a different
session we do send flag
here we are we're now in a break point
on thread three
different stack address right so this is
thread three stack this is thread two
stack
all right let's do it again on thread
two
okay here we go we hit a a break point
on thread two
stack pointer the same as before
for thread two this makes sense right we
are
somewhere the stack is somewhere for you
know volume stack
frame and then we when volume calls uh
seeker correct that allocates a stack
frame for that and of course it's right
next to one stack frame and and
future iterations on that thread will be
at the same location
you can calculate this location once you
have leaked
the address of uh the stack
of one of the threads so you can
calculate this location
and you can use your controlled
allocation primitive
to point one of the messages at the
exact location where the stack
where the secret will be read into and
then you can overwrite the secret
hold on the baby is trying to escape out
of her rocking chair
um
all right um so that's the the correct
way to approach this
um there are people that um
were able to rob through levels
one through uh whatever
that's not the intended solution right
um the intended solution
is to do your memory sleuthing uh
the solution that people did do
is probably the solution for level eight
actually
um but yeah if you can get that working
go for it
yeah the level one through six is
missing the quit command
so that's why my um
my lectures don't apply
in terms of the rock chain level seven
is what the lectures apply to directly
um okay uh
[Music]
baby drop level 14 right
was a question let's dive
into that real quick
let's just do teaching because i have
the baby on my shoulders
okay sorry i uh my mind went blank what
are we doing
let's go to vaughn
let's just decompile this guy
ah all right
so this is a forking server right
um and the question is how do you rob
on a forking server when all the
mitigations are on
um ah yeah yeah so
so someone on on twitch has found
the bug that we had unattended
[Music]
yeah so so in in we have an unintended
bug in levels one through
six where if you uh just close the
connection
the thread will die um i'd still
recommend
that you don't drop through level one
through six
if you want to learn what those mod what
those
uh we fixed that bug now but we're not
going to regenerate the levels part way
through
the assignment or so far into the
assignment if you want to learn what the
levels one through six are trying to
teach you in terms of memory layout
do them without drop
seven and eight is where you're up and
then
try eight with your uh close trick it
won't work
okay anyways um
so this is a forking service right one
thing to keep in mind
on any randomization based mitigation
technique
is um nothing is re-randomized on
fork so every connection to this server
in baby drop level 14 is going to have
the same canary the same address space
layout
the same everything in fact this
is the same concept
as baby mam level 15 i believe
let me pull that up
baby ma'am level 15.
it's also a forking service
and it also um
[Music]
has a canary that you must brute force
right so
my advice do baby uh
oops poor baby
do uh baby mam level 15 before you do
baby rap level 14. baby rob level 14 is
just
harder there it's baby mem level 14 or
level 15 with
a non-executable stack essentially um
oh mama's home mom up for slime one
second
let me hand off the baby
hold on
all right we have to take porch cat to
the vet
um
uh so that's why i had the baby so porch
cat just
returned from the vat with a suspected
uh
bladder infection or uti or something
anyways
so how do you um brute force
uh a an unknown number on a forking
or unknown data on a forking server
well the awesome thing is that you can
brute force this
bite by bite i actually uh
actually went through this in one
in either one of the baby mam or baby
rob office hours
you connect and you overflow one bite of
the canary
and you guess at a value there are 256
possible values for every bite if you
guess correctly
the program doesn't crash if you guess
wrong
the program crashes and then you go on
and you do that
uh so so once you you guessed correctly
and you know one value of the byte
the canary is not re-randomized on fork
so now you know that forever so now you
can put
that proper value and put the second
byte
if you are correct in your guess of the
second byte the program doesn't crash if
you're wrong the program crashes
right and of course when the program
crashes in a forking server it's just
the child that crashes the parent stays
alive
and that's how you do it so you do the
whole canary and then it gets a little
trickier
right so then you have to guess the um
after you brute force the canary and
you're overflowing more and more now
you're overflowing either the saved
uh stack pointer rbp or frame point
rather or
you're overflowing the return address
and it's possible
that you'll get it wrong and the program
still won't crash
so then you have to be careful and then
you have to think okay how can i tell if
the program crashed didn't crash if
the program's doing something weird like
i replaced
the last the the least significant byte
which is the first byte you get
overwritten
and little endian of the return address
and it jumped to
some other random function right and
it's doing something weird right so then
you can
do stuff like for example trying to
replace two bytes at a time
which um gives you
65 000 um um
different possibilities uh but you you
still kind of have the same
problem if you get that second bite
right the first bite wrong the program
might do something different so you
really
you have to
develop a
understanding also using data that you
have available for example
the least significant bite of the return
address of maine
in baby mam level 15 well actually we
don't care about
that in baby men level 15 do we i think
we actually do
um is going to always be so the least
significant byte
from uh vol is going to be
this address it's going to end in eight
five
and actually it's going to end in the
nibble 5 and then
the byte 85 right because it's always
going to be aligned to a page
uh the the random location in memory
um and so you can assume that this is
eight five
and then you can brute force the rest
right this binary small enough that
getting this wrong will immediately
crash in uh
on on um unallocated memory
more questions
did that help um
in terms of how to approach baby rob
level 14 and baby
ma'am level 15.
awesome awesome
uh any idea when my course will be up on
my asu it should be up by wednesday
um and we'll have a nice walk through of
the syllabus well i guess i already had
that last week
so yeah it should be up by wednesday
as a reminder oh go ahead
yeah so there's a question about the
automatic exploitation challenges and uh
you know that we're rapidly approaching
the end of the semester
yeah we'll launch automatic exploitation
uh
the module on wednesday we should have
time
for um everything we'll as usual have to
stagger the launches
um i've set the due date to the latest
possible time
to give you all the the most amount of
time to get that extra credit
um which is going to be the 13th grades
are due on the 14th
um so uh
yeah so we'll have um
over a week you know longer than a
typical
actually over uh what was this one the
second
they'll have 11 days for the automated
uh challenge i know it
goes beyond the end of the semester it's
just extra it is extra credit so if you
don't
um if you want to be done with
with 466 you can be um
but yeah um yeah the question for the 5
98 you can only enroll after 100
completion that is correct
get 100 and you got it
all right we have eight minutes left in
office hours now i have to
run to a faculty meeting any other
questions
yeah what's up
oh no um sorry i think
i think i'm hearing twitch feedback from
so the the twitch audio is delayed or
the twitch stream is delayed by five
seconds over the zoom it's very
confusing
okay so um the question about next week
we will
unfortunately not have a class the next
week this week
is the last um the last
class we will have i will have an office
hours on next monday
um on the 7th
just to uh kind of answer any questions
on
on baby auto and then um
any final questions
yeah um but the
uh class on wednesday is gonna be our
last class
i'll miss you all more than you'll miss
me probably
um there's a question on twitch what do
we do in faculty meetings we discuss the
direction of the department and
and uh vote on um
what you know
vote on on on measures and and and all
this
fun stuff that's it's going to be great
it's good
go ahead
a little bit about toddler 2 level two
let's take a gander
all right let's take a look at level two
and binary ninja
oh interesting idea we could have a last
meme highlight in the last office hours
that could be cool
and the last scoreboard highlight all
right so
um
looks like the commands are also similar
we have sent flag
so the question is
okay ah there we go all right the
question is
um how do we get okay well it also looks
like
the load secret is familiar right so of
course
let's decompile here when we have sent
flag
then uh it asks us for the secret it
calls secret correct
secret correct
is this level two yeah
loads of the secret
i don't see the difference between level
two and level three one second
actually in the interest of time let me
cheat
and look at our generation code for that
because we only have five minutes before
i gotta run
oh oh oh that's weird
so level two
reload the secret
which is exactly the same code
but what we send to it
this is also correct
i'm not seeing what i expect to be
seeing in level two this looks exactly
like level three
let's just uh download this guy and
wow
okay
run it in gdb break on
load secret
run it
connect up load secret
all right sorry load secret send
flag
this okay that's that was behavior that
is binary ninja showing me the wrong
binary oh this is one of these things
like when you start doubting that gcc is
correct
oh it does load the secret
oh
i think this might be a bug in our
challenge all right
level two loads the secret
into an allocated region
right so we load the secret into the
uh heap
that the thread
allocates all right so there's a number
of ways to approach this but
the biggest one of course is to get a
get the the address of the
thread heap
which is of course right after the
address of
the per thread struct and then point a
um figure out the offset
in gdb between this allocation and
uh um the per thread struct so you can
calculate that address
point your um controlled allocation to
that
and then print f it out when it gets
loaded
and then you're good to go
oh connor says it's not a bug
so you can read it out from here but
then
secret correct
actually loads it onto the stack to
compare it
so basically it is level three
but there's an extra um
uh piece of information for you on the
thread heap
is the secret and of course
let's take a look
we're in the um
[Music]
what's it called in the load secret
function right now and it received
what you can see is looks like a
thread heap address
it looks like a thread heap address but
it looks also kind of weird oh yeah here
it is
yeah yep
all right everybody i must run
um
of course collaboration hours have been
open
since we stopped closing them so if you
need collaboration go hop on with fellow
students
ask for help and help if you don't get
the help you need tag us
in um or ping us directly but
ideally let's chat on help so that all
students can benefit
see you on wednesday good luck