office hours of the semester it's
exciting times uh sad
times of course but um this is an
important step
one semester ends one semester must end
in order for a new semester to begin um
let me uh awesome pull up everything on
switch
of course all right now i can use myself
all right let's make sure i'm using the
right microphone
don't want to mess the last office hours
up
[Music]
okay
all right
you're alive um okay so this is gonna be
the
the the last office hours um maybe an
auxiliary meme review of vf time
uh between uh between questions of
course
um and and we'll see from there quick
updates on
belts i'm um uh in
discussion with a bunch of different
suppliers on alibaba
to uh acquire the the blue and yellow
belts
um we have started putting up
we have a page
um on
belts here click through
here's the belted everyone that has
gotten the belt
and has emailed us from the account
that they um uh got their belt on i mean
there are obviously a bunch of people
that are um that
are waiting to be put on here we'll get
you up as soon as possible
and we'll put your your ascended date on
um if you got a belt email us from the
account
from the email account registered on uh
the phone college infrastructure with
your handle
uh standard unicode emoji your email
address
your website and we will put and your
name
if you want it there and we'll put you
up there um
so you can forever have this um
record of earning your belt you don't
have to
um earn your belt during the semester
there's no deadline if you earn your
belt
over the holidays next year whenever
email us um of course as phone calls
continues to evolve
you know earning your belt will will be
the achievement of
for the yellow belt um everything
through
toddler one 100 for the blue belt
it'll be um uh everything
100 that'll be pretty exciting stuff
so congratulations on the uh
awesome hackers that have earned their
belts and uh
i think we'll see many more here we're
already waiting
uh there's one two more that we need to
put on here
um and then there is uh there of course
a bunch that we'll need to put on here
and i'll
i'll get everyone um through the end of
the semester i'm
planning a long tweet um
thread summary of the semester as soon
as uh
the semester is truly over which is uh
sunday night
and then uh we will uh you know
of course call out the the belted there
that'll be really really super exciting
um
let's see let me actually see if
i got waiting for information from a
couple of people
yeah i haven't gotten any more belting
information
cool all right um with that
uh any questions on this office hours
can be about
baby auto but it can also be about
anything else
um i know you're a lot of you are
working to
finish up those makeup um assignments
and then we can we can talk about those
too
oh yeah there's going to be a lot of
people someone on twitch is saying that
they have a
lot to grade still this semester yeah
the nice thing about phone college with
automated grades
is um basically which and and this is
the reason that we can
uh keep the challenges live and
everything up until the very end
as we literally have an api endpoint
that generates
a comma separated value file of
all of the uh grades and
and and we just paste them those into a
spreadsheet paste those into a
um uh the asu interface and boom that's
great
actually let me see where is my
where's zoom see if there's
chats on zoom no chats on zoom
everyone's just chilling
that's cool
overriding so there's a question on zoom
about overriding the return address for
toddler two do you mean overwrite like
the general concept of overriding the
return address
i see
yes um i i see i see uh
yes so let's uh run through real quick
finding the return address specifically
in toddler two so i'm going to fast
forward
to the part of my exploit in toddler 2
where
um we are at the point where we
can do arbitrary reads um
okay here's our screen session
uh let's
there should be an ipython arbitrary
read
all right this i believe is our last our
full end-to-end exploit
and i'm going to break at the point
where we try
to figure out where the return address
is and then
um explain how we do that all right
just to summarize this exploit uh
we have three primitives in some sense
right
one leaks the address of the per thread
struct we do this
and if all of this sounds like whoa um
go back
and um i actually go through this
exploit end-to-end in the advanced
exploitation module
um um videos
those are on youtube um or you can get
to them
just for complete mistakes so no one is
lost you go to pawn college
click on advanced text oh i should
really fix this they've launched already
hold on let me
otherwise i'll forget again one second
i'm editing the website live
boom um modules
all right
okay i fixed that all right now the
website is
complete it's so cool to see all of this
actually have links
and and everything is complete i think
the only
thing from the history upon college
we're missing is the format strings
which we have to skip for time reasons
although looking at this list it makes a
lot of sense anyways all right
oh person on twitch saying i would like
to learn this
you can learn this the power is in your
hands
jump in pwn.college each module has a
set of videos
slides and everything and um
practice problems and some other
information often
practice problems are in our ctf
infrastructure
where you can go and uh
awesome we have four blue belts
incredible you can go
you can go and and work on these crazy
amounts of
awesome challenges okay anyways
uh so you can learn this it's in your
power all right
if you go to
advanced exploitation this series
will go take you through what i am about
to talk about um
all right we're going to come back to
the twitch questions
um so we don't um start
thrashing too much between questions
first let's talk about
this exploit end to end um so as a
reminder
in uh this video
he uh addressed disclosure of your race
conditions
um we figured we talked about how to um
disclose the uh address of
the um per thread struct
the t cash per thread struct then
we talked about here how to dig around
memory in gdb to
find you know offsets and pointers etc
then here we talked about
um how to build exploit primitives and
the primitives we have
is a controlled allocation where we can
point an allocation to a memory we
control
using that we can do an arbitrary read
and using that we can do an arbitrary
write we have now written these
primitives so we can just
call these functions and they interact
with the program
to do what what we wanted to do so for
example
we call leak birthright address to leak
the portrait address and then we call
arbitrary read arbitrary read
to leak memory leak pointers compute
where things are and then finally
we do an arbitrary write to overwrite
note once we have our primitives
together we no longer care about the
program
the program is now the program does
whatever it does
we don't care what it does we now have
the power to read and write memory
arbitrarily we just care about our
exploit at this point so
one important thing is we're not talking
about
the actual vulnerable program you'll
notice
at some point it seems to matter if the
vulnerable program has
message um uh
storage what what the vulnerability is
whatever
we have our arbitrary read we have our
arbitrary right and we go from there
that is the beauty of primitives right
everything above this is more or less
program agnostic except for like how to
trigger that final return and so forth i
mean
obviously you can't get away from it
completely but we've really abstracted
it heavily all right
so the question that was on zoom was
how do we figure out this address the
stored
um rip address and the way you figure it
out
is um
by computing the offset in gdb so we
have
um we have leaked we leak the the per
thread struct
using the uh that first race condition
that i talked about in
video two of this module we then
used techniques from video 3 to
calculate where
there is a pointer to the main arena
which lives in libsy's bss segment where
that is stored
then we read out that pointer using our
arbitrary read primitive that i talked
about
in lecture three of this of the advanced
expectation module then
we used the techniques from lecture two
running around gdb
to figure out where the lip c base is
and we realized that the return
address and this is what i'll go into
detail right now that the return
address of our um
uh of the vulnerable function
that that we're exploiting is on the
stack
at a location because it's a thread
stack it's at a location of
uh about four pages
plus some earlier in memory than libsy
to the left by our memory reckoning
so this is where we're going to
break we're going to do that uh pwn.gdb
attach sorry pawn that
yes gdb attached to our
um process
and we'll go from there
oh yeah what's up
sorry this is the binary name alt is
just what i i named it
locally yeah all right so um
here we go on gdb attach p so we run it
we leaked
the main arena boom okay so let's go
back
oh and then it keeps going all right
hold on let me let me make this a little
cleaner so that
that's wrong launching the exploit okay
great
it the exploit works spoilers
all right we're gonna do input here so
that it pauses
okay
all right we have paused
um cool
so we we calculated the lib c base
right and we have paused right now this
is in thread one
um you can see i made three connections
i only ever used two
i should actually just take out that
that third one so this one is never used
so the there are three cut uh
threads that are handling the um
three connections there's our main
thread right now this is our
the one that gdb is currently attached
to we're going to
to figure out the uh where the return
address is
we're going to um switch into
each thread and we're just going to look
at
where um we're going to go back up the
call stack to the vulnerable
function we're going to see where the
return address is say thread one
we switch to thread one you can look at
the call stack
oops no thread two look at the call
stack
so thread two we had of course
uh called p thread cr uh thread
pre-thread create
in from the main thread it created a new
thread using clone
and then that thread eventually launches
handle connection which
eventually launches a vault right so
we're going to go
all the way up the call stack to von
and gdb is very um of course i compiled
this the reason it's called alt and not
toddler 2 whatever
i compile this with debug symbols so
that um
my mind would like so that it's easier
to show you um live um
but uh
[Music]
but you don't need debug symbols for
this gdb is uh clever enough to figure
out
what um the values actually let's
compile it without debug symbols
just to make sure that all of this still
works
there we go let's re relaunch this
okay so here we are now without
debug symbols thread two uh we still
have the back trace we still have of
course
the the names of the functions we didn't
strip the binary the symbols are still
there
but if you go up to volume now you
notice there's no
um what's it called print it out
no no source code great all right
the interesting thing is as you go up
and down the
the call stack this is me going back
down into what
vol had called f scan f which i'd call f
can have
internal and so forth as i go down um
this
uh the rabbit hole you can see
that
you can see that for functions that use
a base pointer gdb
actually does this magic it figures out
what are at the base pointer
that points to the end of that function
stack frame
should be even though of course the base
pointer when
i'm interrupting this is some specific
value whatever it happens to be
um in the cpu when when gdp attaches to
the process
uh gdb actually emulates this sort of
recovery of where the
what the base pointer should be this is
very useful because as you know
the base pointer points to the saved
base pointer and then eight bytes later
there's the saved
return address so we can see rbp
plus eight this is the return address we
can verify that this makes sense as a
return address
because it points into handle connection
right and if you look at this minus five
that is our call instruction interval
right so of course when you call you
push the saved return
address to the stack so this
is the location of our return address
now we it because we are
operating inside a thread stack this
does not hold
for the main thread we would have to dig
around libsy to find
the main thread address um but or the
main
main threads stack address
which is here but all of our
extra threads map memory using memory
map
which maps memory right up against
libsy so we can actually calculate
the distance between lip c
and our saved
uh return address which is actually this
plus eight
boom and that is hex four one three
eight and that's
what it'll always be from lip c to the
first thread
the distance will always be four one
three eight
all right and that's in fact what we did
we computed the stored return address
now let's hit continue here and it
carries out the rest of the exploit
all right so the reason this works is
that vol
returns if we actually um
if we actually run alt
connect locally it gives us a several
options malik scanf printf
free and quit quit terminate uh
terminates the threat i mean let me just
show you the behind the curtain the
source code
of alt which is also by the way in the
lecture videos
quit makes the uh uh
function return and thus we
successfully um um um
my mind will like quit makes the
function return and then of course
we triggered the hijack now you can
imagine
and you will have to imagine in um
uh toddler two level eight that
vol might not return so then the
question is then what
right then what do you do right because
what what we do
is we happily overwrite the return
address of
uh a volume and hijack control flow and
loan return
if it doesn't we're gonna have to resort
to
sorry this is me editing the
bibliography of a paper
that's the paper where is my oh i'm not
in my python
okay we had a paper deadline that i'm
still recovering from
up until five a.m
and then i had to load the dishwasher
and then i could sleep
anyways okay so um let's rerun this
boom okay so now here
one sec let me clean up everything
because
okay here we go oh my god
okay here we go we are in gdb again
so if we go to thread two
if volume never returns you can't
override the return address of
all but look at all of this
these insane um
functions on the stack there's a lot of
functions that do return
in different threads right so
when volume doesn't return you have to
figure out
using the same techniques the return
address of
these functions and i mean the many of
them are are easy for example
um in uh there's one complication lib c
typically does not use rbp so if you
if you look rbp stays the same as i go
up the call stack that's because these
things don't use rbp
so you can find the first one that does
it seems to be vf
scanf internal and you can
do rbp plus eight that is
going to be
a point uh a return address back into
vf scanf it makes sense so this
is where you want to override for um
to hijack vf scanf uh the return address
or sorry the return address from f scanf
to vscan app internal some crazy
internal loop c stuff but you don't care
you just want to hijack a return address
and info proc map you can calculate that
same offset
and it'll be something very close to 4
000
hex 4 000 but a little off
hex four six six eight for example
all right now but now it's a little
trickier
you can override the vulnera a return
address and return at your heart's
content
the vf scanf you have to um
race it you have to overwrite it while
afscanf
is uh running or
while vfscanf internal is running before
it returns so there's another race
condition there
does it involve writing another function
to do that um
it's not an extra primitive it's just
something you have to set up
it involves triggering an extra race
for sure
all right um let's catch up on
some of the uh questions
that have piled up on twitch was the
decision ever made about
minus grades uh not yet i'm
very much leaning toward eliminating
them but
i'm going to see how many minus grades
we have and etc
i think i'll just make that on the fly
with a
with a glass of wine the better the wine
the more likely i'll eliminate minus
grits
okay um let's see
okay someone's saying i would like to
learn this we addressed that
someone else had found this channel for
a long time but never got around to the
beginning
never got around to beginning the course
any particular advice
on processing through the modules and
more specifically in regards to the
recommended pace of completion to not
burn
out many complex questions there
okay um
advice on progressing through the
modules and someone else asked how do i
learn to use a disassembler
um learn
thing to use a disassembler um we
actually talk about it in
module four right um
it's under static tools um and in some
of the
uh office hours recordings on um
uh youtube basically the best way to
learn to use a disassembler is just to
use it
this course is good at forcing you to go
through a lot of these little challenges
that gradually build up your
your skills
[Music]
now how do you start on the course you
definitely need
a um
a good
uh foundation
right the foundation that i assume from
this course
is uh
basically a very good computer
organization course
right to start to to have have
taken and done well in a good computer
organization course so say okay you need
x86 assembly that a good computer
organization course will teach you
os internals that a good operating
system courts will teach you
and then c programming and then the
knowledge of c compilation again
computer organization
um unfortunately
so i went to uh rpi for my undergrad
and back then which was a long time ago
rpi had an incredible computer
organization course
i don't know what it's like now but back
then it was stellar
um did x86 assembly was basically a mini
hacking course as well as incredible
right it really set me on
on a path that that uh you know
has resulted in this however
most computer organization courses teach
mips
and i wasn't quite aware of how
widespread this problem was
and this is a major problem mips is
relevant if you're building routers but
uh
otherwise um it is very much
a incorrect way in my opinion to teach
computer organization
um so this problem is pretty widespread
and uh it makes approaching discourse
harder
in my intro i give a very quick crash
course to x86
assembly right uh
so you can go through that but that's
just an
hour right realistically i think what
we're going to end up having
is a um kind of a run-up course
two-point college
um
uh oh my god someone's computer
organization
class taught using the msp430 that's
terrifying
um yeah i mean it's it's just asking for
that knowledge to be
relegated to irrelevance um
yeah anyways um
so yeah that's uh
oh sorry that that's that's a tricky uh
thing in terms of of starting
the class so you need that uh right now
you definitely need that
that foundation x86 assembly how do you
get it um
you can uh try there's a youtuber
uh hacker you what the hell is this
that's a youtube ad
okay um there's a hacker youtuber named
liveoverflow
um where you can
go through uh his
uh series here um
and he'll talk about uh x86 assembly etc
that
that is a good thing to run through go
through my fundamental slides
um and uh
it's it's it's tricky outside of
computer organization course i don't
know a good resource
um
asu has a 365
someone just mentioned on um um
switch uh 365 is a junior level course
466 is the senior level course um 365 is
required for everyone it's a
computer um system sorry
it's an introduction to computer
security that is a good way
to get the skills you need to approach
for 66
um 365
exposes you and forces you to learn x86
assembly
um etc right so that's a good so
the person that who is this uh
shawnery said um that
uh they took it at the same time and it
was a great intro
so i guess taking it at the same time
doesn't help with intro but
you know if you do one then the other i
think that's good um someone's asking
should i start by reading practical
malware analysis
um
i don't know i've never read a book in
my life um
about computer science uh that's almost
true i i've read
one book you can consider this an
official indoor no don't consider an
official endorsement um
it's called linux game programming
this this book rather than high school i
wanted to be a game programmer
wow it's still on sale i really like
this book it teaches sdl
it was very fun um also has a
badass font as you can see uh
yeah i i used it heavily for like an sdl
resource anyways obviously it has
nothing to do with hacking
um i've never read a security book so i
can't really comment on those um
i am very skeptical
of the use
like i'm skeptical that
you can read a book and get this
information uh
this course for example is built around
practicing
right practice practice practice
practice
um and that's on purpose because i
haven't found any better way
to learn this stuff um
so i mean maybe reading a book like
the shellcoders handbook or something
and uh just to kind of get familiar with
this stuff and then jumping into the
course might be
good but um i don't know another thing
with most senior level cyber security
professionals have experience with this
it
really depends on the uh
sub discipline right so you could be
successfully be
a security manager right um without
knowing the very very subtleties of
uh heap exploitation you could be
um a pen tester focusing on web security
without knowing this but if you're a
vulnerability researcher for example
yeah vulnerability researchers will will
know this stuff
um then um the last question
that someone just answered on twitch
actually is um
what uh how how what's the pace that we
should take
uh the pace that we set for this course
was one module a week that was
uh extraordinarily high pace um
as as we now see especially because we
added
one two
three
four modules this this year um
so that was a very very high pace we
slowed down for
uh two of the modules and then we made
one extra credit
um uh
1.5 weeks is probably pretty good two
weeks is good we're
looking at ways to redesign the course
for next year for asu so that we could
do
you know one and a half or two weeks
instead of once a week
um but yeah that's uh
one and a half weeks is probably a great
pace it's still a probably a challenging
pace two weeks is probably more casual
longer and then you you you might start
you know
putting it off for getting it etc
um but just remember at the end of the
day there's
a belt a physical yellow belt
for finishing half the course physical
blue belts for finishing the full course
so that should uh motivate you hopefully
all right let's see what else
all right we have a question on zoom
what's up
all right
okay so we have a question on basically
um baby auto level 5
which is fuzzing using afl every version
of read elf
for the last 20 years there are 80
versions
of read elf and you have to crash 60
60 of them a couple of tips one
you mentioned on zoom um that you have a
45 byte l file
right that you use as a seed that's a
great start
actually if you look at what afl is
telling you i'm pretty sure that 45 byte
l file already crashes some of the
readouts
afl will just uh ignore crashing seeds
it'll tell you but ignore them right so
so make sure that you haven't already
crashed some
readouts that that afl afl will only
report crashes for things that it has
found
not things that you have provided it um
because i'm positive that that 45
byte l file crashes some readouts
hundred percent sure
then you created that 45 re uh
by read elf by following a process on
the internet
right that process on the internet has
steps step by step ways that they have
arrived at a 45 bite readouts
those steps use different um
techniques to create small elves right
add those each step of the way add that
as a seed
because even though it's not the
smallest it's still very small
uses slightly different ways to to
achieve its its size and will trigger
slightly different
um code in the program that you're
analyzing
in the readout
right but how did you um how did you get
the 45 byte
elf
exactly so you follow the instructions
the very end of the tiny elf write-up to
create a 45-byte elf
look scroll up there are instructions to
create
other tiny elves that aren't that small
yeah so don't don't just go for the
smallest
single seed right you want a seed corpus
that'll
um
explore different uh um
areas of code there's another tutorial
either by the same people or by
different people that covers uh
64-bit elves you want to also include
those
right include as many small seeds as you
can that trigger different functionality
and uh give it a try
all right let's see on
on twitch did you do
okay there are people
oh yeah and there's a great tutorial on
fuzzing readout with afl
at um that was just posted on twitch
okay and then we'll go okay then let's
go over one of the
kernel toddler levels
all right so let's uh dive into
the infra here oops
oops there uh challenges
level uh
[Music]
let's say level let me let me pull up
how they're generated to see one that
won't be insane
to walk through i won't have to write a
yan85
assembler live
but actually while we're doing this any
um
um um
what am i trying to say uh
any specific questions on the kernel
toddler levels
i think someone wanted level nine right
let's check
level eleven
oh level nine okay so let's start with
level nine and then keep going
um all right so level nine
uh has a
is awesome because let me
get out of there we go
here we go all right so i'm going to
launch up um
toddler 2 level 9.
we'll run it in practice mode
awesome
here we go all right so
it's a kernel challenge so there's a
slash launch
when we launch it
uh we can do an ls
we do an ls mod and see that there's a
kernel module called
challenge
and
where did it go
oh yeah because directory and it's over
here and toddler to
level one teaching one directory there
is a challenge
this is our kernel module that gets
loaded and then there's
our user space program and of course the
user space program
is set uid we are not
root we cannot become roots there is no
sudo
there is no su we are stuck
user space program is our only way of
becoming root and this is important
because we have a proc
pwn college kernel
device that only root can talk to now of
course if you haven't done
the kernel module don't try
this module yet right go back and do the
kernel module
baby kernel now um
um okay now
uh how do we approach
this situation of course we run user
space program
all right well there are two things one
is we can
figure out what is the kernel module
doing
and then two we can run the the the user
space program
um let me see actually what happens i
don't think we actually tested this what
happens when we go to
uh level 11 and hit inspect probably
things crash
error loading sessions okay great um
okay
so let's um create a new session
uh we'll download
that
let's go
here
wait does the downloading yeah the
download works
so it's a zip we need to unzip it
okay awesome
no hold on i downloaded level 11.
bloodline sorry about that
level nine download
okay awesome so
we um go to
binary ninja and we want to
phone toddler 2
level nine oh uh oh yeah
let's look at the user space program
and then let's also look at
the
kernel module
all right so there are two pieces of
code that are interacting with each
other
um
is it going to load what's going on here
okay this guy's analyzing
you can see the user space program is
going to take ages to analyze
why because it's a statically linked
binary
all of lip c is linked in here because
we don't have libraries in our kernel
environment or in our emulator
environment right so
but we left all of the symbols in there
for you so you don't have to figure out
what is what is just a
much larger binary than you used to but
main
is still main and from there you can
reverse as normal
now why the hell does this not work
there we go okay continue
yes dude just delete the session
oh my god can we delete the session
delete session delete
can we delete this session delete
binary ninja has some limited limits for
how many things i can analyze
delete session delete
okay now new session
choose the kernel module continue
thank you okay so the users use space
program is still analyzing oh it's
taking a long time to open
the kernel module is open if you look at
what
device open does just prints some log
device release print some log you're
used to that
device right
seems to copy from user into something
called shellcode
and uh calls
this function that indirectly calls rax
rax is
shellcode we looked at this exact kernel
module in
baby kernel you can go back and look at
the the qas
from that basically this kernel module
just executes shell code
again if you haven't done baby kernel go
back and do baby kernel
toddler one is or toddler two the later
levels are unapproachable if you haven't
done baby kernel
all right so um
so uh wait shauna reeve what did you
mean by it doesn't work i tried what
doesn't work
anyways all right well well they're
typing we'll keep going so basically
this is a simple kernel module
where if you can just write shell code
to slash proc slash phone college it
will execute that shell code inside the
kernel
in baby kernel you use this to gain root
by calling
commit a commit cred prepare cred 0.
oh loading the binary doesn't work on
binary ninja it works it loaded
here it is it's insane but it loaded and
we can
filter this down to go to main
and there it is checking stuff
so let's this is decompile this binary
okay um so anyways
as long as we can write shell code to
the kernel we're good to go
right we can we can achieve whatever we
want now the only way to write shell
code to the kernel of course
uh i mean with this kernel module is to
write to this proc pwn college
device which is only writable by root
of course user programs are only user
space programs are only way
to get root and when we run it it tells
us
okay welcome to user's program let me
specify open a specified file given by
the first argument
and you might upload custom shell code
to do what you want okay
this is directly
a level from baby jail for real
right but harder it's a level from baby
jail
that does second correctly if
yesterday's
there's this stress if you pull this
user space program onto your own machine
and run
user space program
it of course needs um
uh needs a a a
argument that it'll open let's give it
scpass wd
so here's what it does it'll only allow
certain system calls
and we'll have to figure out what those
system calls are by reverse engineering
it
um it'll open the
um file that you wanted to open
and then it will um enable the jail
and run your shell code so
here's what it does okay here's my uh
shell code um of course my shell code is
a bunch of push rbps
that's not a problem it's going to
restrict system calls
and it runs sec comp
set mode filter with
some filter let's take a quick look at
uh what
it does here okay it looks like it
does comp rule add it allows one
system call um
oh yeah okay on on twitch yes so you
can't
just click analyze unfortunately on
on this is something that we should fix
you can't just click
this to analyze um these
uh multi-binary levels because there's
the kernel module and
the um actual user space program you
need to download it
extract the programs you want to analyze
like i did and then load them
individually all right anyways
we see there's second brew ad there's
one rule that this guy allows
and it is um if you reverse engineer
this
it will um add uh
actually if you just run this and see
what it prints out you'll see
what um uh
this being if if the rule add fails then
it'll assert
out with an error message let's check
out this error message
by going to back to the assembly
going here oh come on
oh here yeah second roulade
second writes assists right so the only
syscall you can do is right
in this jail and it is a properly done
second jail of course
normally under normal operations there's
no way to escape
from a set comp right to refresh
yourself
on setcomp go back and check out baby
jail
all right so you have a set comped
um shell code that's running that can
only
run the right system call
and secomp again is solid this isn't
some trick where you can somehow
run other system calls this is real deal
something similar to what you would see
in a kernel or not kernel in a browser
sandbox where
there are just certain system calls you
cannot do in this case
everything but right right but of course
you get to before the sandbox
before you get dropped in the sandbox
you get to open a file
any file so of course you would open
um not on here but on here we would open
proc pwne college all right so it
opens our procbone college lets us
specify shellcode
shellcode just pushes a bunch of rbps
and crashes
right oh it even it even logs what it's
allowing so it allows right
um and uh anything but right we'll call
it
to die then we execute this the shell
code
um and then as you can see it sec faults
it runs one two three four five or six
instructions and on the seventh
instruction that will set fall because
there's nothing there
what do you do obviously you have to
write shell code
that writes to the kernel module what
does it write
it writes shell code that runs inside
the kernel so there are two shell codes
that you need to write
one that runs in the kernel module sorry
one that runs into jail
writes to the kernel module and then
what does your shell code in the kernel
have to do well one thing that you can
do that you're used to doing from baby
kernel
is commit cred prepare cred
zero right make the process
root but that
won't help you first of all you're
already rude right
um you're running a set uid uh program
the problem is you're in a sec comp
sandbox of course i got you
we have a
escaping sec comp
uh module here nope wrong escaping
subcom that is the
god darn it hold on that's that's the
wrong one
that's the one from the sandboxing
module where i said without a kernel
uh bug you can't escape from a well
created um second jail
now we're gonna obviously have codex
using the kernel
so now we can
alright as a summary
there is a flag that linux checks
when it decides whether or not to apply
a setcomp rule
that flag is tif underscore setcomp the
flag
lives on
the flags attribute of the thread
info structure in task struct
and when you enable setcomp
that flag will be set but of course you
can disable setcomp
by doing the equivalent of this right
and in fact
as i talked about in that um
module in that video um if you go to
pawn kernel
i added support there's a make root
kernel module that shows different uh
like allows you to
you know get root access using one io
ctl
and then escape the sandbox using
another one
this is exactly what you need to escape
the sandbox
you just need to implement this in
assembly
awesome
all right let's do a hint on level 11.
oh uh one thing
very important for
uh
for this
when we run this and it's reading
a thousand bytes from standard input um
you
uh this one is fine you just need to
give it shell code that execute
shellcode there's no leaking etcetera
etcetera so you can just say
okay uh
input at c pass wd or something i don't
know right
obviously that's bogus shellcode um
so that's that you can uh redirect the
input and get away with
with this being fine for later levels
you won't be able to do that you will
need to give it binary input
um and receive binary input which
because of the way the terminal
emulation in kimono works
and in linux you it it's very hard to
actually paste binary input into this
terminal
uh you're gonna have a very bad day your
input is gonna get mangled
um what you should do is write
a launch program connor actually wrote
one on discord i will
uh there's vi inside
oh no i hit control c the launch program
should look something like this let me
just pull it up
on discord
or not a launch program a um
a rapper program like this basically all
it does
it's your own mini pwn tools it reads in
from standard input
and it'll write to standard output
um and if you do this
then you can encode
you can send input in hexadecimal
um and then it will
sorry you can hex encode your input so
you can send for one
in like ascii and then it will translate
that to binary
and pipe that into your program
all right any tips to speed up
baby auto level seven and eight um yes
yes there are um look so
baby auto level seven is uh
using anger to solve um
a whole lot of uh
um baby key uh the key gen
levels from baby rev in on like supreme
difficulty with like a hundred levels
and then baby um auto level eight
is solving yawn 85 fully automatically
with anger the yan85 crack knees um
of course this can be slow we do have
ways to speed it up anger has what is
called unicorn
mode unicorn is a cpu emulator based on
well obviously searching for unicorns on
gmail is going to on google is going to
be
um silly but unicorn engine
is a cpu emulator that you can just uh
kind of emulate
individual instructions um it's it's
it's very cool it's based on kimu
it's basically a library version of qimu
that just has the cpu emulation
component
anger has unicorn engine support
to speed up execution there's examples
that do it boom if you look at
little engine
the basic idea when you
create execution
is to add these options for unicorn
all right now go through this script
it's in the anger documentation
first example for reverse engineering
you want to adapt it to your scenario
and that will solve
i don't know by default probably takes a
minute or something for anger to
eat through uh yan85 i'm guessing with
unicorn it should take
on the order of you know 15 seconds
again this script take a look
and adapt it actually your challenge is
much easier
you don't need all of this stuff you
just need
to create the state with unicorn enabled
and um uh
pass that as a argument to the
simulation
manager construction function cool
okay um there's a request for a hint
on level 11. level 11 was conor's
monstrosity
let's let me let me take a quick look
i know what level 11 even is uh no i
mean i know what a little lead
is of course synchronized um
okay so ah that's right that's right
that's right um
so level 11 is baby heap
right plus
um like literally baby heap
uh but of course
there's an extra functionality called
yan85
which we'll talk to a
kernel module which is a yan85 emulator
built as a kernel module that allows you
to do yawn 85 operations
of course the problem as you've all
found out is
the syscall instruction
the jan85 cisco instruction in
this yan85 is hex 20
which is a space and scanf fails
um
so
but but of course
this baby heap you can get code
execution
using this baby heap or or really
uh this is an unsafe baby heap similar
to all of the
the other baby heaps where throughout
the whole thing you were able to exploit
it
even without race conditions which this
doesn't have because we didn't want to
force you to deal with that in the super
limiting cuimo environment
you can achieve code execution you can
talk to your
uh to the colonel happily
um to um
um um
upload your yan85 program and then your
yan85 program
in the kernel has um
handlers for using the kernel apis to
open read and write the file all right
[Music]
now what file do you write to of course
the easiest thing to do is write it out
to the
console let me
bring up
on a linux environment
especially in this qemu
only root can write to this um let me
launch up a baby kernel where
or is this in practice mode awesome
okay so i'm going to uh give myself root
access real quick
because i'm ah no god damn it okay
sorry um
yes launch that sh
what is my init program
where isn't it it's an
fs in it yes okay let's take this off
instead exact bin bash uh let's just do
su
route okay so now i'm giving myself root
access inside
the challenge just so i can show you
where you want to write
there's dev console
if you write to it
it'll pop back out on your console it's
an easy way a place to write things
in a kernel exploit to have them um
pop back out at you quickly
um okay and then um
so to summarize level 11 is baby heap
you know baby heap you have done baby
heap the difference is
uh level 11 doesn't allow you to get the
flag directly
in order to get the flag you need to
talk to the yan85 emulator and the
kernel
to upload yan85 code that will run in
the kernel
that has the standard yan85 open and so
forth
you need to reverse that kernel module
see how that works
and then go from there
uh one second with level seven um
so you manage all right some other bite
like hex
23 okay
uh it crashes in colonel reed
i'm not sure
why it is crashing in colonel reed um
[Music]
this sounds like something that
would be easier to uh tackle over
discord honestly with the ability to
uh test logs to paste logs
zero so let's take this to discord um
today or or later today and figure it
out there
okay level seven what's your question
mhm
do
all right so so we have a really
interesting question
over zoom so basically baby otto has um
baby auto level seven is a bunch
of um
uh no hold on are you talking about
you're talking about baby out of level
six or baby out of level seven
oh okay okay okay okay i guess all right
uh
sorry i confused myself yes okay maybe
out of level seven
is a um
a bunch of baby a bunch of uh
baby rev uh programs
ranked uh ramped up to a high difficulty
level
let me show you um
where are we okay we're here
so if you go to uh
[Music]
phonecollege slash
baby auto crack means you can actually
clone this repository and these are all
the crack means
a super set of the crack means you need
to crack
right so there's 10 000
different crack me's here um and we'll
uh have a um
uh you'll you'll have need to get 42 out
of some subset of these
all right if you look at these crackmes
um what you'll see is the way they're
generated
um is they will skip
some amount of input in that file
right and then read more anger doesn't
always properly
uh um
um um handle that right
um
so you will need to let's let's actually
grab one of these
to take a look
oh hold on let's just do
okay here we go retrieving that
repository
all right
here we go level seven maybe s
trace one of these uh
crack me so it's our standard crack me
right it is
the license key verifier that we give it
the license key and it says wrong
right if yes trace this
notice it runs l-seek
and l seek there
fails because file descriptor zero
is a pipe if you go to man l seek
and search pipe
all right that means the file descriptor
is associated with a pipe
socket or fifo which makes sense
our file descriptor our input was file
descriptor zero
so of course it fails now check out what
happens
if i pass in at c pass wd
l seek works it l seeks off
150 and it works
and then as a result the read works and
so forth
you need to take this into account
to have enough padding in your input
file
to let this work because when the
verifier runs your program
it runs it with something like this it
opens a file
and then it redirects that to zero
the amount isn't always the same it
varies for every program
so then you need to either extract that
with anger
by hooking the lc call and extracting
the
argument um actually let's just take a
quick look
so here is
this
don't want to accidentally trigger i
don't remember if
how easily these are runnable ah
awesome awesome yeah so
yeah it is does take a while
i don't think level 8 has the lc problem
i don't think it has padding
all right so we have a simulation
manager with two dead ends
okay and then we can do postx that stdn
oh let's let's okay conquer ties here is
one and this one is corresponds to
success
and then here is the incorrect one
and it corresponds to fail
right boom wrong no factory so now
of course we're interested in this one
if you run this
uh what was the
50 75. okay
we paste it in boom it crashes all right
but of course the l seek is a problem
um because anger obviously
either didn't uh emulate handle l seek
at all which is possible
or handle it
as if um the uh
with the right behavior of a file
descriptor let's uh of a pipe
let's take a look at which one it is
actually let's look at anger
anger anger procedures
linux kernel
elsique ah no
fd get fd if some of d is none
um let's go back to
state plugins
now it should be fine
okay i it's not
immediately obvious what's going on but
obviously um
there is a problem with the l-seek
um so let's uh take a
look at what we can do all right so
again
um oops here's what we did so far
we did uh simulation manager and then we
ran
it so let's uh
just write a script for that boom boom
boom boom okay
um what we can do is
hook l-seq
right um trying to think of the easiest
way to teach this
um
let's see
okay let's uh okay so p dot hook
lets you hook um something in anger
with um a function
that gets called
when that location gets triggered
so if we do p that hook and then we need
to give it an address
we can give it an address in the um you
can give it the address of the
lc plt call
we can get that by
[Music]
getting
i'll seek
sorry generator
no that's not what we want what is the
easiest way
resorting to pawn tools having a new
moment right now
that's okay fine symbol
yes
all right i'll seek that plt
i don't want to hook lseq and lip c
there we well no that's the import all
right well we can
hook else you can let's see oh no here
we go
okay this is the import symbol
all right well lseq
anger loaded lipsy at this address and
lc
is here so let's just hook that
just for and then we say lambda
this is just an anonymous function that
takes no arguments
and we will say actually we need to take
a state
take the state and we'll say okay
lseq takes three arguments
the file descriptor the offset and
the source of the offset or where to
start offsetting off if you're
interested in that offset that's rsi
okay boom you can hook
and now we just re-execute
boom the offset is hex 96
and obviously hex 96 is 150
we have the offset by hooking
l seek this is the address of l seek and
anger's view of libsy
[Music]
and we have it
i know this getting this value was a
little bit crazy
we can also look at
uh well
this is probably the easiest way
uh
this insane thing is the easiest way
without learning a lot of anger
internals
or more anger than i meant to teach you
let's say that
so it's the l-seek location in libsy
cool
this this will automatically tell you
how what the uh
[Music]
argument to l seek is
and like just to prove it let's
pick up a different crash or a different
binary let's create the simulation
manager
actually let's let's hook
this binary let's create the different
simulation manager
and let's run it and you'll see boom
it's hex 64 now
instead of hex 96 cool
all right um i have to
run um as always
keep asking questions on um
uh discord we are always available
um so there's a question about how to
use afl
check out the q a extended q a from
wednesday
i went over an end to an example of
using afl
to find a crash it's uh very doable
um
keep asking on discord keep being
awesome you guys are great hackers and
it's been an
honor to teach you all semester it's uh
this is my last stream of the semester
i'm
kind of uh sad about that obviously
um but you know you will will
keep um learning
keep uh sending me questions etc the
moment you earned your yellow belt
or blue belt email me from the address
associated with your opponent college
account
and we'll get you your belt
otherwise i will see you around and i
hope to see you continue
to do great things goodbye hackers