hello asu on zoom uh this is the first
phone
college um office hours
session so let's see what
uh people have questions about
all right are we streaming i think we're
streaming
cool okay um asu students on
zoom what is up
hey pretty good
yeah all right so we have a question on
zoom so um actually first let me
give a quick uh summary for for
everybody
palm college is equivalent to
asu's csc 466 class computer system
security um
the class is on zoom and then i'm also
streaming publicly on twitch so this
means that
um i will be taking questions overzoom
from people that
the twitch stream cannot hear i'll
repeat it um
[Music]
repeat the question so that everyone's
on the same page and i'll also be taking
questions through the twitch chat so i'm
on the twitch chat on a different device
right here as well um all right
so we had a question about the extra
credit ctf write-ups
um if you're an asu student taking this
course
you can play one ctf a weekend to get a
one percentage point on your final grade
bonus per weekend total of 14 percentage
points the way the semester works out
uh the question was can the write ups be
in pdf format so that
images and so forth can be pasted to
make the write-ups cooler
so that they can also be used on a
student's web page um you know to to
make them look badass when they graduate
absolutely in fact i would do it
one better you can send me just like a a
link to the webpage that's fine too
so if you're already making an uh
publicly accessible write-up
page i thought about requiring that
anyways but
i figured probably uh kind of out of
scope
um but if you are already making a pay a
website i would just encourage you to
just send me the link
is that does that answer your question
otherwise you can also send the pdf
okay cool
yeah send the pdf and it'll be good all
right um
we got a question on twitch um
uh ox roman 1
says i'm not an asu student am i still
allowed to do the coursework homework
yes absolutely that's why this is on
twitch
go to pwn.college that's an actual
url college is a top level domain for
some reason
go to pond.college and uh jump in
right now module one assignments are up
there's a bunch of lecture videos
and uh you can do those assignments and
on
wednesday module two assignments which
is shellcoding will be released um
you might notice i'm not very stable
right now i'm trying out this new
uh wobbly stool so i might fall over
part way through the stream
um if i don't get back up
i guess
i'll see you on wednesday when i wake up
all right um
any other questions
this is gonna be a pretty boring stream
it's gonna be me like
trying to stay upright on my stool
it's actually surprisingly stable
considering it's
meant to be wobbly
asu students on zoom questions
how are you guys doing with the the
homework
nice fast
very cool
yes so there's a question about uh
getting ahead in the material
um if you go to pond.college the
the the most applicable way to get ahead
but also probably the
least approachable um if you go to
pond.college and you scroll down
there is the archived content from last
year so that content has
um all of the slides from last year not
the videos
uh i didn't have a good recording setup
and
uh you can click through
to do the problems from last year they
won't all be the same this year we're
uh updating the problems especially
things like
the heap has changed a lot last year we
were based on
1804 this year we're updating to or 1804
ubuntu
1804 which was released two years ago
now
this year we'll be running the latest
greatest version of ubuntu
um so
uh it's
um it's it's not going to translate
perfectly but if you really
have time and the grit to kind of
approach
these modules without lecture videos
just with lecture slides
you can um do that otherwise
um the
other best way to get ahead i mean ctfs
are amazing and the best way but there's
you know
a couple ctfs a weekend there's a finite
amount of
time that you can spend playing ctf the
other
route is war games um so i maintain
war games are like offline uh ctfs are
usually a little bit more
accessible um
let's well that's still slides from my
lecture okay nevermind uh i that was uh
up here are our slides i was just
recording last night for
uh the lecture that's up for module two
right now so that's another way to get
ahead i've posted
um materials for module two and i'll
post additional ones
um over here we're gonna look at
war game nexus go war game nexus
i maintain a list of
[Music]
war games which are offline or offline
non-live but but online um
cyber security challenges that you can
uh tackle
uh there's a couple good ones especially
for beginners
i highly recommend picoctf um
it should still be live yep play pico
ctfe around so you can jump in
and um tackle these challenges pico ctf
is really cool because it has
um learning material linkedin
from their challenges uh another
ctf or another um war game i'd recommend
is uh puntable kr and and similar ones
bonobo kr has a bunch of
challenge problems that you can play
through starting from very simple ones
in this toddler's bottle category and
they are actually
um you know
just on the upper level of difficulty of
of this class
too so this this will keep you kind of
uh
pushed all the way um to the cutting
edge of the class if you
click through the first one uh adam
dupey
who is a fellow asu professor some of
you may know
what the hell is that oh that's an ad
all right adam has a whole series where
he will
go through and and and guide you through
um how to do just the
toddler bottle uh very early stage um
challenges here
super good series um also as a bonus you
can
listen to adam talk for like hours on
end it's super great
um what else we have uh
[Music]
i mean there's there's different uh uh
war games for different categories
right so you um you can also tackle some
kind of
very beginner ones bandit will teach you
how to use linux more or less kind of
um with a
kind of similar goal to how
to module one basically but but uh very
different challenges and
and very cool i highly recommend it um
anything here that's like recommended
yes and especially beginner
yes is probably good to to approach
so this glass because i have a
kind of binary reversing and
exploitation focus like personally
this class reflects that um
so what for this class
what is most useful is this binary
pwning
and and probably binary reversing
categories
um but that being said i mean you're
what i want you to take away from from
the course
and from you know the uh
encouragement to participate in ctfs on
on the weekends and so forth is uh
just kind of a passion for security in a
more general way
anything you learn is going to be useful
um this course is all about forcing you
to learn
a lot of stuff every week um
there's also uh ciphertext
on the twitch um has a couple of uh
oh has another link um tf.com
practice etf i don't think i have this
in here
practice prac
tis ctf
ah cool yeah so it's a it's a similar i
didn't know this existed i should link
to it
oh i do link to it awesome okay yeah
there's also a couple of uh
um other links here available um
yeah so uh the the point is any
um ctf is all about forcing you to
to learn concepts very quickly in a
depth
with which you can start exploiting
stuff right
um
pawn college will force you to learn a
lot of binary reverse engineering and
binary exploitation but
you know if you go off on your own and
learn all about crypto that will be
super useful uh and the
kind of takeaways the the ability to
learn that will help you
with the rest of porn college as well
cool
awesome
all right we have a couple of more links
in uh
twitch let's see github.com
guy in a tuxedo
nightmare what's this
intro course based around ctf challenges
oh that's great
i should add this as well
to morgan nexus
wow cool look at that i should go
through some of these
amazing i'm gonna send this out to uh
so this just looking through it this
might be a great
um resource to kind of get ahead in the
class as well
uh it goes through a lot of this uh
similar concepts
and looks like it
i see so it's it's a sort of
learning by write-up oh that is great
cool i'll i'll send this out to the
class
very cool any other questions
asu twitch
ah all right here we go
tips and hints for module one
right um so let's uh
let's let's take a quick look at module
one
of pawn college
all right all right so here's uh
phone college let's go to challenges
okay so every instance of punk of this
uh
module one you can choose a different
binary to try and the the question is
how do you try how do you
figure out um what to find like what
sorry what instances what binaries to
try to exploit
um let me uh launch up something just
with bitcat
set your id real quick and then we will
go from there okay unless ssh in
awesome all right so a couple of things
um
the question on twitch is um just hints
for getting more instances
for for finding more flags every binary
you enter
causes a unique flag to be generated
here i can just read it out
because um it is a catastroid
root and this is a unique flag for cat
and actually specifically for cat on
instance four but it doesn't matter so
unique flag for cat
um
[Music]
i know that i can solve this uh
challenge using cat because cat
obviously you know can cat a a file
um how do i find other things to
look at um
think of how you do it as a
human right you look at
this ridiculous list of binaries in user
bin and you say okay
z run i'm just choosing this on random
can i use z
run to get the flag
obviously right now xeron is not set uid
um
i can show you this by
just looking at it it's just so it won't
be able to get us the flag but
we can make it set uid get as a flag so
you look at xero and you might look at
man pages online
you might um look at dash dash help and
you see oh
interesting xeron has this command and
arguments
what happens if i run 0 on ls
slash looks like it ran
that's interesting all right so now
we're going to
copy this we're gonna make it um
set uid and we're gonna try this oops
wrong
no come on there all right so let's do
instance four
paste in z run play
wait until it gives us the blue light
boom all right
let's go back to my terminal
great so actually we can do this
nice now you can see everything all
right um
we have our uh
[Applause]
[Music]
shell here now i mean i can scroll up
nope all right user bin z run
now it's set uid root so now let's try z
run
uh cat slash flag ah still
permission denied zero and i id
[Music]
young no
ah ctf oh well that's
so see now we we have to figure out why
do we not have can we not leave the flag
with your maybe we can't
by the way i have no idea um
we can uh
[Music]
print out let's create a quick
get euid program
what does it look like
this thing is probably pretty
i mean pretty messed up uh
all this stuff we installed on this hold
on let me
transfer one over
i'm configuring uh ssh to use the right
key
over here on the side
okay let's see if we can speed this
permission denied
oh sweet okay actually it's probably
going to be useful for you to see what i
just
did um
let me show you
all right so i have um my
keys here phone college important.pub
this is what i upd
loaded into um
uh ctf uh into into our uh
into phone calls the web interface
you might find it annoying to keep doing
this
right this whole long string
ssh has a config file where you can
hard code certain options for certain
hosts so for this host
we'll always use user csv 466
and we will
[Music]
always use my key there um oh ciphertex
is telling me
to include so now we can actually just
do
ssh csc.com.college
and it does all the right thing i'll
show you why i did this
in a second even though i think it is
um can be annoying so ciphertext
it is not the include it is the fact
that
stdio.h is the fact that we installed so
many
things on here that i think we broke gcc
oops duh yeah it's it's it's
it's all pretty screwed up but anyways
all right um
i have my uh get eu id
get uid that does the get euid script
program here's what i'm going to do i'm
going to ssh
into here
and transfer this file into
oh i actually need the compiled version
i need to do this because i think
whatever crazy things we do
um to forward the connection into the
container breaks scp
or at least it didn't work on my other
terminal um
but this is just as good oops
what the hell is going on is there no
oh it's user ctf again
ah okay
well now i know why okay so anyways with
that ssh configuration i can now just
scp things directly in here
home ctf get euid
amazing now i can ssh in
okay um here we are
get a uid
uid 100 let's try this um
z run is said uid root let's say z run
get a uid and then i don't know it
doesn't take
okay so xeron unfortunately does not
appear
to uh it probably draws privileges let's
look up
what xeron does you just do man
zeron unfortunately the man pages aren't
installed
in on the the server so
prefixing a shell with z run cause any
compressed files that are arguments of
the command to be transparently
uncompressed
to temp files and then compress
phosphates of the command
that's a bummer there's any compressed
files that are arguing for the command
that's pretty cool though today i
learned
but it looks like it does not honor
it it probably drops privileges back
down
that being said
i wonder if we can be clever
i wonder if we can be clever with
let's create a set uid
actually let's go
create a um copy
something like bin cad in here
so we have uh slash tab slash attack
slash cat which is set uid and owned by
root
so let's um
tie it up
okay
so let's uh
untie this just to make sure that it
maintains the yep okay now this is set
uid
let's scp this
back to the phone college oops
let's go back to my user scp that is
back to the pawn college guy
all right ssh in
okay now what happens if we do z run
cat or ls
okay ah that tar
i see that's tricky
it just untars it it doesn't on g's a
bit
are we screwed
oops the terminals hidden from you sorry
about that
um okay i'll have to think about this a
little
more but xeron it might not be a good
example but what
why did i go down this rabbit hole with
xeron i ran z run
dash dash help and i saw the word
command and like oh
xeron can run command and it can um it
just seems to uh do them without
the elevator privileges that it starts
with um
so the interesting thing is you can look
at user bin
you can see all of these files and for
each file
you can execute it with dash dash help
and you can see
did any uh do any of them take a
command argument uh an easy way to do
this this is gonna
look crazy um parallel is a very awesome
utility um that will
run things in parallel on the command
line so if you ls user bin
more specifically let's make sure
that it prints out the full path
then do parallel uh
the command this is a parallel syntax
this will be replaced with the file
that's
piped in each individual file dash dash
help
and let's grab that for command
okay a lot of options let's
uh standard error away
let's do parallel dash v to see
what command is uh being executed and
here we go
so this says command line command line
ah commands is oh there's a lot
aha execute command above for each file
specified
in a r e pack right so just with that
quick
um uh
query this one we managed to find a
repack
let's look at it dash dash help erie
pack is a file archive for various types
and it has um
well first we can probably use it just
to
the file but second of all it has
where's the where's the command guy
just search command there e dash e
actually command above for each file
specified
i see and it's talking about this
command okay
okay okay that's fine maybe not as fun
but here is
the file of course let's restart with
are pack
we'll go to
user bin are pack
play
ssh back in
awesome ah a tool damn it that's
assembling to a tune a tool
let's use a2 okay
this of course
um
adds to an archive
slash flag
okay does it just what what types does
it support
okay at that time
what's going on here
it should be said uid rude
it launches tar
but it dropped privileges before
launching tar
that's unfortunate this guy drops
privileges as well
i guess it must have dropped privileges
um so question is
what's going on here interestingly we
can
we can run this in practice mode to
s-trace it so let's run this container
in practice mode
practice mode is this second uh button
over here
now we are in practice mode user been a
tool
these have been a tool if we s trace
this guy seriously
we installed a million things but not
asteroids all right
this is a case where you would have to
take this atool
package install it on your machine or
install it on
your docker container along with
asterisks and figure out
is it really dropping privileges can you
um
figure out what's going on or you can
move on
to the next one right because we have a
whole lot of targets
so do we have our parallel guy
no so let's uh user bin
um star so let's do this
ls that let's this time
filter file on all of that
filter by elf okay
awesome uh
[Music]
just take the first so this is a regular
expression
that strips off everything after a colon
file prints a colon
and then the file type so now these are
all the elf files
awesome and now we can
do our old parallel thing where we do
dash dash help
get rid of the command of the standard
error
and grab for command again
and do parallel dash v
all right
so all of these no command no command
command line is not interesting
ooh the a mixer is an
audio mixer most likely this is command
specifically for
the mixer this is interesting what is
amen
so let's uh grab our
um browser
man amen should really get those uh
oops should really get those um
man pages installed on that notify
writers that you are busy
aiming as user and you want to be
written while running a command it runs
the command given normally
if your mess permissions are off so
that's pretty awesome
right whatever it means
and we're not going to go into that
because
there's a lot of content concepts to
explain but it runs
a command so now we have another lead
here we go user bin amen let's
um go to here
spin up a challenge
okay sshn
amen
all right so now the this is initially
can't find your
uh tty in uh utmp
let's go back to the man page so this is
my my terminal
that it can't find my pseudo terminal um
i guess it assumes that i'm running on a
hardware terminal let's take a look
at what the options are
[Music]
telegrams
should be marked this is some old style
stuff
all right um let's see what if we
run this in a screen session so screen
creates a terminal right
uh but i don't know if it creates a real
enough terminal
oops let me show this again screen i
don't know if it creates a real enough
terminal to be worth it
amen echo high looks like it does
now cat slash flag
all this is too secure now
uh home ctf
get euid gosh darn it
yep it's said uid but
no luck for us
that's interesting i wonder
i'll have to look into there there's no
way that
amen and z run and
uh h2 have both been updated
to drop the effective privileges i
wonder if something else changed
what is the eu id of cat in that
instance the uad of cat
is going to be well seemingly 1000
because the
idea might get eid guys 1000
um let's just just some sanity checks
amen touch slash attempts
hey it creates it as a ctf user
how interesting
i'll have to look into this um
further i'll send out an update
to the mailing list
when i figure out what is going on
uh i mean but no no
because find if this works with fine
right so let me just show you in case
you didn't see
the lecture we go
use it ben find which i already solved
so obviously it works
now let's just ssh in
oops
okay so find now works
or find is said uid so find slash flag
dash exec cat
semicolon
oh cat here's our
curly's boom so that works so so
it's not some weird new system-wide
thing
okay so anyways maybe eamonn is
not a good oops a good candidate but
let's keep searching
um please tell me to save my parallel
thing god damn it okay we're going to
rewrite
user bin star xrgs
file so this runs the file command with
all of this as the arguments
it's the same as writing file lsd
user bin star more or less there are
other options to it
grab elf replace everything after
the colon here's our list of targets
parallel dash v
[Music]
help dev null
grab for command
okay i'm gonna log out of this instance
so that
it saves my bash history log back in
thank you okay so let's uh
take a look at a couple other ones
keyboard and command line run commands
on disk
when it is started okay well this is
some
yeah this is uh for cd drives
cg exact this seems
helpful
oh cg x hack of course i doubt
it'll uh
oh okay let's try cgs x so you see with
the cg
c g exact we'll actually talk about c
groups later
um in the course uh
but for now this is a command that we
can look into
if we pull up its man page and let's
pull it up
run a task in a given control group um
you can do a lot of stuff with this but
basically it runs
a task executes the task command
with arguments in the given control
group talk about what what what
control groups are for now what we're
going to do
is um try to use it to get a flag
so let's do user bin cg exec
cg exact
please work
no this is no good things are too secure
sorry you didn't see that things are
just too dang
secure nowadays um
there's a question on is this a college
course or is this a legit stream just to
teach people
how do i answer that i guess it's kind
of both right um
this is a college course uh there are
people that
are currently suffering through this um
homework to get college credit i almost
said for money
no for college credit um
so let's keep going
for use
a given external command to given to c
handle comments that start
okay cam caml to hml
to html let's take a look at this help
this is this is might be an interesting
one to try out channel comments
start with name so you to try this you'd
have to figure out how to create
a camel file i guess is what this
converts to an html file
and how to uh add a comment that starts
with
name and then that would be run that
might be an interesting
one to try out we're not going to do it
live on stream
like to get one that says you know
command
um
for to try out that would be nice
okay why are we frozen
damn it okay let's let's move on we keep
looking at the beginning let's move on
to one of i don't know
things that start with a d all right
running the specified command let's take
a look at detach
attaches to sockets creates a new socket
and run the specified command
okay let's see let's see let's do
a man detach
here it is detach the program that
emulates the detach feature of screen is
designed to be transparent and
non-intrusive it avoids interrupting the
input and output between attached
terminals
cool let's give it a try so
i'm going to here user bin
detach i have a good feeling about this
okay let's go to our terminal
okay
okay perfect let's figure out how to uh
use it detach
create a new socket and run the
specified command
cat slash flag could not execute
the socket will be home
uh ctf
socket okay here we go
detach got us a flag
all right so now we have all of that
blundering we found
one flag admittedly of fewer flags than
i
was hoping for submit
success okay amazing
um cool
so uh
[Applause]
someone's talking about sans on on
on twitch oof
shots fired okay um so now we have one
flag so now you can see my energy
amp up i'm really excited
how did we find that command among the 9
000 commands on this container we ran a
script
the script absolutely
here's the script basically
it does a file on
everything that is in user bin and of
course there's
more elf files than that in this
container they're everywhere
don't just look at user bin search
through for all of the l files
um i grab for the l files i clean up the
output of file and then i pipe all this
into parallel
which runs the command with dash dash
help excuse me
i get rid of the standard error by the
way
this might not be a good thing to do i
just didn't want to see errors from
programs that that
can't run because they're in the docker
container or something some programs
print their help to standard error
so you don't necessarily want to do that
and i grab for command
and after a couple tries and you can do
this after a couple tries here all the
ones that start with g
you start seeing um
get cert this probably is an internal
command to the
to get sir like an option but you start
seeing
um things that
run seem to to run commands this
um
see
dash capital e exec i run the
a session server given on the command
line so this is this might be promising
right you can uh possibly give your own
uh program the other thing is
um i ran with uh
to get the flag with detach i ran cat
slash flag you don't have to run cat
slash drag don't get married to cat
um if you create a program or
shell script or something that does
cat slash flag like cat flag dot c
right
this will cap
the flag you can compile it i can't
compile it on this
uh system because it's broken but you
can transfer in
compile it outside transfer it in and
you will end up
with one thing that when you execute
will
cat the flag without having to specify
options that might make it possible
to use something like this which seems
to just have
i i haven't looked into this
which just seems to have
maybe you can only give it a command but
not the arguments right so you're not a
slave to to cap
um this also seems to be able to read
commands from a file on startup
um that's also pretty uh interesting
maybe maybe they're specific to
you know gpg connect agent but but
that's the thing we
did a large grab and we we filtered down
these 9000 pro we didn't choose them at
random
right we chose them out of a heavily
filtered list in the same way i didn't
mean to spend that much time on
command you can look for file and
actually i recommend
dash i here case insensitive so this is
everything that um can
take a file there's a lot more that can
take a file than
that can um
[Music]
run a command of course but here it's
it's it's interesting here's uh
gene to xml takes an input file so what
if we
do dash i slash flag i have no idea
but you should try it um this can narrow
down
again the commands all of these gfs
combined 2d maybe they're good
but they definitely don't in their help
dash help
say anything about taking a file or
running a command
from the previous thing um this takes a
config file an interesting thing about
programs that take config files and
stuff is oftentimes
if the file that that
um you're trying to give them is uh
oh that's interesting parallel was
having issues
uh you can use xrx instead of parallel
by the way for this but anyways um
oftentimes if a uh
[Music]
file expects some sort of a
configuration so let's say gcc
expects a c file invalid c format
let's see what happens
when i um try to compile the flag
gcc7 that goes to this
so you also have to figure out where the
actual there we go that's that
so that's the elf let's go here
that's selected monitor boom run the
challenge
okay go back here
ssh back in
okay
oh gcc is broken
i'm sure there's a way to fix this but
here okay it says
slash flag file format not recognized
because
why because uh c files should end in dot
c what if you make a sim link so here's
my sim link flag.c
a lot of crap that got started probably
by all the dashes
that's great the uh
something durant created at dash dash
health director alright
anyways what if we compile flag.c
well that's interesting our flag has a
syntax error
but here is the flag alright so we copy
that
um what are you oops wrong
what are you um
what path are you specifying to be set
uid
yeah so user been gcc is a sim link
it's not the actual file so you have to
resolve it all the way
good question actually that so these are
been dc points user been gcc7
that points to this and this is the l
file
ah sorry and this is the l file
sorry that was a question on i'm sorry
good
that's what happened to be installed on
this container yeah
there's a question on zoom about um
a student putting user bin gcc into the
uh um
college interface but that doesn't work
because it is not
a uh it is not the actual file i think
it
fails silently we should actually look
into that and fix it
oh kanakis
uh sargent up to you um canx actually
saying it should
it should resolve sim links and it
doesn't fail silently i didn't realize
conor was on the zoom um on the slack
sorry
on the switch uh connor can you work
um sorry who was saying this
on the zoom anyways conor k
okay can you reach out to connor because
it should have worked user been gcc
should
resolve to the right thing um but
this definitely does work all right
there was a follow-up question
i interrupted someone good
so someone said detach doesn't work um
how are you using detach
no so check out detach
detach works dash c and then it takes a
a name of a socket
which is i guess where it'll it'll uh
redirect all the program output to or or
try it i just gave it some random socket
and it it it'll attach to that socket so
it'll dump the contents on screen
anyways
cool any other uh questions hopefully
this
gave uh you a good direction
um just as a
hint this
big script there's other things you can
script right so here we scripted
help can you go further
can you try to you know automatically
solve some of these
cool um
connor's on the twitch helping people
connect to ctf that from the college
connor shouldn't they just collect
connect to
cse466 upon that college can viewer kind
of
well i guess we're not going to retire
it it's still the archived version
maybe we can be more explicit about it
ah yeah if people want to do something
other than baby sue it then they'll have
to use the
archive version all right anyone else
have uh
questions we have three minutes left
we can go a little later but i
eventually have a hard stop
let's give them five seconds okay
can you repeat that question
that one was yeah so i i saw gcc by
using a sim link
to make it think this is the the sim
link
to make it think that this flag is
actually
a c file and i'll give you another hint
that
anyone else
do
right so so the question there's a
command text to engram
let's see text to engram
and it mangles the flag beyond recovery
possibly right um
here is my advice so let's say we want
to approach something like text to
engram we don't have enough time to
figure this out i'll leave this as an
exercise i don't know if it is solvable
leave this as an exercise to the the
students
let's put in text to engram into
instance six here
um you can hit play right and play will
um start up the container and then you
have to solve it or you can hit practice
the second button we connect up here
this is a container with
user bin text to engram properly
uh set your id to root but you have
pseudo access
so you can become rude and you can cat
slash flag
and you can practice what happens
when you do text to anagram
on the flag
okay so here is uh if you do text
anagram
on the flag it split up the flag
into this guy
and then the second thing it shows is
this
which is at the end of the flag so
obviously it doesn't maintain order
right um so you you have to be careful
about this and and it it seems that it
actually
doesn't output the non-uh printable
characters at all
um so you also have to probably brute
force some part of the flag
into as in the order of these
three things or however many parts there
are
and the uh characters that join them
together
right so it's it's it's a non-trivial
solve but i from the looks of it it
looks solvable i mean there's not
there aren't that many special
characters that can go here connor
sent out a script with which you can
um
programmatically submit flags to phone
college so you can
give a lot of them a try so it should be
solvable
uh oh someone on twitch says can you go
over the script that is basically a cat
okay let's go um
my cat flag.c catflag.c it's a c file
that does two things first it opens the
file
uh open flag this returns a file
descriptor
of flag open and read only
um um read-only mode
right which is what we want cool and
that if you do
man open ah if you don't have the man
pages on this
thing okay if you look at man open
actually
let me just log out and do man open
right open is a system call that takes
the path name
and flags this flag uh
oh only happens to be
uh the value or have which have a value
zero
which is great so so this opens the flag
and read only
the other thing it does is send file
send file takes an output file scripture
file scripture one is the standard
output so if you you'd see it on the
on the screen and let's agree there i
said somewhere takes an input file
descriptor that's why i have the open
right here
so it reads from the flag at an offset
of zero so right from the beginning
and it reads a thousand bytes so let me
actually write it here
compile it and transfer it over
oh oops i put null inside of c and for
this i would have to include a header i
don't like including headers
i like these warnings all right so
here's cat flag
doesn't do anything because if i s trace
it you see that the open
of the slash flag failed i don't have a
slash flag on my local system as
embarrassing as that is
we can now um
cse 466. copy it over
to the right place
okay
connecting over here
okay so now we have this uh this is
still a practice container so i can show
you this
by becoming rude and launching it if i
run home ctf cat flag
prints out the flag right it opens the
flag reads it writes it of course
normally it doesn't have access to this
and
and we can't make it set uid um but we
can
um demo the detach
uh solution let's just
run this with detach
okay and uh so here's our detach
okay cool and we can do detach
c ctf sdf
this will create an attach to that
socket and then um
we can do home ctf cat flag
no arguments nothing if you scroll up
here it is
cool
um
awesome yeah and so then the follow-up
question on twitch is uh so then you
would just find other binaries that can
run a file
yes then you would find other binaries
that can just run a command
you don't no longer have to pass
arguments to it and you just
you know get flags that way
cool all right we are going to end the
stream
here um as a reminder connor
is running office hours tomorrow at 2pm
arizona time
please join in then i think that
it will be super interesting and it'll
be his
um well i was going to say it will be a
twitch
debut but he's he's a hip
person so maybe not but it'll definitely
be his
first time streaming on this channel
that will be fun
um and i will try to make it
to uh troll on the chat
awesome thank you very much uh if
any asu students uh need one-on-one
officers that aren't
streamed to the uh open internet please
uh email me
and we'll schedule a time and if um
anyone worldwide has any questions
dm me on twitter shoot me an email um
i'm
at zardis on twitter yan
s asu.edu over email
and we will see you next time on
wednesday
we have our next lecture we're starting
module two
which is shell coding please if you're
going to join that lecture it's going to
be an extended q a
the lecture actually is happening on
youtube now
as in i uploaded the first one yesterday
so
um take a look and uh we'll see on
wednesday
bye bye everybody