all right hello world this is cs50 on
twitch my name is Colton Ogden and we're
joined today again by C's 50s Nick Wong
hello hello good to go in the stream
again what are you talking about his
pleasure to come back so we're talking
about CTFs I saw some discussions in the
chat which was you know what is a CTF
it's cool the fridge giving that sounds
not at all what it stands for it stands
for capture the flag and that is non
technical we were talking a little bit
earlier that it sounds very really
non-technical for something that is
somewhat technical but basically there's
these kind of flags they're basically
just strings of random characters or
maybe meaningful characters or phrases
they're hidden somewhere maybe in a
system or maybe as like some sort of
abstracts like reward for solving
puzzles and you have to go find them so
what we're doing today is a type of CTF
which is you get handed a system and
there may be some vulnerabilities or
kind of like puzzles that you have to
solve and when you solve them you get
these flags and the flags are actually
in our case passwords to new levels so
each level is actually a user on a UNIX
on a bin to system and after we get a
flag we can use it as a password before
the next level or the next user you
mentioned there this is particularly a
server based CTF but there are file
based versions I'm like Google's that
they put out and I think maybe another
one that I'm missing up in I Dagon I
think Pico 2017 didn't have some base
stuff to it figure I think covers a wide
range of like category where they have
some like SSH interfaces sometimes it's
just a puzzle like just decrypt this
some of them are like can you explain
how this works or can you pick the right
answer some of that we're like here's a
file can you figure out what its meaning
is and it's like a pcap files you throw
it through a wire shark or something and
so I think piece of Pico CDF does a
really good job of covering a wide range
of difficulties and also just types I
like to focus on the Box based ones just
because my background is a little bit
more type of security focused so it
tends to be focused on like a machine
what vulnerabilities it has how do you
configure it correctly hopefully a lot
of awesome people so is our scopes cold
as leeteuk
bill occurs and connects effects to see
um that should come pronounced in that
one correctly but thanks to everybody so
much for tuning in unrelated to see tips
or anything really a content-wise
today's episode is number 50 and this is
spy this is a cs50 show this is cs50 on
twitch yeah and actually gonna take this
opportunity to announce that we're
actually rebranding so we are moving
away from the name cs50 on twitch given
that we publish or we produce our
content not only for YouTube and on for
twitch-based a Facebook and YouTube and
at the platforms and so we're actually
transitioning from strictly being cs50
on twitch to being cs50 alive and the
chat window in a little bit it looks
like it's kind of blocking that up just
a little bit so I'm gonna shoot that
down just a little bit but some folks
might remember this from years prior
where we actually had a new show this we
did this back in like 2013 24 so before
my time yeah yeah current events show
cs50 live and David and Doug and others
would come on and actually did a show to
an episode to the robot but we danced
some ocarina actually which is a class
while there we did this show based on
current events and you know just given
time constraints weren't able to really
bring the show we weren't able to do it
as consistent as we wanted to so even
that we've been doing this show and it's
live it went broadcast to multiple
platforms they are sweet transition even
cs50 live so thanks a 50 thanks for
being on this episode and for being on
so many of those prior to this yeah
that's with that announcement I guess
why don't we why don't we just kind of
get right into it
chuckling yeah I also realize I'm we're
in the I think this is from my freshman
year doing this for a while because the
one who sees 50 in the air and is gonna
be like I can I can feel it I can feel
it you couldn't tell this is let me go
ahead and transition to what I think I
think yours is in right now so if I do
that we didn't see your I cannot go back
our show there that is a remind people
how again to get a show that it's kind
of like yeah so this is a program we'll
go and find it this is the program C
matrix which looks like this normally on
max I can pipe that
wall cat poops sorry can't type live and
it gets this beautiful rainbow color
I found that unlike a bin two systems I
wasn't necessarily able to get this
piping effect quite right so there is
kind of a bummer with that but if you
can figure it out Limina I tried piping
all of the like varying standard outs
and standard errors to one output and
see if I could get it to rainbow color
but I'm not entirely sure how see matrix
and wall cat work on the bottom or the
back end so however that ended up
happening it works on men
I know SX is Bosch this is fine it's you
know that's an upgrade from yeah from
the people I think you I agree I'm also
a huge fan of if you look at my
terminals my Bosch it has a little come
in cute smiley face right yeah yeah
really not interesting for functionality
but if I only type the command that
doesn't exist it tells me that I had an
error and you had our face yeah it just
kind of says dude what happened and if I
go back something that works then I get
my smiley face back kind of give me like
he's done has an important thing exactly
I just like in my my terminal personal
yeah and you don't typically get a lot
of very nice visual feedback with the
terminal interview by default not not
normally a lot of times things will
succeed by giving you nothing
actually yeah and they fail by yelling
at you so it's like I kind of like
having some feedback oh and oh oh
Nina on Oni needs now in Beijing I'm not
sure yeah sorry that's a tough one call
it oh wait I'm behind that virtual
machine for a while I keep asking link
where they looked for it not entirely
sure which virtual machine you are
talking about although my guess would be
the CTF and so there's actually a link
we short linked it or a bit lead it so
if you go to this link there's a
beautiful blog post by a type of the
chats a person named Charlie Kuo and he
wrote that as kind of like setup
walkthrough on all some duck doesn't
mean that on the CTF that we're going to
do today I followed his walkthrough to
set everything up and then that's where
I stopped so definitely a good good a
good thing to go and follow if you want
to kind of play around on your own AWS
instances we're doing all this for free
but technically through AWS so you're
welcome to follow along if you like
if you want to get some cool bug bounty
money from AWS then you could try and
hack into the box we're using today
we've set up a firewall that hopefully
drops all traffic but ours Oh
so if you find any way through you know
let us know and then we'll tell you had
to play us and we'll share money I guess
they're going straight David something I
tell ya sorrel CS tells us Oni means
demon in Japanese this is true this is
true it's good to know I don't know the
whole lot of Japanese but I'll take your
word for it okay it's good people people
are talking about C speed line there's a
scratch episode that was so nice it's
been a while but I Begley do remember
that and then date shout-out to David in
the chat David J Malan thanks for
joining us today every welcome and then
also yeah shoutouts again for 50th
episode which I'll say thanks to David
for the support on the show we've been
able to get that far so really
appreciate it yeah all right well let's
hop into it so we will kind of like
breeze through some of the parts that we
did last time and then we'll be on a new
puzzle but neither of us have looked at
work so true yes we're tuning in for the
first time we didn't do this yeah we did
use this part of the CTF so what kind of
like chill turret it is set up correctly
at this time
sorry yeah before we kind of like I
don't know the idea of this show at
least when I'm on is usually to kind of
show everyone what it looks like to go
through things from scratch without any
prior preparation except for just
knowing about it
and so the goal last time was kind of
like oh well just kind of set it up you
know four minutes before the show starts
and it'll work there was a little bit
more setup involved than I had realized
and so I messed it up and then we kind
of dealt with the repercussions of that
three we're about to solve a couple
puzzles we can still solve some which
was kind of cool but yeah this should be
a little bit easier for us it's a fairly
straightforward CTF I say that and I'll
mess up I'm positive yeah I also that
week nine points out that I had midterms
last time and that is one of the percent
correct I was coming I feel like for
midterms and a final project it's paper
or presentation or whatever no more of
those I got all the midterms back not
great but like you know I am not as
exhausted by those so yeah we're over
and then with at this point yeah exactly
NASA's way yeah well there you and
that's that's what we have so I also
wanted to point out that if you ever
feel like I'm laughing too
you're missing the joke you're not
missing the joke I laugh too much that's
not a comment on YouTube video from like
four weeks ago or something I was like I
don't understand what's he laughing at
I just like laughing don't worry thing
yeah it's holding I had some fun it's
like what I do so don't worry about it
all right so for us
interpreting that I need to do this too
right yeah this one also apply to you so
we will go here and I don't know if the
password is still here bummer I don't
have the password anymore
but that's okay so I'm gonna go on I say
that if you want to do something if you
ever need to bring your screen off let
me know and I can transition those back
to our beautiful not downtown card but
the new seaside you live type of card
which open it today yeah no worries
which looks fantastic
let's see a stray CTF and sorry I'll put
you back there in a sec I just need the
password for the first level so that
we're not all and you'll notice I'm not
even not even checking the passwords of
the other levels I only have one of the
passwords available to me because we are
honorable people over here at scene 30
all right so this is where we're going
is level a1 at 54 that 183 of 109 232
and so just as an FYI you guys should
not be able to access this as coltan
kind of types that in this should block
you I hope if it does not watch you let
us know
yeah I know however it's gonna speed in
there so we're gonna hope that you guys
don't get in and then I'll paste the
password for you
my preferred handle is powerhouse of the
just also might get hope as an FYI and
that is the password that we have to
paste okay so which part of qwm 60 yet
of effort sorry there are a lot of a lot
of things on the screen at the moment
I'll make this a little bit bigger
very good cool and you'll notice that as
opposed to last time we actually get
instructions and introductions and
things which is kind of nice
Gary the last letter oh sorry I am no
that's wrong way there you I think
that's correct yep there you reckon
you're it doesn't matter any of the
other end
after this point the handle preferred
handling so all that you can do in our
house I just saw out of the cell which
is my getup yes as Caine points out
you're not allowed to connect to those
yeah I'm really glad you connect to that
you're not supposed to be able to
connect to that that is just for us to
use
you're welcome to set your own up if you
follow the bitly that Colton posted up
in the top or kind of set it up yourself
but I am very glad you are not a focus
set it up on their own
yeah and the reason for that is we
basically just want to make sure oh I
can't park that so basically we just
want to make sure that you guys weren't
you know messing around while we're in
here and so you'll notice that if I do
WI can see this is kind of just some
sysadmin stuff I can see that there are
three users two of them are at level 1
that's me and Colton and the third one
is myself from this screen which is the
CTF user himself or herself so level low
one sowhat's never seen the CTF and then
your version of level of one then right
so level at one is kind of just if you
imagine a CTF has several different like
levels of difficulty then level one is
actually a user in this case but it also
represents the first level of difficulty
so it's the easiest level but it is also
in our case a actual user that we can
login to a machine as and that's why
these kinds of CTF s-- are somewhat
interesting is they do give you some
exposure to an actual system usually a
Linux system they're fairly easy to set
up on Linux distributions so this one is
an ability system and we have several
users we actually have level we can we
can point out which ones we have or
actually I guess I'll tail Etsy password
and that tells us that we have these
seven users where we have users level of
one two three four five and six and then
we have the final user which is the flag
so if you are able to log in as the flag
you win how those user groups those are
each individual users they have their
own associated groups but they're all
also individual users as well
interesting
and then the CTF user is an
administrative user so that is all yeah
yeah so I'm logged in twice this screen
has me logged in as the administrator
and the others logged into the console
so we're looking at one mitochondria
yeah so actually there's a cute little
story behind that I when I took cs50 as
a freshman I was my first CS class I
hadn't programmed before and I was like
oh this is really fun I'll just kind of
mess around and I was interested in
studying bioengineering I still studied
bio engineering but I've added CS and my
TF at the time was like oh you guys have
to make github and I was like okay sure
I'll make it get out account I was a bio
person so I was kind of like a
powerhouse of the cell mitochondria is
funny you know well and I made my github
user as powerhouse of the cell and
everyone else made the github user names
like you know first name last name some
string of numbers and so my TF was like
well who's this person in my section
Paris myself
I think we've since coordinated that in
cs50 so they don't have to worry about
it but my TF at the time was very
confused who this person was and he
asked in class he was like you know who
is this I was like oh that's me and then
I was wondering why no one else had been
called for their weird handles and the
reason was they all had normal ones so
yeah I ended up keeping it and I really
liked it and most of my online stuff is
related in some way or another to power
of the cell or some other spelling
thereof only within the last couple
years - yeah all the things for you oh
yeah three Jeanette is geez that's crazy
yeah so we're currently in this
directory you actually should have a
different directory if you - yeah mine's
got like a p9 yeah oh sorry
you get some kind of like random strings
this is just scratch space so we're
allowed to like you know do things in
this directory so I actually have a
writable file for the heads a writable
filesystem not the whole thing but this
part is actually writable so I'm gonna
actually alias some stuff I'm gonna
Ilyas the commands scratch to take us to
this kind of scrap space and we'll have
that just CD in to PWD so we can like
copy files here and then those files we
can manipulate but we can't manipulate
the original files exactly so now if I
type scratch I'll end up back where I
belong and this lets me like write
things to the filesystem because the way
this CTF is kind of intended they I
should not chancing it hard to see
what's going on
let me do that real quick I can also
move my terminal holidays everybody
and actually it might work better if
it's like maybe and that way at least
does its commands like filter up we're
gonna be able to see stuff I'll try not
to refresh my screen too much let's see
if that works hopefully that works happy
that should be okay yeah so this way I
can kind of like keep my scratch
directory as I go as we log into former
that like further users I'll probably
forget to do this at least once and then
we'll have to do that again but
basically this is just kind of some
setup as far as like how this is set up
the over RT overreaching system is an
abuti system it has a series of users
each of those users represents a level
and then the last user is called the
flag and that's the user you're trying
to login as if you can successfully log
in as the flag then you win that's
that's the game now it's intended to be
such that each level is more and more
difficult as you go on and I think that
given the CTF that's probably true from
there what we're trying to do is the
overarching system actually has mounted
a kind of file system that we are
currently in as level oh one three room
six that is read-only except for a small
portion which is writable as well and
that small portion is where you can like
write files copy files over rewrite text
if you want and so on and that lets you
kind of control how things are working
there's a very convenient I think so
it's just kind of set up as like a give
you some space to move around explore
the system work you'll notice that if
you go up a directory and type OS you
actually are not able to see what other
users temporary spaces exist and that
makes perfect sense we're all in the
same like writable sub portion of the
file system so it makes sense that we
can't see each other's sub spaces and
then copied them that would be kind of
silly so Han is just like that scratch
like deal yeah and so temp is the scraps
get scratch domain I think it's a great
way of putting it and then underneath
that there are about subdivision
allocated folders exactly and if you
type CD you do it actually in a home
directory and it is the level oh one
home directory and if I type ll which is
now correctly alias I was for those of
you that weren't here last time I kept
hiding lol except to habit of mine and
it was doing nothing
like the compound and so I have to
really us at every time this time it's
aliased by default which is great we see
that we have our dot password file so if
we dot or if we kept that we get the
password that we logged in with that's
the current users password now if we go
up a directory and then into level of
two for example we can talk about level
again we can't cat their password file
unfortunately but we see that they also
have a password file and so the way the
CTF is structured is in everybody's home
directory they have a dot password file
and it is their password and also kind
of their flag so if we can capture it
then we can log in as them and we can
move on to the next level and so the
eventual goal excuse me is to get this
one I'm sorry that password and if we
can get this particular file then we
would that is the eventual goal
I highly doubt we'll get there within an
hour and fifteen minutes or so but you
know Never Say Never and all that and so
the goal of this will basically be to
see how far we can get and kind of
explore we are currently on level one we
got to get to level two the other thing
that we have in the CTF oops
so into that a bit of just like CDOs and
so on ello would be a better habit
you'll notice that we also have this
folder or directory called levels if we
go into this we find a bunch of
executive alls so level one will run and
it prints to us the current time if you
were here last time you'll remember that
this is a particularly vulnerable
application and then level o2 we can't
run at the moment but we will be able to
eventually and as far as like sis
admitting and kind of like UNIX goes the
paradigm is everything is a file and you
get to see all sorts of kind of things
as you go and so you'll notice that this
like D here at the beginning if I do ll
which lists out the long form
everybody's files that stands for
directory and then everything else is
sets of permissions I don't really
remember what s names were probably I
mean them guarantee it's meaningful but
you have these kind of like are blank X
patterns oops and there are three sets
of those so one of them is for the root
user one of them is for sorry one of
this for everybody one of them is for
the group that owns this and then one of
them is
for the user that owns it and they oh
thank you yeah someone pointed out in
the chat history set UID so it sets the
user idea of the process when it's it
moved it's a great way of reminding me
of what that does great point so
everything else is pretty much just like
can I read it can I write to it can I
execute it and so on and those if those
flags are set then you can do those if
you can't then you can't if they're
fairly self-explanatory they're all also
often encoded as the binary
representations so you'll often see
people do like chmod 755 blah and what
that means is basically you're using the
binary representation of 7 which is 1 1
1 and then 5 and 5 which is what 1 0 1
and 1 0 1 and so what those will do is
it'll say ok set this one all too true
set this group to true and false and
true and then set the last one to also
true false and true and that basically
just means anyone can read and execute
it not everyone can write to it
necessarily so yeah oh it's really
useful things to know but basically when
we look into this directory we have this
level of one executable and you'll
notice that the user who owns it is
level of 1 the group that owns it is
level 2 and I can run it but I can't
necessarily write to it I'm not given
any individual permissions so if I'm not
in the group then I can't necessarily do
anything useful
I can only execute it and then tux man
Kenny humorously points out chmod 777
can't go wrong right and certainly you
can go wrong that is very wrong I have
seen people do stuff like this
so chmod recursive I believe it's
capital my parent
that would be back this is pretty
unfortunate command has been run
occasionally by you know you might see
like a troll post on Stack Overflow or
something tells you to do this or you
might see an equivalently troll post
that's like RM RF star this is a
equivalent one this one also works
that's also bad don't run it I mean run
like a virtual machine if you want I
think a lot of his work a nice truck
would be bad
like more directly catastrophic you'll
you'll find use filesystems pretty well
to safe it's a safer space you know yeah
a space efficient after your filesystem
won't take up a lot of space actually
cool so we have this level of one and
the swipe CTF is really not like a
systems CTF so we don't really have to
verify that like the code that they hand
us the C code is the code that got
compiled to it we can more or less
assume that it is just as a note in
general you really shouldn't assume that
if I give you source code and a binary
but I don't tell you how I compiled it
and you didn't compile it yourself you
have no real guarantee that like they
even used the same compiler that you
might use a home and that might be as
trivial as like you know they use a
random compiler like a different version
of GCC or whatever it might be as
non-trivial as they write there and
compiler or they edited a compiler so
that it prepend x' or appends malware to
anything it compiles I mean that would
be really bad also they could have just
compiled completely different code to
that executive Bowl and then left you a
random binary or a random source code
and you'd have no idea so generally if
you're not compiling code in like a
security sense you really don't know if
it is what it says it is but in this
case we're gonna just kind of go off
that assumption and right after I tell
you that you can't do that we're gonna
do it and that's because that's not the
point of the CTF so the CTF actually
focuses on like logic puzzles and kind
of do you know how file system works
rather than that but I'd be kind of
funny about mcnight points out that you
can just alias RM that are a star that
start to CD or LS and taxpayer in
response to that's evil I agree that's
pretty demonic oh very funny
yeah that's very very entertaining and
it's very funny you kind of like haha
unless it's the work computer in there
that's good so yeah maybe like do it to
play virtual machines or something I
might put that in for my club for your
cyber security and I have that be like a
level seven or something all right so
yeah with that let's do some analysis of
this source code and so just as an FYI
we did this one we do know the answer
I do actually know the answer to this
one we also know the answer roughly to
the second one so we're really gonna
like start working on
perches and things on the third and
fourth poles but we'll go through this
one for the people who are currently
here and we'll take suggestions from the
audience kind of like every time but
we'll also kind of point out things that
are going on here something I didn't
know last time but I do know now is how
system works so system checks the
current executors path
sorry environment and looks for this
string as a key in that environment
dictionary and then executes whatever is
on the other end of that so you'll
notice that if we do like end oops and
we can't or I was losing my mind if we
kept for date we won't really find
anything sorry I don't know why I
removed the quotes cuz nomadic but
whatever so if we go for date after
typing out our user environments we
don't seem to get anything super
interesting and you'll notice that that
I guess might mean nothing to everyone
but just for funsies I'm gonna also
alias date or sorry I'm going to export
date is equivalent to let's do like
what's a common one I'm gonna have to
escape those actually we don't have to
escape anything echo works like this
we'll do that and now if I run this
executive all again nothing interesting
happens so what might be kind of
interesting to do for our users is say
okay then maybe you we should go and
investigate how the system function
works right so I said okay maybe it's
the environment and that's what I claim
to have remembered so generally when I
approach the CTF like this it's pretty
much always useful to anything you don't
fully understand as you go google and
people is like oh no you shouldn't
google things like you're so slow it was
like yeah that's true in like a
specialized field right so if I'm
sitting there and I'm a systems engineer
and I need to go Google every time I
want to understand how a kernel like
like a protective control transfer works
yeah that's unfortunate you're you're
probably get fired but if you're
googling around for things that aren't
necessarily in your domain specific
field then it makes perfect sense and
actually this one is in my kind of like
domain-specific fields and that I'm a
generalist cuz I'm a student but we're
gonna go
but anyway just to kind of double
verifying things oh right if you gotta
have that one open you guys good to see
my problem sets there's not really
anything interesting there um so all
right in C system function yeah
couple of Google's searching algorithms
so it tells us okay we get the syntax
for the system function in the C
language is that it returns some integer
probably like a succeeded or didn't it
takes in some act like string literal
and it says a command line that will be
executed by the operating systems
command processor okay so that's pretty
reasonable reasonably straightforward
but maybe we return and we say okay
system function returns nonzero value
but along and so we want to say okay how
can we edit this to I guess get it to
work to our advantage
right and as we saw last time there is a
way to get this to work fairly
straightforward but you'll notice that
this actually just looks for things in
the path and not things in environment
so that should be kind of your first
clue that maybe what we were attempting
as like our intuition for how this might
work was not quite right and when we
look at this it says it's a command line
that'll be executed okay reasonable so
what I can do and what I did is the
solution last time that there are
simpler one-liners that would also work
is I'm gonna say okay I want it to look
for certain commands that it can run so
I'm gonna go into my scratch space hey
if I could spell scratch correctly and
in here I can create whatever I want so
I'm actually gonna move the current
folder or file that's there to date the
chmod also takes arguments like this
instead of just the standard like
numbers representing binary and I'm
going to allow date to be executed so I
can execute date doesn't do anything
interesting but I can execute it
regardless and if I nano date because I
love nano sorry for all the vim users
who are like oh my god you're so slow
and yong-man a knows this and it's very
simple very very simple menu no it's not
a bad thing that dim or when you learn
how to use it
oh for sure if I knew how to use BIM I
would want to be very much much more
intelligent and - of course I would also
be much faster but you all be horrified
to know that I also can't touch type so
if you see me looking down at my
keyboards because I'm finding the keys I
have a terrible terrible thought saber I
have been working on it but I would
touch-type at the speed of like a
kindergartner so you've only been being
CS for two years that's a pretty crazy
kiki craft as well as boots ck and
tricks Jersey thank you very much for
the follows the name the names are just
always fascinating also now if I execute
date you'll notice that it prints out
hello to my console oh I just realized
no yeah you guys were able to see that I
think building say basically I added a
date I gave it my kind of favorite
shebang bin bash and then I gave it an
executive Bowl I kind of command and now
if I go back into this levels
oops typing in the real world horrifies
me because there is a curse with typing
live exactly Oh anytime anytime live
it's always somebody else in front of
you every time every single time and
you'll notice that when I go and run
level one again doesn't really do
anything interesting um but what I can
do is I can say okay you know what let's
update my path let's pretend oh I
probably should go back into scratch
just to make this a little bit easier so
what I can do is I can export path which
is a variable that represents where
things look or where like programs look
when they're trying to like do stuff and
I can run this command which updates
path to include the current directory as
well and you'll notice that if I echo it
it also includes this directory which is
my current one and what that means is
that if I go to run a command say date
for example it'll check that first so it
checks everything in your path in order
from left to right and what that means
is that now date instead of being the
system date is oh my god I can't type
for the life of me is actually the date
that it found first which is in my scrap
space so now if I go
levels again I guess I could have
equivalently done CD - for those of you
that are not like or are like me and
only typing as much if I run level o1
this time it returns to me hello
and that's pretty useful I can now
arbitrarily change the output and I know
that it's owned by the group level o2
which means it has access to anything
else that is owned by a little - like a
file that we were yeah like I'm kind of
interested in earlier so I'm gonna nano
what date is instead of having an echo
hello I'm going to actually have it
capped out for me but let's say I
remember this dot password this home was
it levels I think well so this one is
actually their users directory I think
that's about right well double check
that though oh let's go here and we can
actually OS home level Oh to just double
check okay cool
so that directory exists we're good out
and I forgot the spacebar killer
nevermind not worth it oh I can show
that to you I guess but oh and I can't
run that um that's unfortunate
oh sorry um did you do right because I
can't have this actually be running from
there
oops so what we'll actually do is we
will have let's just rewrite to do I
can't cat it because I can't have it do
that let me think of what I actually
wants it to do so I wanted to execute
this command well we could alias date
that might work well find out next on
this version of you mess around with
systems just to do when in doubt always
do sudo yep yeah I wish I wish were
gonna do sudo well let's try sudo it's a
good point nope can't do sudo we got to
think about this slightly more carefully
now that we're in a proper file system
oh I see I was like huh interesting I
mean I can try it I realize you're
reading up
as you know I don't know anything about
or anything so now let's look anything
else so we get this permission denied
error and that basically means that cat
is being run by not by me which is not
useful so what we want is for dot level
of one to execute I'm sorry I want to
type we want level O one to execute this
system call where date is actually just
level o twos password returned to us and
so the way that we can go ahead and try
out different ways to do that would be
something like excuse me the things that
we have done so far which is creating a
version of this that excusing is wasn't
gonna say oh sorry
if we go into scratch I'll show you what
I'm talking about so that I can
contextualise so we have this version of
date which is executive bull and it's
owned by level of one and level of one
we might actually be able to do this to
date SAP I can't change the ownership of
that unfortunate so what I will do then
it working last time well last time we
had some extra help because we also had
access to the owner of the system so I
think my permissions were set by
accident yeah so this requires slightly
more finesse than what we currently are
attempting but that's okay so let me
actually do this
oops so what we're gonna do is move
dates to dated and now if I type date
I'll still get this error but that's
because my alias which says okay date is
this and then if I run level of one this
goes back to doing what it was doing
normally and so what you can do is
actually this if you do which date that
actually tells you it's been slash date
that's all reasonable so we want to be
able to do is we want to get the output
of kind of caddy level oh twos password
file but we're not given permission for
that because it's being however the
being executed when we run level 1 it's
not transferring the kind of permissions
set from level 1 to the command
underneath although it really should
under my understanding so what we're
going to do is play around with kind of
just different ways of getting it to do
that we couldn't do it in kind of a
one-liner sense well let's see if we do
what we could probably do is this let me
go back into my scratch Spade oh so my
scratch base is also owned by the wrong
person done by me and only my group so
what we can actually try and do is do
get dates to be executed by this and I
want dates to be on my current path so I
think I can send oh no that is a
function from maybe not this language or
this system that's okay so we'll go
ahead and do is see if I can get a
catted version of that file printed out
to us and I'm gonna think through how
did yeah at the moment
so there are proud well there should be
a way that I can't think of at the
moment it doesn't deal with export but
is close let me think about what I'm
trying to do nice is Justin's cool I'm
trying to try to recall so your globally
but their goal is to print out what's in
the highest password file in level of
two right you got it which would be just
cat cat loves you there are other
versions of that command that'll work
but I'm also trying to get it to use
kind of the right executioner so why
isn't it executing date as since this
the executable has through the level Oh
two permissions yeah why is it not
executing the file as level Oh - well
that is a great question my
understanding is that it's because of
where date is actually written which is
not ideal so what I need it to do
is use kind of my own custom command and
I don't remember how I would set that
just as like a general command line
statement and I believe it deals with
[Music]
the like I could set kind of this date
command in my current directory
oh actually something that I could do is
alias date itself oh I can't edit if I
go into bin I'm fairly certain
everything here is own Barry yeah I was
gonna say I can actually just create a
like a version of date that is aliased
and did they miss a date just out of
curiosity might as well look not that
nice zoom that looks about right yeah so
my guess is that it's the way that I've
written it isn't quite right but I also
am aware that I should be able to set it
and I'm not I'm blanking on that command
so no will do how to set a command on
half this is something I should know
yeah Windows XP it's a useful to do yeah
they tell you how to set the path
variable correctly I was just saying
descent command yeah let's take a look
it's sent
cuddle-up man they just there's no man
pages unfortunately so what does set do
on its own
dude to do and we'll kind of just keep
looking around I am somewhat confused as
to why that doesn't quite work it is
very annoying you'll notice that there's
like handle is set here and what we're
looking for is actually just where I can
set my look at where I can set a
commands to be run called date mates
right there so dataset here but date is
obviously not what's actually being run
and so I can't actually
do that one unfortunately because that
one I believe would actually execute the
right permissions I am somewhat
surprised that this one was not oh well
actually no not I really should have
done this to do so what we're doing is
called an experiment we're here trying
out some things so what we're gonna do
is we're gonna try out a bunch of
different things and there we go oh it's
because it was using the house how I use
my own fashion yeah sorry that would
make sense yeah so there you go yeah
don't overcomplicate things good thing
to remember
so now what I can do is when I explain
for people who might add sorry so that's
like you know it's very easy to
overcomplicate stuff so if I go back to
that directory and I nano date so when I
when do you explain what we's did to
right so we'll go through kind of the
whole thing here so I had this flag at
the top which was you know execute using
slash bing bin bash and when I went to
level level of one so level of one is
now currently executing whatever command
I put in date and it is supposedly
executing it with the right permissions
executing as part of level ou 2's group
and level o1 as the user the problem was
that it was saying permission denied and
I was kind of confused by that as well I
actually didn't notice that I had done
something that would mess that up but if
you look in that folder doo doo or in
that directory sorry know same word if
you look in that file an executive both
if I remove the shebang did bash which
tells it explicitly which shell to use
and things that might not have the right
permissions it kind of dictates some of
the permissions and you'll notice that
this actually works just fine and in
fact gives us the password for level o2
and the reason for that is just that I
was kind of accidentally messing with
the permissions with which things were
being run whereas I should have left
those alone as much as possible
good to know so from here what we can do
is
oh sorry we should also explain what
this is so basically if you look in
level o1
as a like the code that supposedly is
being run and I believe is being run
there is this kind of like print after
the current time flush standard out so
just wipe out whatever things are in
your buffer and then call the system
date so this is the whatever these
command-line arguments I'm sorry
whatever the command line function date
is according to the user who calls this
file or this executive Bowl and what
I've done is I've exported my path
variable which is where your computer
oops where a linux computer will look
for things that can be executed and I've
changed it such that it uses this
directory first which means that if
there's something in that directory that
is executive bull and it's called date
it's gonna execute that instead of
whatever it finds later and because of
that we now have access to whatever
level to has access to so that means
that I can do sue level Oh to sue being
switched up flips oh well sue doesn't
exist all right Melissa sage level Oh
two at one 27001 and that's fine and
we're gonna paste that password and here
we are now in the new new user so we
have gone up a little we get a new
temporary directory and all that jazz so
what I basically did there was I just SS
aged into the machine itself from where
I was and what this basically does for
me is it says okay you've now moved up a
level and you are on the next level
which is level o to and from here what I
am able to do is attempt live load to so
you'll notice I get a new scratch
directory again I can't actually see
other people's scratch directories and I
get my own home directory this time that
password has level of two's password so
from here if you noticed at the top here
they gave us some instructions oh that's
cute okay thank you straight so they
gave us some like congrats you know pat
yourself on the back you've made it up
from the first level excuse me and you
get the password to the next level is in
level of threes directory
now this one is web-based so we want to
go ahead and go to a browser at level o2
dot PHP on the server we have to use
kind of the standard password
authentication and then we can see
what's going on in var www and so on and
so what we're gonna do first is Scouts
go look at that source code and there's
level two dot PHP and so if I print this
out it's a PHP file looks good to me and
then we're gonna go to this server at
level oh two PHP so let me remember the
IP of the server there we go so we'll go
here yep oh that's cool I think if you
go to slash lobola tune-up PHP or
whatever oh sorry yeah slash little Oh -
not PHP that's like oh that's minty oh
right and then we need level o2s
password which we have and we'll copy
that our username is level Oh - very
secure and we go over here nice cool we
were left off on last and this is where
we left off last time and we will and I
mean we also did I think have to do more
this time to get past level one
- yeah this time we had to actually do
the proper C - so here you now this time
as we kind of noted last time if you go
into application and cookies we see that
there is a cookie that is set here it's
some arbitrarily like created string
yeah it's just a randomized string here
yeah bua there's just kind of this like
string it's duck txt file
seems cool we don't really care it tells
us a little bit about our browsers from
like the headers where we're accessing
things from tells me I'm 234 years old
it's great and it tells me I'm NW stands
for not worldly that's insulting to
myself and let's see if we go in a TMP
and kind of look around there's nothing
in here all right cool so we haven't
found anything interesting and it seems
to me like all this is reasonable now we
immediately went looked at cookies
because that's very kind of that last
time also generally good idea to see
what cookies detailing them gripping
through the PHP file to find out laughs
yeah they were
yeah playing equals so we did we did
find if we less level Oh - don't what
can't spell big problem learn to spell
kids so yeah if we look through this PHP
function there's this kind of generate a
random string function seems reasonable
there's an output with nothing in it and
then this and this is where we kind of
knew to look at our cookies it says hey
if not is set cookie then set the output
to pay there's some random user or first
user and then our first time user sorry
and then get a file name which is just a
random string hey so um yourself up
probably creates a random string chuckle
yeah crazy and then this is the
concatenation for string operator in PHP
and it put up ends the dot txt extension
to the end of it and then it opens that
file in temp slash level Oh - which is
good to know and it says okay from there
we want to create this file and for
write ability and we're gonna just save
some data about that user and then from
there we're going to blow - bug LOD
continue on set the cookie and move on
seems reasonable to me these are stored
in your browser pretty reasonable so
they can make a copy of file to the
location and have it we can so let's HP
file actually no I don't think so oh we
just checking ownership nope it's owned
by level three entirely and if we go
into /tmp which is where yeah we don't
actually have access there so even if we
were to go into level Oh - also denied
okay so we're not quite able to access
those files directly but I think that's
the right intuition in that if we can't
I'm sorry I'm blessed just so that
everyone can read and you'll notice that
if the file is set already
so if that thing is already set then the
output is actually just set to file get
contents of whatever is in this
directory cat it's on the cookie so what
might be really interesting to us yeah
thinking that it wants to load the
password file exactly and you'll note
that we can't use an absolute path
because it prepends this /tmp slash
level o - and that kind of immediately
indicates that
maybe it's vulnerable to this kind of
like relative having exception sent so
relative having absolute pathing i can
be very confusing
and so if i start something with a slash
and then continue typing stuff so like
slash home level Oh - for example that's
an absolute path I know that this sorry
I didn't give it an actual command to do
with that that is an absolute path and
that means hey slashes the root of the
entire file system and so from there you
can access anything inside of it or
whatever but it's going to start at the
very root so if we go into root we see
all the things that are available to
this current file system if we wanted a
relative path then we might do something
like this I'm in my current home
directory so I can see where that is and
it gives you the absolute path if you do
PWD but I can go relatively to level low
three for example and dot that means go
up in directory and then whatever that
directory is slash means inside of that
and we can go from there
so what might be really useful to us is
if we remember what
oops borrow WVW what this was then if we
look at how this file dot yet come or
file underscore get contents is we can
go up to directories and now we're at
the root and then slash home slash level
oh three / password and it would get the
contents of those and set them as our
output slash home slash level oh three /
password yeah so we're gonna we're gonna
go ahead and try that out so in our
browser I'm going to try and set this
cookie so let's go ahead and edit this
value dot does this way now assumes that
you have a browser that's capable of
doing this any it doesn't still do
different in Chrome and you're like
family yeah you deal with like curl or
whatever have you gone we could also
certainly curl this so what we're gonna
do is dot dot slash dot dot slash home
level o three dot password and we're
gonna go ahead and refresh the page from
there and see what happens so we've set
the cookie everything seems pretty
reasonable we're we're obviously not a
first-time user stuff is going on and
we've refreshed the page our cookie is
set has not changed
we don't see anything immediately change
so let's go ahead and take a look at
where things are here we don't see
anything useful actually
so nothing seems to get put out so my
guess is that maybe we're doing
something wrong and how we're setting
the cookie or something like that so as
I mentioned you can do this with curl
actually so let's do some kind of
command line version of this and that'll
give us a little bit more direct access
to everything that gets returned to us
so we're going to go ahead and we're
going to use curl now curl has all sorts
of cool functionalities so we're gonna
kind of man through it and I believe
it's like - - set - cookie and we can
specify which cookie we want to set and
then query things but that's a lot of
things out of it
actually what I should have done is this
we're in a Google it set cookie curl and
that'll give us a direct command line
syntax for it which is very useful cool
so what we're gonna do is curl the
website I've curled ourselves actually
so we're gonna go into our own home
directory we're gonna curl - or then you
could think I'd be able to remember this
after so many times typing things like
this user token so this is where we need
the cookies name if we got an
application it's user underscore details
user underscore details equals I think
is the syntax I always hate missing
these up yeah it looks like that's
correct and then we'll copy this paste
that here and we can do one 27001
slash level Oh - dot PHP and oops woah
oh right mean authorization required so
let's go ahead and curl authorization
header okay
actually we're not really using true
authorization we're using what's it
called do to do HTTP digest
doodoo oh maybe there's an authorization
having we'll find out
so username and password seems good to
me seems pretty accurate I like it I
like simple
so we'll say user and we'll say level oh
- oh man I don't remember password so
what we'll do is this cat of password
seems good to me oh that's a bad is it
doc passwd might be I'll just cut it out
no that's the right one might have not
bashed completed the like did
intercourse is entirely wrong and we'll
find out we'll find out next on this
episode of how many times coming myself
in different ways and we that's that's
so cruel to Coleman it's not a week I
got messin out an eye I would not be
getting us any farther so here it's
still not authorized to do it but I
think that's just because we don't need
this kind of yeah we're not doing Oh
finally I think our authorization is oh
oh I see so if you use like the user
thing then that creates this header
that's good to know but we're not
necessarily doing this oh this might be
right
I mean I guess we should have used their
kinetic standard dancer canes question
oh yeah had to take call mr. Fixx
fillable one what was wrong with the
initial script they injected and that
was the the bash yeah that was I was
kind of setting our own version of it
yeah we had a shebang that said what was
the user was it user bin bash yep it
said uh they're using our own kind of
like bin bash and then we were using
kind of a it was setting its own
permissions as the color or the owner of
the script rather than the color of the
script right Oh
- - digest not user why not just edit
the cookie named user - level oh three
asks fitness lab I don't see anything
that has done that prevents you from
reloading the PHP file with a different
username and you will get the next
password not entirely understanding what
you mean but I will take a guess as to
what you
would like so they say why not edit the
cookie names user to level 3 we don't
actually have a cookie named user we
only have one cookie
it's called user details and I can't
necessarily just edit to be level o3
itself I need it to be the password file
that they actually have I'm also not
able to edit the PHP file so here you're
very much correct and then if I could
edit the PHP file that'd be great
but it's owned by level of 3 themselves
so I can't touch it meaning I have to
kind of use what they've given me to
mess around with things and that's often
how these kind of like vulnerability
exploits in CTFs our design is given
some set of tools that you have how do
you use them to mess with what you're
doing and I think that that more clearly
understands it explains what's going on
he's saying on the browser locally edit
the cookie right so that is what we did
but we suspect that there might be
something weird going on with how we're
doing that and that's not quite right
for us here I can't seem to authenticate
to the browser correctly we can go back
to it and make sure that we're setting
things correctly but if we reload this
page with that cookie set correctly
seems fine to me
but if we explore the actual return
there is nothing useful returned to us
we could also like go here oh there we
go yeah actually great idea do you think
it hard refresh the road yeah I'd forgot
to refresh the browser correctly so that
is our password now I was like huh
that's weird yeah so crow would also
work and if I could figure it out I
would know I mean we now have it so
we're going to oh well we should explain
what's going on first and then we'll
keep going so for anyone who just hopped
in or wasn't necessarily looking user
details as a cookie that was set we know
by looking at the PHP file itself that
it just goes and grabs whatever the
contents are of the file that has been
provided and it thinks that it's safe
because it gives us /tmp slash some
actual file directory and then expects a
file name in there but we use relative
pathnames slash dot to take us back up
to the home directory or sorry the root
directory and then we go down from there
from home to level o3 to their password
file
and then it actually just printed out
for us what was very convenient and as
was pointed out it's very convenient to
set it in the browser
I just forgot to refresh the page
correctly so my keyboard command that
was doing it was not quite right
equivalently you could do this with curl
and it would do the same thing except it
would print it out I'm not super
familiar with curl thus the googling but
if you are familiar with it then it
would be very convenient for you to just
authenticate yourself and you can only
have so many things at the top of your
head oh yeah exactly could not create a
directory oh well actually what's hard
fail that one maybe I can sue dang it I
don't know another way to switch users
in and Linux I always assume so and it's
not a writable directory so it kind of
makes sense we'll just go up to and yep
that's fine here's the password
hey and we're at level o 3 so my
preferred handle is still powerhouse of
the cell that's not going to change we
have a new directory here and so I'm
going to alias scratch again because
that comes in handy from time to time
and this will be - PWD cool so now if I
type in alias I'll see that scratch
aliases maybe here if we look through to
do the instructions that we got the
password that the next level is in the
place that we expect and as before we
may find the levels scripts useful the
supplied binary does mundane tasks they
always there is very funny how they do
these we trust you'll find a way of
making it do something much more
interesting
Igor voltaic says you can try login
didn't know those command cannot
possibly work with that effective route
good suggestion didn't know it was the
thing where you know hey you know I'm
not allowed to do that either
good to know kind of - Uncle Mike's is -
me Korean hello kind of tell them I know
that beauty Panther PTT 3 3 3 also thank
you for the phone yeah appreciate you
all right so let's go ahead and run the
below three and we get level 3 index
string possible in nice use something to
upper
to lower capitalize and length
interesting okay do we have access to
the source we do I was gonna just I'm
just gonna mess with it I was gonna mess
with it seems to just do those things
it's kind of nifty okay and I'm gonna
take a wild guess and say that returns
fine
shocker and yeah so okay seems pretty
reasonable to me so probably gonna have
to exploit maybe like like a bounce
checking error or something sounds
sounds like it's me it might have to do
with some buffer overflowing that they
might they do specifically use the like
buf - maybe treading yeah it does kind
of point us at a buffer overflow of some
sort so it looks like if our supplied
string is greater than 64 characters we
may have a slight problem and it says oh
well so actually what it does is it
copies it - one into this buffer right
so it copied something to that adds the
yep yeah and then it adds a null byte to
it and it returns that okay
FNS index what is FNS oh it's an FN
pointer function pointer yeah okay oh
that makes sense
very cool this function is now
deprecated I'm a huge fan the deprecated
for most tender tend to point some
interesting things interesting I can go
casting the function planet to run cute
so if we can get a return address to be
this one or this this call then we'd be
okay we could get it to return system of
whatever you want whatever string and
actually maybe we should just kind of
make a new version of whatever string we
would like but we'll we'll get there
when we get there we'll have an execute
arbitrary code first and then we're
gonna kind of skim through the rest of
these we have to lower to upper and
capital and length I'm gonna take a
guess and say they probably do all the
same thing in terms of like they
probably take a first step and capture
Oh
so the first step is probably didn't
mean actually yeah so here is our int
index
FN pointer functions of the number of
functions
and it has the addresses of shockingly
every one of our functions does it have
the two strings as well or the what
anyone was yeah
so our deprecated one is run and then we
have um Kate and call which is adorable
and sounds sounds kind of interesting
this pulls the actual function on buffer
so runs actually not in the function
player larae though no it is not but it
is in the actual will say bytecode of
the file so if we use gdb will actually
be able to see where that is and we're
gonna take a look a little bit more just
to understand exactly what's going on it
doesn't index a to I says if the index
is greater than or equal to the number
of balls it print out some error give us
the indices so we're not gonna
accidentally go into random things there
and then it says return truncate and
call there's our beloved truncate and
call of the functions that we have the
index and then whatever the second thing
we passed in was and so Fitz's love fit
fit test love yeah maybe says this is a
privilege escalation function use it
yeah technically everything we're doing
is privilege escalation the whole CTF is
actually privilege escalation privilege
escalation meaning hey I have as some
given users some set of privileges and I
wants to escalate those privileges or
make them greater than the current set I
have and oftentimes that involves either
granting your current users some new set
of privileges or getting access to
another user who has those greater sets
of privileges from your current user
either works
they run equivalently in terms of like
you get more power and that's what
you're after the eventual goal is often
to get root or kind of master privileges
privileges if you can own the system so
a lot of the terminology around this is
like owning a system or routing a system
or getting root privilege or so on and
that's what we're really after here so
yeah this is exactly what we're trying
to do I believe the function you're
pointing at is run which allows us to
run something as kind of as we saw
before in the level oh one the run
function right and so what we're gonna
try it's deprecated so it doesn't
non-existent anymore
but the problem with putting code like
this into a file as we'll see is if we
run gdb we can actually tell what the
address of this of this function is and
from there we can have that return
address be the thing that actually gets
returned instead of whatever is here
right and if you know a little bit about
how assembly works and my assembly is
somewhat rusty but it should be a little
bit better we just need to figure out
whatever the first argument was which is
I think our di is the register and path
makes sure that our di and you'll notice
our di is this F n pointers star
possibly but that register might get
changed in the assembly we need that our
di oh actually sorry it'll be buff so
it'll be whatever is in buff we just
need that to be the right thing for
system to call so we're gonna do a
little bit of setup and then we're gonna
see if we can buffer overflow some stuff
and we're done from there so if we go
into our scratch space pray do oh yeah
so you'll notice I messed up my alias
and forgot the CD part so I'm currently
just printing out functions there we go
so if we go into scratch that worked now
we're gonna make again touch hey I think
that's kind of cute
nope nope wrong they didn't think that
one through we're gonna just echo hello
so if we can get hello to print will
know that we have arbitrary execution
and we can go from there
and we're gonna do this chmod plus x and
gotta keep yourself any veins people are
too serious when they program uh-huh
that's what I think so what we're gonna
do is then we're gonna run the level oh
three I believe we run through gdb no
it's so upsetting
um that's okay we're gonna go into
scratch which is not a read-only file
system alright gdb slash levels whoa I
can't spell for the life of me oh three
all right so Oh No
cool so no source file is available I
probably should have specified a fourth
source file if we click run no such file
or directory what that's unfortunate
this is where you get to see me miss use
gdb and probably cause all of its
creators to roll over in their graves is
that not correct that looks right I
think you can well we'll see
oh not a core dump okay good to know do
you - do we made do some googling on
like basic gdb syntax cuz who has time
to remember all basic gdb usage I just
really want to oh I don't want that cool
GB tutorial okay I don't really did a
full tutorial so the exact same font and
style as the everything - yeah they all
just did yeah like there must be like a
standard standard thing okay file this
is not super helpful
Oh was supposed to be a hint might have
been a head like Oh Google some syntax
yeah
all right well see when I had to use gdb
for a class I was like a master of
syntax and now I am not so much it fades
fast yeah it really does level oh three
oh that was cool
okay yeah so actually let's give it a
slash levels slash level Oh three dots
see not an executive oh okay so that's
right I'm not crazy
maybe I'm and then oops
oh let's type layout invalid layout sure
but you didn't you still did something
there you okay cool I can have the
addresses of everything in the program
yep so we're gonna go fine I used to
know how to do all sorts of cool things
in gdb and now I know nothing oh well go
search for it ourselves so we want to go
find the address of run
and so here's main let's see if we can
find where run got put and we may run
past the end no nope we're gonna go up
the other arrogance large C library
stuff oh shoot thank you again froze on
me and I think that was my own fault
alright let's go up and see where run is
there it is nice and you'll see that the
return address of run is here too so we
want to do is we want to get this call
function or this call to execute with
the wrong thing inside of it we do want
to address on the very far left rent
post 12 to be essentially what gets fed
into that function almost so we actually
want the calling address of run so that
the return address goes to run and then
execute everything underneath it so this
is kind of like pushed which kind of
just tells you where to like set your
stack pointer and things like that but
we want to go to the execution of run
and we want our RDI register to be set
with the right thing for us to use and
this is our hexadecimal address that we
want to go to so now we just need to
convert that into the equivalent
characters and have that be the last
thing that
actually gets returned and so what we're
looking to do if we own I don't know
where I was going but I was going to go
somewhere did I copy that yeah I did
cool if we cat levels
slash level of three dot see you'll
notice that it returns this like
truncate and call function and then when
we go to truncate and call when we get
to the very end or kind of like as we go
it will have copied into buff whatever
our user string was the first 63
characters of it and then the 64th
character will be a null byte and then
it returns whatever that is so as
whatever the functions at index
operating on buffer is and so what we
want to do is we want to essentially
replace that or kind of overwrite past
this what they actually wanted for us
and so we can actually do that not not
too terribly by providing them just
things that are too long so we can go
ahead and do that let's go ahead and
move spent dot slash slash levels slash
level oh three and we're gonna execute
this with just something that is way too
long so let's just kind of like throw in
more than 64 characters and generally I
ain't voting for this kind of like
experimental oops forgot the arguments
experimental approach just because even
if you don't necessarily know what
you're doing you could still kind of
figure it out and I prefer that and so
you'll notice that this got cut off way
before it got to the end of our string
yeah so that properly cut off the 64
characters yeah correctly did what we
were looking for it to do which is great
appreciate it
so what we can do is instead of manually
typing all of that we can actually just
do like a yes of some character and
you'll notice that this was prints the
character C to the screen over and over
again
I can't quit it yeah you would think yes
would let you quit but that's just
because the print is going on for a lot
longer than the actual function is
running there we go so once we use yes
we could use yes of any
individual character and each one is
going to be one byte we can pipe that
into like head 0 1 oh it's a fraction 1
and we'll get stuff like this
and we can use all sorts of things to do
this to do what was I gonna do oh right
I don't really want the lines though I'd
rather have just individual I don't
really remember how to use yes entirely
yeah you'll find that I don't really
remember how to do everything I was
hoping it had like an argument for just
individual prints single is it like
greater than so greatest enzyme would
like push it into some sort of file okay
Oh actually what we can do is just
Python it aha yeah so what we can do is
actually just write a script that
generates this for this so what we'll do
is touch character Jen
a no and what we're gonna do is just for
blank in range 64 the actually I'm
simplex not waiting in this version is
yeah wow man oh that how about my
machine doesn't have syntax highlighting
unfortunately I don't know it's kind of
Tara will give it I guess like C for
cs50 sure question right and then n
equal oh this might be Python 3 cindex
the end yeah without the yeah if you
print space oh is it just like how do
you not print the newline in Python 2
and pythons I remember I think it's a
thing you need a comma at the end of
what you're printing but it's been a
little while yeah i don't use Python to
a lot it has been a long time
[Music]
yeah finally home I think myself cool
nice nice and Trisha a little bit of my
memory that's come they roughly there
yeah like a phantom does that exactly
pretty what you're looking for them Oh
Oh cuz you need it to be without the
parentheses wow that's wild
okay and it prints a space what is that
oh yeah can we make it not for a space
um
listen this is really an exercise in us
just knowing how to use Python to use
just the standard out dot right oh okay
that's mine you're gonna have to import
so yeah we will need sis oh I do need to
import sis
yeah well or I comment it's hard to type
in front of people it's okay I do
appreciate how difficult that can be
there we go so we get 64 C's all in a
row and that's it
nothing particularly interesting but
what that means is that we can now be at
the end of our buffer and so if we this
somewhat annoying not to have multiple
screens do I have screen on this okay
it's also useful if we look at level of
three dots seem you'll notice that in
this truncate and call we're only
allocated 64 spaces and they try to
basically oh yeah yeah although I'm
trying to be like very explicit in what
exactly I'm printing as an FYI
but yeah that would have also worked
good solution you'll notice that they do
kind of make sure that it's like
whatever the size of buff is minus one
so they're only going to copy in 63
characters but what we can look at is
what functions that are called here
might also do something kind of strange
for example so we're gonna kind of mess
around as we go but
[Music]
we don't see anything too wild with how
this works they put char which just puts
it out into standard out so we do have
to figure out a way to perform a buffer
overflow given what we see here and we
know that 64 characters is roughly the
limit technically 63 anything after 64
though and it's not going to get copied
over supposedly so what we want to do is
try and overwrite parts of what's going
on so really what we want to be able to
do is overwrite the address of this with
the address of something else by writing
out some form of gibberish beyond the
line that says we go it's not enforcing
that index falls within a certain number
right so index actually deals with the
functions part so yeah it does it ends
up actually just checking that yeah and
then if index is negative it doesn't do
anything which is kind of good to know
but I don't think you can actually give
it a negative index or maybe you could
wouldn't really help us so we do need to
kind of think of a way to in kind of the
binary of this code we want the like
next address set here to be the address
that we copied over are the one that we
saw before which is the calling address
for function yeah so we have to go and
figure how to do that from here we see
that the char array has just this and we
can't seem to copy over something bigger
than the size of buf minus one and that
one is where I'm gonna have to kind of
love to sit and think for a moment or
Google is it a hundred percent a buffer
is it could be a red herring could be
good very much B although I have a
feeling this is probably the right fact
the right concept yeah
so let's take a look let's take a look
at stir and copy a know I mean I would
imagine that it just does what we think
it does but you know maybe doesn't so
this has some size T's copying from the
source to destination it copies the
bytes one byte at the time beware a
buffer overruns that's kind of cool so
maybe we go ahead and take a look at how
to perform a buffer overrun with stir in
copy one validate and intended use okay
actually let's keep reading there man
page because it's kind of funny
uh-huh so if you read some programmers
consider storing copy to be inefficient
and error-prone the size of destination
is greater than the length of source
then this is store copy is fine but one
valid and intended use of stirrin copy
is to copy a c string to a fixed length
buffer while ensuring them both with the
buffer is not overflowed and that unused
bytes in the target buffer are zeroed
out Oh interesting
if there is no terminating null byte in
the first n bytes of source Sterne copy
produces an underrated string and then
you can force a termination oh so this
actually seems like a valid use of the
kind of function so we're gonna do is
we're gonna go ahead and see if we can
figure out a buffer overflow and maybe
that's not maybe you're right maybe
there's a hearing a red herring with
string copy oh why is there gotta be
insecure I'm a huge fan beware of and I
well I love these kind of like oh no
this is not good it doesn't require
knoll termination okay so that assumes
that we don't turn all terminate but we
do actually null terminate did you to do
these answers seem to be aligning with
way do mines are going yeah but they
also seem to point out that this part is
required and if you don't do this then
you're in trouble yeah you actually
doing they doing in so that is kind of
annoying
unfortunate for us so maybe we need
another solution oh well actually how
are they where are they storing the
buffer for argh vo so it's just a
bargain v/o I'm doing the saying certain
companies not stir copy thing are we
looking at right right but we are so
stern copy and stir coffee are kind of
part of the same family of functions we
were actually looking at stern copy not
stir copy so just as a half way because
this is actually storing a copy so the N
refers to just including n number of
bytes rather than just the string
entirely so very communicating likes
them so all right so what we're gonna do
is look through the other kind of two
problems yes the idioms for mem copy
thank you so the correct idiom with
stern copy is the following okay so what
are you saying in yeah that is pretty
much exactly what they do so I don't
necessarily know if we can overflow that
my intuition though is that this is a
good the right path maybe we're on kind
of the wrong function in particular so
my next guess is can I overflow can I
overflow argh V I don't think you can
but maybe you can I could actually do a
stack overflow so we just write outside
of the stack entirely so we could
actually do a stack smashing kind of
attack that might be and how would you
do that my people so basically what
we're trying to do is you're in any
given like call to some process or
function you have a certain amount of
stack that is allocated but if I include
some form of variable that's too large
for that stack then I can end up
actually pushing past its boundaries and
executing arbitrary code on my
which might be kind of useful so I
actually I'm not super familiar with
stack smashing how - gotta love the
Internet
so we're gonna kind of yeah we're gonna
take a look at this stack smashing
detected terminated that's a good idea
[Music]
excuse me
so let's see what we can try and do here
assuming that there's no kind of safety
protections on it we can try and stack
smash a little bit so let's up our piped
out code
let's go nano this to something like I
don't know what's a ridiculously high
number with the upper limit of a 32-bit
integer this is a megabyte of integers
which i think is larger than a
reasonable stack we'll go to a gigabyte
and okay what that for that like this
steam yeah so let's see what happens if
we throw that
Oh oops not today memory er oh right
because this device doesn't have that
much memory whoops forgot about that
sorry we'll go one megabyte then broken
pipe interesting oh right I have I
always forget to give it like the index
I'm still a broken pipe though because
it's literally just telcos J they the
index comes before the string yep so we
should be able to oh right so here's
where we get kind of an interesting area
so it ran correctly except our uppercase
string is a string literal so what I
want this to do is this will put this
into a file
wow that's tasty shocker and if we can't
file dot txt you'll see that we get only
megabyte of C's yeah so as andre points
out the default stack size on linux is 8
megabytes I believe that that is still
correct on this one this device is no
different as far as I know you
and the index be negative and send my
point to the input string but we saw
right that it doesn't close it doesn't
tech for negatives but I don't believe
we can actually have it parson negative
although we can try hey I'm always happy
to try okay always forget but dang the
first index Oh interesting so you may
not take it because it takes it as an
argument okay I'm sure so we'll just do
this I just didn't think I just assumed
it was taking it from standard in oh
whoops
that's a right argument list is too long
really is it that should actually just
be a Bosch variable okay well we can
figure that out as we go but I also
pointed out the defaults oh it's very
fun fine put file the code of the
function is located out with previous
explained yes we actually do know the
code of the function that one's not
necessarily our issue so let's go take a
look at it and see if maybe our like
buffer overflows - smacking stack
smashing attacks are maybe not quite
right oh whoops because I believe Colton
might have been honest on the name I
thought it was the right idea but you
know we'll investigate a little bit more
okay so here's all of our stuff we have
a type def of things to do - upper well
yeah actually let's take a look at how
some of these two upper things work so
they just iterate through all of the
strings which we could truncate those by
providing our own no bytes but that's
not necessarily super helpful to us and
that just says well stir at AI is
something so that's not super helpful
this does the same thing but it goes to
lower this does to upper on stir at zero
but nothing else interesting really
happens here yeah I really do you think
it's a buffer overflow attack but we
need to figure out how to do it because
it's kind of set up perfectly right you
have old deprecated code supposedly we
know it's address we can find out with
gdb we should have the ability to
overrun this buffer somehow we just need
to figure out how to do that this is
meant for more for like beginners - or
is this it okay it is kind of I mean at
this point you're on like level three or
so you're about halfway through it
should be about right it's like this is
definitely a reasonable difficulty as I
say the red herring philosophy might
have been more for like a little bit
don't you think
something somewhat semi obvious yeah in
this case because it set up so perfectly
just beginner oriented see if it seems
like it's probably about right they are
trying to kind of lead us that way it
looks like and I'm not necessarily aware
of how to go against what looks like
correctly set up buffering I'm sure my
systems professor is shaking his head
he's turning over right now in his
classroom just like how you should know
this ah yes you just failed my class I
yeah mostly kidding but I'm sure my
sister's professor is not happy that I'm
not remembering how to do this correctly
so let's see a how-to and we'll go and
figure that out
exploring adjacent memory against stern
copy that's kind of fun okay so this is
a full paper yeah but like null
termination is not our problem here they
do null terminate there all right unless
I'm missing something in terms of like
what they use nope no those are all
reasonable hmm good to know these are
all just nope that's not anything well
maybe
okay so what they're saying is that if
the buffer is not filled completely no
bytes will be concatenated oh that is a
good point is actually if we pass in a
string that is actually too small so the
opposite of a overflow but rather we
just put in something that is too tiny
then it will copy in that string so that
string will already be an alternative
now that's not super usable because I
was gonna say we could actually get it
to have a blank space in the middle
where things go but hey so fits Tesla is
asking run is an arbitrary function and
only serves as an Authenticator of a
task you haven't completed what else is
called in the function calling run
nothing actually calls run so Ron is a
deprecated function that is no longer
used no function in this system calls it
I believe so Ron is something that we're
trying to get access to and execute
ourselves by taking its stack address
and saying hey actually return this
stack address instead of your return and
have that be called arbitrarily and then
from there whatever is in buff at that
moment will then get executed so
basically we could put in an arbitrary
set of bytes like date with a null byte
and then when that gets passed in it
will call system on that is what we're
attempting to have done here the part
that we are currently stuck on and kind
of thinking through is okay so we know
that we want system to call some
arbitrary function that we've caught
that we've named we named it head like
HHA and we want that to be called by
system now given that we want to say
okay from here we need to get this run
function to be executed or called and so
we looked through gdb at the byte code
or the we call it the assembly of this
executive and looking through that we
found the address for run so we now know
where to where we want this return to be
and we know too that this buffer is only
64 bytes so if we can overwrite this
buffer and then overwrite the return
address of this command which is just
several instructions down then we can
overwrite it with the calling address of
run and we know that at this point here
sorry hard to highlight right around
here we know that buff is now in the RDI
register since it is the first argument
to whatever this function that's being
called is so the assembly will have buff
in RDI and since it's already in RDI if
we call run now RDI will then be this
stir here and that'll be what system is
called on and that'll get returned to us
well the difference between run how far
away in instructions has run from all
the other instruct like the instructions
directly above we can take a look so if
we're gonna down in file levels slash
level of three and we'll just do like a
layout next there are all short cuts for
these so you'll notice that in truncate
and call this is all sorts of things and
as Bobby Knight suggests we have write
permission nope we don't get to write
any of the executive ol files we can
kind of write our own executive bowls to
be used by them but we can't edit level
o3 itself that would kind of defeat the
purpose and make it a little too easy so
we're trying to think more like
attackers which is kind of like how do
we you know use the tools that are given
to us that are intended to the right way
and use them incorrectly so if we kind
of keep scrolling up here's run and then
length is the one directly above it and
so you'll notice that basically we just
want to be able to get this instruction
to be executed and what is instead
happening here is to do in the assembly
we are running through all of these
instructions bla bla we're calling
something here and by the end this gives
me we jump to here so
we want to replace that with the return
address for the previous instruction and
blah wolf mentions a tube but is there
an opportunity to use a negative index
we can try it shouldn't actually parse
correctly I don't think but me it is so
we'll try negative one and hello is our
string it executed but nothing
meaningful the template rinse it out
interesting
good point so let's go take a look at
the source code and see so only checking
for greater than equal to that is true I
wonder what a - I pay - I of negative
number
so I actually don't know exactly what a
2i does that's not useful
okay so let's man a2im and this gives us
some string and the return of a 2i is
some integer seems like it would convert
it correctly seems good to me and then
if we look in the actual function call
it you're right it actually only does
check for some positive integer yeah
except we don't necessarily know what
that ends up doing that should be some
form of undefined behavior actually and
I believe it if you pass in negative 1
as a index it should just actually go
the other direction
as far as I'm aware indexing basically
meaning just adding to the address of
whatever you're indexing into yeah so if
we go backward and try to call oh
because the bets a good point location
of y got the first function in functions
is which is what whereas the where the
function is defined yeah so FNS is
defined here so to upper is the first
function I so the so what I'm saying is
like if we could just have it go
backwards enough bytes I get to the red
function address seems good to me
oh very cool see alright so we'll try
that and then we can just get it to
execute arbitrary code maybe cool
so I mean a simple way to do this would
be to just test it with every single one
until it works like you just like
arbitrarily oh you do eventually seg
fault but maybe you don't seg fault for
every bite that you go back we might
want to actually calculate how many
bites this is this would they might need
to be like specific offsets yeah as it
worked with me there are certain ones
that this should work in alright great
can I said yeah all right so let's let's
go ahead and check this out
little o3 and then lay out next all
right so let's see where FNS is sitting
oh we need to figure out where
if we look at what's in the RDI pointer
it's really annoying to have to keep
switching between things I can scream at
loved screen okay so if we look at do
when truncate and call is called F and s
wait let's actually see where it's using
the index so index actually just gets
passed through four negative numbers it
gets called on F NS which is in our di
at truncate and call so here's the
actual pointer which is in our di and it
actually only gets called here yep okay
yeah so as fun as it would be I think to
go through this and like double check
things I am very tempted to just brute
force it because it's some finite number
of bytes and I just live just suggested
yeah I was gonna say I'm gonna just do
it that way instead of like trying to
calculate it and figured out
so let's actually set everything up
correctly though so we're gonna export
path to be kind of the same trick that
we did before where we set it to be PWD
and then the path before and now if we
just double check that that actually
worked we have our kind of scratch
directory on here we have hat which will
print out hello and then what we can do
is kind of just like wow oh my god or
actually for I in will say like one
let's try a hundred and to start do
levels slash level of three- dollar sign
i I guess this one we just want it to be
and then any other strings well don't we
want to pass the string that's the path
to the file well right so we actually
are just executing a command right so we
want it to execute whatever because it
does that system call again if you'll
notice here so it returns whatever the
result of system is so we really just
want the system to be called and it's
kind of the same exploit as what we had
in the first function where we wrote
some function that is then executed by
system and so now has in our path so
that's what will be here
oh is Hanna and is him running the yeah
so execute heja will actually execute
this correctly oops and then oops
where's my hopes yeah so this should
execute things correctly eventually
it'll print out a Hello just because
that's what head does currently but we
can modify that it will once we know
which one it prints up we're gonna just
you know it's one yeah we're gonna
ignore segmentation cool so none of them
actually printed there but we'll also
just kind of keep going from there let's
verify that this actually does what we
think it does
yeah because didn't we sometimes get the
result printed like for no problems just
did nothing so negative one printed
hello though it doesn't print anything
negative one prints so we do like slash
levels slash level three negative one
hello nothing actually yeah so as long
as nothing gets printed we're fine we're
segmenting out segmentation and then
we're gonna just run this through like
like a reasonable number of bytes and
one of these should be hello um ideally
and what kind of get-go do you want to
write okay
Oh point two to the 32 yeah okay we
could certainly try that
so although will run from 4096 upward
do I believe that should be fine because
basically let's think because it goes
backward by bites on you let me pull up
the code itself so from here so I feel
like we probably shouldn't hit it by now
yeah so what it does is it says okay
yeah what is the pointer at FNS can we
figure it out can we go to give you a
good look at the binary and look at how
many go back starting how many bites or
up above right yep sounds good to me
Oh three so then the thing that is going
to be a little bit tricky
is we need to figure out where exactly
the function or FNS is yeah so we do
need to know where that is and what its
address is so basically will not show up
in not named no but you can see here
where it calls truncate and call you can
you can kind of see where it would have
called
sorry not truncating call all the
truncating call would be you're gonna go
will receive it as its yeah kind of
having to switch botanics it was the
first argument to truncate and call the
point right so we want to look at what's
in our di when truncating call whoops no
dot see him there we go we want to see
what the what do you call it
alright as a register yeah RDI is your
first arguments registering and so we
want to go find where that is so
basically when truncate and call is
called at the very end it returns this
function called on some buffer right and
what we want to do is see where FNS is
so oh so actually what we could do is go
find truncating call look at where our
di is used and just kind of track where
that gets used to see where it ends up
what it ends up being is a value
alternatively in main we can look at
where truncate and call is called and
see what thing is passed in is our di
right and I think those would work so
let's go ahead and do that
and louder it's loud as little bit
easier yeah alright so let's go through
Maine and let's find where truncating
call is called so it should be at the
end here yeah somewhere yeah it is
alright so now let's go and look at
what's in an RTI so there's a bunch of
stuff in the ax which is the return
address and we want whatever is in our
di
just to do let me know if you see it is
they may not mess with it a whole lot
cuz FNS is set up at the beginning right
so notice how there's these four things
that are set up here kind of randomly so
it looks like we're ever
yes P is is the actual FNS because what
this looks like is what they're doing is
they're putting each of these addresses
into the corresponding area of ESP and
so my guess you see the stuff literally
that should be so they're just
allocating a space on the stack at the
very end for this array and what they're
doing is shoving in these addresses so
my guess is if we went to this address
we would have the I think lower function
so let's go ahead and double check that
just to make sure we're right so this is
a tofor85 efore so 804 eight is going to
always be true 5e for as long we're
looking for and I can't scroll super
quickly but it'll it'll pass don't worry
yeah and we want to say 5e for should be
the first bite to eat for two upper okay
first if well it's not the first bite
it's very this is the ESR as protecting
those mystery so this one is pretty much
exactly what we wanted or sorry this is
to upper so I guess zero is two up or
not to lower and so we know that that is
the item that is being pushed there so
we know the address of FNS
college to scroll all the way back down
there and so to clarify what we're
looking for and what we're trying to do
here we're basically trying to because
of the way that arrays work in C is C
arrays say okay I have some address of
the actual array and if I index into
some address and what that actually
toxically does is it says hey take that
number multiply it by the size of
whatever this array contains and then
add that to the address so if I have a
series of integer it's an array of
integers then my array is actually just
a pointer to a block of memory that
contains continuous integers so I can
access any of those integers by doing
whatever index you pass me multiplied by
the size of an integer which standard in
2 is just 4 bytes so that means that I'm
going to just jump 4 bytes
every time kept in a loop in increments
of 4 then would that have been more so
so in this case the size of a pointer is
8 bytes and so that's what it contains
at the moment right so we're actually
jumping by blocks of 8 bytes when we
have our kind of negative 1 negative 2
and so on and so we are basically hoping
that the address of FNS right dealing in
by self-sealing in pointer arithmetic
where the the ones are the index minus 1
is the size of the pointer yes so
wherever FNS is we're basically hopping
backward by chunks of eight and we're
hoping that one of those chunks of eight
hits the kind of first address the
starting address of run so we're doing
kind of a weird not a buffer overflow so
much is kinda like a buffer ignorin s--
and moving on right so what we're trying
to do is get if you look in the code
here we are essentially attempting to
get this code right here FNS is a array
containing a bunch of addresses to
different functions we're trying to get
the address of we're trying to get that
to actually be the address for run and
then it will be called on buffer and
that's what that syntax kind of ends up
saying and so we kind of figured we
could prove or sit by just passing it to
varying amounts of this although I'm
starting to think that maybe we have to
do something slightly more complex it
really making us dive deeper level three
challenge it's kind of a it's kind of
rough Channel
so fit does fits Tesla sorry I
mispronounced your name is a lot says
you can cause an exception in the script
and then trace to where the pointer is
yeah that would work I don't necessarily
know I think it's just a little tricky
to cause a specific exception and then
trace to where that pointer is I'm more
comfortable of looking through GDP gdb
and just kind of scrolling through it
and figuring out where things are but
yeah I think that in concepts that seems
reasonable but I think this is a more
kind of programmatic approach and that
it will guarantee that eventually I can
find a solution and so what we're trying
to do here is we're trying to say okay
where is FNS located and then where is
the address for run and can we just get
a fan s's value to be that address right
which or at least the index at FNS yeah
we just want basically wherever FNS is
we want the offset of like negative I
times earth I times eight to go back to
wherever the address of run is to give
us that address to be that address as
people have kind of pointed out in the
comments above the array access includes
a dereference so we need a pointer to
the function not the function itself and
I agree
so brute forcing it should in concept
work it just may take a while but I'm
working with a while as we kind of
discuss what's going on so I'm gonna
keep running this as we go and we'll
start it at 4096 and go up to let's see
c5 536 eventually it'll reach an out of
memory thing in the little freaked out
really all right now but yeah so as that
runs what we're essentially trying to do
is get what's called undefined behavior
to execute and a lot of privilege
escalation deals with that sort of thing
and or finding things that you shouldn't
have access to so what's really going on
here is we're eventually after we can
figure out which ended oh well yeah I
realized your comment from like 20
minutes ago was like also print out I
that is a great point yes I should have
printed out I
what kind of ballpark it based on how
long today I mean if nothing happens it
isn't right nothing happens that it
won't make a difference and we'll have
to kind of rethink our drawing board
because it might be something slightly
more complex where for example we
actually have FNS points to a function
that like gets called just before and
then try to acts like buffer overflow
from there right like you can get what
half way back through truncate and call
and then instead of having the like
safety measures that they have you
cannot really replace things and then
replace from there and that may be
slightly too complex for a level level
three feel like that's yeah but but we
could in concept do it and so Wow
blough elf says I still think we should
put the pointer into the second argument
and try hitting that one unless you
already have a pointer to run and so
what we're actually the reason that the
second argument is what it is at the
moment is that we're eventually trying
to set we're trying to get what you call
it we're trying to get run to use the
second argument that buffer that string
to be what is the argument for system so
if you look back in the code I'll have
to rethink our strategy a little bit
here but I think we're on a better track
in this case if you look in the code for
run you'll see that system is the thing
that actually gets called here and so
system is called them whatever the first
arguments to run is and the first
argument to run will be whatever's in
the RDI register when it gets called and
what we're saying is okay in truncate
and call you return this.f NS of index
called on buffer and so buff is whatever
is what's in RDI and buff is whatever we
gave it as the second argument to the
function so I want that buff to be what
I want system to call and that's what is
going on here but from there I want the
concept that we were kind of testing was
okay let's take index and have that
point us to the address of run which
will then get called on buffer
unfortunately that didn't seem to work
we passed in a fairly large number
temps for I the issue may be a kind of
result of the fact that I is actually
increments of 8 bytes since the size of
a pointer is 8 bytes which is not super
great for us because that means we're
not necessarily hitting every single
chunk of code and there may be another
case in which we have to figure this out
what is um what is hand hit again uh
heaven is just a script that prints out
hello okay and eventually we could just
replace it to have it print out whatever
we want and so I mean the reason I use
that is because it's easy for me to pick
out in a lot of output where it's like a
random string I may not notice which is
what their passwords are so scent is
just can't hello or yeah well that was
it so a system were called on it it
would cat out hello I do I did realize
that you might we might still sake fault
even with the correct thing printed out
so I'm going to run this again oh and
that's actually yeah let's get there and
let it stop you grabbing for it but yeah
we'll print out I as well so that does
that and then will echo clue try use
hand hair to print hello world says
fittest live equivalent technically to
what we're doing but I'm also not going
to grep out segmentation I'm going to
grep for hello and that should be fairly
reasonable for us
actually it's not printing I either yeah
yeah it's gonna say it should actually
be printing I so let's let's take a look
oh okay well we can actually just have
this printout because at least it shows
something changing and let me know if
you see a hello anyway yeah that's gonna
happen - way too fast I feel like I've
seen a bunch of blips gone by that I
can't really yeah and since cruising
through Tesla says this is a joke yes I
agree
alright and as we go through all of
these numbers there are some blips but
it doesn't seem to be finding anything
particularly interesting for us so what
might be kind of of use to us to note is
that negative 1 and negative 8 did not
have seg faults they were actually both
valid so that might be something worth
us kind of playing around with is there
are some values here that do not say
fault although most of these have I
don't know how we could possibly see it
though it's going so fast I feel like
we'd miss it if it were I think it would
be a pretty pretty solid otally tighten
it so file and then grab the file we can
also do anyone have it won't be able to
possibly get through all this at this
point so what we can do here is actually
just put this into some of the same
thing oh yeah I think it's also maybe
moving faster oh wait is this just yeah
this is I background in it but I I kind
of just like figured I would background
it I forgot to make sure that its
standard error also went to the file
this is only putting out its standard
out which is annoying and I could kill
it by typing yeah well I can't type fast
enough actually - oh well it's
continuing - yeah that's cool
I think it is recycled it gonna look
like it did I did it even restart it
salute back now let me look back so
we're gonna we're gonna just kill that
process externally fun idea uh might
just kill that user let's see that user
should have been at the bottom oh that's
cuz it get cut off so this is level of
three I want to kill it pts but I would
do want to kill the other process oh
this is using exploits to finish writing
a script that solves another level
script yeah you can act yourself out yes
yes so good yep that sounds better
alright I do need the password cat oh
right I need level threes password
alright well we're gonna just cut that
out to ourselves there's level three is
password thanks and then we'll switch
over to level three no classic cheat
codes we've got a constant gotta love
some cheek it's okay alright cool and
when you stopped accidentally blasting
ourselves with level 3 the output
alright so we're gonna kind of to recap
so we have levels level of 3 and with
this takes is some indices which indexes
into a list of functions function
pointers actually and it then tries to
call them so unfortunately we are not
doing that quite correctly and I don't
know that our like I think our negative
indexing is right in terms of ideas but
it's not quite what we're going for here
so there is something there is some
other kind of trick to this or some
misunderstanding that I'm making but
you'll notice that negative one actually
doesn't say fault and have it is
negative eight
buzz- sixteen will try it yep okay so
it's not deterministic I'm on any sort
of I know maybe I'm not a pattern that
we thought about it that we see
today though rapping yeah
if we did like a 32 or something still
sick bolts so what an eight don't though
and I think that's kind of interesting
so if we look back at will do within
that instruction like our one and eight
the same instruction now it's light uh
so let's see let's see
and also see it Martin thanks for
popping by appreciate it yeah all right
so if we look let's just take a look
make sure I'm not missing anything there
where is f ends defined right so effing
pointer Oh
also I didn't realize FN pointers a
custom type what's gonna take a look at
F n pointer so I think your pointer star
oh boy is defined as so the DL
dereferencing of F n pointer which is an
address okay so it's still an address
which doesn't help us too much but is a
constant char star okay so they just put
it into like the discrete byte units and
then they defined it isn't it that's
cool okay
Coolio so we want to do is we're
basically trying to replace this index
with something that allows us to access
something interesting but wherever FNS
is apparently one address back is kind
of interesting
it doesn't sake fault at all and then
eight addresses back also doesn't seg
fault
which is very strange wait do you
they're typed effing int throughout the
whole program
no sorry so type def is weird because
it's backwards so the attenti thing yeah
so if you d allocate or sorry
dereference FN pointer and call it on
constant char star that that type def is
of an it
and I guess that works too implicitly
define an FN pointer which is I didn't
know that's what that worked but that's
what that reads to me and yeah type devs
are backwards so type def int whatever
follows that is now defined isn't it
okay okay so we have come to kind of a
couple of ideas so Bob ignite suggests
hey maybe it's a cubic pattern it sounds
good to me let's see if maybe that's
true 27 nope sorry but what we're gonna
try and do is see if we can figure out
what kind of idea we're missing here it
seems like there's some other stuff
going on so we know that we can access
two addresses one back and eight back
and they don't segfault they're not
broken which is very strange but seems
fine and we know that they buffer
overflow protect as much as they could
have they follow the instructions that
we found on Stack Overflow and the
internet so it's probably not a direct
buffer overflow but there might be
something kind of interesting going on
here now my guess is that wherever this
is currently located FNS is on the stack
and if we go one address back what we
can do is for calling something we're
doing something that's valid
so wherever FNS is one address size back
is okay it's valid eight is also valid
meaning that one of those two is
probably useful to us assuming that this
negative indexing is doing what we want
it to do right so if we look at where
FNS is here one address back would
probably be something like this and
eight addresses back is probably the
actual function in itself although if
that were true then it should end up
getting called over and over and over
again and eventually just running out
memory like it should just recursively
call itself so that can't be true
so my next approach or kind of idea it
might be okay in this case what should I
look at and I would say something like
gdb right so yeah let's go back into gdb
and see if we can figure that one out
Lake nemi birthday Colton thank you time
stone it's getting to Egypt thanks so
much for the lecture cool too minik
awesome well thanks for attending thank
you for sharing much for the kind of
message appreciate it and then fit this
love was saying that this is computer
abuse to solve this you'll need to use a
bunch of parts of scripts to rewrite the
its own script maybe the solutions
really say the CPU range percentage I
don't think so
there are too many exploits that I know
of that aren't like of some form of like
super fun and advanced that would hit a
CPU range certainly not a level three on
the beginner CTF but also I don't
necessarily see how hitting a certain
CPU range would help us here I believe
we're on the right track in terms of
some form of dealing with either bad
indexing or buffer overflows they both
deal with undefined behavior and so what
this exploit and or level is really
touching on is how can you get code to
execute it kind of can get C code to
execute undefined behavior in a
meaningful way and so yeah what we're
looking for is where F and s actually
sits or functions actually sits and what
we can do is we can see in truncate and
call it eventually calls let's see it
jumps if equal to if the equal flag is
set we want to see where okay so here's
where stern copy is called which is
right here line of 50 in truncating call
or instruction if at line 15 bite 50
sorry and then we kind of like move some
stuff we do some kind of shifts adding
and moving the load effective address oh
so here's where we're actually loading
an effective address into our return and
then we're going to call the dereference
EDX which is just part of the our ax
register so sorry that's not true it's
part of a different register it's half
so ei X is half of the rx register and
then it looks like we load 0 or this
address backward into EDX and from there
we say if everything is valid then jump
otherwise don't like fit basically just
give up and say that there was some real
problem ok so basically what we're
trying to do is get this kind of
highlight the instructions that are
important to us
we're trying to get this to load in the
address of something that doesn't belong
we're trying to get in it's a load in
the address of run now we know the
address of run but we don't necessarily
we haven't quite figured out how to get
it to do anything meaningful yet we
haven't quite figured that one out so we
are now left in the place where it's
like we have to kind of just guess and
debug and take cracks and things so we
tried a buffer overflow but we know that
that one doesn't work we try it well we
think that it doesn't work we looked at
some stack smashing but we're pretty
sure that that's not quite what they
were pointing us out and then we're at
this point where we realize that
negative indexes are valid sometimes and
we're not quite sure where we want to go
from there
so let's take a look at what like
negative 1 might look like so if we load
in negative 1 which is probably coming
from EVP a think is part of the second
instruction or a second pointer let me
double check that let's see our dia
argument order pointed registers I don't
always remember these I would if I was
still doing these
um did you do where are my favorite
registers I know it's like RDI RSI RDX
right and RSI is the second argument
okay
trouble a dose those beatings from
Germany hey let's collect revenue I
unfortunately don't speak any German but
uh come on good news from the United
States yeah
welcome okay so if we look back to where
FNS sits on the stack actually we don't
know where FNS sits on the stack um we
should probably go find that I realized
that I don't know FNS is actual address
yeah I think we were we were we were
thinking about going and finding that
yeah let's go ahead and do that so this
moves oh okay so here's this address is
at ESP and movie SP and EBP and do a
logical end of these 2 and then subtract
third right but we're in hexadecimal so
that's 148 but we can uh we can we can
convert what 0 X 30 and also I know I
know that is 48 I think that's 48 oh
wait I also forgot I hadn't Google so X
13 yeah
I'm sure someone will leave a comment
like oh you can't do hexadecimal in your
head and it's like yep that's correct
okay you're right okay I guess it's like
16 times 3 yeah but it gets hard on it
doesn't it slim what trick here and also
I'm not the best at computationally like
mental math never really needed to be
okay so we know that it puts the
addresses for our four functions into
the varying offsets of ESP and we also
know that we subtract 30 from ESP so
that gives us space for four addresses
which makes sense so each address is
apparently 16 and we're adding
well actually add thanks presents and
then we're at this we're roughly just
all FS and then is zero is is that the
max space for that like one two three
four five six seven yeah okay
excuse me all else is the whole ones all
Epson to zero means your last one to our
very last one is a zero well if I know
so from here we basically want to say
what where do we want to really want to
mess with things I feel like this is
getting so complex for a level three I
know but it's and I feel like the answer
should be staring us right in if this is
just like some really obvious like and
we just go straight for like they're
really hard stuff all right well in that
case let's step back and think about it
for a sec that's that's a good point
that we are in some somewhat complex
territory they're definitely within
bounds but maybe in the upper bound
let's take a look again at what we know
so level three right can't do that I
think for PHP feel like it's a little a
little much okay so we know that level
of three takes in some index and some
string and from there it executes in
some way now if we go and cat out what
each of the source code files say I'm
sorry I don't really use cat when he is
less is there an opportunity to use not
ask like non ASCII symbols but none
alphanumeric symbols nothing we could
write raw bytes or kind of non numeric
things or not asking things to it
we can write raw bytes because to upper
well to upper is probably safe on non
alphanumeric yeah so let's take a look
at a kind of things that are going on
here so two upper is pretty reasonable
yeah and then two lower is also quite
reasonable seems fine and then put char
of two over okay so this one just
assumes the first thing two
of it and then put charter to lower the
rest of them okay and then length just
iterates through increments its length
and then prints that out to us so none
of the other functions seem inherently
terrible yeah and none of them really
have arrays or things that we can really
interact with anywhere meaningfully so
let's take a look at how well some runs
call system so we know run is the
objective in some way right that has to
be what we're going for is somehow we
want to execute run and then from here
we know truncating call gets called at
the end of main and it takes in this
pointer to or sorry an array of
functions and then index which is just
some number and then it takes in this
like string which is the user supplied
string it allocates a char buffer of
size 64 so 64 bytes and it copies in 63
bytes from the user string up to the
size of buffer minus one so that's how
we do some fun nun functions the
constant we're numb funds the Oh for to
find a fork yeah attached to finest for
okay have a funny feels like that's like
20 yeah yeah and from here we are
basically assuming that you're supposed
to use 0 1 2 & 3
to access the appropriate numbers and we
know that if you pass it an index that
is too large it catches that and says
now before it ever tries to access it so
those ones not necessarily super helpful
to us so from there the only flaw so far
is that doesn't check for negative
numbers yep then I've seen that's the
only one I can see it either or as well
is that negative numbers are not checked
and Arg V 2 is always set
or sorry is passed indirectly they don't
validate anything about your second
argument so really what we're trying to
look for here is how do we get run to
execute and my guess is that the
negative numbers intuition is roughly
right
the problem I have I guess is that it's
not it's not quite there right like it's
like almost but we tried brute forcing
it within reason and is there something
flawed at all with what we'd have what
we're printing or what how we're
actually like running that loop hmm
could be yeah
so let me just double check that it's
executing what we think it is so let's
do levels slash level of three we'll do
negative I guess two or one which should
print out nothing and this yeah no sig
fault so that's the right kind of idea
and then what we'll do is we'll export I
equals one and then we'll do a bash
complete or bash substitution I hope
whoops weird that uppercase tip though
wait what did you type in what's the
index I didn't type in anything I
actually just accidentally placed
parentheses around something that
shouldn't have been placed wait I was
very strange oh I guess cuz the return
code of that is zero and negative zero
is still zero
oh so zero works okay well things do
believe we should have the pointer in
the stream maybe we don't need the full
63 characters so if we were to put the
pointer in the string I'll walk through
it I guess to kind of debunk why I don't
think that that would be necessary is
let's say we put the pointer into the
string then essentially what you're
doing is you're saying okay we're gonna
copy over that pointer into buff and the
pointer is not more than 63 bytes so we
don't worry about that it'll get put in
there and then once we have our pointer
in buff that is just a string so the
data is still being treated as a string
and
whatever index you pass will call will
be called that function will be called
with that string pointer as its argument
so for example I can pass in a random
pointer that is roughly right so we'll
do like 0x this wouldn't actually be
quite right because it is represented as
ASCII but we could print it as binary
and it wouldn't actually matter but if
we do 0 X 0 0 we'll just get the X
capitalized and if I were to pass in
just raw data we also really shouldn't
get too much too many interesting things
happening it's a passing raw data that
would look like a pointer it actually
doesn't matter you either way it's being
treated as a string so we don't really
want that but we do want to call a
function arbitrarily and the function
that we want to call is run and actually
as many of you have suggested the like
why is run deprecated we actually don't
necessarily care too much about why it
was deprecated as much as that is like
part of the story of the CTF it doesn't
really deal with how we could use it so
like the reasoning behind why a function
is deprecated doesn't necessarily matter
to us since it's still there
I can still access it in the bytecode
and that means that I could still
arbitrarily execute it hmm what could be
useful is to have this execute in main
and have it just call that oh no I was
gonna say if I can just arbitrarily
execute parts of this code that would be
very useful as well to just execute run
from the bytecode but I don't believe I
can do that we this would be I think too
advanced but you could grab its assembly
and execute that possibly but again it
would be created with the wrong
permission so I actually nevermind what
happens if you overflow the buffer sorry
I came here really late says it ain't it
so your main name says what happens to
be overflow the buffer we actually can't
in this case it appears that they use
this correctly it
only copy up to 63 bytes from our input
string into the buffer and that's
unfortunately not going to let us
overflow it they also remembered to null
terminate their buffer which is
apparently the common problem with stern
copy so it doesn't seem to have a
obvious buffer overflow opportunity
there is the possibility that this is a
stack smashing kind of attack but I
don't think that that would be
particularly useful here what we did
discover was that negative indexes are
sometimes valid not often but sometimes
okay
there is the occasional index where the
negative index is valid and what we're
about to tribe is actually just putting
that into a while loop and executing the
ones that this is valid or it's re
telling us which ones it's valid so if
we echo dollar sign right so what I want
to do is this so well or not well for I
in one - we'll say 8 because we know
some of those are valid do this which
just execute this with that percent I
and then echo dollar sign
I said percent I meant dollar sign I
never like this to a file
yeah and we'll just shove that sorry
done we'll shove
both both of those into our data TX 1000
and Senator yeah because the standard
error will be the segmentation faults
well or not so we got six so that's
that's appropriate though because 180
because what an 8 should have worked
yeah so actually the numbers output it
as well yeah I realize I didn't wrap
this effectively there yeah uh-huh okay
so now for cat Dada txt we get 1 2 3 4 5
6 7 8
with no segmentation interesting that's
supposed to be pre neak segmentation
thought there it should yeah as far as
I'm aware this is the correct syntax for
a piping that correctly but I might be
Oaks I'm dropping it into a sub shell as
well so maybe the sub shells version of
this doesn't get picked over you would
think for someone who spends so much
time with with UNIX systems I would know
even more but I don't quite well so what
time is it ah yes I will have to
unfortunately end this fun little
endeavor into this and these things they
take - there's so fun and they so they
yeah that's annoying so hey I always
said to not be able to finish a CTF but
also that would mean spending - a little
bit too much time so yeah unfortunately
we probably won't be able to get through
level 3 today either but this time it
was set up correctly and this time we
actually got to spend time working on
the CTF itself rather than debugging the
setup and the CTF your and we can do
another episode some we can do more of
these as well I do enjoy kind of bashing
my head against these a little bit I
think it's worth kind of walking through
how I think through it and also just
kind of trying out new things
this kind of CTF I think is particularly
fun and engaging because there are many
different iterations of it and you can
do all sorts of different kinds if
you're ever interested there is a
generator for this kind of CTF it's
called sec gen and you can go ahead and
look at their github it's pretty fun
they give you a tool that basically
builds these sorts of CT apps this one
we posted a link we can repost that yeah
you agree that's right so there's this
link and that is the kind of tutorial
that I follow to set up the CTF it's
fairly straightforward and simple
you basically just well go to AWS and
grab an ami for it fairly easy to build
pretty straightforward not too bad it's
a fairly straightforward CTF it's pretty
much beginner's CTF as far as this is
concerned yes like you should sit there
they're definitely like there's a large
I mean there's an almost infinite design
space there's a logistically infinite
one where they can come up with all
sorts of creative problems and things to
solve and the more of these that you
kind of look at and try to solve the
better you get at seeing them and
recognizing them in the future and as
Colton pointed out my first approach to
this looked like a buffer overflow but
that is probably not actually the right
approach and so that's a great example
of where the patterns that I've seen
before point me in that direction but
for someone who is maybe I never seen
that before or who knows this a lot
better than I do would not immediately
go there one should be like the simplest
answer I would imagine by it like
Occam's razor x' principle or the
principle of Occam's razor we would end
up at that solution so yeah so you're
welcome to go ahead and try these on
your own feel free to tell us how they
went next time I think we'll be talking
about Kali Linux will have an
exploitable machine out on the web and
we will go through how Kali can be used
to take together or take down a machine
like that I think is very fun okay folks
you may be unfamiliar cowlicks featured
heavily and mr. robot yeah just that
very very part of your show thing is it
all the time SSI uses it all the time oh
yeah thanks so much for coming on
Purdue's party having me it was it was
very similar to last one in the sense
but we also got more done the right way
yeah it did it correctly this time it
was so much more the representative look
at how a CTF is done legitimately this
is much more correct I'd say
legitimately in the sense of like we
approached it right
most people who actually do these I
think for like real time like
competitions they're a lot more
experienced than these sorts of things
and they tend to do more of them for
this sort of thing they would have seen
it before and/or be able to figure it
out for myself it's just kind of a fun
little exercise I think bad basic sanity
get to County Linux yes waiting for
quite some time thanks Colton I can't be
15th Dreamcoat at exact scratch
appreciate it and Babic says thank you
as well yeah this was episode 50 this is
pretty exciting that's cool
I was also environment the rebranding is
cool too I'm
you want to see I like that logo Allah I
didn't create that logo I have to shut
up production for making that logo but
it's nice it's clean and it's it's kind
of bold - yeah but this video a lot
let's go yeah thanks so much everybody
this is cs50 live not cs50 on Twitch
yeah and we not exclusively rebrand them
ok most likely watching this live on
Twitch right now but this is CPU live
Jonas on Friday it'll just be me I'll be
talking about jQuery which is JavaScript
library I mean just do Ajax requests you
can use it to manipulate the DOM and
cool ways you can do some animations
with it's got a bunch of functions that
we'll take a look at a bunch of them and
then next week you learn Kali Linux yep
and we're figuring out the rest of
schedule but I think on Wednesday I'll
be doing a text adventure and I don't
Friday we'll see that that we're still
working on the details for but thanks so
much everybody who tuned in this is for
you live 150 we'll see you all on Friday
whoops tonight so she's in the wrong to
the wrong slide all right have a good
one
stay safe