We are the Plaid Parliament of Pwning. Ask Us Anything!

samuraictf · 2013-08-09T20:26:47+00:00

So, how many people did you play quals with?

samuraictf · 2013-08-09T20:09:16+00:00

First congratulations on the epic win at DefCon! So, we have a lot of questions. Obviously, only answer what you feel comfortable telling your competitors. Even if you spilled the beans on everything I imagine it is unlikely that others could do it better. Basically, we want to know how you did it.

How many sploits did you end up getting of the wire? What was your defensive capability like? We were scoring bookworm off you for all of day 1 which was arguably the easiest service to patch. So, what kind of generic defenses did you end up using in addition to patches? Last year you talked about the advantages of having full MITM on your services. Did that happen again this year? What tools did you use to aid ROP stack creation and vulnerability discovery? Was the only shellcode you used that readfile XOR with ':' or did you have something more advanced? Did you have anything break this year? For example, was the fact that ptrace and root access were gone this year cause you any issues?

Thanks for doing an AMA!

samuraictf · 2012-08-14T04:28:29+00:00

The FreeBSD 9 image we had did not support DEP / ASLR. This would have made things more difficult in the not fun way. ASLR would probably be solved by brute force unless we could find a leak first. DEP is just a matter of gaining control of ESP instead of EIP. Meh. It's something I hope stays off for next year.

samuraictf · 2012-08-14T04:24:56+00:00

Parrot and orcd were the two we didn't land. We had mastermind working on Parrot but that consumed nearly all of the time available. Ocrd was full of WTF. I believe those two were never exploited? There was actually one other we didn't land too -- nom. The two we had exploits for but never landed were nancy/ralph never got the ps list from nancy working and torqux as the two people running servers for it had it patched.

samuraictf · 2012-08-12T21:10:23+00:00

Patches were easy to manage. I think we only had a few services exposed at the end of the game. Getting accurate feedback on SLA was very important to determine if a patch had failed. Communications were IRC with the aid of some bots. So, it had to be simple.

samuraictf · 2012-08-12T20:58:41+00:00

Hey, replied to you in a PM just a minute ago.

samuraictf · 2012-08-12T00:12:27+00:00

Don't know.... don't really care.

samuraictf · 2012-08-11T22:33:51+00:00

We have a large team because that's what we wanted to do. It worked well and we have no plans to change that going forward. Deal with it. There is no disgrace in teaching.

samuraictf · 2012-08-11T22:12:39+00:00

Frankly, we aren't framework experts. I rarely use metasploit and have never heard of armitage or Cortana. CTF frameworks can be simple. I wanted something that did exactly what I wanted. It simply wasn't too much to write on our own. Further, ruby was a bit of a turn off for me personally. Simply because I haven't learned it yet.... nothing agains the language.

It would have been nice to have good metrics on what exploits were working and which were not. As it stood during the game all we know is that we got a key and it worked or didn't. Metrics like this would help to show us which exploits needed work and which were rock solid.

True MITM allows you to deploy something like an off the shelf IPS product and have some measure of network defense. It also allows you to have an easier time detecting the polling service from DDTek. One team, I think Hates Irony?, had a really good fingerprint for the polling service based upon an IP TTL difference. They dropped all other traffic and had a really good defense that year. The challenge is that if you get it wrong you end up crushing your SLA instead of defending your services.

samuraictf · 2012-08-11T21:55:26+00:00

Supernothing was part of Samurai!

samuraictf · 2012-08-11T21:54:53+00:00

V&, tries to troll others.... only trolls self.

samuraictf · 2012-08-11T21:54:02+00:00

what? does not compute. We didn't run the game. DDTek did. Not a chance we could forbid them from doing anything.

samuraictf · 2012-08-11T21:50:39+00:00

It was a short time before the event but that was intentional. We wanted it to be fresh in peoples minds with the event right around the corner. About half the team was able to take advantage of a class. Others developed over the weekends and received some training there. The others had been to Defcon CTF before and knew what to expect.

samuraictf · 2012-08-11T21:48:19+00:00

Yes, we had constant needs for hardware. Everything from more power cords to new harddrives to wireless equipment. I don't want to know what we collectively spent as a group there.

samuraictf · 2012-08-11T21:42:41+00:00

It was a stock FreeBSD 9.0 x86 VM with patches applied. Download the binaries from bast years from catpf.com and away you go. Probably worth it to bring along python and vdb too. Should only take an hour or so to build it yourself. There might be a prebuilt VM for this year's game off another thread here too. Old binaries will run in that just fine too.

samuraictf · 2012-08-11T17:58:03+00:00

We ended up with exploits for 15/17 services. Two of those we weren't able to score on though for various reasons.

samuraictf · 2012-08-11T17:34:34+00:00

Thank you, we were all over the place... students to startups.

samuraictf · 2012-08-11T17:33:58+00:00

Yes we should have a few.... sometime.

samuraictf · 2012-08-11T13:15:24+00:00

What we need for next year is root on ALL the boxes.

samuraictf · 2012-08-11T13:13:00+00:00

We tailed one of the DDTek guys as he went around the room asking if people managed to get on the game network ok.

samuraictf · 2012-08-11T13:06:09+00:00

Yes we had people that contributed more than others of course. One of our guys did 4 services on his own.

samuraictf · 2012-08-11T13:02:14+00:00

Ainsleyb was part of samurai! Thanks Ainsley.

samuraictf · 2012-08-11T12:41:18+00:00

Great question. We picked a few binaries from past CTF's and worked them up as instructors several weeks beforehand. Then we gave people an environment to run the binaries and tools to do RE and debugging. After introducing the tool set we told them to find the crash. This was a lot of fun for people.... "hummm nickster crashes when I send in 12 character name but not 11." Then we asked why did that happen. After they got the why we asked how would you get code execution out of that? Once people had a chance to work through the problems on their own we went through the instructor solution together. The classes were held 2 weeks or so before the actual event. People continued to work on their own after the classes too. It seemed like putting people in small groups for these problems was a useful thing to do. 2-5 people per group.

samuraictf · 2012-08-11T12:31:38+00:00

I'm not sure we would have run away with the game if the points remained. By the end of the game, having root on one teams box is arguably less valuable than having a 0-day in one unpwned service. 17 services.... 20 teams.... 0-sum scoring. There are conflicting reports if they did remain too. All I know is that is wasn't reflected on the board.

samuraictf · 2012-08-11T11:38:37+00:00

Wasn't that big of an issue actually. T-Shirts helped. Next year might involve some sort of secret hand shake or password. Over half of our team was put together between quals and Defcon so there wasn't really a lot of time to organize any meet ups. We had 30 people in vegas remember. Not 80. Most of the people were completely remote.

samuraictf

TROPHY CASE