OOO archive --- DEF CON CTF [ login ]

dc2021f - shooow-your-shell shellcoding finals

by zardus

This was a King-of-the-Hill challenge, part of dc2021f.

Points: 1,000

You may spawn the server:

On your laptop
  • Install docker
  • docker pull archiveooo/pub:shooow-your-shell (docker-saved download)
  • docker run -d --name shooow-your-shell archiveooo/pub:shooow-your-shell
  • Local IP: docker inspect shooow-your-shell -f '{{ .NetworkSettings.Networks.bridge.IPAddress }}'
  • Connect to that IP:9090 — Remember to docker rm -f when done.
On your laptop (full source)
  • Install docker and pip install PyYAML coloredlogs
  • git clone https://github.com/o-o-overflow/dc2021f-shooow-your-shell-public
  • cd shooow-your-shell
  • ./spawner --log-level=INFO
  • Connect to the ip:port displayed
Hosted by OOO Right now we're asking players to login first.

Description

sports

This challenge was part of the finals

During finals, scoring happens per-round based on attack (steal flags from others) and defense (patch the service to prevent others from pwning you) points. Patching is not currently simulated on the archive, but keep in mind that most services only allowed a limited amount of bytes to be changed from the original binary. Scoring rules for 2019 2020 2021.

King of the Hill points are also awarded per-round, with only the top-ranking teams getting points.

Teams were informed of game events, with redacted info on the last day. In 2019 players could see traffic pcaps only after some time, in 2020 and 2021 they had the choice the stealth their traffic or not (for half the points).

Can you out-shellcraft your opponents? Only the worthy will hold the hill!

The shortest shellcode we know of is just two bytes (!).


But this is not just a shellcoding challenge! Can you see a situation in which you'd overtake someone without actually having better shellcode than the latest?
That part is better done locally, so you can set different team IDs for yourself.

line_weight service.py line_weight shuffl line_weight runner-x86_64 line_weight runner-aarch64 line_weight runner-riscv64 line_weight banner_fail line_weight Dockerfile line_weight service.conf line_weight wrapper

Hints

Hint 1Could you build your shellcode in stages?
Hint 2Where could you read a second stage of shellcode from?
Hint 3There is no locking or synchronization, can you use that to your advantage?

If you wish, you can contribute more.

Source

Spoilers ahead! Code for this challenge is publicly available.