3 ms·
Hey, I played in that CTF! Although, I ended up spending most of my time pwning QEMU instead. There was an easier challenge, aptly named Easy Escape, in which t
by nneonneo 6y ago
Hey, I played in that CTF! Although, I ended up spending most of my time pwning QEMU instead. There was an easier challenge, aptly named Easy Escape, in which the organizers added a vulnerable memory-mapped device to QEMU. The device had the ability to read and write certain memory, so the exploit ended up being an attack where you triggered a memory operation which accessed the device's own memory - essentially causing the device's MMIO handler to recurse. That in turn set up a use-after-free situation which could be exploited for the win.
I love Real World CTF. In 2018 I participated in the finals round held in Zhengzhou, and there was a problem that involved Java and the RMI protocol. We ended up exploiting two zero-days in Java, reported them to Oracle and got a CVE: CVE-2019-2684. That was very exciting to me - to discover and exploit a bug in real software in less than 48 hours :)
Kudos to the VirtualBox hackers for doing that on such a high-profile bit of software - amazing work!
- freedomben 6y agoAre these CTFs recorded and/or streamed? It just occurred to me that would be really fun to watch.
- saagarjha 6y agoCTFs are not usually streamed, as that would give a leg up to other teams watching it :P Not sure if anyone records their work for later viewing, though.
- marcelm72 6y agoYou might like LiveOverflow 's video about playing the Google CTF finals hackceler8: https://www.youtube.com/watch?v=DGuRI_SPZYg https://www.youtube.com/watch?v=DGuRI_SPZYg
- J-Kuhn 6y agoJust a question: Do the organizers know about the security vulnerability? Where do they get the vulnerabilities from?
- WGH_ 6y agoLots of CTF organizers are security researchers. This particular CTF is organized by people from Chaitin Tech, which is a cybersecurity company. They emphasize that their challenges are based on real vulnerabilities (found in their research, I presume).
- WGH_ 6y agoThe QEMU task was likely inspired by a real vulnerability as well: https://mail.gnu.org/archive/html/qemu-devel/2020-09/msg00906.html https://mail.gnu.org/archive/html/qemu-devel/2020-09/msg0090... (discovered by CTF organizers, I think)