Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2629 Thanks!
[Music]
hello welcome to Stage
milliways uh today here are npace and
San pencil from Team organizers and they
[Music]
just they just came back from Defcon and
uh you'll hear a talk about attack and
defense uh capture the
flag have
[Applause]
fun
[Music]
[Applause]
sorry you good hey yeah perfect so hello
everyone um we're going to give a talk
about Capture the Flag so who here has
played a capture the flag competition at
least
once okay quite a few quite a few so who
of you has ever played attack and
defense
CTF oh still quite a lot of people so
who of you have ever been confused or
lost the first time they played an
attack and defense
CTF okay so still quite a few people
okay so basically this talk for is for
you for these people so um we play CF
with organizers um we have been playing
CF to together for a few years now since
about 2020 I've been playing longer than
that before with like different teams
and uh we got like yes last year we got
first place in the world ranking and
when we started out we were really
terrible attack and defense uh over the
years we gotten like less terrible and
we learn a lot of things uh we have been
playing for some time now so what we
wanted to do in this talk is to give you
about a short introduction to what a CF
is for everyone else in the audience who
hasn't played uh we will show you how we
play attack and defense in CTF and
overall we would like to give you an
idea of what we would have liked to know
when we started with attack and defense
and then at the end there's going to be
some fun stories so let's get started uh
so first of all uh for those of you who
have no idea about t defense this is a
bit of a short introduction so what is
this and CTF in general so a CTF stands
for capture the flag and it's a hacking
competition the goal of the competition
is to uh basically hack computers which
are set up on purpose with vulnerable
software and steal some secret data from
these computers uh um and the secret
data you have to steal is called a flag
and um which is this is where the name
of the competition comes from it's
Capture the Flag because you have to
hack computer steal flag um and a flag
is basically something like this it's um
some data uh usually has some
recognizable format for example in this
case there's some prefix that lets you
identify this as a flag and then the
rest can be anything like sometimes it's
random data sometimes it's like somebody
puts something meaningful in there but
the important thing is that it has this
like identifiable thing that let you as
well as machines figure out that this is
a flag and not something else now um
there are two types of CTF jery CTF and
attack and defense CTF uh so jery is by
far the most common type and this is
what most people will have will be
familiar with if they play CTF at least
once we have a jery CTF going on right
now at the camp so if you're interested
you should go play uh ATT it's over oh
never mind too late sorry but um and
then uh in ja CF the way it works is
that uh the the team that organizes the
CTF sets up the computers that that run
the vulnerable software and then every
team attacks the same computers and
everyone has to capture the same Flags
so it's like kind of um yeah everyone
competes against everyone but like they
don't hack each other and uh each each
Challenge in a jery CTF is worth some
number of points and then once the
challenge is solved you get the points
and at the end uh the team that has the
most points wins so it's pretty easy so
you solve the challenge you're done with
the challenge you move on to something
else uh attack and defense on the other
hand is pretty different uh this is the
type of the CT of CTF that this stock
will focus on and um in this case rather
than everyone attacking the same
computers everyone is trying to attack
everyone else so it's like um a lot
different uh unfortunately they're also
a lot less common because um playing an
attack and defense CF is much more
confusing much more difficult requires
much more preparation but also
organizing attack and defense CF
requires much more preparation so
because then you have you don't just
have like you know a bunch of service
Services running on some computer you
actually have to set up a network
connecting all the players and every
player has to have their vulnerable
machine and it's like a ton more setup
and it's like a lot harder so um the
setup is that uh every team will have
their own machine called a vul box so
vulner vulnerable box vul box for short
uh where all of these Services run and
every team can talk to every other
team's Vol box and the flags are on the
team's Vol box and the idea is that as a
team you should like find bugs in the
services that run on every everyone in
the v box everyone runs the same and
hack them and then steal the other teams
flags and at the same time prevents the
other teams from stealing with flags so
it's like yeah you you're directly uh
attacking other teams and other teams
are attacking you and you're like trying
to you're sort do incident response in
real time or at the same trying to hack
everyone else so um the way this is set
up normally is that uh every Vol box has
a number of services like so programs
running on this machine and uh every one
of these Services communicates with the
game network uh over UDP or TCP so that
other teams can interact with you and
then uh every service has its own set of
flags like uh we saw before what the
flag is uh in this case every service
has distinct flags that uh you have to
steal by attacking that service and the
interactions with the services typically
Works in a way similar to this um so the
service lets you a client create uh
create some kind of account or like in
some way stores some kind of secret data
in this case we see that this is could
be like a web service that lets you post
things like in a blog I don't know and
um in the client is creating a secret
post that only they can see uh and the
content is some secret and then only the
client is allowed to see the secret if
somebody else tries to access it they
will get like some permission Andi um
permission denight error so uh the goal
of the CTF of course is like that there
are bugs in the services so every
service has some bug I don't know like
sequel injection or like buffer overflow
whatever like can be really any anything
and so the goal of all of the teams is
to find these bugs and then exploit them
to get the other teams plags from their
V boxes so in practice it could look
something like this so say that our blog
service has some kind of SQL injection
and you submit a SQL injection payload
and you use it to get out all of the
post including the secret ones and so
you steal the team's plugs okay so this
is like kind of the high level overview
and um uh so the goals that we've
established uh for you as a team are as
follows so first of all you have to
steal the other Flags pretty clear right
you just exploit the bugs and then steal
the flags number two you have to defend
your own Flags uh so uh you have there
are bugs and you have to prevent the
other teams from exploiting these bugs
and stealing your flag somehow now you
might be wondering okay well um since we
we said that you have every team has the
B Vol box and by the way the teams have
full usually have full access to the Vol
box so they have like root on it and
everything so can't they the team just
like you know shut down everything and
then nobody gets hacked
well I mean yes uh the thing is that if
everyone did this and if it was allowed
then this would make for a very
uninteresting challenge because simply
everyone takes their services offline
and no one nobody has anything to attack
no Stu no flx to seal no fun and of
course this is obviously like not
possible so um what most CTF in practice
do is that they add the third goal third
goal is that you have to keep your
services running and functional and this
is called like the SLA goal because uh
it's uh supposed to resemble I guess
like in the real world where you're
running some service and somebody's
paying you for this service you have an
SLA which means that if you the service
is down you get penalized for it and
this is the same in defense CTF so uh on
top of stealing uh flags and Defending
Your Own Flags you also have to make
sure that the services that let the
vulnerable Services keep working as
intended and that doesn't mean that they
have to also keep work like the bugs
have to keep working just the service in
like for example going back to our
previous example uh um you have to have
like if somebody submits uh some secret
data and secret post they have to be
able to C get it back so um if you for
example patch the service so that like
the last request doesn't actually return
a flag it just returns an empty response
then this would be normally be an SLA
violation because you yes you made it
impossible to steal the flag but also
you made it like you made the service
not work anymore so this is like you get
penalized for this and so the Checker is
a system that is part of the CF
infrastructure that enforces this rule
so it's a bot that will regularly
connect to every service on every team's
V box and test that is still works
properly so uh in this case like you see
that the Checker is you know creating
account creating a secret post that
contains a flag and then try to read the
flag back and if the actually receives
the flag then it means that the service
is working and if it's not then the
service is not working and the team is
going to get penalized uh so
um the other thing the Checker also does
something else that is really really
important for the game which is that as
you can see here actually it uploads
Flags to the to the V boxes so at the
start of the game The V boxes don't
actually contain any Flags the V box the
flags are added periodically by the
Checker when it connects the to the
challenges and test them so it does like
both things at once both test that the
challenge works and make and uploads the
new Flags uh like that so um yeah and
the thing is that unlike so the main
difference in this case is that unlike
in geopy where there's one flock per
Challenge and once you solve this
challenge like the the flug is gone and
you just move on to something else in a
andd uh you typically have to keep
exploiting the service every service
over and over and over so that every
time that the Checker uploads a new flag
to to some other team you steal the flag
so it's like a bit different you just
have to keep working on the challenges
throughout the
match uh and then of course like you
might ask yourself well okay I have this
game network and I don't know suppose
that I am team one and uh like and the
Checker has this like IP that only the
Checker uses and how can can I not just
like set up a firewall rule that just
drops every connection except the
connections from the server it's from
the checker
well obviously I mean if you could do
that it will also be like really
uninteresting because then every nobody
can attack anymore so uh the way that
this is solved is that uh the game
network has a router that's um where
that every teams all of the traffic sent
by the other teams go through and uh
this router does Source not so when you
receive traffic from the game network uh
it looks like all the connections are
coming from the IP address of the router
so that in practice unless you can
somehow like fingerprint the Checker by
looking at I don't know the user agent
or some other stuff you're not supposed
to be able to tell that a connection
comes from the Checker versus from
another team so so yeah this is
basically like uh this is kind of the
setup all right so this was like a bit
of an introduction now uh suppose we are
imagine that you're playing an attack
and defense CTF the CTF start and know
what we do well okay first few things to
keep in mind time time is thing number
one in attack and defense CTF it's very
hectic and unlike in geopy like in geopy
if you solve a challenge right at the
start of the CTF or if you solve at the
end of the CTF it really doesn't matter
that much because uh at the end of the
day you always get the same number of
points it doesn't matter if you so like
if you get the first blood or not like
some jery ctfs do have first Blood
bonuses but it's kind of frowned upon
because uh it really doesn't like it's
really bad if it happens when you know
your team is asleep because uh it's like
and some other team is away because
you're in a different time zone so in
practice nobody really does that uh and
so in jery doesn't matter if you're like
too fast or too slow as long as you
solve something it's good uh on the
other hand an attack and defense the
first team that solved the challenge uh
typically has a big advantage over
everybody else well be and that's mainly
for two reasons well first of all that
you're essentially surprising everyone
because if you're really fast at finding
a bug and exploiting it uh there's good
chance that none of the other teams have
found the same bug that you did and so
they're unaware of it they haven't PCH
so you just like exploit everyone get
everyone's flag and then you keep doing
so for the entire game like many often
it just happens that some teams like
just never PCH a certain buck so you
keep just keep farming them throughout
the game for points and it's it's pretty
good uh so um and again if you patch
quickly you're also going to prevent
you're going to get a lot more defense
points because you're going to get all
prevent all the other teams that are
exploiting from stealing with flux So
the faster teams to exploit the bug and
to patch the bug typically is the team
that wins uh and so like again keep in
mind time is King be fast as fast as you
can and importantly um often attack and
the first services are um they they
typically have some low hanging fruits
like usually there's at least one bug if
often even more than one bug in each St
in different service and many of them
are like pretty easy to find like for
example if you see that there's I don't
know a service that has a SQL like web
service that has a MySQL databas as back
end like you should immediately start
looking for you know like trivial SQL
injection where to like concatenate the
strings or like it maybe you should try
to see if the the database server has
some default password or things like
that so like my advice is like
immediately start looking for the long
game fruits because uh this is going to
pay off and then the other thing that is
really really important is collaboration
so C CTF in general is a team sport but
I think a and is even more of a team
sport than jardy so the thing is that in
jery in a jardy CTF it will have 20 plus
or maybe even 30 plus challenges and
then uh you might have like one two
maybe three people working on the same
Challenge and everyone like kind of work
independently and they're work in
isolation in a andd on the other hand
you will have many fewer Services maybe
like five six like not that many and so
for a team of the same size you will
have uh many more people working on the
same service and uh you will have things
happening all the time because you don't
just have to work on exploiting the
service like in jery you also have to
check if anyone is exploiting you try to
steal their exploits make sure that your
patch has wor like you tried to patch a
service but also make sure that your
patch worked and you're you're not
losing SLA points and maybe somebody
founds a Doss and like brings your
service down by like exploiting I don't
know crushing your service service and
then you lose the slay points you have
to patch that as well and so it's like
many many many many things going on at
once and it's really really important
that uh you communicate what you're
doing to the rest of your team so uh you
will have many more people working on a
single service and it's important that
if somebody just like you know um just
join the CTF late they don't have to uh
have somebody explain the service to
them and like take this person away from
the service so uh my advice is write
down everything everything everything
everything you find about the service
anything that you've done like all of
the patches that you wrote try to write
everything down so you can use uh you
can just like use a chat like chats like
RC or Discord like we we use Discord a
lot and it kind of works for us but we
also use uh dedicated tools for this
like CTF note so CTF note is an open
source tool that uh lets you is
specifically designed to share notes
during a CDF it lets you like create a
task and then you can have markdown
notes uh on about the task like using
HCK and D or something like that and we
use that as well it works pretty well
like but yeah you can use whatever tools
you want the important thing is that
everything is written down and is
communicated to the entire team because
it's also really important so what do
you get at the start of the CTF so you
will get access to the game network
which means you can connect to the
network typically it's going to be
through a VPN or if you're playing an
onsite CTF you're going to actually get
like an actual ethernet cable that lets
you connect to the VPN you will get the
the Vol box uh and you get typically get
root access on the Vol box not all ctfs
do this but typically you do and and uh
you will have some way to submit the
flags you steal from the other teams and
this is like typically some API where
you can submit the flags and then if you
submit a an actual flag and not just
something fake you'll get points um so
try to figure out at first what are you
even running because uh in jerd you if
you ever play a jery CTF there's
typically some files you can download
and then you look at the files and you
kind of know like what you're doing on a
andd no you just get like the V box you
might there might be like a list of the
names of the services but you don't know
like what is running you don't know what
ports or protocols the services use like
it could be TCP UDP HTTP like some text
based protocol TLS you just don't know
you have to find out and uh so try to
figure out what ports and protocols the
services use you need to figure out
where the code is where the binary is
for each service so that you can patch
it or you can like look at the code and
try to figure out what it's doing and
then you need to try to eventually you
also need to try to figure out what the
services do so that you can you know try
to find bugs exploit the bug fix the bug
okay so this is a lot of things and like
not all of these things are easy like if
you want just want to see I don't know
what ports uh what ports are open on the
V box you can just use something like
net stot or SS something like this but
then um like for example what do the
services do like this is kind of hard to
figure out sometimes so um an important
part of playing andd is to have the
right tools and so we're going to now
we're going to talk a bit more about
what tools we use what the ones we think
are important what they do for us and uh
we can yeah give you some advice on like
what tools you should try to prepare for
an so the first thing like most
important thing the single most
important thing that you should have
like if you are not going to have any
other tooling please have this is some
kind of uh traffic analysis setup now
this doesn't have to be very complicated
like the simplest thing you can do is to
Simply run TCP dump on your Vol box and
dump all TCP and UDP traffic in some
peup files and then open it in W shark
now this is like really easy it's also
not that great because uh so wire shark
is uh not really meant to give you an
overview of I don't know like I mean yes
it can show you an HTTP session and show
you that yeah this thing made this
client made a request but it's also like
really low level it's show it will show
you a lot of noise that is not really
needed like for example that there was
TCP packet and like this is the size of
the TCP window and all of these things
and I mean this is not really very
useful for attack and defense it also
doesn't really support having opening
multiple pickups at once and if you run
TCP dump in a loop you typically only
save like I don't know one pickup a
minute and then generate a new file and
then also there is no way to generate
interaction scripts uh which basically
means there's no way once given a a um a
pickup that contains some client
interacting with one of your services
there is no way to automatically
generate a script like a python script
that uh replicates this interaction
between the two Services which is really
really useful if you're trying to attack
somebody else like just to have a basic
interaction script so where sh can work
not great though uh so what we would
like from a our ideal traffic analysis
tools is something that will show you
traffic by service ideally run request
at a time as we saw before um ID CTF CTF
services are typically like the request
based to some extent like uh in the
previous example we had a web service
but it could also be like a text base
interface where you just tell the
service do this thing and then the
service replies so you would like to see
one request at a time you'll be able you
want to be able to search the traffic
for pattern
like uh we saw at the beginning of the
presentation that Flags usually have
some kind of recognizable format that
tells you this is a flag and one of the
things that you will do very often is to
try to search for your traffic uh for
requests containing the flags for
example ER if you see that there is a
connection where somebody um you know
doesn't submit any Flags but then
receives a flag this is likely somebody
exploiting you right so uh you want to
be able to spot this connections quickly
and then the other thing is it lets you
replicate exploits quickly so if you see
somebody attacking you
uh you ideally like this tool should
have some button that gives you a python
script that replicates the exploited
just attacked you so that you can use it
against other teams so uh this is like
the tools traffic analysis tools that we
tried there's a few uh so the first one
we tried is aremy which is I think was
used to be called molo now they Chang
the name to aremy this is not really
designed for specifically for CTF it's
more of a general traffic analysis tool
that is meant for like I don't know uh
threat detection things like that it can
work uh but I think it's also not the
Great great because uh for example it
has no way to to do um to do replication
like has a bunch like you need to run
elastic search which is kind of annoying
to do uh and so on um and then so you
can use it I just wouldn't like
recommend it we it didn't work very well
for us and then the others are pikaa 2
uh which is um written specifically for
attack and defense ctfs works pretty
well and then flower and tulip so flower
was written I think many years ago by U
like another team and then tulip is a
fork of flower made by like some of our
teammates
uh some of which are in the audience so
thank you they they forked flower and a
lot added a lot of improvements and then
uh they used it for when they were
playing in the ICC the international
cyber security competition and we
decided to well that we should use this
as well it's open source like anyone can
take it and use it and we think this is
like this is the kind of the standard
tool that we useing nowadays works
pretty well so here's like some
screenshots of the things that I talked
about before like in tulip you can see
on the top there like a the thing where
it says trademark that's uh a drop down
menu that lets you select a service uh
you can see on the left that there's a
list of requests that were made to a
service some of them some of them are
tagged as flag out or um or enemy uh and
these are tags you can assign like you
can uh add rules so that it will auto
tag your traffic for example with flag
out it means that uh this like somebody
attacked you and like a flag came out or
maybe the Checker requested the flag so
you can like do all this like advanc
searching and then on the right side you
uh can see the data contained the
request in this case we can you can see
that the
HTTP and a very good feature of tulip is
that it lets you replicate exploits
really easily so in this case you can
see this like this is the HTTP request
from the previous slide you can see it
just like you know HTTP if you open if
you click on py on the python request
view it will show you give you the
python code that will um basically make
the same request now this sounds like
you know you could write this code by
hand of course but as we said in at the
beginning of the talk time is King so
you don't want want to waste time
writing the same thing by hand so having
this and being able to get a python
script that replicates uh your like some
what traffic somebody sent you
automatically is really good uh and this
doesn't only work for HTTP it also works
for text based things like so in this
case you can see that this service is
like just a text interface over TCP and
uh there's a button called copy as pone
tools so for those of you who don't know
or who have not placed CF Pon is a
python library that basically every uh
CTF team should know and use and it has
many many functions but in this case
what matters is that it has functions to
let you uh communicate with remote
Services over TCP over this the text
based interface it's kind of like the
standard like everyone uses this and
being able to copy text based traffic as
Pawn tools is really useful because you
can then like do the same use this as a
basis for your
exploit okay so like this is it for
traffic analysis like use tulip it's
open source if you want to send like
send some feature requests I think uh
will be more than more than the authors
will be more than happy to to take them
and yeah so that's one thing other thing
is that of course you have to get
yourself connected to the game network
so you might have uh you know like
Services you want to be on the game
network and also your players probably
also want to be on the game network and
uh so the thing is that um I high what I
highly recommend doing is to run your
own VPN server and then connect that
server to the game network and then root
everyone's traffic through your game
server now why should you do this well
first of all if the CTF is on site often
what you get is just one ethernet cable
one ethernet cable for the entire team
and so if you have if the CTF allows
remote players you want those players to
be able to connect to the game network
uh even though you and they they cannot
possibly do so directly so you have to
set up a VPN server for them but even in
online ctfs where you do get VPN
conflicts that everyone can use you
often get a limited amount of VPN
configs like a li limited amount of VPN
credentials so
uh and in my experience like uh if you
have few enough players you can try to
share those between players but it
always ends up in like being really
messy because you have to make sure that
no two people use the same configur
wiard configuration and and so on and so
I just recommend not doing that and
instead having your own VPN server that
way it just like become everything
becomes a lot easier so um set up your
own VPN
server uh now okay suppose that you have
you know looked at the service you
reversed it you find you find a you rate
an exploit and this exploits can get
flags now what well first of all some
things about Flags is that the an attack
and defense CTF runs in ticks and a tick
is a time time interval of 1 to 5
minutes every tick the Checker will
upload new flags and then after a few
ticks that have been uploaded these
floods will expire they will not be
considered valid anymore so if you steal
a flag that is too old it just wasted
effort so uh what you have to do is that
you first of all you uh you don't only
want to run this against one team you
want to run your exploit against every
single team in the CTF as we said before
there will be some teams that never PCH
there will be some teams that just like
I mean they either cannot be bothered or
they just don't have enough time to PCH
everything so um like in every single
City have a play there was always
somebody who had like who there was
never a time where everyone had PS
against some exploit except uh unless it
was like very late in the CTF so always
run everything against everyone unless
you really know that everyone is pouched
but even then somebody sometimes people
revert their Patches by accident so
never SE ever uh and um if you're early
you'll take uh all all the teams are
surprise and they will not have patched
so you will get a lot of flags even if
you're not early again people don't
patch so just like keep running your
exploit and you don't also don't want to
run the exploit only once as we said
before Flags get reintroduced all the
time so you should run it over and over
and over and over again like every every
tick ideally and uh this is like already
starting to be like quite a lot of code
like you know keeping track of which
teams exist and I connecting to a team
and then rerun the exploit and this can
be like quite a lot of boiler plate so
uh you don't really don't want to have
to reimplement this every time you write
an exploit so you should have some kind
of framework or tool that that does this
automatically for you and we'll show you
what we use later so but I mean keep
this in mind um also another
consideration is that sometimes exploits
uh so you have if you have a CTF with
100 teams which can happen sometimes you
will have 100 instances of every exploit
so this can add up to quite some
resources except if the exploit is like
CPU intensive or Ram intensive so you
probably also want to have some machines
that you just use to run the exploits
and then also you have to submit the
flags so as I said before uh the CTF
gives you some kind of API that lets you
submit the flag that you stolen from a
different team so Al you will also need
to implement the submission protocol in
your exploit like uh and usually it
needs some kind of authentication and
then you need to make the request in a
specific format and then it will tell
you if the flag was like valid or not
valid and and again you don't really
don't want to waste time doing this
every time you write this exploit so how
do we do it well we basically use a tool
called destructive farm so this is a
open source tool that we didn't make
like somebody else made it and put it on
GitHub and we just like um saw it on
GitHub when we started using it a um we
have our own Fork of this like our own
private fork with some improvements
which we call destructive Ranch but like
I would say that the curve functionality
is like mostly the same uh so the way
this works is that uh you route your
exploit as a python script that takes
the IP address of the team and then has
to print like it does stuff and run Farm
doesn't really care all all it has to do
is take the IP on the command line and
then print print flags and then uh on
ond out and then you will run the
exploit using a c a farm client which
will like automatically respawn your
exploit every every time there's a new
tick it will like automatically spawn
one instance of the exploit per team it
will like kill it if it takes too long
it will like do all of this for you you
just have to like basically print the
flags and then when the client sees that
your exploit has printed a flag it will
submit it to the destructive F to
destructive Farm or Ranch server which
collects all of the flags from your team
you can have like exploits running on as
many machines as you want like they can
be on a teammate's laptop they can be on
like some VPS somewhere that has a lot
of cores it can be whatever as long as
they can connect to your to the server
it will like submit the flug there and
then the the server will implements the
game submission API so basically like
this kind of obstruction layer between
your exploit and the flux submission so
it will if the and it will also do
things like if the for some reason the
flag submission Server doesn't work it
will like retry to submit later and like
does all of these things for you it
works pretty well um yeah so again
advantages of of doing it like this is
that you don't have to reimplement uh
the retries and resubmission and like
running against every team and every
exploit and you have can run the
exploits anywhere you want it doesn't
have to be on like some server you can
just like run it whatever uh some
customization we added to this is that
uh we uh added some dedicated machines
that uh we only use to run exploits we
call these the exploit farms and we
added some features to the web UI that
lets you simply upload an exploit as a
python file and then this gets scheduled
on one on one of the Farms of you're
choosing and then simply runs it like
for the rest of the CTF uh so the
advantage of doing this uh as opposed to
running your exploit on your own laptop
is that well first of all if you like
fall asleep on your desk and your laptop
like dies because it run out of battery
the explo will not start running that's
if somebody opens the web UI they can
see a list of all the exploits that are
running there and then third that if
your exploit uses a lot of resources we
can schedule it on a machine that has a
lot of CPU a lot of RAM and not like
make your you know laptop die because
you had too many Chrome tabs open as
well as the exploit uh we also have some
monitoring like you can see here like I
don't know this is how many flags will
be submitting every tick and so on and
yeah and yeah um also you we already
introduced like quite a lot of
infrastructure like you know farm and
like the the the exploit servers and the
VPN server and all of these things like
tulip whatever
exploits uh so you probably don't want
to like lose time at the beginning of
the CTF by setting up all of these
things by hand like if it's just one
service it's okay but when it starts
being four services that have to be up
it's quite a lot of work and again time
is king So you you need to automate this
and what we use to automate is a
terraform and anible so terraform is
basically something that uh calls a
cloud providers API to um create VMS
create uh private networks create
everything thing and um which is very
useful for just like creating your infr
cloud and then anible is a tool that
then configures the servers for you so
Anil basically uh it's a tool that lets
you run arbitrary commands on any
service that you can s any server that
you that you can SSH into so you say you
say I want you to do this and this and
this on this server on this server or
this many servers and this will like go
on SSH to the servers and do it for you
like the reason why we chose to do
anible is that like there are many
alternatives to it but the reason why we
like it so much is that uh first of all
it works with anything that supports SSH
it doesn't matter if it's a cloud VM
physical machine like anything and it's
pretty flexible and it also works really
well with uh onsize ctfs where we have
like actual physical machines and we
cannot rely on like a cloud provider to
run the scripts for us and yeah and then
also you can have some monitoring I
think this is not like super critical
but it can be nice monitor your infra
monitor the start of the game and we use
grafana for this because it basically
supports showing anything that is in a
database and it's pretty good we the
camp has a graph dashboard which I think
is really cool but yeah we use the same
as well okay so uh now we talked about
the tools we talked about how CTF work
works I will give uh Luca the stage so
that he can talk a bit about andd
tactics so go look
[Applause]
out thank you can you hear me yes
perfect so okay now uh you know how to
basic basically play ad uh let's talk
about now how do you win ad right what
are the strategies uh that you should uh
Implement uh we'll go through them in
order of
priority um some of them are fair to
other teams some of them are not um
let's get into it so uh what should you
spend time on first of all uh the most
important thing is look at traffic use
your traffic analyzer right this is the
most important tool in Your Arsenal to
understand what is going on again ad is
very hectic it's very messy there are a
lot of services looking at traffic is
gives you the status of the game right
um not only you can uh detect when
you're getting exploited and you look at
what are the attacker is doing against
your service but you can actually
understand how a service works just for
example looking at the Checker what is
doing right instead of looking at the
source of a service sometimes it's much
faster to look at okay what requests
does the Checker do like what is the
login flow what actions can can it do
and so on and so
on directly related to look at traffing
uh the one of the most important things
vital to winning it's uh the following
stealing exploits right uh as a very
famous as a very famous painter once
said um good duckers get inspired but
the ones who win really steal right and
this is so important right we never saw
a team winning without doing this right
uh the reason is uh usually you have a
lot of services with a lot of
vulnerabilities there is no way you have
enough manpower to just exploit all of
them right you will always have one
service that you didn't really look at
right but if your tooling is good enough
you can just replicate exploits you know
and
Ste uh next up if you cannot really
steal exploits you have to find them
yourself uh annoying I know very
boring uh but uh again this is necessary
to win uh focusing on attack is usually
more important than focusing on defense
it depends on the ad how the scoring is
but in general uh attack points are
worth more if you manage to exploit
every single other team this is more
important than defense uh there are a
few uh important things to keep in mind
when trying to find
exploits um the most important one is uh
there are more than one vulnerability
per service and uh the difficulty is not
the same very often you have low anging
fruits and you should absolutely focus
on them do not look for the cool
exploits look sorry look for the easy
ones look for the fastest you can
Implement do not worry about the
Elegance or how fascinating one exploit
is just get the flag as fast as possible
uh also keep in mind the last point is
PR important uh whoever organized the
CTF will maybe plant five bugs in the
service um but in truth there will be 15
probably right and the unintended ones
are usually the best because they're the
stupidest and so keep an eye out for
them then uh number four uh is
coordination uh Team sizes nowadays are
large and uh managing a team of hackers
is not easy
like um what you want is that the the
main problem in ad is tunnel vision
right people will focus on a service try
to write an exploit and uh do not really
be aware of the main status of the game
where we being exploited what do we need
to patch it's very important that you
need at least one person that acts like
an overseer right looks at the
scoreboard looks at the traffic and
doesn't do anything else and just tells
people okay now you stop doing whatever
you're doing and replicate this exploit
or patch this
service even more important is infra
people by infra mean tooling right you
need at least two people possibly more
that are able to fix whatever breaks
your tooling uh this happens every
single time we never had a CTF where our
tooling didn't break for some super
weird esoteric reason and you want
people that are very familiar with the
tooling possibly the developers of the
tools itself can Hot Patch them as fast
as possible because if your tools go
down uh basically you your tee also goes
down then next up is defense right and
uh here you need to patch Services um
and um patch the bugs here is very
important that you forget everything you
know about uh good software practices or
root cause analysis or whatever your
priority here is to make the exploits
stop working right the fastest you are
the better it is so for example you
notice that some team is exploiting a
use after free whatever right and
instead of doing um what is the weird
condition that enables this use fre
something that works is maybe just
modify the hip layout a bit just add a
few mocs here and there right this will
actually break the exploit and you're
good for a few ticks you don't care
right um a good technique is to use your
own checker because because uh uh your
patches might break uh SLA service level
agreement so it's kind of important that
you are aware that whatever you're doing
doesn't break the intended functionality
right uh next up if you really cannot
patch Services you can at least Harden
them uh this depends on the setup of the
ad uh some ctfs gives you more freedom
on the wound box for example uh Defcon
usually does not but some some other
they give you root on the w box and you
can do all kinds of shenanigans to break
exploits right for example you can
recompile your services with other
sanitizer so you prevent memory
corruption triy right you can for
example remove B this works very well I
don't recommend to do it because half of
the binaries in your system will stop
working but it's a technique you can go
for the fancy stuff second cinux up arm
more whatever uh something extremely
unfair is Checker detection you might be
able to determine when the Checker is
using your service compared to other
teams right you cannot determine it from
the IP but maybe there is some peculiar
characteristic in the request it does
right um so what you do is you can clone
the service and serve to other teams uh
a clone service with fake flags for
example Flags you just randomize right
this work works extremely well because
the other teams cannot do anything about
it it's very unfair but when when you
pull it off it's
amazing um then uh vectors right when
you exploit a service uh you don't want
the other team to patch it right away
right and this really depends again on
the 8 do you have root or not can you
pop a shell or not but sometimes you can
actually plant
vectors and uh steel flags for every
tick even after the service is patched
uh those are one of the best techniques
if you can pull it off pay attention on
make make your vector hidden uh pay
attention that other teams to not
reverse your vector and use the Bor you
planted on other teams this also
happens uh in fact very linked to this
point is uh masking your exploits so
when you have an exploit especially if
it's a trivial one if it's an easy one
uh you want to prevent the teams you are
attacking to uh trivially patch it or
steal steal it right right so uh for
example one uh very common technique is
to encrypt the flag before you send it
to to yourself right as soon as you read
it you encrypt it with an RSA key or
whatever so it doesn't appear
immediately in the traffic analyzer of
whoever you're exploiting and the other
teams cannot reflect it because they
need to change the key you're using to
encrypt it so they're going to waste
time reversing whatever you're doing to
hide your exploit and so on and so on
and this works pretty well you can waste
even one or two hours on other team if
you prepare the encryption
beforehand uh lastly if you're really
out of ideas on what to do during an
attack defense some teams uh think that
uh this uh AAL strategy uh submit gar
garbage to other teams submit something
that looks like it's throwing out of
flag when it's not and uh you will waste
time of whoever is analyzing the traffic
I was victim of this many times is very
annoying and uh but yeah this is only if
you have nothing else to do uh finally
uh one last thing that can have a slight
advant Advantage is to anonymize
yourself do not make other players aware
of who you
are uh this usually might be because uh
you might have beef beefs against other
teams you might be targeted and so on
and so on so maybe you can play with a
different name or whatever uh but yeah
not super important this was the last
tip uh we're now going to go inside uh
Defcon specific strategies right why
because Defcon is a very peculiar attack
defense uh it's played in a very weird
location in Las Vegas and this spawns
a set of new problems that you will not
have in a normal ID for example the
location of where you play right um Team
sizes are large as I said last year we
were 30 this year we merged with sacloud
to play Defcon and we were about 50
playing the the attack defense part
right uh in Las Vegas there are no uh
office rooms you can rent there's no
conference rooms with tables uh there
are only hotels uh in fact uh you need
to rent a suite this is what every team
does a very expensive Suite um they and
you're going to need to play on beds and
couches and you're just need to get
creative um for example here you can see
our this is our closet battle
station also the the location is split
in two uh because eight of your players
will play on the CF floor uh you can see
there uh in which all the teams have a
table with eight players in them and you
get access to the game network with one
internet cable that comes out of this
table right so your VPN setup needs to
uh support that the players in your
Suite will send all the traffic through
the CF floor which goes through this
headnet cable and so on and so on and it
quickly becomes a huge mess in fact make
sure if you ever go there uh bring a
[ __ ] ton of networking equipment because
it's always a mess uh another problem is
internet uh hotels do not give you good
internet here you need to get creative
too right each team has this problem
every year there is no good solution two
years ago we bought 10 Sims with
unlimited data and uh we had a very
weird setup of uh uh a router that
multiplexed Connections in uh with three
phones the phones were stored in um in
our bathroom for some weird reason we
tried many suits uh a tip we can
recommend do not take a suite on a very
high floor because cell phone reception
is worse there and uh in all the suits
we tried for some reason the bathroom
had the best reception I don't know why
and so basically it turns out that uh
like in in the camp here the the the
toilets are the rooters actually uh last
year we had the quote unquote smart
fridge and uh you know where this is
going
so uh I had a slide for this year I had
to uh I had to censor it because
unfortunately this will go public and we
don't want to get banned from the hotel
but we can have this discussion offline
of what happened this year and uh yeah
finally uh a few things about Devcon
infra is very often down the the
organizers infra not actually ours uh
the network is terrible most of the time
there the only category is paone you
might get baited into crypto rev it's
only phone in fact your laptop will look
like this after
Devcon but uh yeah uh in conclusion key
takeaways we want you to remember attack
defense are very messy very dirty right
but they're also super fun they're super
stressful the adrenaline you get when
you replicate an exploit is um is very
fun uh tooling is what really makes a
difference if you want to get first
place you need to have the best traffic
analyzer there is no other option and
lastly yeah uh somehow uh the one of the
best ctfs is hosted in the worst place
so yeah that's it thank you very much
for your attention
[Applause]
many thanks uh npace and CN pencil for
your great talk and yeah give him
another round of
[Applause]
applause