Challenge Information - CROMU_00046

Commonly known as: Hug_Game

Rounds Enabled

52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66

Details

Original Versions

Known Vulnerabilities

  • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Dustin Fraze" df@cromulence.com

DARPA performer group

Cromulence (CROMU)

Description

This is a challenge modelled after one of the author's favorite DEF CON Capture The Flag challenges - perudo, from the Kenshoto group.

Feature List

This service is a simple gambling parlor for the user. Upon connecting, the user is asked for a name and then given a selection of four games to play. The name is used to seed a PRNG. The games are:

  • Coin Flip
  • Hangman
  • Dice Roll
  • War

Vulnerability

The dice roll game stores the results of the rolls into a staticly sized array. If the player decides to play more than 16 rounds of dice, stack corruption occurs.

Generic class of vulnerability

Unbounded memory write

CWE classification

Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119

Challenges

This CB takes a "less is more" approach to proving vulnerability. The CRS will have very little control over the state of the application at crash - namely, the output from the PRNG is what is used to determine EIP and any other corrupted registers. Because of this, type1 proofs of vulnerability should be less straight forward than typical - instead of being able to use the function epilogue to pop corrupted values into preserved registers, a CRS will have to generate a payload which sets EIP to a sequence of instructions that points the stack into the name buffer, and then pops, for example.

POV Information

Round Source Destination Result POV Analysis Video
53 CSDS CodeJitsu Failed POV POV Watch
53 CSDS DeepRed Failed POV POV Watch
53 CSDS Disekt Failed POV POV Watch
53 CSDS ForAllSecure Failed POV POV Watch
53 CSDS Shellphish Failed POV POV Watch
53 CSDS TECHx Failed POV POV Watch
53 DeepRed CodeJitsu Failed POV POV Watch
53 DeepRed CSDS Failed POV POV Watch
53 DeepRed Disekt Failed POV POV Watch
53 DeepRed ForAllSecure Failed POV POV Watch
53 DeepRed Shellphish Failed POV POV Watch
53 DeepRed TECHx Failed POV POV Watch
54 CSDS CodeJitsu Failed POV POV Watch
54 CSDS DeepRed Failed POV POV Watch
54 CSDS Disekt Failed POV POV Watch
54 CSDS ForAllSecure Failed POV POV Watch
54 CSDS Shellphish Failed POV POV Watch
54 DeepRed CodeJitsu Failed POV POV Watch
54 DeepRed CSDS Failed POV POV Watch
54 DeepRed Disekt Failed POV POV Watch
54 DeepRed ForAllSecure Failed POV POV Watch
54 DeepRed Shellphish Failed POV POV Watch
55 CodeJitsu Shellphish Failed POV through defenses POV Watch
55 CSDS CodeJitsu Failed POV POV Watch
55 CSDS DeepRed Failed POV POV Watch
55 CSDS Disekt Failed POV POV Watch
55 CSDS ForAllSecure Failed POV POV Watch
55 CSDS Shellphish Failed POV through defenses POV Watch
55 CSDS TECHx Failed POV through defenses POV Watch
55 DeepRed CodeJitsu Failed POV POV Watch
55 DeepRed CSDS Failed POV POV Watch
55 DeepRed Disekt Failed POV POV Watch
55 DeepRed ForAllSecure Failed POV POV Watch
55 DeepRed Shellphish Failed POV through defenses POV Watch
55 DeepRed TECHx Failed POV through defenses POV Watch
56 CodeJitsu Disekt Failed POV through defenses POV Watch
56 CSDS CodeJitsu Failed POV POV Watch
56 CSDS DeepRed Failed POV POV Watch
56 CSDS Disekt Failed POV through defenses POV Watch
56 CSDS ForAllSecure Failed POV POV Watch
56 CSDS Shellphish Failed POV through defenses POV Watch
56 CSDS TECHx Failed POV through defenses POV Watch
56 DeepRed CodeJitsu Failed POV POV Watch
56 DeepRed CSDS Failed POV POV Watch
56 DeepRed Disekt Failed POV through defenses POV Watch
56 DeepRed ForAllSecure Failed POV POV Watch
56 DeepRed Shellphish Failed POV through defenses POV Watch
56 DeepRed TECHx Failed POV through defenses POV Watch
57 CSDS CodeJitsu Failed POV POV Watch
57 CSDS DeepRed Failed POV POV Watch
57 CSDS Disekt Failed POV through defenses POV Watch
57 CSDS ForAllSecure Failed POV POV Watch
57 CSDS Shellphish Failed POV through defenses POV Watch
57 CSDS TECHx Failed POV through defenses POV Watch
57 DeepRed CodeJitsu Failed POV POV Watch
57 DeepRed CSDS Failed POV POV Watch
57 DeepRed Disekt Failed POV through defenses POV Watch
57 DeepRed ForAllSecure Failed POV POV Watch
57 DeepRed Shellphish Failed POV through defenses POV Watch
57 DeepRed TECHx Failed POV through defenses POV Watch
58 CSDS CodeJitsu Failed POV POV Watch
58 CSDS DeepRed Failed POV POV Watch
58 CSDS Disekt Failed POV through defenses POV Watch
58 CSDS ForAllSecure Failed POV POV Watch
58 CSDS Shellphish Failed POV through defenses POV Watch
58 CSDS TECHx Failed POV through defenses POV Watch
58 DeepRed CodeJitsu Failed POV POV Watch
58 DeepRed CSDS Failed POV POV Watch
58 DeepRed Disekt Failed POV through defenses POV Watch
58 DeepRed ForAllSecure Failed POV POV Watch
58 DeepRed Shellphish Failed POV through defenses POV Watch
58 DeepRed TECHx Failed POV through defenses POV Watch
58 Shellphish CodeJitsu Successful POV POV Analysis Watch
58 Shellphish CSDS Successful POV POV Analysis Watch
58 Shellphish DeepRed Successful POV POV Analysis Watch
58 Shellphish ForAllSecure Successful POV POV Analysis Watch
58 Shellphish TECHx Failed POV through defenses POV Watch
59 CSDS CodeJitsu Failed POV POV Watch
59 CSDS DeepRed Failed POV POV Watch
59 CSDS Disekt Failed POV through defenses POV Watch
59 CSDS ForAllSecure Failed POV POV Watch
59 CSDS Shellphish Failed POV through defenses POV Watch
59 CSDS TECHx Failed POV through defenses POV Watch
59 DeepRed CodeJitsu Failed POV POV Watch
59 DeepRed CSDS Failed POV POV Watch
59 DeepRed Disekt Failed POV through defenses POV Watch
59 DeepRed ForAllSecure Failed POV POV Watch
59 DeepRed Shellphish Failed POV through defenses POV Watch
59 DeepRed TECHx Failed POV through defenses POV Watch
59 Shellphish CodeJitsu Successful POV POV Analysis Watch
59 Shellphish CSDS Successful POV POV Analysis Watch
59 Shellphish DeepRed Successful POV POV Analysis Watch
59 Shellphish ForAllSecure Successful POV POV Analysis Watch
59 Shellphish TECHx Failed POV through defenses POV Watch
60 CSDS CodeJitsu Failed POV through defenses POV Watch
60 CSDS Disekt Failed POV through defenses POV Watch
60 CSDS ForAllSecure Failed POV POV Watch
60 CSDS Shellphish Failed POV through defenses POV Watch
60 CSDS TECHx Failed POV through defenses POV Watch
60 DeepRed CodeJitsu Failed POV through defenses POV Watch
60 DeepRed CSDS Failed POV POV Watch
60 DeepRed Disekt Failed POV through defenses POV Watch
60 DeepRed ForAllSecure Failed POV POV Watch
60 DeepRed Shellphish Failed POV through defenses POV Watch
60 DeepRed TECHx Failed POV through defenses POV Watch
60 Shellphish CodeJitsu Failed POV through defenses POV Watch
60 Shellphish CSDS Successful POV POV Analysis Watch
60 Shellphish ForAllSecure Successful POV POV Analysis Watch
60 Shellphish TECHx Failed POV through defenses POV Watch
61 CSDS CodeJitsu Failed POV through defenses POV Watch
61 CSDS DeepRed Failed POV through defenses POV Watch
61 CSDS Disekt Failed POV through defenses POV Watch
61 CSDS ForAllSecure Failed POV POV Watch
61 CSDS Shellphish Failed POV through defenses POV Watch
61 CSDS TECHx Failed POV through defenses POV Watch
61 DeepRed CodeJitsu Failed POV through defenses POV Watch
61 DeepRed CSDS Failed POV POV Watch
61 DeepRed Disekt Failed POV through defenses POV Watch
61 DeepRed ForAllSecure Failed POV POV Watch
61 DeepRed Shellphish Failed POV through defenses POV Watch
61 DeepRed TECHx Failed POV through defenses POV Watch
61 Shellphish CodeJitsu Failed POV through defenses POV Watch
61 Shellphish CSDS Successful POV POV Analysis Watch
61 Shellphish DeepRed Failed POV through defenses POV Watch
61 Shellphish ForAllSecure Successful POV POV Analysis Watch
61 Shellphish TECHx Failed POV through defenses POV Watch
62 CSDS CodeJitsu Failed POV through defenses POV Watch
62 CSDS DeepRed Failed POV through defenses POV Watch
62 CSDS Disekt Failed POV through defenses POV Watch
62 CSDS ForAllSecure Failed POV POV Watch
62 CSDS Shellphish Failed POV through defenses POV Watch
62 CSDS TECHx Failed POV through defenses POV Watch
62 DeepRed CodeJitsu Failed POV through defenses POV Watch
62 DeepRed CSDS Failed POV POV Watch
62 DeepRed Disekt Failed POV through defenses POV Watch
62 DeepRed ForAllSecure Failed POV POV Watch
62 DeepRed Shellphish Failed POV through defenses POV Watch
62 DeepRed TECHx Failed POV through defenses POV Watch
62 Shellphish CodeJitsu Failed POV through defenses POV Watch
62 Shellphish CSDS Successful POV POV Analysis Watch
62 Shellphish DeepRed Failed POV through defenses POV Watch
62 Shellphish ForAllSecure Successful POV POV Analysis Watch
62 Shellphish TECHx Failed POV through defenses POV Watch
63 CSDS CodeJitsu Failed POV through defenses POV Watch
63 CSDS DeepRed Failed POV through defenses POV Watch
63 CSDS Disekt Failed POV through defenses POV Watch
63 CSDS ForAllSecure Failed POV POV Watch
63 CSDS Shellphish Failed POV through defenses POV Watch
63 CSDS TECHx Failed POV through defenses POV Watch
63 DeepRed CodeJitsu Failed POV through defenses POV Watch
63 DeepRed CSDS Failed POV POV Watch
63 DeepRed Disekt Failed POV through defenses POV Watch
63 DeepRed ForAllSecure Failed POV POV Watch
63 DeepRed Shellphish Failed POV through defenses POV Watch
63 DeepRed TECHx Failed POV through defenses POV Watch
63 Shellphish CodeJitsu Failed POV through defenses POV Watch
63 Shellphish CSDS Successful POV POV Analysis Watch
63 Shellphish DeepRed Failed POV through defenses POV Watch
63 Shellphish ForAllSecure Successful POV POV Analysis Watch
63 Shellphish TECHx Failed POV through defenses POV Watch
64 CSDS CodeJitsu Failed POV through defenses POV Watch
64 CSDS DeepRed Failed POV through defenses POV Watch
64 CSDS Disekt Failed POV through defenses POV Watch
64 CSDS ForAllSecure Failed POV POV Watch
64 CSDS Shellphish Failed POV through defenses POV Watch
64 CSDS TECHx Failed POV through defenses POV Watch
64 DeepRed CodeJitsu Failed POV through defenses POV Watch
64 DeepRed CSDS Failed POV POV Watch
64 DeepRed Disekt Failed POV through defenses POV Watch
64 DeepRed ForAllSecure Failed POV POV Watch
64 DeepRed Shellphish Failed POV through defenses POV Watch
64 DeepRed TECHx Failed POV through defenses POV Watch
64 Shellphish CodeJitsu Failed POV through defenses POV Watch
64 Shellphish CSDS Successful POV POV Analysis Watch
64 Shellphish DeepRed Failed POV through defenses POV Watch
64 Shellphish ForAllSecure Successful POV POV Analysis Watch
64 Shellphish TECHx Failed POV through defenses POV Watch
65 CSDS CodeJitsu Failed POV through defenses POV Watch
65 CSDS DeepRed Failed POV through defenses POV Watch
65 CSDS Disekt Failed POV through defenses POV Watch
65 CSDS ForAllSecure Failed POV POV Watch
65 CSDS Shellphish Failed POV through defenses POV Watch
65 CSDS TECHx Failed POV through defenses POV Watch
65 DeepRed CodeJitsu Failed POV through defenses POV Watch
65 DeepRed CSDS Failed POV POV Watch
65 DeepRed Disekt Failed POV through defenses POV Watch
65 DeepRed ForAllSecure Failed POV POV Watch
65 DeepRed Shellphish Failed POV through defenses POV Watch
65 DeepRed TECHx Failed POV through defenses POV Watch
65 Shellphish CodeJitsu Failed POV through defenses POV Watch
65 Shellphish CSDS Successful POV POV Analysis Watch
65 Shellphish DeepRed Failed POV through defenses POV Watch
65 Shellphish ForAllSecure Successful POV POV Analysis Watch
65 Shellphish TECHx Failed POV through defenses POV Watch
66 CodeJitsu DeepRed Failed POV through defenses POV Watch
66 CSDS CodeJitsu Failed POV through defenses POV Watch
66 CSDS DeepRed Failed POV through defenses POV Watch
66 CSDS Disekt Failed POV through defenses POV Watch
66 CSDS ForAllSecure Failed POV POV Watch
66 CSDS Shellphish Failed POV through defenses POV Watch
66 CSDS TECHx Failed POV through defenses POV Watch
66 DeepRed CodeJitsu Failed POV through defenses POV Watch
66 DeepRed CSDS Failed POV POV Watch
66 DeepRed Disekt Failed POV through defenses POV Watch
66 DeepRed ForAllSecure Failed POV POV Watch
66 DeepRed Shellphish Failed POV through defenses POV Watch
66 DeepRed TECHx Failed POV through defenses POV Watch
66 Shellphish CodeJitsu Failed POV through defenses POV Watch
66 Shellphish CSDS Successful POV POV Analysis Watch
66 Shellphish DeepRed Failed POV through defenses POV Watch
66 Shellphish ForAllSecure Successful POV POV Analysis Watch
66 Shellphish TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email