Challenge Information - CROMU_00065

Commonly known as: WhackJack

Rounds Enabled

80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Steve Wood" swood@cromulence.com

DARPA performer group

Cromulence LLC (CROMU)

Description

This program is a game of chance called WhackJack. It might or might not bear a similarity to another game with a rhyming name. It allows up to 8 players to play, with players being human or computer simulated according to various play algorithms.

Feature List

The service simulates a card game where the goal is to get a higher score than the dealer without going over 21. Up to 8 players can play with the option of making some of those players computer simulated. Five different algorithms are included that embody various schools of thought on how to play the game. The game also includes a training mode whereby human players can get play hints from one of the algorithms.

Vulnerability

Vulnerability 1 is a buffer overwrite due to the programmer inadvertently using the wrong #define constant in a bounds check of a read from STDIN. The read buffer is adjacent to the data structures holding player data, including a function pointer to the simulation algorithm chosen for that player. An overwrite of this pointer will allow the attacker to jump to arbitrary code.

Generic class of vulnerability

Stack buffer overwrite

CWE classification

CWE-121 Stack-based Buffer Overflow

Challenges

Vulnerability 1 is able to overwrite the function pointer for the simulation module, but not much else in the player data. Therefore proving this vulnerability requires multiple steps. First, a player has to be entered and setup as a computer player. This enables the deference of the function pointer later. The buffer overwrite is not long enough to set the variable setting the player as a computer simulation. Next the overwrite needs to happen and setup shellcode to establish the desired register values. However, the available buffer space is quite small so some creativity is needed to write enough shellcode. POV_1 enters three fake players, and spreads the shellcode between the name fields in all three players, with the first jumping to the second and the second to the third. Only the the player 1 data actually uses the vulnerable overwrite to get the first stage shellcode into place. Once the shellcode is setup and the function pointer overwritten to point to the start of the shellcode, the game must be instructed to play a round of the game to invoke the function poniter.

An additional complexity is added in that a readline-type input function is used so the shellcode data, including the EIP and Register data from the framework, can't have 0x0a in the data. A strcpy function is used to store the second and third stages of the shellcode, so it also must be null safe, including the values from the framework.

This vulnerability is easy to find and very easy to fix. Exploitation is hard given the constraints on the shellcode and the multiple steps required to invoke the shellcode.

Finding Vulnerability 1: easy
Proving Vulnerability 1: hard
Fixing Vulnerability 1: easy

POV Information

Round Source Destination Result POV Analysis Video
81 CodeJitsu CSDS Successful POV POV Analysis Watch
81 CodeJitsu DeepRed Successful POV POV Analysis Watch
81 CodeJitsu Disekt Successful POV POV Analysis Watch
81 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
81 CodeJitsu Shellphish Successful POV POV Analysis Watch
81 CodeJitsu TECHx Successful POV POV Analysis Watch
81 CSDS CodeJitsu Failed POV POV Watch
81 CSDS DeepRed Failed POV POV Watch
81 CSDS Disekt Failed POV POV Watch
81 CSDS ForAllSecure Failed POV POV Watch
81 CSDS Shellphish Failed POV POV Watch
81 CSDS TECHx Failed POV POV Watch
81 DeepRed CodeJitsu Failed POV POV Watch
81 DeepRed CSDS Failed POV POV Watch
81 DeepRed Disekt Failed POV POV Watch
81 DeepRed ForAllSecure Failed POV POV Watch
81 DeepRed Shellphish Failed POV POV Watch
81 DeepRed TECHx Failed POV POV Watch
82 CodeJitsu CSDS Successful POV POV Analysis Watch
82 CodeJitsu DeepRed Successful POV POV Analysis Watch
82 CodeJitsu Disekt Failed POV through defenses POV Watch
82 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
82 CodeJitsu Shellphish Successful POV POV Analysis Watch
82 CSDS CodeJitsu Failed POV through defenses POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV through defenses POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV POV Watch
82 DeepRed CodeJitsu Failed POV through defenses POV Watch
82 DeepRed CSDS Failed POV POV Watch
82 DeepRed Disekt Failed POV through defenses POV Watch
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV POV Watch
83 CodeJitsu CSDS Successful POV POV Analysis Watch
83 CodeJitsu DeepRed Failed POV through defenses POV Watch
83 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
83 CodeJitsu Shellphish Successful POV POV Analysis Watch
83 CSDS CodeJitsu Failed POV through defenses POV Watch
83 CSDS DeepRed Failed POV through defenses POV Watch
83 CSDS Disekt Failed POV through defenses POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV POV Watch
83 CSDS TECHx Failed POV through defenses POV Watch
83 DeepRed CodeJitsu Failed POV through defenses POV Watch
83 DeepRed CSDS Failed POV POV Watch
83 DeepRed Disekt Failed POV through defenses POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV POV Watch
83 DeepRed TECHx Failed POV through defenses POV Watch
84 CodeJitsu CSDS Successful POV POV Analysis Watch
84 CodeJitsu DeepRed Failed POV through defenses POV Watch
84 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
84 CodeJitsu Shellphish Successful POV POV Analysis Watch
84 CSDS CodeJitsu Failed POV through defenses POV Watch
84 CSDS DeepRed Failed POV through defenses POV Watch
84 CSDS Disekt Failed POV through defenses POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV POV Watch
84 CSDS TECHx Failed POV through defenses POV Watch
84 DeepRed CodeJitsu Failed POV through defenses POV Watch
84 DeepRed CSDS Failed POV POV Watch
84 DeepRed Disekt Failed POV through defenses POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV POV Watch
84 DeepRed TECHx Failed POV through defenses POV Watch
85 CodeJitsu CSDS Successful POV POV Analysis Watch
85 CodeJitsu DeepRed Failed POV through defenses POV Watch
85 CodeJitsu Disekt Failed POV through defenses POV Watch
85 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
85 CodeJitsu Shellphish Successful POV POV Analysis Watch
85 CSDS CodeJitsu Failed POV POV Watch
85 CSDS DeepRed Failed POV through defenses POV Watch
85 CSDS Disekt Failed POV through defenses POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV POV Watch
85 CSDS TECHx Failed POV through defenses POV Watch
85 DeepRed CodeJitsu Failed POV POV Watch
85 DeepRed CSDS Failed POV POV Watch
85 DeepRed Disekt Failed POV through defenses POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV POV Watch
85 DeepRed TECHx Failed POV through defenses POV Watch
86 CodeJitsu CSDS Successful POV POV Analysis Watch
86 CodeJitsu DeepRed Failed POV through defenses POV Watch
86 CodeJitsu Disekt Failed POV through defenses POV Watch
86 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
86 CodeJitsu Shellphish Failed POV through defenses POV Watch
86 CSDS CodeJitsu Failed POV POV Watch
86 CSDS DeepRed Failed POV through defenses POV Watch
86 CSDS Disekt Failed POV through defenses POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV through defenses POV Watch
86 DeepRed CodeJitsu Successful POV POV Analysis Watch
86 DeepRed CSDS Successful POV POV Analysis Watch
86 DeepRed Disekt Failed POV through defenses POV Watch
86 DeepRed ForAllSecure Successful POV POV Analysis Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV through defenses POV Watch
87 CodeJitsu CSDS Successful POV POV Analysis Watch
87 CodeJitsu DeepRed Successful POV through defenses POV Analysis Watch
87 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
87 CodeJitsu Shellphish Failed POV through defenses POV Watch
87 CodeJitsu TECHx Failed POV through defenses POV Watch
87 CSDS CodeJitsu Failed POV POV Watch
87 CSDS DeepRed Failed POV through defenses POV Watch
87 CSDS Disekt Failed POV through defenses POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV through defenses POV Watch
87 DeepRed CodeJitsu Successful POV POV Analysis Watch
87 DeepRed CSDS Successful POV POV Analysis Watch
87 DeepRed Disekt Failed POV through defenses POV Watch
87 DeepRed ForAllSecure Successful POV POV Analysis Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV through defenses POV Watch
88 CodeJitsu CSDS Successful POV POV Analysis Watch
88 CodeJitsu DeepRed Successful POV through defenses POV Analysis Watch
88 CodeJitsu Disekt Failed POV through defenses POV Watch
88 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
88 CodeJitsu Shellphish Failed POV through defenses POV Watch
88 CSDS CodeJitsu Failed POV POV Watch
88 CSDS DeepRed Failed POV through defenses POV Watch
88 CSDS Disekt Failed POV through defenses POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV through defenses POV Watch
88 DeepRed CodeJitsu Successful POV POV Analysis Watch
88 DeepRed CSDS Successful POV POV Analysis Watch
88 DeepRed Disekt Failed POV through defenses POV Watch
88 DeepRed ForAllSecure Successful POV POV Analysis Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV through defenses POV Watch
89 CodeJitsu CSDS Successful POV POV Analysis Watch
89 CodeJitsu DeepRed Failed POV through defenses POV Watch
89 CodeJitsu Disekt Failed POV through defenses POV Watch
89 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
89 CodeJitsu Shellphish Failed POV POV Watch
89 CSDS CodeJitsu Failed POV POV Watch
89 CSDS DeepRed Failed POV through defenses POV Watch
89 CSDS Disekt Failed POV through defenses POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV POV Watch
89 CSDS TECHx Failed POV through defenses POV Watch
89 DeepRed CodeJitsu Successful POV POV Analysis Watch
89 DeepRed CSDS Successful POV POV Analysis Watch
89 DeepRed Disekt Failed POV through defenses POV Watch
89 DeepRed ForAllSecure Successful POV POV Analysis Watch
89 DeepRed Shellphish Failed POV POV Watch
89 DeepRed TECHx Failed POV through defenses POV Watch
90 CodeJitsu CSDS Successful POV POV Analysis Watch
90 CodeJitsu DeepRed Failed POV through defenses POV Watch
90 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
90 CodeJitsu Shellphish Successful POV POV Analysis Watch
90 CSDS CodeJitsu Failed POV POV Watch
90 CSDS DeepRed Failed POV through defenses POV Watch
90 CSDS Disekt Failed POV through defenses POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV POV Watch
90 CSDS TECHx Failed POV through defenses POV Watch
90 DeepRed CodeJitsu Successful POV POV Analysis Watch
90 DeepRed CSDS Successful POV POV Analysis Watch
90 DeepRed Disekt Failed POV through defenses POV Watch
90 DeepRed ForAllSecure Successful POV POV Analysis Watch
90 DeepRed Shellphish Successful POV POV Analysis Watch
90 DeepRed TECHx Failed POV through defenses POV Watch
90 Disekt CodeJitsu Failed POV POV Watch
90 Disekt CSDS Failed POV POV Watch
90 Disekt ForAllSecure Failed POV POV Watch
90 Disekt Shellphish Successful POV POV Analysis Watch
90 Disekt TECHx Failed POV through defenses POV Watch
91 CodeJitsu CSDS Successful POV POV Analysis Watch
91 CodeJitsu DeepRed Failed POV through defenses POV Watch
91 CodeJitsu Disekt Failed POV through defenses POV Watch
91 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
91 CodeJitsu Shellphish Successful POV POV Analysis Watch
91 CSDS CodeJitsu Failed POV POV Watch
91 CSDS DeepRed Failed POV through defenses POV Watch
91 CSDS Disekt Failed POV through defenses POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV POV Watch
91 CSDS TECHx Failed POV through defenses POV Watch
91 DeepRed CodeJitsu Successful POV POV Analysis Watch
91 DeepRed CSDS Successful POV POV Analysis Watch
91 DeepRed Disekt Failed POV through defenses POV Watch
91 DeepRed ForAllSecure Successful POV POV Analysis Watch
91 DeepRed Shellphish Successful POV POV Analysis Watch
91 DeepRed TECHx Failed POV through defenses POV Watch
91 Disekt CodeJitsu Successful POV POV Analysis Watch
91 Disekt CSDS Failed POV POV Watch
91 Disekt DeepRed Failed POV through defenses POV Watch
91 Disekt ForAllSecure Failed POV POV Watch
91 Disekt Shellphish Failed POV POV Watch
91 Disekt TECHx Failed POV through defenses POV Watch
91 Shellphish CodeJitsu Failed POV POV Watch
91 Shellphish CSDS Failed POV POV Watch
91 Shellphish DeepRed Failed POV through defenses POV Watch
91 Shellphish Disekt Failed POV through defenses POV Watch
91 Shellphish ForAllSecure Successful POV POV Analysis Watch
92 CodeJitsu CSDS Successful POV POV Analysis Watch
92 CodeJitsu DeepRed Failed POV through defenses POV Watch
92 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
92 CodeJitsu Shellphish Successful POV POV Analysis Watch
92 CodeJitsu TECHx Failed POV through defenses POV Watch
92 CSDS CodeJitsu Failed POV POV Watch
92 CSDS DeepRed Failed POV through defenses POV Watch
92 CSDS Disekt Failed POV through defenses POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV POV Watch
92 CSDS TECHx Failed POV through defenses POV Watch
92 DeepRed CodeJitsu Successful POV POV Analysis Watch
92 DeepRed CSDS Successful POV POV Analysis Watch
92 DeepRed Disekt Failed POV through defenses POV Watch
92 DeepRed ForAllSecure Successful POV POV Analysis Watch
92 DeepRed Shellphish Successful POV POV Analysis Watch
92 DeepRed TECHx Failed POV through defenses POV Watch
92 Disekt CodeJitsu Successful POV POV Analysis Watch
92 Disekt CSDS Failed POV POV Watch
92 Disekt DeepRed Failed POV through defenses POV Watch
92 Disekt ForAllSecure Failed POV POV Watch
92 Disekt Shellphish Failed POV POV Watch
92 Disekt TECHx Failed POV through defenses POV Watch
92 Shellphish CodeJitsu Successful POV POV Analysis Watch
92 Shellphish CSDS Successful POV POV Analysis Watch
92 Shellphish DeepRed Failed POV through defenses POV Watch
92 Shellphish Disekt Failed POV through defenses POV Watch
92 Shellphish ForAllSecure Successful POV POV Analysis Watch
93 CodeJitsu CSDS Successful POV POV Analysis Watch
93 CodeJitsu DeepRed Successful POV through defenses POV Analysis Watch
93 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
93 CodeJitsu Shellphish Successful POV POV Analysis Watch
93 CodeJitsu TECHx Failed POV through defenses POV Watch
93 CSDS CodeJitsu Failed POV POV Watch
93 CSDS DeepRed Failed POV through defenses POV Watch
93 CSDS Disekt Failed POV through defenses POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV POV Watch
93 CSDS TECHx Failed POV through defenses POV Watch
93 DeepRed CodeJitsu Successful POV POV Analysis Watch
93 DeepRed CSDS Successful POV POV Analysis Watch
93 DeepRed Disekt Failed POV through defenses POV Watch
93 DeepRed ForAllSecure Successful POV POV Analysis Watch
93 DeepRed Shellphish Successful POV POV Analysis Watch
93 DeepRed TECHx Failed POV through defenses POV Watch
93 Disekt CodeJitsu Failed POV POV Watch
93 Disekt CSDS Successful POV POV Analysis Watch
93 Disekt ForAllSecure Successful POV POV Analysis Watch
93 Disekt Shellphish Failed POV POV Watch
93 Disekt TECHx Failed POV through defenses POV Watch
93 Shellphish CodeJitsu Successful POV POV Analysis Watch
93 Shellphish CSDS Successful POV POV Analysis Watch
93 Shellphish DeepRed Successful POV through defenses POV Analysis Watch
93 Shellphish Disekt Failed POV through defenses POV Watch
93 Shellphish ForAllSecure Successful POV POV Analysis Watch
94 CodeJitsu CSDS Successful POV POV Analysis Watch
94 CodeJitsu DeepRed Failed POV POV Watch
94 CodeJitsu Disekt Failed POV through defenses POV Watch
94 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
94 CodeJitsu Shellphish Successful POV POV Analysis Watch
94 CSDS CodeJitsu Failed POV POV Watch
94 CSDS DeepRed Failed POV POV Watch
94 CSDS Disekt Failed POV through defenses POV Watch
94 CSDS ForAllSecure Failed POV POV Watch
94 CSDS Shellphish Failed POV POV Watch
94 CSDS TECHx Failed POV through defenses POV Watch
94 DeepRed CodeJitsu Successful POV POV Analysis Watch
94 DeepRed CSDS Successful POV POV Analysis Watch
94 DeepRed Disekt Failed POV through defenses POV Watch
94 DeepRed ForAllSecure Successful POV POV Analysis Watch
94 DeepRed Shellphish Successful POV POV Analysis Watch
94 DeepRed TECHx Failed POV through defenses POV Watch
94 Disekt CodeJitsu Failed POV POV Watch
94 Disekt CSDS Successful POV POV Analysis Watch
94 Disekt DeepRed Failed POV POV Watch
94 Disekt ForAllSecure Successful POV POV Analysis Watch
94 Disekt Shellphish Successful POV POV Analysis Watch
94 Disekt TECHx Failed POV through defenses POV Watch
94 Shellphish CodeJitsu Successful POV POV Analysis Watch
94 Shellphish CSDS Successful POV POV Analysis Watch
94 Shellphish DeepRed Failed POV POV Watch
94 Shellphish Disekt Failed POV through defenses POV Watch
94 Shellphish ForAllSecure Successful POV POV Analysis Watch
95 CodeJitsu CSDS Successful POV POV Analysis Watch
95 CodeJitsu DeepRed Successful POV POV Analysis Watch
95 CodeJitsu Disekt Failed POV through defenses POV Watch
95 CodeJitsu ForAllSecure Successful POV POV Analysis Watch
95 CodeJitsu Shellphish Successful POV POV Analysis Watch
95 CSDS CodeJitsu Failed POV POV Watch
95 CSDS DeepRed Failed POV POV Watch
95 CSDS Disekt Failed POV through defenses POV Watch
95 CSDS ForAllSecure Failed POV POV Watch
95 CSDS Shellphish Failed POV POV Watch
95 CSDS TECHx Failed POV through defenses POV Watch
95 DeepRed CodeJitsu Successful POV POV Analysis Watch
95 DeepRed CSDS Successful POV POV Analysis Watch
95 DeepRed Disekt Failed POV through defenses POV Watch
95 DeepRed ForAllSecure Successful POV POV Analysis Watch
95 DeepRed Shellphish Successful POV POV Analysis Watch
95 DeepRed TECHx Failed POV through defenses POV Watch
95 Disekt CodeJitsu Successful POV POV Analysis Watch
95 Disekt CSDS Failed POV POV Watch
95 Disekt DeepRed Failed POV POV Watch
95 Disekt ForAllSecure Failed POV POV Watch
95 Disekt Shellphish Failed POV POV Watch
95 Disekt TECHx Failed POV through defenses POV Watch
95 Shellphish CodeJitsu Successful POV POV Analysis Watch
95 Shellphish CSDS Successful POV POV Analysis Watch
95 Shellphish DeepRed Successful POV POV Analysis Watch
95 Shellphish Disekt Failed POV through defenses POV Watch
95 Shellphish ForAllSecure Successful POV POV Analysis Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email