Challenge Information - KPRCA_00071

Commonly known as: Childs_Game


Rounds Enabled

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
  • CWE-839 - Numeric Range Comparison Without Minimum Check
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

Author Information

Kaprica Security

DARPA performer group

Kaprica Security (KPRCA)

Description

A gaming system that pits a user against a basic AI

Feature List

After a user registers, there are 3 games that can be played Games: 1. Hammer, Sheet, Sheers 2. Guess my number 3. Three in a row 4. Give up

The games are inspired by class children's games.

Vulnerability

Vuln 1

The Guess my number game let's a user choose the maximum of the range of numbers the computer will choose. There is an improper bounds check that doesn't account for negative numbers. The random number is generated from the magic page and then a bitewise & is done against the value and the range max. If a user changes the range max to -1, it will & with 0xFFFFFFFF. If the CRS can guess the number by doing a binary search it will leak 4 bytes from the magic page.

Vuln 2

Vulnerability 2 is a fairly straightforward buffer overflow. The difficult part is reaching the code control that allows a user to exploit the system. The vulnerable function is only ever called after the player has one both games and tied with the computer 600 times in a row. At this point if a player has chosen option 4 to create a custom 'flair', it's possible to overwrite the buffer and take control of eip and ebp. 3 in a row is a solved game and has deterministic behavior, but the AI will never lose and will always make optimal moves. Beating the computer requires an oponent to never make a suboptimal move.

Generic class of vulnerability

Stack based buffer overflow Information Exposure

CWE classification

CWE-121: Stack-based Buffer Overflow CWE-839: Numeric Range Comparison Without Minimum Check

Challenges

Vulnerability 1 requires using a bounds check error and then requires winning the game to obtain the leak. Winning the game requires doing a simple binary search against the game.

Vulnerability 2 allows for a function pointer overwrite the second time a user logs in. This function is called after a player successfully ties with the AI 100 times. The bug is a reference to a 1983 film.

Vulnerability 2 allows for a buffer overflow once the opponent has beaten the AI several times. Specifically the player must win games 1 and 2 once and tie at game 3 (3 in a row) 600 times without losing.

Both vulnernerabilities were meant to test the reasoning system of the CRS and were created such that brute force or fuzzing would not be a viable solution for discovering either of the vulnerabilities.

Difficulty

Discovering = Easy Proving = Medium Patching = Medium


POV Information

Round Source Destination Result POV Analysis Video
1 CSDS CodeJitsu Failed POV POV Watch
1 CSDS DeepRed Failed POV POV Watch
1 CSDS Disekt Failed POV POV Watch
1 CSDS ForAllSecure Failed POV POV Watch
1 CSDS Shellphish Failed POV POV Watch
1 CSDS TECHx Failed POV POV Watch
1 DeepRed CodeJitsu Failed POV POV Watch
1 DeepRed CSDS Failed POV POV Watch
1 DeepRed Disekt Failed POV POV Watch
1 DeepRed ForAllSecure Failed POV POV Watch
1 DeepRed Shellphish Failed POV POV Watch
1 DeepRed TECHx Failed POV POV Watch
1 ForAllSecure CodeJitsu Failed POV POV Watch
1 ForAllSecure CSDS Failed POV POV Watch
1 ForAllSecure DeepRed Failed POV POV Watch
1 ForAllSecure Disekt Failed POV POV Watch
1 ForAllSecure Shellphish Failed POV POV Watch
1 ForAllSecure TECHx Failed POV POV Watch
2 CodeJitsu Disekt Failed POV through defenses POV Watch
2 CodeJitsu Shellphish Failed POV through defenses POV Watch
2 CSDS CodeJitsu Failed POV POV Watch
2 CSDS DeepRed Failed POV POV Watch
2 CSDS Disekt Failed POV through defenses POV Watch
2 CSDS ForAllSecure Failed POV POV Watch
2 CSDS Shellphish Failed POV through defenses POV Watch
2 CSDS TECHx Failed POV POV Watch
2 DeepRed CodeJitsu Failed POV POV Watch
2 DeepRed CSDS Failed POV POV Watch
2 DeepRed Disekt Failed POV through defenses POV Watch
2 DeepRed ForAllSecure Failed POV POV Watch
2 DeepRed Shellphish Failed POV through defenses POV Watch
2 DeepRed TECHx Failed POV POV Watch
2 ForAllSecure CodeJitsu Failed POV POV Watch
2 ForAllSecure CSDS Failed POV POV Watch
2 ForAllSecure DeepRed Failed POV POV Watch
2 ForAllSecure Disekt Failed POV through defenses POV Watch
2 ForAllSecure Shellphish Failed POV through defenses POV Watch
2 ForAllSecure TECHx Failed POV POV Watch
3 CSDS CodeJitsu Failed POV POV Watch
3 CSDS DeepRed Failed POV POV Watch
3 CSDS Disekt Failed POV through defenses POV Watch
3 CSDS ForAllSecure Failed POV POV Watch
3 CSDS Shellphish Failed POV through defenses POV Watch
3 CSDS TECHx Failed POV POV Watch
3 DeepRed CodeJitsu Failed POV POV Watch
3 DeepRed CSDS Failed POV POV Watch
3 DeepRed Disekt Failed POV through defenses POV Watch
3 DeepRed ForAllSecure Failed POV POV Watch
3 DeepRed Shellphish Failed POV through defenses POV Watch
3 DeepRed TECHx Failed POV POV Watch
3 ForAllSecure CodeJitsu Failed POV POV Watch
3 ForAllSecure CSDS Failed POV POV Watch
3 ForAllSecure DeepRed Failed POV POV Watch
3 ForAllSecure Disekt Failed POV through defenses POV Watch
3 ForAllSecure Shellphish Failed POV through defenses POV Watch
3 ForAllSecure TECHx Failed POV POV Watch
4 CSDS CodeJitsu Failed POV POV Watch
4 CSDS DeepRed Failed POV POV Watch
4 CSDS Disekt Failed POV through defenses POV Watch
4 CSDS ForAllSecure Failed POV POV Watch
4 CSDS Shellphish Failed POV through defenses POV Watch
4 CSDS TECHx Failed POV POV Watch
4 DeepRed CodeJitsu Failed POV POV Watch
4 DeepRed CSDS Failed POV POV Watch
4 DeepRed Disekt Failed POV through defenses POV Watch
4 DeepRed ForAllSecure Failed POV POV Watch
4 DeepRed Shellphish Failed POV through defenses POV Watch
4 DeepRed TECHx Failed POV POV Watch
4 ForAllSecure CodeJitsu Failed POV POV Watch
4 ForAllSecure CSDS Failed POV POV Watch
4 ForAllSecure DeepRed Failed POV POV Watch
4 ForAllSecure Disekt Failed POV through defenses POV Watch
4 ForAllSecure Shellphish Failed POV through defenses POV Watch
4 ForAllSecure TECHx Failed POV POV Watch
5 CSDS CodeJitsu Failed POV POV Watch
5 CSDS DeepRed Failed POV POV Watch
5 CSDS Disekt Failed POV through defenses POV Watch
5 CSDS ForAllSecure Failed POV POV Watch
5 CSDS Shellphish Failed POV through defenses POV Watch
5 CSDS TECHx Failed POV POV Watch
5 DeepRed CodeJitsu Failed POV POV Watch
5 DeepRed CSDS Failed POV POV Watch
5 DeepRed Disekt Failed POV through defenses POV Watch
5 DeepRed ForAllSecure Failed POV POV Watch
5 DeepRed Shellphish Failed POV through defenses POV Watch
5 DeepRed TECHx Failed POV POV Watch
5 ForAllSecure CodeJitsu Failed POV POV Watch
5 ForAllSecure CSDS Failed POV POV Watch
5 ForAllSecure DeepRed Failed POV POV Watch
5 ForAllSecure Disekt Failed POV through defenses POV Watch
5 ForAllSecure Shellphish Failed POV through defenses POV Watch
5 ForAllSecure TECHx Failed POV POV Watch
6 CSDS CodeJitsu Failed POV POV Watch
6 CSDS DeepRed Failed POV POV Watch
6 CSDS Disekt Failed POV through defenses POV Watch
6 CSDS ForAllSecure Failed POV POV Watch
6 CSDS Shellphish Failed POV through defenses POV Watch
6 CSDS TECHx Failed POV POV Watch
6 DeepRed CodeJitsu Failed POV POV Watch
6 DeepRed CSDS Failed POV POV Watch
6 DeepRed Disekt Failed POV through defenses POV Watch
6 DeepRed ForAllSecure Failed POV POV Watch
6 DeepRed Shellphish Failed POV through defenses POV Watch
6 DeepRed TECHx Failed POV POV Watch
6 ForAllSecure CodeJitsu Failed POV POV Watch
6 ForAllSecure CSDS Failed POV POV Watch
6 ForAllSecure DeepRed Failed POV POV Watch
6 ForAllSecure Disekt Failed POV through defenses POV Watch
6 ForAllSecure Shellphish Failed POV through defenses POV Watch
6 ForAllSecure TECHx Failed POV POV Watch
7 CSDS CodeJitsu Failed POV POV Watch
7 CSDS DeepRed Failed POV POV Watch
7 CSDS Disekt Failed POV through defenses POV Watch
7 CSDS ForAllSecure Failed POV POV Watch
7 CSDS Shellphish Failed POV through defenses POV Watch
7 CSDS TECHx Failed POV POV Watch
7 DeepRed CodeJitsu Failed POV POV Watch
7 DeepRed CSDS Failed POV POV Watch
7 DeepRed Disekt Failed POV through defenses POV Watch
7 DeepRed ForAllSecure Failed POV POV Watch
7 DeepRed Shellphish Failed POV through defenses POV Watch
7 DeepRed TECHx Failed POV POV Watch
7 ForAllSecure CodeJitsu Failed POV POV Watch
7 ForAllSecure CSDS Failed POV POV Watch
7 ForAllSecure DeepRed Failed POV POV Watch
7 ForAllSecure Disekt Failed POV through defenses POV Watch
7 ForAllSecure Shellphish Failed POV through defenses POV Watch
7 ForAllSecure TECHx Failed POV POV Watch
8 CSDS CodeJitsu Failed POV POV Watch
8 CSDS DeepRed Failed POV POV Watch
8 CSDS Disekt Failed POV through defenses POV Watch
8 CSDS ForAllSecure Failed POV POV Watch
8 CSDS Shellphish Failed POV through defenses POV Watch
8 CSDS TECHx Failed POV POV Watch
8 DeepRed CodeJitsu Failed POV POV Watch
8 DeepRed CSDS Failed POV POV Watch
8 DeepRed Disekt Failed POV through defenses POV Watch
8 DeepRed ForAllSecure Failed POV POV Watch
8 DeepRed Shellphish Failed POV through defenses POV Watch
8 DeepRed TECHx Failed POV POV Watch
8 ForAllSecure CodeJitsu Failed POV POV Watch
8 ForAllSecure CSDS Failed POV POV Watch
8 ForAllSecure DeepRed Failed POV POV Watch
8 ForAllSecure Disekt Failed POV through defenses POV Watch
8 ForAllSecure Shellphish Failed POV through defenses POV Watch
8 ForAllSecure TECHx Failed POV POV Watch
9 CSDS CodeJitsu Failed POV POV Watch
9 CSDS DeepRed Failed POV POV Watch
9 CSDS Disekt Failed POV through defenses POV Watch
9 CSDS ForAllSecure Failed POV POV Watch
9 CSDS Shellphish Failed POV through defenses POV Watch
9 CSDS TECHx Failed POV POV Watch
9 DeepRed CodeJitsu Failed POV POV Watch
9 DeepRed CSDS Failed POV POV Watch
9 DeepRed Disekt Failed POV through defenses POV Watch
9 DeepRed ForAllSecure Failed POV POV Watch
9 DeepRed Shellphish Failed POV through defenses POV Watch
9 DeepRed TECHx Failed POV POV Watch
9 ForAllSecure CodeJitsu Failed POV POV Watch
9 ForAllSecure CSDS Failed POV POV Watch
9 ForAllSecure DeepRed Failed POV POV Watch
9 ForAllSecure Disekt Failed POV through defenses POV Watch
9 ForAllSecure Shellphish Failed POV through defenses POV Watch
9 ForAllSecure TECHx Failed POV POV Watch
10 CSDS CodeJitsu Failed POV POV Watch
10 CSDS DeepRed Failed POV POV Watch
10 CSDS Disekt Failed POV through defenses POV Watch
10 CSDS ForAllSecure Failed POV POV Watch
10 CSDS Shellphish Failed POV through defenses POV Watch
10 CSDS TECHx Failed POV POV Watch
10 DeepRed CodeJitsu Failed POV POV Watch
10 DeepRed CSDS Failed POV POV Watch
10 DeepRed Disekt Failed POV through defenses POV Watch
10 DeepRed ForAllSecure Failed POV POV Watch
10 DeepRed Shellphish Failed POV through defenses POV Watch
10 DeepRed TECHx Failed POV POV Watch
10 ForAllSecure CodeJitsu Failed POV POV Watch
10 ForAllSecure CSDS Failed POV POV Watch
10 ForAllSecure DeepRed Failed POV POV Watch
10 ForAllSecure Disekt Failed POV through defenses POV Watch
10 ForAllSecure Shellphish Failed POV through defenses POV Watch
10 ForAllSecure TECHx Failed POV POV Watch
11 CSDS CodeJitsu Failed POV POV Watch
11 CSDS DeepRed Failed POV POV Watch
11 CSDS Disekt Failed POV through defenses POV Watch
11 CSDS ForAllSecure Failed POV POV Watch
11 CSDS Shellphish Failed POV through defenses POV Watch
11 CSDS TECHx Failed POV POV Watch
11 DeepRed CodeJitsu Failed POV POV Watch
11 DeepRed CSDS Failed POV POV Watch
11 DeepRed Disekt Failed POV through defenses POV Watch
11 DeepRed ForAllSecure Failed POV POV Watch
11 DeepRed Shellphish Failed POV through defenses POV Watch
11 DeepRed TECHx Failed POV POV Watch
11 ForAllSecure CodeJitsu Failed POV POV Watch
11 ForAllSecure CSDS Failed POV POV Watch
11 ForAllSecure DeepRed Failed POV POV Watch
11 ForAllSecure Disekt Failed POV through defenses POV Watch
11 ForAllSecure Shellphish Failed POV through defenses POV Watch
11 ForAllSecure TECHx Failed POV POV Watch
12 CSDS CodeJitsu Failed POV POV Watch
12 CSDS DeepRed Failed POV POV Watch
12 CSDS Disekt Failed POV through defenses POV Watch
12 CSDS ForAllSecure Failed POV POV Watch
12 CSDS Shellphish Failed POV through defenses POV Watch
12 CSDS TECHx Failed POV POV Watch
12 DeepRed CodeJitsu Failed POV POV Watch
12 DeepRed CSDS Failed POV POV Watch
12 DeepRed Disekt Failed POV through defenses POV Watch
12 DeepRed ForAllSecure Failed POV POV Watch
12 DeepRed Shellphish Failed POV through defenses POV Watch
12 DeepRed TECHx Failed POV POV Watch
12 ForAllSecure CodeJitsu Failed POV POV Watch
12 ForAllSecure CSDS Failed POV POV Watch
12 ForAllSecure DeepRed Failed POV POV Watch
12 ForAllSecure Disekt Failed POV through defenses POV Watch
12 ForAllSecure Shellphish Failed POV through defenses POV Watch
12 ForAllSecure TECHx Failed POV POV Watch
13 CSDS CodeJitsu Failed POV POV Watch
13 CSDS DeepRed Failed POV POV Watch
13 CSDS Disekt Failed POV through defenses POV Watch
13 CSDS ForAllSecure Failed POV POV Watch
13 CSDS Shellphish Failed POV through defenses POV Watch
13 CSDS TECHx Failed POV POV Watch
13 DeepRed CodeJitsu Failed POV POV Watch
13 DeepRed CSDS Failed POV POV Watch
13 DeepRed Disekt Failed POV through defenses POV Watch
13 DeepRed ForAllSecure Failed POV POV Watch
13 DeepRed Shellphish Failed POV through defenses POV Watch
13 DeepRed TECHx Failed POV POV Watch
13 ForAllSecure CodeJitsu Failed POV POV Watch
13 ForAllSecure CSDS Failed POV POV Watch
13 ForAllSecure DeepRed Failed POV POV Watch
13 ForAllSecure Disekt Failed POV through defenses POV Watch
13 ForAllSecure Shellphish Failed POV through defenses POV Watch
13 ForAllSecure TECHx Failed POV POV Watch
14 CSDS CodeJitsu Failed POV POV Watch
14 CSDS DeepRed Failed POV POV Watch
14 CSDS Disekt Failed POV through defenses POV Watch
14 CSDS ForAllSecure Failed POV POV Watch
14 CSDS Shellphish Failed POV through defenses POV Watch
14 CSDS TECHx Failed POV POV Watch
14 DeepRed CodeJitsu Failed POV POV Watch
14 DeepRed CSDS Failed POV POV Watch
14 DeepRed Disekt Failed POV through defenses POV Watch
14 DeepRed ForAllSecure Failed POV POV Watch
14 DeepRed Shellphish Failed POV through defenses POV Watch
14 DeepRed TECHx Failed POV POV Watch
14 ForAllSecure CodeJitsu Failed POV POV Watch
14 ForAllSecure CSDS Failed POV POV Watch
14 ForAllSecure DeepRed Failed POV POV Watch
14 ForAllSecure Disekt Failed POV through defenses POV Watch
14 ForAllSecure Shellphish Failed POV through defenses POV Watch
14 ForAllSecure TECHx Failed POV POV Watch
15 CSDS CodeJitsu Failed POV POV Watch
15 CSDS DeepRed Failed POV POV Watch
15 CSDS Disekt Failed POV through defenses POV Watch
15 CSDS ForAllSecure Failed POV POV Watch
15 CSDS Shellphish Failed POV through defenses POV Watch
15 CSDS TECHx Failed POV POV Watch
15 DeepRed CodeJitsu Failed POV POV Watch
15 DeepRed CSDS Failed POV POV Watch
15 DeepRed Disekt Failed POV through defenses POV Watch
15 DeepRed ForAllSecure Failed POV POV Watch
15 DeepRed Shellphish Failed POV through defenses POV Watch
15 DeepRed TECHx Failed POV POV Watch
15 ForAllSecure CodeJitsu Failed POV POV Watch
15 ForAllSecure CSDS Failed POV POV Watch
15 ForAllSecure DeepRed Failed POV POV Watch
15 ForAllSecure Disekt Failed POV through defenses POV Watch
15 ForAllSecure Shellphish Failed POV through defenses POV Watch
15 ForAllSecure TECHx Failed POV POV Watch
16 CSDS CodeJitsu Failed POV POV Watch
16 CSDS DeepRed Failed POV POV Watch
16 CSDS Disekt Failed POV through defenses POV Watch
16 CSDS ForAllSecure Failed POV POV Watch
16 CSDS Shellphish Failed POV through defenses POV Watch
16 CSDS TECHx Failed POV POV Watch
16 DeepRed CodeJitsu Failed POV POV Watch
16 DeepRed CSDS Failed POV POV Watch
16 DeepRed Disekt Failed POV through defenses POV Watch
16 DeepRed ForAllSecure Failed POV POV Watch
16 DeepRed Shellphish Failed POV through defenses POV Watch
16 DeepRed TECHx Failed POV POV Watch
16 ForAllSecure CodeJitsu Failed POV POV Watch
16 ForAllSecure CSDS Failed POV POV Watch
16 ForAllSecure DeepRed Failed POV POV Watch
16 ForAllSecure Disekt Failed POV through defenses POV Watch
16 ForAllSecure Shellphish Failed POV through defenses POV Watch
16 ForAllSecure TECHx Failed POV POV Watch
17 CSDS CodeJitsu Failed POV POV Watch
17 CSDS DeepRed Failed POV POV Watch
17 CSDS Disekt Failed POV through defenses POV Watch
17 CSDS ForAllSecure Failed POV POV Watch
17 CSDS Shellphish Failed POV through defenses POV Watch
17 CSDS TECHx Failed POV POV Watch
17 DeepRed CodeJitsu Failed POV POV Watch
17 DeepRed CSDS Failed POV POV Watch
17 DeepRed Disekt Failed POV through defenses POV Watch
17 DeepRed ForAllSecure Failed POV POV Watch
17 DeepRed Shellphish Failed POV through defenses POV Watch
17 DeepRed TECHx Failed POV POV Watch
17 ForAllSecure CodeJitsu Failed POV POV Watch
17 ForAllSecure CSDS Failed POV POV Watch
17 ForAllSecure DeepRed Failed POV POV Watch
17 ForAllSecure Disekt Failed POV through defenses POV Watch
17 ForAllSecure Shellphish Failed POV through defenses POV Watch
17 ForAllSecure TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email