Challenge Information - KPRCA_00075

Commonly known as: Messaging


Rounds Enabled

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16

Details

Original Versions

Known Vulnerabilities

  • CWE-122 - Heap-based Buffer Overflow
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

A metadata parser built with message passing primitives.

This service is split into multiple processes to provide for concurrency. The original goal was to model it on message passing primitives. The service is split up into these components:

  • Master process
  • Network communications and framing
  • Packet correction
  • Metadata parsing

When the service is sent a packet that contains valid metadata, it will traverse from the network process, to master process, to packet correction, to master process, and finally to the metadata process that will send a metadata object back to the master process. The master process will then ask the metadata process to dump the metadata to standard out.

Feature List

  • Built using concurrency
  • Support for storing metadata with titles, artists, and/or albums
  • Customizable error correction capability up to 5% of input bytes
  • No parity is possible if connection is known to be reliable

Vulnerability

Vuln 1

In cb_1/src/main.cc, there is a function escape_string which is responsible for escaping newlines, NUL bytes, and other unsafe characters. It assumes that the buffer it is writing to is long enough to contain the escaped string. The calling function, however, only allocates enough space for the input string and since some characters are escaped as a two byte sequence, this results in a buffer overflow. Conveniently for exploitation, if the input string is short enough, the destination buffer will be right before a char pointer that is printed to stdout. A type 2 POV is possible by setting the pointer to somewhere in the secret page.

It should also be possible to exploit the vulnerability with a type 1 POV by overflowing into the heap metadata which results in control of the free list pointers. This is left as an exercise for the reader.

Generic class of vulnerability

Heap Corruption

CWE classification

CWE-122: Heap-based Buffer Overflow

Challenges

  • The primary challenge is dataflow analysis through multiple CBs that communicate using IPC.
  • A secondary challenge is the error correction codes that can be optionally enabled. Should be easily bypassed by a symbolic executor if the vulnerability was already found and it is just trying to find a path to the vulnerable code.

Difficulty

  • Discovery: medium
  • Proving: easy
  • Patching: easy

POV Information

Round Source Destination Result POV Analysis Video
1 CSDS CodeJitsu Failed POV POV Watch
1 CSDS DeepRed Failed POV POV Watch
1 CSDS Disekt Failed POV POV Watch
1 CSDS ForAllSecure Failed POV POV Watch
1 CSDS Shellphish Failed POV POV Watch
1 CSDS TECHx Failed POV POV Watch
1 DeepRed CodeJitsu Failed POV POV Watch
1 DeepRed CSDS Failed POV POV Watch
1 DeepRed Disekt Failed POV POV Watch
1 DeepRed ForAllSecure Failed POV POV Watch
1 DeepRed Shellphish Failed POV POV Watch
1 DeepRed TECHx Failed POV POV Watch
1 ForAllSecure CodeJitsu Failed POV POV Watch
1 ForAllSecure CSDS Failed POV POV Watch
1 ForAllSecure DeepRed Failed POV POV Watch
1 ForAllSecure Disekt Failed POV POV Watch
1 ForAllSecure Shellphish Failed POV POV Watch
1 ForAllSecure TECHx Failed POV POV Watch
2 CodeJitsu Shellphish Failed POV through defenses POV Watch
2 CSDS CodeJitsu Failed POV POV Watch
2 CSDS DeepRed Failed POV POV Watch
2 CSDS Disekt Failed POV POV Watch
2 CSDS ForAllSecure Failed POV POV Watch
2 CSDS Shellphish Failed POV through defenses POV Watch
2 CSDS TECHx Failed POV POV Watch
2 DeepRed CodeJitsu Failed POV POV Watch
2 DeepRed CSDS Failed POV POV Watch
2 DeepRed Disekt Failed POV POV Watch
2 DeepRed ForAllSecure Failed POV POV Watch
2 DeepRed Shellphish Failed POV through defenses POV Watch
2 DeepRed TECHx Failed POV POV Watch
2 ForAllSecure CodeJitsu Failed POV POV Watch
2 ForAllSecure CSDS Failed POV POV Watch
2 ForAllSecure DeepRed Failed POV POV Watch
2 ForAllSecure Disekt Failed POV POV Watch
2 ForAllSecure Shellphish Failed POV through defenses POV Watch
2 ForAllSecure TECHx Failed POV POV Watch
3 CodeJitsu Shellphish Failed POV through defenses POV Watch
3 CSDS CodeJitsu Failed POV POV Watch
3 CSDS DeepRed Failed POV POV Watch
3 CSDS Disekt Failed POV POV Watch
3 CSDS ForAllSecure Failed POV POV Watch
3 CSDS Shellphish Failed POV through defenses POV Watch
3 CSDS TECHx Failed POV POV Watch
3 DeepRed CodeJitsu Failed POV POV Watch
3 DeepRed CSDS Failed POV POV Watch
3 DeepRed Disekt Failed POV POV Watch
3 DeepRed ForAllSecure Failed POV POV Watch
3 DeepRed Shellphish Failed POV through defenses POV Watch
3 DeepRed TECHx Failed POV POV Watch
3 ForAllSecure CodeJitsu Failed POV POV Watch
3 ForAllSecure CSDS Failed POV POV Watch
3 ForAllSecure DeepRed Failed POV POV Watch
3 ForAllSecure Disekt Failed POV POV Watch
3 ForAllSecure Shellphish Failed POV through defenses POV Watch
3 ForAllSecure TECHx Failed POV POV Watch
4 CodeJitsu Shellphish Failed POV through defenses POV Watch
4 CSDS CodeJitsu Failed POV POV Watch
4 CSDS DeepRed Failed POV POV Watch
4 CSDS Disekt Failed POV POV Watch
4 CSDS ForAllSecure Failed POV POV Watch
4 CSDS Shellphish Failed POV through defenses POV Watch
4 CSDS TECHx Failed POV POV Watch
4 DeepRed CodeJitsu Failed POV POV Watch
4 DeepRed CSDS Failed POV POV Watch
4 DeepRed Disekt Failed POV POV Watch
4 DeepRed ForAllSecure Failed POV POV Watch
4 DeepRed Shellphish Failed POV through defenses POV Watch
4 DeepRed TECHx Failed POV POV Watch
4 ForAllSecure CodeJitsu Failed POV POV Watch
4 ForAllSecure CSDS Failed POV POV Watch
4 ForAllSecure DeepRed Failed POV POV Watch
4 ForAllSecure Disekt Failed POV POV Watch
4 ForAllSecure Shellphish Failed POV through defenses POV Watch
4 ForAllSecure TECHx Failed POV POV Watch
5 CodeJitsu Shellphish Failed POV POV Watch
5 CSDS CodeJitsu Failed POV POV Watch
5 CSDS DeepRed Failed POV POV Watch
5 CSDS Disekt Failed POV POV Watch
5 CSDS ForAllSecure Failed POV POV Watch
5 CSDS Shellphish Failed POV POV Watch
5 CSDS TECHx Failed POV POV Watch
5 DeepRed CodeJitsu Failed POV POV Watch
5 DeepRed CSDS Failed POV POV Watch
5 DeepRed Disekt Failed POV POV Watch
5 DeepRed ForAllSecure Failed POV POV Watch
5 DeepRed Shellphish Failed POV POV Watch
5 DeepRed TECHx Failed POV POV Watch
5 ForAllSecure CodeJitsu Failed POV POV Watch
5 ForAllSecure CSDS Failed POV POV Watch
5 ForAllSecure DeepRed Failed POV POV Watch
5 ForAllSecure Disekt Failed POV POV Watch
5 ForAllSecure Shellphish Failed POV POV Watch
5 ForAllSecure TECHx Failed POV POV Watch
6 CodeJitsu TECHx Failed POV through defenses POV Watch
6 CSDS CodeJitsu Failed POV through defenses POV Watch
6 CSDS Disekt Failed POV POV Watch
6 CSDS ForAllSecure Failed POV POV Watch
6 CSDS Shellphish Failed POV POV Watch
6 CSDS TECHx Failed POV through defenses POV Watch
6 DeepRed CodeJitsu Failed POV through defenses POV Watch
6 DeepRed CSDS Failed POV POV Watch
6 DeepRed Disekt Failed POV POV Watch
6 DeepRed ForAllSecure Failed POV POV Watch
6 DeepRed Shellphish Failed POV POV Watch
6 DeepRed TECHx Failed POV through defenses POV Watch
6 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
6 ForAllSecure CSDS Failed POV POV Watch
6 ForAllSecure Disekt Failed POV POV Watch
6 ForAllSecure Shellphish Failed POV POV Watch
6 ForAllSecure TECHx Failed POV through defenses POV Watch
7 CodeJitsu TECHx Failed POV through defenses POV Watch
7 CSDS CodeJitsu Failed POV through defenses POV Watch
7 CSDS DeepRed Failed POV through defenses POV Watch
7 CSDS Disekt Failed POV POV Watch
7 CSDS ForAllSecure Failed POV POV Watch
7 CSDS Shellphish Failed POV POV Watch
7 CSDS TECHx Failed POV through defenses POV Watch
7 DeepRed CodeJitsu Failed POV through defenses POV Watch
7 DeepRed CSDS Failed POV POV Watch
7 DeepRed Disekt Failed POV POV Watch
7 DeepRed ForAllSecure Failed POV POV Watch
7 DeepRed Shellphish Failed POV POV Watch
7 DeepRed TECHx Failed POV through defenses POV Watch
7 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
7 ForAllSecure CSDS Failed POV POV Watch
7 ForAllSecure DeepRed Failed POV through defenses POV Watch
7 ForAllSecure Disekt Failed POV POV Watch
7 ForAllSecure Shellphish Failed POV POV Watch
7 ForAllSecure TECHx Failed POV through defenses POV Watch
8 CodeJitsu TECHx Failed POV through defenses POV Watch
8 CSDS CodeJitsu Failed POV through defenses POV Watch
8 CSDS DeepRed Failed POV through defenses POV Watch
8 CSDS Disekt Failed POV POV Watch
8 CSDS ForAllSecure Failed POV POV Watch
8 CSDS Shellphish Failed POV POV Watch
8 CSDS TECHx Failed POV through defenses POV Watch
8 DeepRed CodeJitsu Failed POV through defenses POV Watch
8 DeepRed CSDS Failed POV POV Watch
8 DeepRed Disekt Failed POV POV Watch
8 DeepRed ForAllSecure Failed POV POV Watch
8 DeepRed Shellphish Failed POV POV Watch
8 DeepRed TECHx Failed POV through defenses POV Watch
8 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
8 ForAllSecure CSDS Failed POV POV Watch
8 ForAllSecure DeepRed Failed POV through defenses POV Watch
8 ForAllSecure Disekt Failed POV POV Watch
8 ForAllSecure Shellphish Failed POV POV Watch
8 ForAllSecure TECHx Failed POV through defenses POV Watch
9 CodeJitsu TECHx Failed POV through defenses POV Watch
9 CSDS CodeJitsu Failed POV through defenses POV Watch
9 CSDS DeepRed Failed POV through defenses POV Watch
9 CSDS Disekt Failed POV POV Watch
9 CSDS ForAllSecure Failed POV POV Watch
9 CSDS Shellphish Failed POV POV Watch
9 CSDS TECHx Failed POV through defenses POV Watch
9 DeepRed CodeJitsu Failed POV through defenses POV Watch
9 DeepRed CSDS Failed POV POV Watch
9 DeepRed Disekt Failed POV POV Watch
9 DeepRed ForAllSecure Failed POV POV Watch
9 DeepRed Shellphish Failed POV POV Watch
9 DeepRed TECHx Failed POV through defenses POV Watch
9 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
9 ForAllSecure CSDS Failed POV POV Watch
9 ForAllSecure DeepRed Failed POV through defenses POV Watch
9 ForAllSecure Disekt Failed POV POV Watch
9 ForAllSecure Shellphish Failed POV POV Watch
9 ForAllSecure TECHx Failed POV through defenses POV Watch
10 CSDS CodeJitsu Failed POV through defenses POV Watch
10 CSDS DeepRed Failed POV through defenses POV Watch
10 CSDS Disekt Failed POV POV Watch
10 CSDS ForAllSecure Failed POV POV Watch
10 CSDS Shellphish Failed POV POV Watch
10 CSDS TECHx Failed POV through defenses POV Watch
10 DeepRed CodeJitsu Failed POV through defenses POV Watch
10 DeepRed CSDS Failed POV POV Watch
10 DeepRed Disekt Failed POV POV Watch
10 DeepRed ForAllSecure Failed POV POV Watch
10 DeepRed Shellphish Failed POV POV Watch
10 DeepRed TECHx Failed POV through defenses POV Watch
10 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
10 ForAllSecure CSDS Failed POV POV Watch
10 ForAllSecure DeepRed Failed POV through defenses POV Watch
10 ForAllSecure Disekt Failed POV POV Watch
10 ForAllSecure Shellphish Failed POV POV Watch
10 ForAllSecure TECHx Failed POV through defenses POV Watch
11 CSDS CodeJitsu Failed POV through defenses POV Watch
11 CSDS DeepRed Failed POV through defenses POV Watch
11 CSDS Disekt Failed POV POV Watch
11 CSDS ForAllSecure Failed POV POV Watch
11 CSDS Shellphish Failed POV POV Watch
11 CSDS TECHx Failed POV through defenses POV Watch
11 DeepRed CodeJitsu Failed POV through defenses POV Watch
11 DeepRed CSDS Failed POV POV Watch
11 DeepRed Disekt Failed POV POV Watch
11 DeepRed ForAllSecure Failed POV POV Watch
11 DeepRed Shellphish Failed POV POV Watch
11 DeepRed TECHx Failed POV through defenses POV Watch
11 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
11 ForAllSecure CSDS Failed POV POV Watch
11 ForAllSecure DeepRed Failed POV through defenses POV Watch
11 ForAllSecure Disekt Failed POV POV Watch
11 ForAllSecure Shellphish Failed POV POV Watch
11 ForAllSecure TECHx Failed POV through defenses POV Watch
12 CSDS CodeJitsu Failed POV through defenses POV Watch
12 CSDS DeepRed Failed POV through defenses POV Watch
12 CSDS Disekt Failed POV POV Watch
12 CSDS ForAllSecure Failed POV POV Watch
12 CSDS Shellphish Failed POV POV Watch
12 CSDS TECHx Failed POV through defenses POV Watch
12 DeepRed CodeJitsu Failed POV through defenses POV Watch
12 DeepRed CSDS Failed POV POV Watch
12 DeepRed Disekt Failed POV POV Watch
12 DeepRed ForAllSecure Failed POV POV Watch
12 DeepRed Shellphish Failed POV POV Watch
12 DeepRed TECHx Failed POV through defenses POV Watch
12 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
12 ForAllSecure CSDS Failed POV POV Watch
12 ForAllSecure DeepRed Failed POV through defenses POV Watch
12 ForAllSecure Disekt Failed POV POV Watch
12 ForAllSecure Shellphish Failed POV POV Watch
12 ForAllSecure TECHx Failed POV through defenses POV Watch
13 CSDS CodeJitsu Failed POV through defenses POV Watch
13 CSDS DeepRed Failed POV through defenses POV Watch
13 CSDS Disekt Failed POV POV Watch
13 CSDS ForAllSecure Failed POV POV Watch
13 CSDS Shellphish Failed POV POV Watch
13 CSDS TECHx Failed POV through defenses POV Watch
13 DeepRed CodeJitsu Failed POV through defenses POV Watch
13 DeepRed CSDS Failed POV POV Watch
13 DeepRed Disekt Failed POV POV Watch
13 DeepRed ForAllSecure Failed POV POV Watch
13 DeepRed Shellphish Failed POV POV Watch
13 DeepRed TECHx Failed POV through defenses POV Watch
13 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
13 ForAllSecure CSDS Failed POV POV Watch
13 ForAllSecure DeepRed Failed POV through defenses POV Watch
13 ForAllSecure Disekt Failed POV POV Watch
13 ForAllSecure Shellphish Failed POV POV Watch
13 ForAllSecure TECHx Failed POV through defenses POV Watch
14 CSDS CodeJitsu Failed POV through defenses POV
14 CSDS DeepRed Failed POV through defenses POV Watch
14 CSDS Disekt Failed POV POV Watch
14 CSDS ForAllSecure Failed POV POV Watch
14 CSDS Shellphish Failed POV POV Watch
14 CSDS TECHx Failed POV through defenses POV Watch
14 DeepRed CodeJitsu Failed POV through defenses POV Watch
14 DeepRed CSDS Failed POV POV Watch
14 DeepRed Disekt Failed POV POV Watch
14 DeepRed ForAllSecure Failed POV POV Watch
14 DeepRed Shellphish Failed POV POV Watch
14 DeepRed TECHx Failed POV through defenses POV Watch
14 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
14 ForAllSecure CSDS Failed POV POV Watch
14 ForAllSecure DeepRed Failed POV through defenses POV Watch
14 ForAllSecure Disekt Failed POV POV Watch
14 ForAllSecure Shellphish Failed POV POV Watch
14 ForAllSecure TECHx Failed POV through defenses POV Watch
15 CSDS CodeJitsu Failed POV POV Watch
15 CSDS DeepRed Failed POV through defenses POV Watch
15 CSDS Disekt Failed POV POV Watch
15 CSDS ForAllSecure Failed POV POV Watch
15 CSDS Shellphish Failed POV POV Watch
15 CSDS TECHx Failed POV through defenses POV Watch
15 DeepRed CodeJitsu Failed POV POV Watch
15 DeepRed CSDS Failed POV POV Watch
15 DeepRed Disekt Failed POV POV Watch
15 DeepRed ForAllSecure Failed POV POV Watch
15 DeepRed Shellphish Failed POV POV Watch
15 DeepRed TECHx Failed POV through defenses POV Watch
15 ForAllSecure CodeJitsu Failed POV POV Watch
15 ForAllSecure CSDS Failed POV POV Watch
15 ForAllSecure DeepRed Failed POV through defenses POV Watch
15 ForAllSecure Disekt Failed POV POV Watch
15 ForAllSecure Shellphish Failed POV POV Watch
15 ForAllSecure TECHx Failed POV through defenses POV Watch
16 CSDS CodeJitsu Failed POV POV Watch
16 CSDS DeepRed Failed POV through defenses POV Watch
16 CSDS Disekt Failed POV POV Watch
16 CSDS ForAllSecure Failed POV POV Watch
16 CSDS Shellphish Failed POV POV Watch
16 CSDS TECHx Failed POV through defenses POV Watch
16 DeepRed CodeJitsu Failed POV POV Watch
16 DeepRed CSDS Failed POV POV Watch
16 DeepRed Disekt Failed POV POV Watch
16 DeepRed ForAllSecure Failed POV POV Watch
16 DeepRed Shellphish Failed POV POV Watch
16 DeepRed TECHx Failed POV through defenses POV Watch
16 ForAllSecure CodeJitsu Failed POV POV Watch
16 ForAllSecure CSDS Failed POV POV Watch
16 ForAllSecure DeepRed Failed POV through defenses POV Watch
16 ForAllSecure Disekt Failed POV POV Watch
16 ForAllSecure Shellphish Failed POV POV Watch
16 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email