Challenge Information - KPRCA_00077

Commonly known as: Venture_Calculator


Rounds Enabled

79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95

Details

Original Versions

Known Vulnerabilities

  • CWE-125 - Out-of-bounds Read
  • CWE-129 - Improper Validation of Array Index
  • CWE-398 - Indicator of Poor Code Quality
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

None

DARPA performer group

Kaprica Security (KPRCA)

Description

A command line visual stack-based performant RPN calculator. Leveraging the old to build the new. Guaranteed to net a mad series A.

Feature List

Support for variety of useful operations:

  • +
  • -
  • *
  • /
  • !
  • neg
  • abs
  • mod
  • &
  • |
  • ^
  • ~
  • sum
  • avg
  • dup
  • dupn
  • dupr
  • min
  • max
  • depth
  • drop
  • dropn
  • undo (we keep a history!)
  • ivrt (invert stack, super useful!)
  • shuf (shuffle stack, even more useful!)

Only signed 32bit integers are currently supported, but our rockst^H^H^H^H^H^Hdevelopers are working on 64bit support and maybe even floats soon!

Vulnerability

Vuln 1

In the shuf function, random bytes are loaded from the secret page and then predictably scrambled. The resulting scrambled bytes are utilized to shuffle the stack.

In the dupr function, the passed position and length arguments are converted to 16bit unsigned integers and then added to form a slice into the current stack. The values used to form the index are checked, but the invalidation routine is faulty. The resulting indexed values are then pushed onto the stack. This gives an attacker the ability to load values out of memory within a limited distance from Vector in the VC class and push them onto the CalcStack where they will then be printed out.

If the random bytes loaded for the shuffle function are left in memory within a short enough distance from the accesses made in the dupr function, an attacker could leak secret page data out of the problem.

Generic class of vulnerability

Improper cleansing and leaking of sensitive data.

CWE classification

  • CWE-125: Out-of-bounds Read
  • CWE-129: Improper Validation of Array Index
  • CWE-398: Indicator of Poor Code Quality

Challenges

  • Performing the required heap manipulation to place the secret page data with reach of the out-of-bounds read.

Difficulty

  • Discovery: Easy
  • Proving: Medium
  • Patching: Easy

POV Information

Round Source Destination Result POV Analysis Video
80 CSDS CodeJitsu Failed POV POV Watch
80 CSDS DeepRed Failed POV POV Watch
80 CSDS Disekt Failed POV POV Watch
80 CSDS ForAllSecure Failed POV POV Watch
80 CSDS Shellphish Failed POV POV Watch
80 CSDS TECHx Failed POV POV Watch
80 DeepRed CodeJitsu Failed POV POV Watch
80 DeepRed CSDS Failed POV POV Watch
80 DeepRed Disekt Failed POV POV Watch
80 DeepRed ForAllSecure Failed POV POV Watch
80 DeepRed Shellphish Failed POV POV Watch
80 DeepRed TECHx Failed POV POV Watch
80 Disekt CodeJitsu Failed POV POV Watch
80 Disekt CSDS Failed POV POV Watch
80 Disekt DeepRed Failed POV POV Watch
80 Disekt ForAllSecure Failed POV POV Watch
80 Disekt Shellphish Failed POV POV Watch
80 Disekt TECHx Failed POV POV Watch
81 CSDS CodeJitsu Failed POV through defenses POV Watch
81 CSDS DeepRed Failed POV POV Watch
81 CSDS Disekt Failed POV POV Watch
81 CSDS ForAllSecure Failed POV POV Watch
81 CSDS Shellphish Failed POV POV Watch
81 CSDS TECHx Failed POV POV Watch
81 DeepRed CodeJitsu Failed POV through defenses POV Watch
81 DeepRed CSDS Failed POV POV Watch
81 DeepRed Disekt Failed POV POV Watch
81 DeepRed ForAllSecure Failed POV POV Watch
81 DeepRed Shellphish Failed POV POV Watch
81 DeepRed TECHx Failed POV POV Watch
81 Disekt CodeJitsu Failed POV through defenses POV Watch
81 Disekt CSDS Failed POV POV Watch
81 Disekt DeepRed Failed POV POV Watch
81 Disekt ForAllSecure Failed POV POV Watch
81 Disekt Shellphish Failed POV POV Watch
81 Disekt TECHx Failed POV POV Watch
82 CSDS CodeJitsu Failed POV through defenses POV Watch
82 CSDS DeepRed Failed POV POV Watch
82 CSDS Disekt Failed POV POV Watch
82 CSDS ForAllSecure Failed POV POV Watch
82 CSDS Shellphish Failed POV POV Watch
82 CSDS TECHx Failed POV POV Watch
82 DeepRed CodeJitsu Failed POV through defenses POV Watch
82 DeepRed CSDS Failed POV POV Watch
82 DeepRed Disekt Failed POV POV Watch
82 DeepRed ForAllSecure Failed POV POV Watch
82 DeepRed Shellphish Failed POV POV Watch
82 DeepRed TECHx Failed POV POV Watch
82 Disekt CodeJitsu Failed POV through defenses POV Watch
82 Disekt CSDS Failed POV POV Watch
82 Disekt DeepRed Failed POV POV Watch
82 Disekt ForAllSecure Failed POV POV Watch
82 Disekt Shellphish Failed POV POV Watch
82 Disekt TECHx Failed POV POV Watch
83 CSDS CodeJitsu Failed POV through defenses POV Watch
83 CSDS DeepRed Failed POV POV Watch
83 CSDS Disekt Failed POV POV Watch
83 CSDS ForAllSecure Failed POV POV Watch
83 CSDS Shellphish Failed POV POV Watch
83 CSDS TECHx Failed POV POV Watch
83 DeepRed CodeJitsu Failed POV through defenses POV Watch
83 DeepRed CSDS Failed POV POV Watch
83 DeepRed Disekt Failed POV POV Watch
83 DeepRed ForAllSecure Failed POV POV Watch
83 DeepRed Shellphish Failed POV POV Watch
83 DeepRed TECHx Failed POV POV Watch
83 Disekt CodeJitsu Failed POV through defenses POV Watch
83 Disekt CSDS Failed POV POV Watch
83 Disekt DeepRed Failed POV POV Watch
83 Disekt ForAllSecure Failed POV POV Watch
83 Disekt Shellphish Failed POV POV Watch
83 Disekt TECHx Failed POV POV Watch
84 CSDS CodeJitsu Failed POV through defenses POV Watch
84 CSDS DeepRed Failed POV POV Watch
84 CSDS Disekt Failed POV POV Watch
84 CSDS ForAllSecure Failed POV POV Watch
84 CSDS Shellphish Failed POV POV Watch
84 CSDS TECHx Failed POV POV Watch
84 DeepRed CodeJitsu Failed POV through defenses POV Watch
84 DeepRed CSDS Failed POV POV Watch
84 DeepRed Disekt Failed POV POV Watch
84 DeepRed ForAllSecure Failed POV POV Watch
84 DeepRed Shellphish Failed POV POV Watch
84 DeepRed TECHx Failed POV POV Watch
84 Disekt CodeJitsu Failed POV through defenses POV Watch
84 Disekt CSDS Failed POV POV Watch
84 Disekt DeepRed Failed POV POV Watch
84 Disekt ForAllSecure Failed POV POV Watch
84 Disekt Shellphish Failed POV POV Watch
84 Disekt TECHx Failed POV POV Watch
85 CSDS CodeJitsu Failed POV through defenses POV Watch
85 CSDS DeepRed Failed POV POV Watch
85 CSDS Disekt Failed POV POV Watch
85 CSDS ForAllSecure Failed POV POV Watch
85 CSDS Shellphish Failed POV POV Watch
85 CSDS TECHx Failed POV POV Watch
85 DeepRed CodeJitsu Failed POV through defenses POV Watch
85 DeepRed CSDS Failed POV POV Watch
85 DeepRed Disekt Failed POV POV Watch
85 DeepRed ForAllSecure Failed POV POV Watch
85 DeepRed Shellphish Failed POV POV Watch
85 DeepRed TECHx Failed POV POV Watch
85 Disekt CodeJitsu Failed POV through defenses POV Watch
85 Disekt CSDS Failed POV POV Watch
85 Disekt DeepRed Failed POV POV Watch
85 Disekt ForAllSecure Failed POV POV Watch
85 Disekt Shellphish Failed POV POV Watch
85 Disekt TECHx Failed POV POV Watch
86 CodeJitsu Shellphish Failed POV through defenses POV Watch
86 CSDS CodeJitsu Failed POV through defenses POV Watch
86 CSDS DeepRed Failed POV POV Watch
86 CSDS Disekt Failed POV POV Watch
86 CSDS ForAllSecure Failed POV POV Watch
86 CSDS Shellphish Failed POV through defenses POV Watch
86 CSDS TECHx Failed POV POV Watch
86 DeepRed CodeJitsu Failed POV through defenses POV Watch
86 DeepRed CSDS Failed POV POV Watch
86 DeepRed Disekt Failed POV POV Watch
86 DeepRed ForAllSecure Failed POV POV Watch
86 DeepRed Shellphish Failed POV through defenses POV Watch
86 DeepRed TECHx Failed POV POV Watch
86 Disekt CodeJitsu Failed POV through defenses POV Watch
86 Disekt CSDS Failed POV POV Watch
86 Disekt DeepRed Failed POV POV Watch
86 Disekt ForAllSecure Failed POV POV Watch
86 Disekt Shellphish Failed POV through defenses POV Watch
86 Disekt TECHx Failed POV POV Watch
87 CSDS CodeJitsu Failed POV through defenses POV Watch
87 CSDS DeepRed Failed POV POV Watch
87 CSDS Disekt Failed POV POV Watch
87 CSDS ForAllSecure Failed POV POV Watch
87 CSDS Shellphish Failed POV through defenses POV Watch
87 CSDS TECHx Failed POV POV Watch
87 DeepRed CodeJitsu Failed POV through defenses POV Watch
87 DeepRed CSDS Failed POV POV Watch
87 DeepRed Disekt Failed POV POV Watch
87 DeepRed ForAllSecure Failed POV POV Watch
87 DeepRed Shellphish Failed POV through defenses POV Watch
87 DeepRed TECHx Failed POV POV Watch
87 Disekt CodeJitsu Failed POV through defenses POV Watch
87 Disekt CSDS Failed POV POV Watch
87 Disekt DeepRed Failed POV POV Watch
87 Disekt ForAllSecure Failed POV POV Watch
87 Disekt Shellphish Failed POV through defenses POV Watch
87 Disekt TECHx Failed POV POV Watch
88 CSDS CodeJitsu Failed POV through defenses POV Watch
88 CSDS DeepRed Failed POV POV Watch
88 CSDS Disekt Failed POV POV Watch
88 CSDS ForAllSecure Failed POV POV Watch
88 CSDS Shellphish Failed POV through defenses POV Watch
88 CSDS TECHx Failed POV POV Watch
88 DeepRed CodeJitsu Failed POV through defenses POV Watch
88 DeepRed CSDS Failed POV POV Watch
88 DeepRed Disekt Failed POV POV Watch
88 DeepRed ForAllSecure Failed POV POV Watch
88 DeepRed Shellphish Failed POV through defenses POV Watch
88 DeepRed TECHx Failed POV POV Watch
88 Disekt CodeJitsu Failed POV through defenses POV Watch
88 Disekt CSDS Failed POV POV Watch
88 Disekt DeepRed Failed POV POV Watch
88 Disekt ForAllSecure Failed POV POV Watch
88 Disekt Shellphish Failed POV through defenses POV Watch
88 Disekt TECHx Failed POV POV Watch
89 CodeJitsu Shellphish Failed POV POV Watch
89 CSDS CodeJitsu Failed POV through defenses POV Watch
89 CSDS DeepRed Failed POV POV Watch
89 CSDS Disekt Failed POV POV Watch
89 CSDS ForAllSecure Failed POV POV Watch
89 CSDS Shellphish Failed POV POV Watch
89 CSDS TECHx Failed POV POV Watch
89 DeepRed CodeJitsu Failed POV through defenses POV Watch
89 DeepRed CSDS Failed POV POV Watch
89 DeepRed Disekt Failed POV POV Watch
89 DeepRed ForAllSecure Failed POV POV Watch
89 DeepRed Shellphish Failed POV POV Watch
89 DeepRed TECHx Failed POV POV Watch
89 Disekt CodeJitsu Failed POV through defenses POV Watch
89 Disekt CSDS Failed POV POV Watch
89 Disekt DeepRed Failed POV POV Watch
89 Disekt ForAllSecure Failed POV POV Watch
89 Disekt Shellphish Failed POV POV Watch
89 Disekt TECHx Failed POV POV Watch
90 CSDS CodeJitsu Failed POV through defenses POV Watch
90 CSDS DeepRed Failed POV POV Watch
90 CSDS Disekt Failed POV POV Watch
90 CSDS ForAllSecure Failed POV POV Watch
90 CSDS Shellphish Failed POV POV Watch
90 CSDS TECHx Failed POV POV Watch
90 DeepRed CodeJitsu Failed POV through defenses POV Watch
90 DeepRed CSDS Failed POV POV Watch
90 DeepRed Disekt Failed POV POV Watch
90 DeepRed ForAllSecure Failed POV POV Watch
90 DeepRed Shellphish Failed POV POV Watch
90 DeepRed TECHx Failed POV POV Watch
90 Disekt CodeJitsu Failed POV through defenses POV Watch
90 Disekt CSDS Failed POV POV Watch
90 Disekt DeepRed Failed POV POV Watch
90 Disekt ForAllSecure Failed POV POV Watch
90 Disekt Shellphish Failed POV POV Watch
90 Disekt TECHx Failed POV POV Watch
91 CSDS CodeJitsu Failed POV through defenses POV Watch
91 CSDS DeepRed Failed POV POV Watch
91 CSDS Disekt Failed POV POV Watch
91 CSDS ForAllSecure Failed POV POV Watch
91 CSDS Shellphish Failed POV POV Watch
91 CSDS TECHx Failed POV POV Watch
91 DeepRed CodeJitsu Failed POV through defenses POV Watch
91 DeepRed CSDS Failed POV POV Watch
91 DeepRed Disekt Failed POV POV Watch
91 DeepRed ForAllSecure Failed POV POV Watch
91 DeepRed Shellphish Failed POV POV Watch
91 DeepRed TECHx Failed POV POV Watch
91 Disekt CodeJitsu Failed POV through defenses POV Watch
91 Disekt CSDS Failed POV POV Watch
91 Disekt DeepRed Failed POV POV Watch
91 Disekt ForAllSecure Failed POV POV Watch
91 Disekt Shellphish Failed POV POV Watch
91 Disekt TECHx Failed POV POV Watch
92 CSDS CodeJitsu Failed POV through defenses POV Watch
92 CSDS DeepRed Failed POV POV Watch
92 CSDS Disekt Failed POV POV Watch
92 CSDS ForAllSecure Failed POV POV Watch
92 CSDS Shellphish Failed POV POV Watch
92 CSDS TECHx Failed POV POV Watch
92 DeepRed CodeJitsu Failed POV through defenses POV Watch
92 DeepRed CSDS Failed POV POV Watch
92 DeepRed Disekt Failed POV POV Watch
92 DeepRed ForAllSecure Failed POV POV Watch
92 DeepRed Shellphish Failed POV POV Watch
92 DeepRed TECHx Failed POV POV Watch
92 Disekt CodeJitsu Failed POV through defenses POV Watch
92 Disekt CSDS Failed POV POV Watch
92 Disekt DeepRed Failed POV POV Watch
92 Disekt ForAllSecure Failed POV POV Watch
92 Disekt Shellphish Failed POV POV Watch
92 Disekt TECHx Failed POV POV Watch
93 CSDS CodeJitsu Failed POV through defenses POV Watch
93 CSDS DeepRed Failed POV POV Watch
93 CSDS Disekt Failed POV POV Watch
93 CSDS ForAllSecure Failed POV POV Watch
93 CSDS Shellphish Failed POV POV Watch
93 CSDS TECHx Failed POV POV Watch
93 DeepRed CodeJitsu Failed POV through defenses POV Watch
93 DeepRed CSDS Failed POV POV Watch
93 DeepRed Disekt Failed POV POV Watch
93 DeepRed ForAllSecure Failed POV POV Watch
93 DeepRed Shellphish Failed POV POV Watch
93 DeepRed TECHx Failed POV POV Watch
93 Disekt CodeJitsu Failed POV through defenses POV Watch
93 Disekt CSDS Failed POV POV Watch
93 Disekt DeepRed Failed POV POV Watch
93 Disekt ForAllSecure Failed POV POV Watch
93 Disekt Shellphish Failed POV POV Watch
93 Disekt TECHx Failed POV POV Watch
94 CSDS CodeJitsu Failed POV through defenses POV Watch
94 CSDS DeepRed Failed POV POV Watch
94 CSDS Disekt Failed POV POV Watch
94 CSDS ForAllSecure Failed POV POV Watch
94 CSDS Shellphish Failed POV POV Watch
94 CSDS TECHx Failed POV POV Watch
94 DeepRed CodeJitsu Failed POV through defenses POV Watch
94 DeepRed CSDS Failed POV POV Watch
94 DeepRed Disekt Failed POV POV Watch
94 DeepRed ForAllSecure Failed POV POV Watch
94 DeepRed Shellphish Failed POV POV Watch
94 DeepRed TECHx Failed POV POV Watch
94 Disekt CodeJitsu Failed POV through defenses POV Watch
94 Disekt CSDS Failed POV POV Watch
94 Disekt DeepRed Failed POV POV Watch
94 Disekt ForAllSecure Failed POV POV Watch
94 Disekt Shellphish Failed POV POV Watch
94 Disekt TECHx Failed POV POV Watch
95 CSDS CodeJitsu Failed POV through defenses POV Watch
95 CSDS DeepRed Failed POV POV Watch
95 CSDS Disekt Failed POV POV Watch
95 CSDS ForAllSecure Failed POV POV Watch
95 CSDS Shellphish Failed POV POV Watch
95 CSDS TECHx Failed POV POV Watch
95 DeepRed CodeJitsu Failed POV through defenses POV Watch
95 DeepRed CSDS Failed POV POV Watch
95 DeepRed Disekt Failed POV POV Watch
95 DeepRed ForAllSecure Failed POV POV Watch
95 DeepRed Shellphish Failed POV POV Watch
95 DeepRed TECHx Failed POV POV Watch
95 Disekt CodeJitsu Failed POV through defenses POV Watch
95 Disekt CSDS Failed POV POV Watch
95 Disekt DeepRed Failed POV POV Watch
95 Disekt ForAllSecure Failed POV POV Watch
95 Disekt Shellphish Failed POV POV Watch
95 Disekt TECHx Failed POV POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email