Challenge Information - KPRCA_00093

Commonly known as: BIRC


Rounds Enabled

34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
  • CWE-287 - Improper Authentication
  • CWE-521 - Weak Password Requirements
  • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

A binary protocol inspired by an internet relay chat service service

Feature List

The CB proivdes a Client/Server model with the server holding all of the program's state and the client interfacing with the user to make requests and receive responses. A client may make the following request to the sever: -Register an account -Verify user password -Search for registered accounts -Add a channel -Join other channels -Search for registered channels -Leave a channel -Delete a channel if the user is its creator -Request server tokens, if the user is a remote admin -Exit Client/Server The local client also allows a user to switch between accounts via a login/logout

Vulnerability

Vuln 1

The vulnerability is triggered by a buffer overflow which allows an attacker to overwrite the name of the first cached user. This allows an attacker to change the client's username to {12, 34, 56, 78} (which is supposed to represent some well known admin string, such as "root" or "admin"). This special value represents the server's internal default admin user whose password is the same as its username (think admin/admin). By exploiting this realitively simple 4 byte user/pass combination the client can access functionality that it was never supposed to have access to. This gives the attacker access to a privileged function call that can access the server's secret data.

The patch not only fixes the buffer overflow, but changes the remote server authentication from a short and guessable password to a longer and harder to brute force token.

Generic class of vulnerability

Buffer overflow Weak permission/authentication

CWE classification

CWE-121: Stack-based Buffer Overflow CWE-287: Improper Authentication CWE-521: Weak Password Requirements

Challenges

The challenege for this CB is understanding how both the client and the server function in order to enable the info leak. The CB has built a nontrivial communication protocol between the client and server in order to test the CRS's ability to interpret structured data. With this model the data sent from the CRS to the client does not use the same structure as the data protocol between the client and server. This forces the CRS to deduce the communication protocol strictly through binary analysis and not through pcap data.

Difficulty

  • Discovery: easy
  • Proving: hard
  • Patching: medium

POV Information

Round Source Destination Result POV Analysis Video
35 CSDS CodeJitsu Failed POV POV Watch
35 CSDS DeepRed Failed POV POV Watch
35 CSDS Disekt Failed POV POV Watch
35 CSDS ForAllSecure Failed POV POV Watch
35 CSDS Shellphish Failed POV POV Watch
35 CSDS TECHx Failed POV POV Watch
35 DeepRed CodeJitsu Failed POV POV Watch
35 DeepRed CSDS Failed POV POV Watch
35 DeepRed Disekt Failed POV POV Watch
35 DeepRed ForAllSecure Failed POV POV Watch
35 DeepRed Shellphish Failed POV POV Watch
35 DeepRed TECHx Failed POV POV Watch
36 CSDS CodeJitsu Failed POV POV Watch
36 CSDS DeepRed Failed POV POV Watch
36 CSDS Disekt Failed POV POV Watch
36 CSDS ForAllSecure Failed POV POV Watch
36 CSDS Shellphish Failed POV POV Watch
36 DeepRed CodeJitsu Failed POV POV Watch
36 DeepRed CSDS Failed POV POV Watch
36 DeepRed Disekt Failed POV POV Watch
36 DeepRed ForAllSecure Failed POV POV Watch
36 DeepRed Shellphish Failed POV POV Watch
36 ForAllSecure CodeJitsu Failed POV POV Watch
36 ForAllSecure CSDS Failed POV POV Watch
36 ForAllSecure DeepRed Failed POV POV Watch
36 ForAllSecure Disekt Failed POV POV Watch
36 ForAllSecure Shellphish Failed POV POV Watch
37 CodeJitsu Shellphish Failed POV through defenses POV Watch
37 CSDS CodeJitsu Failed POV POV Watch
37 CSDS DeepRed Failed POV POV Watch
37 CSDS Disekt Failed POV POV Watch
37 CSDS ForAllSecure Failed POV POV Watch
37 CSDS Shellphish Failed POV through defenses POV Watch
37 CSDS TECHx Failed POV through defenses POV Watch
37 DeepRed CodeJitsu Failed POV POV Watch
37 DeepRed CSDS Failed POV POV Watch
37 DeepRed Disekt Failed POV POV Watch
37 DeepRed ForAllSecure Failed POV POV Watch
37 DeepRed Shellphish Failed POV through defenses POV Watch
37 DeepRed TECHx Failed POV through defenses POV Watch
37 ForAllSecure CodeJitsu Failed POV POV Watch
37 ForAllSecure CSDS Failed POV POV Watch
37 ForAllSecure DeepRed Failed POV POV Watch
37 ForAllSecure Disekt Failed POV POV Watch
37 ForAllSecure Shellphish Failed POV through defenses POV Watch
37 ForAllSecure TECHx Failed POV through defenses POV Watch
38 CSDS CodeJitsu Failed POV POV Watch
38 CSDS DeepRed Failed POV POV Watch
38 CSDS Disekt Failed POV POV Watch
38 CSDS ForAllSecure Failed POV POV Watch
38 CSDS Shellphish Failed POV through defenses POV Watch
38 CSDS TECHx Failed POV through defenses POV Watch
38 DeepRed CodeJitsu Failed POV POV Watch
38 DeepRed CSDS Failed POV POV Watch
38 DeepRed Disekt Failed POV POV Watch
38 DeepRed ForAllSecure Failed POV POV Watch
38 DeepRed Shellphish Failed POV through defenses POV Watch
38 DeepRed TECHx Failed POV through defenses POV Watch
38 ForAllSecure CodeJitsu Failed POV POV Watch
38 ForAllSecure CSDS Failed POV POV Watch
38 ForAllSecure DeepRed Failed POV POV Watch
38 ForAllSecure Disekt Failed POV POV Watch
38 ForAllSecure Shellphish Failed POV through defenses POV Watch
38 ForAllSecure TECHx Failed POV through defenses POV Watch
39 CSDS CodeJitsu Failed POV POV Watch
39 CSDS DeepRed Failed POV POV Watch
39 CSDS Disekt Failed POV POV Watch
39 CSDS ForAllSecure Failed POV POV Watch
39 CSDS Shellphish Failed POV through defenses POV Watch
39 CSDS TECHx Failed POV through defenses POV Watch
39 DeepRed CodeJitsu Failed POV POV Watch
39 DeepRed CSDS Failed POV POV Watch
39 DeepRed Disekt Failed POV POV Watch
39 DeepRed ForAllSecure Failed POV POV Watch
39 DeepRed Shellphish Failed POV through defenses POV Watch
39 DeepRed TECHx Failed POV through defenses POV Watch
39 ForAllSecure CodeJitsu Failed POV POV Watch
39 ForAllSecure CSDS Failed POV POV Watch
39 ForAllSecure DeepRed Failed POV POV Watch
39 ForAllSecure Disekt Failed POV POV Watch
39 ForAllSecure Shellphish Failed POV through defenses POV Watch
39 ForAllSecure TECHx Failed POV through defenses POV Watch
40 CSDS CodeJitsu Failed POV POV Watch
40 CSDS DeepRed Failed POV POV Watch
40 CSDS Disekt Failed POV POV Watch
40 CSDS ForAllSecure Failed POV POV Watch
40 CSDS Shellphish Failed POV through defenses POV Watch
40 CSDS TECHx Failed POV through defenses POV Watch
40 DeepRed CodeJitsu Failed POV POV Watch
40 DeepRed CSDS Failed POV POV Watch
40 DeepRed Disekt Failed POV POV Watch
40 DeepRed ForAllSecure Failed POV POV Watch
40 DeepRed Shellphish Failed POV through defenses POV Watch
40 DeepRed TECHx Failed POV through defenses POV Watch
40 ForAllSecure CodeJitsu Failed POV POV Watch
40 ForAllSecure CSDS Failed POV POV Watch
40 ForAllSecure DeepRed Failed POV POV Watch
40 ForAllSecure Disekt Failed POV POV Watch
40 ForAllSecure Shellphish Failed POV through defenses POV Watch
40 ForAllSecure TECHx Failed POV through defenses POV Watch
41 CSDS CodeJitsu Failed POV POV Watch
41 CSDS DeepRed Failed POV POV Watch
41 CSDS Disekt Failed POV POV Watch
41 CSDS ForAllSecure Failed POV POV Watch
41 CSDS Shellphish Failed POV through defenses POV Watch
41 CSDS TECHx Failed POV through defenses POV Watch
41 DeepRed CodeJitsu Failed POV POV Watch
41 DeepRed CSDS Failed POV POV Watch
41 DeepRed Disekt Failed POV POV Watch
41 DeepRed ForAllSecure Failed POV POV Watch
41 DeepRed Shellphish Failed POV through defenses POV Watch
41 DeepRed TECHx Failed POV through defenses POV Watch
41 ForAllSecure CodeJitsu Failed POV POV Watch
41 ForAllSecure CSDS Failed POV POV Watch
41 ForAllSecure DeepRed Failed POV POV Watch
41 ForAllSecure Disekt Failed POV POV Watch
41 ForAllSecure Shellphish Failed POV through defenses POV Watch
41 ForAllSecure TECHx Failed POV through defenses POV Watch
42 CodeJitsu Shellphish Failed POV POV Watch
42 CSDS CodeJitsu Failed POV POV Watch
42 CSDS DeepRed Failed POV POV Watch
42 CSDS Disekt Failed POV POV Watch
42 CSDS ForAllSecure Failed POV POV Watch
42 CSDS Shellphish Failed POV POV Watch
42 CSDS TECHx Failed POV through defenses POV Watch
42 DeepRed CodeJitsu Failed POV POV Watch
42 DeepRed CSDS Failed POV POV Watch
42 DeepRed Disekt Failed POV POV Watch
42 DeepRed ForAllSecure Failed POV POV Watch
42 DeepRed Shellphish Failed POV POV Watch
42 DeepRed TECHx Failed POV through defenses POV Watch
42 ForAllSecure CodeJitsu Failed POV POV Watch
42 ForAllSecure CSDS Failed POV POV Watch
42 ForAllSecure DeepRed Failed POV POV Watch
42 ForAllSecure Disekt Failed POV POV Watch
42 ForAllSecure Shellphish Failed POV POV Watch
42 ForAllSecure TECHx Failed POV through defenses POV Watch
43 CSDS CodeJitsu Failed POV POV Watch
43 CSDS DeepRed Failed POV POV Watch
43 CSDS Disekt Failed POV POV Watch
43 CSDS ForAllSecure Failed POV POV Watch
43 CSDS Shellphish Failed POV POV Watch
43 CSDS TECHx Failed POV through defenses POV Watch
43 DeepRed CodeJitsu Failed POV POV Watch
43 DeepRed CSDS Failed POV POV Watch
43 DeepRed Disekt Failed POV POV Watch
43 DeepRed ForAllSecure Failed POV POV Watch
43 DeepRed Shellphish Failed POV POV Watch
43 DeepRed TECHx Failed POV through defenses POV Watch
43 ForAllSecure CodeJitsu Failed POV POV Watch
43 ForAllSecure CSDS Failed POV POV Watch
43 ForAllSecure DeepRed Failed POV POV Watch
43 ForAllSecure Disekt Failed POV POV Watch
43 ForAllSecure Shellphish Failed POV POV Watch
43 ForAllSecure TECHx Failed POV through defenses POV Watch
44 CSDS CodeJitsu Failed POV POV Watch
44 CSDS DeepRed Failed POV POV Watch
44 CSDS Disekt Failed POV POV Watch
44 CSDS ForAllSecure Failed POV POV Watch
44 CSDS Shellphish Failed POV POV Watch
44 CSDS TECHx Failed POV through defenses POV Watch
44 DeepRed CodeJitsu Failed POV POV Watch
44 DeepRed CSDS Failed POV POV Watch
44 DeepRed Disekt Failed POV POV Watch
44 DeepRed ForAllSecure Failed POV POV Watch
44 DeepRed Shellphish Failed POV POV Watch
44 DeepRed TECHx Failed POV through defenses POV Watch
44 ForAllSecure CodeJitsu Failed POV POV Watch
44 ForAllSecure CSDS Failed POV POV Watch
44 ForAllSecure DeepRed Failed POV POV Watch
44 ForAllSecure Disekt Failed POV POV Watch
44 ForAllSecure Shellphish Failed POV POV Watch
44 ForAllSecure TECHx Failed POV through defenses POV Watch
45 CSDS CodeJitsu Failed POV POV Watch
45 CSDS DeepRed Failed POV POV Watch
45 CSDS Disekt Failed POV POV Watch
45 CSDS ForAllSecure Failed POV POV Watch
45 CSDS Shellphish Failed POV POV Watch
45 CSDS TECHx Failed POV through defenses POV Watch
45 DeepRed CodeJitsu Failed POV POV Watch
45 DeepRed CSDS Failed POV POV Watch
45 DeepRed Disekt Failed POV POV Watch
45 DeepRed ForAllSecure Failed POV POV Watch
45 DeepRed Shellphish Failed POV POV Watch
45 DeepRed TECHx Failed POV through defenses POV Watch
45 ForAllSecure CodeJitsu Failed POV POV Watch
45 ForAllSecure CSDS Failed POV POV Watch
45 ForAllSecure DeepRed Failed POV POV Watch
45 ForAllSecure Disekt Failed POV POV Watch
45 ForAllSecure Shellphish Failed POV POV Watch
45 ForAllSecure TECHx Failed POV through defenses POV Watch
46 CSDS CodeJitsu Failed POV POV Watch
46 CSDS DeepRed Failed POV POV Watch
46 CSDS Disekt Failed POV POV Watch
46 CSDS ForAllSecure Failed POV POV Watch
46 CSDS Shellphish Failed POV POV Watch
46 CSDS TECHx Failed POV through defenses POV Watch
46 DeepRed CodeJitsu Failed POV POV Watch
46 DeepRed CSDS Failed POV POV Watch
46 DeepRed Disekt Failed POV POV Watch
46 DeepRed ForAllSecure Failed POV POV Watch
46 DeepRed Shellphish Failed POV POV Watch
46 DeepRed TECHx Failed POV through defenses POV Watch
46 ForAllSecure CodeJitsu Failed POV POV Watch
46 ForAllSecure CSDS Failed POV POV Watch
46 ForAllSecure DeepRed Failed POV POV Watch
46 ForAllSecure Disekt Failed POV POV Watch
46 ForAllSecure Shellphish Failed POV POV Watch
46 ForAllSecure TECHx Failed POV through defenses POV Watch
47 CSDS CodeJitsu Failed POV POV Watch
47 CSDS DeepRed Failed POV POV Watch
47 CSDS Disekt Failed POV POV Watch
47 CSDS ForAllSecure Failed POV POV Watch
47 CSDS Shellphish Failed POV POV Watch
47 CSDS TECHx Failed POV through defenses POV Watch
47 DeepRed CodeJitsu Failed POV POV Watch
47 DeepRed CSDS Failed POV POV Watch
47 DeepRed Disekt Failed POV POV Watch
47 DeepRed ForAllSecure Failed POV POV Watch
47 DeepRed Shellphish Failed POV POV Watch
47 DeepRed TECHx Failed POV through defenses POV Watch
47 ForAllSecure CodeJitsu Failed POV POV Watch
47 ForAllSecure CSDS Failed POV POV Watch
47 ForAllSecure DeepRed Failed POV POV Watch
47 ForAllSecure Disekt Failed POV POV Watch
47 ForAllSecure Shellphish Failed POV POV Watch
47 ForAllSecure TECHx Failed POV through defenses POV Watch
48 CSDS CodeJitsu Failed POV POV Watch
48 CSDS DeepRed Failed POV POV Watch
48 CSDS Disekt Failed POV POV Watch
48 CSDS ForAllSecure Failed POV POV Watch
48 CSDS Shellphish Failed POV POV Watch
48 CSDS TECHx Failed POV through defenses POV Watch
48 DeepRed CodeJitsu Failed POV POV Watch
48 DeepRed CSDS Failed POV POV Watch
48 DeepRed Disekt Failed POV POV Watch
48 DeepRed ForAllSecure Failed POV POV Watch
48 DeepRed Shellphish Failed POV POV Watch
48 DeepRed TECHx Failed POV through defenses POV Watch
48 ForAllSecure CodeJitsu Failed POV POV Watch
48 ForAllSecure CSDS Failed POV POV Watch
48 ForAllSecure DeepRed Failed POV POV Watch
48 ForAllSecure Disekt Failed POV POV Watch
48 ForAllSecure Shellphish Failed POV POV Watch
48 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email