Challenge Information - NRFIN_00049

Commonly known as: Matchmaker

Rounds Enabled

0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14

Details

Original Versions

Known Vulnerabilities

  • CWE-129 - Improper Validation of Array Index
  • CWE-190 - Integer Overflow or Wraparound
  • CWE-20 - Improper Input Validation
  • CWE-201 - Information Exposure Through Sent Data
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

Author Information

"Maxwell Koo" info@narfindustries.com

DARPA performer group

Narf Industries (NRFIN)

Description

Parsing as a service! This service handles all of your regular language recognition needs. Input a description of a regular language compiled into a series of statements representing a discrete finite automaton, and then enter in strings to test if they are accepted by the language or not. Also included is a method to generate strings which match a language, for testing purposes. Configurable actions are taken on a match.

Feature List

This service allows a user to test strings against a description of a regular language.

  • Parses descriptions of DFAs
  • Tests user input to see if it is accepted by a DFA
  • Can reset language description on the fly
  • Can generate example strings satisfying the language
  • Can configure custom actions to be taken on a match

Vulnerability 1

This service leaks data from the flag page. The "magic" action uses the input string to calculate an offset into the flag page to take a byte, and then drops the user into a "guess the number" style game. A byte from the flag page can be leaked then by binary search.

Generic class of vulnerability

Information exposure through sent data

CWE classification

CWE-201 Information exposure through sent data

Challenges

  • The vulnerability can be discovered by a CRS which does taint tracking, this is made more difficult by hiding the vulnerable function behind an indirect function call which requires a specific input to enable.
  • Proving the vulnerability requires the ability to enable the vulnerable function through a specific command, provide a series of inputs which result in the leak of four consecutive bytes, and reasoning about the functionality of the number game in order to successfully leak the required information.
  • Fixing the vulnerability is easy once identified. The byte retrieved from the flag page is not crucial to the operation of the game, so changing where that byte comes from is sufficient to prevent the leakage.

Difficulty

  • Discovering is medium
  • Proving is hard
  • Fixing is easy

Vulnerability 2

The service uses a signed type improperly as an array index, allowing crafted data to be parsed by the application leading to control of EIP and EAX. By transitioning to a state >= 128, state objects are looked up outside of the states array due to interpreting the state as a signed char. This allows an attacker to control the onmatch handler and data pointer.

Generic class of vulnerability

Improper input validation Integer overflow or wraparound Improper validation of array index

CWE classification

CWE-20: Improper input validation CWE-190: Integer overflow or wraparound CWE-129: Improper validation of array index

Challenges

  • The vulnerability can be discovered by a CRS which looks for out of bounds array accesses, including those who do not directly lead to a crash. This is made more difficult by requiring an input with >= 128 states to lead to an out of bounds access.
  • This vulnerability was designed to make proving through fuzzing or symbolic execution difficult by use of an input language with a specific grammar and behaviors which require specific structure to the inputs and depend on input length, etc. In order to trigger this vulnerability, an input with >= 128 states followed by an input which can successfully transition to an accept state beyond 127 is required.
  • Fixing the vulnerability is easy once identified, by inserting bounds checks around all potentially vulnerable accesses.

Difficulty

  • Discovering is medium
  • Proving is hard
  • Fixing is easy

POV Information

Round Source Destination Result POV Analysis Video
1 CSDS CodeJitsu Failed POV POV Watch
1 CSDS DeepRed Failed POV POV Watch
1 CSDS Disekt Failed POV POV Watch
1 CSDS ForAllSecure Failed POV POV Watch
1 CSDS Shellphish Failed POV POV Watch
1 CSDS TECHx Failed POV POV Watch
1 DeepRed CodeJitsu Failed POV POV Watch
1 DeepRed CSDS Failed POV POV Watch
1 DeepRed Disekt Failed POV POV Watch
1 DeepRed ForAllSecure Failed POV POV Watch
1 DeepRed Shellphish Failed POV POV Watch
1 DeepRed TECHx Failed POV POV Watch
1 ForAllSecure CodeJitsu Failed POV POV Watch
1 ForAllSecure CSDS Failed POV POV Watch
1 ForAllSecure DeepRed Failed POV POV Watch
1 ForAllSecure Disekt Failed POV POV Watch
1 ForAllSecure Shellphish Failed POV POV Watch
1 ForAllSecure TECHx Failed POV POV Watch
2 CodeJitsu CSDS Failed POV through defenses POV Watch
2 CodeJitsu Disekt Failed POV through defenses POV Watch
2 CodeJitsu Shellphish Failed POV through defenses POV Watch
2 CSDS CodeJitsu Failed POV POV Watch
2 CSDS DeepRed Failed POV POV Watch
2 CSDS Disekt Failed POV through defenses POV Watch
2 CSDS ForAllSecure Failed POV POV Watch
2 CSDS Shellphish Failed POV through defenses POV Watch
2 DeepRed CodeJitsu Failed POV POV Watch
2 DeepRed CSDS Failed POV through defenses POV Watch
2 DeepRed Disekt Failed POV through defenses POV Watch
2 DeepRed ForAllSecure Failed POV POV Watch
2 DeepRed Shellphish Failed POV through defenses POV Watch
2 ForAllSecure CodeJitsu Failed POV POV Watch
2 ForAllSecure CSDS Failed POV through defenses POV Watch
2 ForAllSecure DeepRed Failed POV POV Watch
2 ForAllSecure Disekt Failed POV through defenses POV Watch
2 ForAllSecure Shellphish Failed POV through defenses POV Watch
3 CSDS CodeJitsu Failed POV POV Watch
3 CSDS DeepRed Failed POV POV Watch
3 CSDS Disekt Failed POV through defenses POV Watch
3 CSDS ForAllSecure Failed POV POV Watch
3 CSDS Shellphish Failed POV through defenses POV Watch
3 CSDS TECHx Failed POV through defenses POV Watch
3 DeepRed CodeJitsu Failed POV POV Watch
3 DeepRed CSDS Failed POV through defenses POV Watch
3 DeepRed Disekt Failed POV through defenses POV Watch
3 DeepRed ForAllSecure Failed POV POV Watch
3 DeepRed Shellphish Failed POV through defenses POV Watch
3 DeepRed TECHx Failed POV through defenses POV Watch
3 ForAllSecure CodeJitsu Failed POV POV Watch
3 ForAllSecure CSDS Failed POV through defenses POV Watch
3 ForAllSecure DeepRed Failed POV POV Watch
3 ForAllSecure Disekt Failed POV through defenses POV Watch
3 ForAllSecure Shellphish Failed POV through defenses POV Watch
3 ForAllSecure TECHx Failed POV through defenses POV Watch
4 CodeJitsu ForAllSecure Failed POV through defenses POV Watch
4 CSDS CodeJitsu Failed POV through defenses POV Watch
4 CSDS Disekt Failed POV through defenses POV Watch
4 CSDS ForAllSecure Failed POV through defenses POV Watch
4 CSDS Shellphish Failed POV through defenses POV Watch
4 CSDS TECHx Failed POV through defenses POV Watch
4 DeepRed CodeJitsu Failed POV through defenses POV Watch
4 DeepRed CSDS Failed POV through defenses POV Watch
4 DeepRed Disekt Failed POV through defenses POV Watch
4 DeepRed ForAllSecure Failed POV through defenses POV Watch
4 DeepRed Shellphish Failed POV through defenses POV Watch
4 DeepRed TECHx Failed POV through defenses POV Watch
4 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
4 ForAllSecure CSDS Failed POV through defenses POV Watch
4 ForAllSecure Disekt Failed POV through defenses POV Watch
4 ForAllSecure Shellphish Failed POV through defenses POV Watch
4 ForAllSecure TECHx Failed POV through defenses POV Watch
5 CSDS CodeJitsu Failed POV through defenses POV Watch
5 CSDS DeepRed Failed POV through defenses POV
5 CSDS Disekt Failed POV through defenses POV Watch
5 CSDS ForAllSecure Failed POV through defenses POV Watch
5 CSDS Shellphish Failed POV through defenses POV Watch
5 CSDS TECHx Failed POV through defenses POV Watch
5 DeepRed CodeJitsu Failed POV through defenses POV Watch
5 DeepRed CSDS Failed POV through defenses POV Watch
5 DeepRed Disekt Failed POV through defenses POV Watch
5 DeepRed ForAllSecure Failed POV through defenses POV Watch
5 DeepRed Shellphish Failed POV through defenses POV Watch
5 DeepRed TECHx Failed POV through defenses POV Watch
5 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
5 ForAllSecure CSDS Failed POV through defenses POV Watch
5 ForAllSecure DeepRed Failed POV through defenses POV
5 ForAllSecure Disekt Failed POV through defenses POV Watch
5 ForAllSecure Shellphish Failed POV through defenses POV Watch
5 ForAllSecure TECHx Failed POV through defenses POV Watch
6 CSDS CodeJitsu Failed POV through defenses POV Watch
6 CSDS DeepRed Failed POV through defenses POV
6 CSDS Disekt Failed POV through defenses POV Watch
6 CSDS ForAllSecure Failed POV through defenses POV Watch
6 CSDS Shellphish Failed POV through defenses POV Watch
6 CSDS TECHx Failed POV through defenses POV Watch
6 DeepRed CodeJitsu Failed POV through defenses POV Watch
6 DeepRed CSDS Failed POV through defenses POV Watch
6 DeepRed Disekt Failed POV through defenses POV Watch
6 DeepRed ForAllSecure Failed POV through defenses POV Watch
6 DeepRed Shellphish Failed POV through defenses POV Watch
6 DeepRed TECHx Failed POV through defenses POV Watch
6 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
6 ForAllSecure CSDS Failed POV through defenses POV Watch
6 ForAllSecure DeepRed Failed POV through defenses POV Watch
6 ForAllSecure Disekt Failed POV through defenses POV Watch
6 ForAllSecure Shellphish Failed POV through defenses POV Watch
6 ForAllSecure TECHx Failed POV through defenses POV Watch
7 CSDS CodeJitsu Failed POV through defenses POV Watch
7 CSDS DeepRed Failed POV through defenses POV
7 CSDS Disekt Failed POV through defenses POV Watch
7 CSDS ForAllSecure Failed POV through defenses POV Watch
7 CSDS Shellphish Failed POV through defenses POV Watch
7 CSDS TECHx Failed POV through defenses POV Watch
7 DeepRed CodeJitsu Failed POV through defenses POV Watch
7 DeepRed CSDS Failed POV through defenses POV Watch
7 DeepRed Disekt Failed POV through defenses POV Watch
7 DeepRed ForAllSecure Failed POV through defenses POV Watch
7 DeepRed Shellphish Failed POV through defenses POV Watch
7 DeepRed TECHx Failed POV through defenses POV Watch
7 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
7 ForAllSecure CSDS Failed POV through defenses POV Watch
7 ForAllSecure DeepRed Failed POV through defenses POV
7 ForAllSecure Disekt Failed POV through defenses POV Watch
7 ForAllSecure Shellphish Failed POV through defenses POV Watch
7 ForAllSecure TECHx Failed POV through defenses POV Watch
8 CSDS CodeJitsu Failed POV through defenses POV Watch
8 CSDS DeepRed Failed POV through defenses POV
8 CSDS Disekt Failed POV through defenses POV Watch
8 CSDS ForAllSecure Failed POV through defenses POV Watch
8 CSDS Shellphish Failed POV through defenses POV Watch
8 CSDS TECHx Failed POV through defenses POV Watch
8 DeepRed CodeJitsu Failed POV through defenses POV Watch
8 DeepRed CSDS Failed POV through defenses POV Watch
8 DeepRed Disekt Failed POV through defenses POV Watch
8 DeepRed ForAllSecure Failed POV through defenses POV Watch
8 DeepRed Shellphish Failed POV through defenses POV Watch
8 DeepRed TECHx Failed POV through defenses POV Watch
8 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
8 ForAllSecure CSDS Failed POV through defenses POV Watch
8 ForAllSecure DeepRed Failed POV through defenses POV
8 ForAllSecure Disekt Failed POV through defenses POV Watch
8 ForAllSecure Shellphish Failed POV through defenses POV Watch
8 ForAllSecure TECHx Failed POV through defenses POV Watch
9 CSDS CodeJitsu Failed POV through defenses POV Watch
9 CSDS DeepRed Failed POV through defenses POV
9 CSDS Disekt Failed POV through defenses POV Watch
9 CSDS ForAllSecure Failed POV through defenses POV Watch
9 CSDS Shellphish Failed POV through defenses POV Watch
9 CSDS TECHx Failed POV through defenses POV Watch
9 DeepRed CodeJitsu Failed POV through defenses POV Watch
9 DeepRed CSDS Failed POV through defenses POV Watch
9 DeepRed Disekt Failed POV through defenses POV Watch
9 DeepRed ForAllSecure Failed POV through defenses POV Watch
9 DeepRed Shellphish Failed POV through defenses POV Watch
9 DeepRed TECHx Failed POV through defenses POV Watch
9 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
9 ForAllSecure CSDS Failed POV through defenses POV Watch
9 ForAllSecure DeepRed Failed POV through defenses POV Watch
9 ForAllSecure Disekt Failed POV through defenses POV Watch
9 ForAllSecure Shellphish Failed POV through defenses POV Watch
9 ForAllSecure TECHx Failed POV through defenses POV Watch
10 CSDS CodeJitsu Failed POV through defenses POV Watch
10 CSDS DeepRed Failed POV through defenses POV
10 CSDS Disekt Failed POV through defenses POV Watch
10 CSDS ForAllSecure Failed POV through defenses POV Watch
10 CSDS Shellphish Failed POV through defenses POV Watch
10 CSDS TECHx Failed POV through defenses POV Watch
10 DeepRed CodeJitsu Failed POV through defenses POV Watch
10 DeepRed CSDS Failed POV through defenses POV Watch
10 DeepRed Disekt Failed POV through defenses POV Watch
10 DeepRed ForAllSecure Failed POV through defenses POV Watch
10 DeepRed Shellphish Failed POV through defenses POV Watch
10 DeepRed TECHx Failed POV through defenses POV Watch
10 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
10 ForAllSecure CSDS Failed POV through defenses POV Watch
10 ForAllSecure DeepRed Failed POV through defenses POV Watch
10 ForAllSecure Disekt Failed POV through defenses POV Watch
10 ForAllSecure Shellphish Failed POV through defenses POV Watch
10 ForAllSecure TECHx Failed POV through defenses POV Watch
11 CSDS CodeJitsu Failed POV through defenses POV Watch
11 CSDS DeepRed Failed POV through defenses POV
11 CSDS Disekt Failed POV through defenses POV Watch
11 CSDS ForAllSecure Failed POV through defenses POV Watch
11 CSDS Shellphish Failed POV through defenses POV Watch
11 CSDS TECHx Failed POV through defenses POV Watch
11 DeepRed CodeJitsu Failed POV through defenses POV Watch
11 DeepRed CSDS Failed POV through defenses POV Watch
11 DeepRed Disekt Failed POV through defenses POV Watch
11 DeepRed ForAllSecure Failed POV through defenses POV Watch
11 DeepRed Shellphish Failed POV through defenses POV Watch
11 DeepRed TECHx Failed POV through defenses POV Watch
11 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
11 ForAllSecure CSDS Failed POV through defenses POV Watch
11 ForAllSecure DeepRed Failed POV through defenses POV
11 ForAllSecure Disekt Failed POV through defenses POV Watch
11 ForAllSecure Shellphish Failed POV through defenses POV Watch
11 ForAllSecure TECHx Failed POV through defenses POV Watch
12 CSDS CodeJitsu Failed POV through defenses POV Watch
12 CSDS DeepRed Failed POV through defenses POV
12 CSDS Disekt Failed POV through defenses POV Watch
12 CSDS ForAllSecure Failed POV through defenses POV Watch
12 CSDS Shellphish Failed POV through defenses POV Watch
12 CSDS TECHx Failed POV through defenses POV Watch
12 DeepRed CodeJitsu Failed POV through defenses POV Watch
12 DeepRed CSDS Failed POV through defenses POV Watch
12 DeepRed Disekt Failed POV through defenses POV Watch
12 DeepRed ForAllSecure Failed POV through defenses POV Watch
12 DeepRed Shellphish Failed POV through defenses POV Watch
12 DeepRed TECHx Failed POV through defenses POV Watch
12 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
12 ForAllSecure CSDS Failed POV through defenses POV Watch
12 ForAllSecure DeepRed Failed POV through defenses POV
12 ForAllSecure Disekt Failed POV through defenses POV Watch
12 ForAllSecure Shellphish Failed POV through defenses POV Watch
12 ForAllSecure TECHx Failed POV through defenses POV Watch
13 CSDS CodeJitsu Failed POV through defenses POV Watch
13 CSDS DeepRed Failed POV through defenses POV
13 CSDS Disekt Failed POV through defenses POV Watch
13 CSDS ForAllSecure Failed POV through defenses POV Watch
13 CSDS Shellphish Failed POV through defenses POV Watch
13 CSDS TECHx Failed POV through defenses POV Watch
13 DeepRed CodeJitsu Failed POV through defenses POV Watch
13 DeepRed CSDS Failed POV through defenses POV Watch
13 DeepRed Disekt Failed POV through defenses POV Watch
13 DeepRed ForAllSecure Failed POV through defenses POV Watch
13 DeepRed Shellphish Failed POV through defenses POV Watch
13 DeepRed TECHx Failed POV through defenses POV Watch
13 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
13 ForAllSecure CSDS Failed POV through defenses POV Watch
13 ForAllSecure DeepRed Failed POV through defenses POV Watch
13 ForAllSecure Disekt Failed POV through defenses POV Watch
13 ForAllSecure Shellphish Failed POV through defenses POV Watch
13 ForAllSecure TECHx Failed POV through defenses POV Watch
14 CSDS CodeJitsu Failed POV through defenses POV Watch
14 CSDS DeepRed Failed POV through defenses POV
14 CSDS Disekt Failed POV through defenses POV Watch
14 CSDS ForAllSecure Failed POV through defenses POV Watch
14 CSDS Shellphish Failed POV through defenses POV Watch
14 CSDS TECHx Failed POV through defenses POV Watch
14 DeepRed CodeJitsu Failed POV through defenses POV Watch
14 DeepRed CSDS Failed POV through defenses POV Watch
14 DeepRed Disekt Failed POV through defenses POV Watch
14 DeepRed ForAllSecure Failed POV through defenses POV Watch
14 DeepRed Shellphish Failed POV through defenses POV Watch
14 DeepRed TECHx Failed POV through defenses POV Watch
14 ForAllSecure CodeJitsu Failed POV through defenses POV Watch
14 ForAllSecure CSDS Failed POV through defenses POV Watch
14 ForAllSecure DeepRed Failed POV through defenses POV
14 ForAllSecure Disekt Failed POV through defenses POV Watch
14 ForAllSecure Shellphish Failed POV through defenses POV Watch
14 ForAllSecure TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email