Challenge Information - KPRCA_00094

Commonly known as: ShoutCTF

Rounds Enabled

63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77

Details

Original Versions

Known Vulnerabilities

  • CWE-121 - Stack-based Buffer Overflow
    • CWEs are listed as indicated by the challenge author.

Deployed patches

Deployed IDS rules

DARPA performer group

Kaprica Security (KPRCA)

Description

ShoutCTF is a CTF platform where a user can register to either start a new team or join an existing team to play CTF. When creating a team, the leader (the first user who creates the team) can specify a shoutout that shows up when the team profile is looked up. Just like any other CTFs, the system goes down at random and new challenges are added/opened randomly. ShoutCTF provides a universal flag submission, where you can just submit the flag for any challenge in main CTF menu instead of submitting for a specific challenge.

Feature List

- Register User - Register Team - Join Team - Login User - Scoreboard - View challenges list - View challenge detail - View ranking - “Scroll” through the teams (Max of 5 teams per page) - Ticker with most recent solves and team info for the logged-in user. - View team profile - Submit flags - Quit

Vulnerability

Vuln 1

In handle_register_user function, there is a trivial stack-based buffer overflow in team creation mode. The shoutout section of the team information is read into a buffer (shout) with a larger size (sizeof(buf)) than the buffer's size.

Generic class of vulnerability

Stack-based Buffer Overflow

CWE classification

CWE-121: Stack-based Buffer Overflow

Challenges

  • Randomness (service outage) needs to be handled to consistently exploit the bug.

Difficulty

  • Discovery: easy
  • Proving: easy
  • Patching: easy

POV Information

Round Source Destination Result POV Analysis Video
64 CSDS CodeJitsu Failed POV POV Watch
64 CSDS DeepRed Failed POV POV Watch
64 CSDS Disekt Failed POV POV Watch
64 CSDS ForAllSecure Failed POV POV Watch
64 CSDS Shellphish Failed POV POV Watch
64 CSDS TECHx Failed POV POV Watch
64 DeepRed CodeJitsu Failed POV POV Watch
64 DeepRed CSDS Failed POV POV Watch
64 DeepRed Disekt Failed POV POV Watch
64 DeepRed ForAllSecure Failed POV POV Watch
64 DeepRed Shellphish Failed POV POV Watch
64 DeepRed TECHx Failed POV POV Watch
65 CSDS CodeJitsu Failed POV POV Watch
65 CSDS DeepRed Failed POV POV Watch
65 CSDS Disekt Failed POV POV Watch
65 CSDS ForAllSecure Failed POV POV Watch
65 CSDS Shellphish Failed POV POV Watch
65 DeepRed CodeJitsu Failed POV POV Watch
65 DeepRed CSDS Failed POV POV Watch
65 DeepRed Disekt Failed POV POV Watch
65 DeepRed ForAllSecure Failed POV POV Watch
65 DeepRed Shellphish Failed POV POV Watch
66 CSDS CodeJitsu Failed POV POV Watch
66 CSDS DeepRed Failed POV POV Watch
66 CSDS Disekt Failed POV POV Watch
66 CSDS ForAllSecure Failed POV POV Watch
66 CSDS Shellphish Failed POV POV Watch
66 CSDS TECHx Failed POV through defenses POV Watch
66 DeepRed CodeJitsu Failed POV POV Watch
66 DeepRed CSDS Failed POV POV Watch
66 DeepRed Disekt Failed POV POV Watch
66 DeepRed ForAllSecure Failed POV POV Watch
66 DeepRed Shellphish Failed POV POV Watch
66 DeepRed TECHx Failed POV through defenses POV Watch
67 CSDS CodeJitsu Failed POV POV Watch
67 CSDS DeepRed Failed POV POV Watch
67 CSDS Disekt Failed POV POV Watch
67 CSDS ForAllSecure Failed POV POV Watch
67 CSDS Shellphish Failed POV POV Watch
67 CSDS TECHx Failed POV through defenses POV Watch
67 DeepRed CodeJitsu Failed POV POV Watch
67 DeepRed CSDS Failed POV POV Watch
67 DeepRed Disekt Failed POV POV Watch
67 DeepRed ForAllSecure Failed POV POV Watch
67 DeepRed Shellphish Failed POV POV Watch
67 DeepRed TECHx Failed POV through defenses POV Watch
68 CodeJitsu Shellphish Failed POV through defenses POV Watch
68 CSDS CodeJitsu Failed POV POV Watch
68 CSDS DeepRed Failed POV POV Watch
68 CSDS Disekt Failed POV POV Watch
68 CSDS ForAllSecure Failed POV POV Watch
68 CSDS Shellphish Failed POV through defenses POV Watch
68 CSDS TECHx Failed POV through defenses POV Watch
68 DeepRed CodeJitsu Failed POV POV Watch
68 DeepRed CSDS Failed POV POV Watch
68 DeepRed Disekt Failed POV POV Watch
68 DeepRed ForAllSecure Failed POV POV Watch
68 DeepRed Shellphish Failed POV through defenses POV Watch
68 DeepRed TECHx Failed POV through defenses POV Watch
69 CSDS CodeJitsu Failed POV POV Watch
69 CSDS DeepRed Failed POV POV Watch
69 CSDS Disekt Failed POV POV Watch
69 CSDS ForAllSecure Failed POV POV Watch
69 CSDS Shellphish Failed POV through defenses POV Watch
69 CSDS TECHx Failed POV through defenses POV Watch
69 DeepRed CodeJitsu Failed POV POV Watch
69 DeepRed CSDS Failed POV POV Watch
69 DeepRed Disekt Failed POV POV Watch
69 DeepRed ForAllSecure Failed POV POV Watch
69 DeepRed Shellphish Failed POV through defenses POV Watch
69 DeepRed TECHx Failed POV through defenses POV Watch
70 CSDS CodeJitsu Failed POV POV Watch
70 CSDS DeepRed Failed POV POV Watch
70 CSDS Disekt Failed POV POV Watch
70 CSDS ForAllSecure Failed POV POV Watch
70 CSDS Shellphish Failed POV through defenses POV Watch
70 CSDS TECHx Failed POV through defenses POV Watch
70 DeepRed CodeJitsu Failed POV POV Watch
70 DeepRed CSDS Failed POV POV Watch
70 DeepRed Disekt Failed POV POV Watch
70 DeepRed ForAllSecure Failed POV POV Watch
70 DeepRed Shellphish Failed POV through defenses POV Watch
70 DeepRed TECHx Failed POV through defenses POV Watch
71 CSDS CodeJitsu Failed POV POV Watch
71 CSDS DeepRed Failed POV POV Watch
71 CSDS Disekt Failed POV POV Watch
71 CSDS ForAllSecure Failed POV POV Watch
71 CSDS Shellphish Failed POV through defenses POV Watch
71 CSDS TECHx Failed POV through defenses POV Watch
71 DeepRed CodeJitsu Failed POV POV Watch
71 DeepRed CSDS Failed POV POV Watch
71 DeepRed Disekt Failed POV POV Watch
71 DeepRed ForAllSecure Failed POV POV Watch
71 DeepRed Shellphish Failed POV through defenses POV Watch
71 DeepRed TECHx Failed POV through defenses POV Watch
72 CSDS CodeJitsu Failed POV POV Watch
72 CSDS DeepRed Failed POV POV Watch
72 CSDS Disekt Failed POV POV Watch
72 CSDS ForAllSecure Failed POV POV Watch
72 CSDS Shellphish Failed POV through defenses POV Watch
72 CSDS TECHx Failed POV through defenses POV Watch
72 DeepRed CodeJitsu Failed POV POV Watch
72 DeepRed CSDS Failed POV POV Watch
72 DeepRed Disekt Failed POV POV Watch
72 DeepRed ForAllSecure Failed POV POV Watch
72 DeepRed Shellphish Failed POV through defenses POV Watch
72 DeepRed TECHx Failed POV through defenses POV Watch
73 CSDS CodeJitsu Failed POV POV Watch
73 CSDS DeepRed Failed POV POV Watch
73 CSDS Disekt Failed POV POV Watch
73 CSDS ForAllSecure Failed POV POV Watch
73 CSDS Shellphish Failed POV through defenses POV Watch
73 CSDS TECHx Failed POV through defenses POV Watch
73 DeepRed CodeJitsu Failed POV POV Watch
73 DeepRed CSDS Failed POV POV Watch
73 DeepRed Disekt Failed POV POV Watch
73 DeepRed ForAllSecure Failed POV POV Watch
73 DeepRed Shellphish Failed POV through defenses POV Watch
73 DeepRed TECHx Failed POV through defenses POV Watch
73 Shellphish CodeJitsu Successful POV POV Analysis Watch
73 Shellphish CSDS Successful POV POV Analysis Watch
73 Shellphish DeepRed Successful POV POV Analysis Watch
73 Shellphish Disekt Successful POV POV Analysis Watch
73 Shellphish ForAllSecure Successful POV POV Analysis Watch
73 Shellphish TECHx Failed POV through defenses POV Watch
74 CSDS CodeJitsu Failed POV POV Watch
74 CSDS DeepRed Failed POV POV Watch
74 CSDS Disekt Failed POV POV Watch
74 CSDS ForAllSecure Failed POV POV Watch
74 CSDS Shellphish Failed POV through defenses POV Watch
74 CSDS TECHx Failed POV through defenses POV Watch
74 DeepRed CodeJitsu Failed POV POV Watch
74 DeepRed CSDS Failed POV POV Watch
74 DeepRed Disekt Failed POV POV Watch
74 DeepRed ForAllSecure Failed POV POV Watch
74 DeepRed Shellphish Failed POV through defenses POV Watch
74 DeepRed TECHx Failed POV through defenses POV Watch
74 Shellphish CodeJitsu Successful POV POV Analysis Watch
74 Shellphish CSDS Successful POV POV Analysis Watch
74 Shellphish DeepRed Successful POV POV Analysis Watch
74 Shellphish Disekt Successful POV POV Analysis Watch
74 Shellphish ForAllSecure Successful POV POV Analysis Watch
74 Shellphish TECHx Failed POV through defenses POV Watch
75 CodeJitsu CSDS Failed POV through defenses POV Watch
75 CodeJitsu DeepRed Failed POV through defenses POV Watch
75 CodeJitsu Disekt Failed POV through defenses POV Watch
75 CSDS CodeJitsu Failed POV through defenses POV Watch
75 CSDS DeepRed Failed POV through defenses POV Watch
75 CSDS Disekt Failed POV through defenses POV Watch
75 CSDS ForAllSecure Failed POV POV Watch
75 CSDS Shellphish Failed POV through defenses POV Watch
75 CSDS TECHx Failed POV through defenses POV Watch
75 DeepRed CodeJitsu Failed POV through defenses POV Watch
75 DeepRed CSDS Failed POV through defenses POV Watch
75 DeepRed Disekt Failed POV through defenses POV Watch
75 DeepRed ForAllSecure Failed POV POV Watch
75 DeepRed Shellphish Failed POV through defenses POV Watch
75 DeepRed TECHx Failed POV through defenses POV Watch
75 Shellphish CodeJitsu Failed POV through defenses POV Watch
75 Shellphish CSDS Failed POV through defenses POV Watch
75 Shellphish DeepRed Failed POV through defenses POV Watch
75 Shellphish Disekt Failed POV through defenses POV Watch
75 Shellphish ForAllSecure Successful POV POV Analysis Watch
75 Shellphish TECHx Failed POV through defenses POV Watch
76 CSDS CodeJitsu Failed POV through defenses POV Watch
76 CSDS DeepRed Failed POV through defenses POV Watch
76 CSDS Disekt Failed POV through defenses POV Watch
76 CSDS ForAllSecure Failed POV POV Watch
76 CSDS Shellphish Failed POV through defenses POV Watch
76 CSDS TECHx Failed POV through defenses POV Watch
76 DeepRed CodeJitsu Failed POV through defenses POV Watch
76 DeepRed CSDS Failed POV through defenses POV Watch
76 DeepRed Disekt Failed POV through defenses POV Watch
76 DeepRed ForAllSecure Failed POV POV Watch
76 DeepRed Shellphish Failed POV through defenses POV Watch
76 DeepRed TECHx Failed POV through defenses POV Watch
76 Shellphish CodeJitsu Failed POV through defenses POV Watch
76 Shellphish DeepRed Successful POV through defenses POV Analysis Watch
76 Shellphish ForAllSecure Successful POV POV Analysis Watch
76 Shellphish TECHx Failed POV through defenses POV Watch
77 CSDS CodeJitsu Failed POV through defenses POV Watch
77 CSDS DeepRed Failed POV through defenses POV Watch
77 CSDS Disekt Failed POV through defenses POV Watch
77 CSDS ForAllSecure Failed POV POV Watch
77 CSDS Shellphish Failed POV through defenses POV Watch
77 CSDS TECHx Failed POV through defenses POV Watch
77 DeepRed CodeJitsu Failed POV through defenses POV Watch
77 DeepRed CSDS Failed POV through defenses POV Watch
77 DeepRed Disekt Failed POV through defenses POV Watch
77 DeepRed ForAllSecure Failed POV POV Watch
77 DeepRed Shellphish Failed POV through defenses POV Watch
77 DeepRed TECHx Failed POV through defenses POV Watch
77 Shellphish CodeJitsu Failed POV through defenses POV Watch
77 Shellphish DeepRed Successful POV through defenses POV Analysis Watch
77 Shellphish ForAllSecure Successful POV POV Analysis Watch
77 Shellphish TECHx Failed POV through defenses POV Watch

Curated by Lunge Technology, LLC. Questions or comments? Send us email