[Music]
all right we're missing our last player
so too many mics all right we're missing
our last player so we're going to go
ahead and get started here uh so the way
that this works is uh this is our final
round for the hungry hungry hackers
challenge we've got three players soon
to be hopefully four uh if they get here
um that are going to be competing live
on a CTF challenge that they have never
seen before um this is this is something
you'd find on a on a on a pintest um so
we'll see if anybody can get to it in
the next 30 minutes um so this is this
is sort of a uh gentle person's game
that uh we would expect everybody to
respect each other's instances they all
have four instances of that they're only
allowed to touch their own um you will
be able to see what instances are
attacking on the internet but please
don't go after them from a spectator
perspective um uh once they win whoever
is the first person to finish the
challenge will get a lifetime badge to
cyphercon um so the challenges are at
challenges. hungryhungry hackers.com um
just like all of the prequals um but
from left to right it's going to be on
Port
2201 2 3 and four so 2201 2202 2203
2204 good luck
[Applause]
all right I see the sight up
[Applause]
already we've got somebody running an in
map on the challenges here trying to see
what other ports are open I will say
that there is only one port that's in
scope for this oh we're not displaying
oh my gosh thank
you how about now are we good all right
there we go okay
so is an HTP site you only have one port
in scope it is
HTTP or HTP challenges. h00 hippo.com
calling
2201 Port
2201
pic is that
[Music]
[Applause]
working
[Music]
yeah
[Music]
making sure so we're all connected via
uh hotpots over phones so the network is
a little bit spotty we'll see how it
[Music]
goes
we've got network connectivity issues
I've seen it up on a couple players so I
know that they're alive I can get to
them on the hot spot
here I see Google
[Music]
up challenge number one of the CTF is
can you connect to the
internet but Adam you're up there
right you're not connected to the
network you're connected to the internet
right
[Music]
hey Eric do you mind sharing the hot
spot quest for DJ Roomba how you have it
can you yeah can you make sure you get
[Music]
everybody we we have
[Music]
a
all right players are connected note for
next time have a better way to get
people to link to begin
[Music]
with oh I see some that's getting
getting there
though
there's a flag. text on the system yep
flag. text on the
[Music]
system
[Music]
Mike are you make sure you got your
screen on mirror instead of
on
[Music]
I already see somebody that's gotten
past the uh first gate and is working on
a solution here so hopefully every in
the audience has been able to see what's
going on I know it's kind of been hectic
getting everybody connected to start
with uh one of the cool things about CTF
is that if you've been doing this for
one year or 10 years Google is your best
friend uh I don't think I can go through
any single test without hitting Google
thousands of
[Music]
times
[Music]
okay
[Music]
he
[Applause]
[Music]
he
[Music]
all right we've got a winner we'll give
everybody a couple minutes to see didn't
finish it up we'll give it we'll give it
uh we'll go for second place as well
we'll see if Mike is kind with the
[Music]
badges
I I will give a hint for everybody
that's still playing uh the password is
a common one that you'll find as a
default
[Music]
install
to
[Music]
all right I'm going to set a 3 minute
timer for the challenge we'll see you
can finish up everybody here is going to
get some type of uh cyphercon swag for
playing but we'll give everybody three
more
[Music]
minutes
[Music]
got some hacker taper going on
here the speed of that code it's
[Music]
amazing
[Music]
silence
shake you
feel
[Music]
as
[Applause]
[Music]
all right that's our one minute timer
everybody give everybody a round of a
hand for playing here it is terrifying
to sit in front of a room of people and
let them watch you type out on a
computer I hate when like one person's
watching me code and a whole room full
of it so like awesome jobs like just
even participating in this is like
resume worthy stuff so great job
everybody that played um thank you so uh
Adam do you want to come and give a
quick walkr of how you solved it really
quick uh I'll throw it on your screen
and I don't know if I get a mic over
there um can you do it without knocking
the cord out we'll just keep it plugged
in
for everybody else if you guys would
like to go sit down that's fine but
stick around because we'll figure out
how to get you some swag and some prises
afterwards
[Music]
hello
there all right
so you say Inspire points Inspire points
okay so
um the first thing I did when I came
across this page is noticed that it was
a patchy Tom Cat and um just due to
experience in compromising aache Tomcat
server like two weeks ago I had this
actually fresh in my mind so um it
didn't how many years have you been
contes eight plus how many you say do a
year um there's 52 weeks in a year so
probably 45 pent tests yeah okay just
want to provide cont okay yeah thanks um
so in Apache Tomcat typically if you go
to like the um manager app it'll prompt
you for
authentication um there's a list of
common creds if you Google um
common patchy Tomcat
credentials and usually you can try one
of these I think I tried admin Tomcat
without even looking and it worked on
the first
try
um so the cool thing about um the
timecat web application managers it
allows you to upload um like War files
which are essentially like zipped up
jsps and you know I quickly at first I
tried to just get a regular webshell and
um like you know save it as a JSP file
zip it and upload it but it didn't work
the first thing I tried said 44 not
found because I didn't do something
right I think it was because I didn't
name it index.jsp I named it like log.
JSP U but the second one I did um for
this/ webshell here um I made an
index.jsp inside there and I think
that's why it worked
if I'm wrong then I don't know why it
worked oh yeah um I went to Google and I
typed in war file
shell and I went down to hack tricks
because that's one of my favorite um
like little copy pasta sites and it had
a whole bunch of stuff on basically this
same type of attack you know um even had
admin Tomcat in there so um if you're
following um along or Googling stuff
you'd be able to find it right in there
it shows a couple options for automating
that type of attack for you know um
using like metas sploit or Hydra to
brute force
that um and then shows a couple of um
other things you can find within
there I scrolled all the way down to the
webshell portion right here so this said
create an index.jsp with this content so
I said okay did that created index at
JSP made a or directory called webshell
copied that into the webshell directory
and then um oh that's probably what I
had to do
um I had to run this Command right here
to create the war file
and
um pretty much I think Java just does
all the heavy lifting there um after you
create it then you just upload it so um
went back here whoops then I went to
this nice little file upload thing
um uploaded that and then it showed up
right here so soon as I clicked it I saw
immediately that um I had a nice little
working webshell so first thing I did is
I ran who am
I of course I was already running this
route so then at that point it was a
matter of trying to find the flag and
you can see I tried a whole bunch of
different ways to do that but then I
realized I'm actually in this directory
right here so after I did this a couple
times I completely missed the fact that
there was a flag. text there um but
after I realized that then um I was able
to do that and you can see that it says
scream I am a hippo to
win any
questions yeah yeah so thank you
everybody for playing that is like
nerve-wracking on so many levels to
actually do that and then to go up to
against somebody that's been doing it
professionally for eight years and does
like 45 plus tests a week um so like
even oh a week a year no a year a week a
year sorry go yeah yeah you're good but
maybe not that that good
uh the question was how many black
badges does he have or like lifetime
badges to various cons like deathcon
black hat I only have a geran lifetime
badge so how many times have you won the
car hacking Village at
Geron
six so all had to say the competition
was incredibly tough so thank you guys
for playing you guys did great hang out
afterwards and we'll get you some swag
um we'll try to do this again next year
we'll see if we can find a way to get a
little bit more broader participation so
we can keep it going all day but thank
you for everybody that dealt with our
first year of trialing it out and
figuring out how to make it work um but
we'll see you around if you guys have
any questions feel free to come and hang
out up front um otherwise enjoy the rest
of the
[Applause]
con