From 6a321759f6f75e7e14a29fde7cd0fa359d14215e Mon Sep 17 00:00:00 2001 From: Louis Burda Date: Wed, 21 Jul 2021 19:37:15 +0200 Subject: final tweaks to documentations, added intro and final presentation slides --- documentation/slides-final/.gitignore | 1 + documentation/slides-final/index.html | 768 +++++++++++++++++++++ documentation/slides-final/media/dirlist.png | Bin 0 -> 2322 bytes .../slides-final/media/enowars5-timeout.png | Bin 0 -> 202709 bytes documentation/slides-final/media/enowars5.png | Bin 0 -> 22214 bytes documentation/slides-final/media/exploit-1-1.png | Bin 0 -> 16715 bytes documentation/slides-final/media/exploit-1-2.png | Bin 0 -> 26940 bytes documentation/slides-final/media/exploit-1-3.png | Bin 0 -> 52090 bytes documentation/slides-final/media/exploit-1-4.png | Bin 0 -> 70074 bytes documentation/slides-final/media/exploit-1-5.png | Bin 0 -> 71647 bytes documentation/slides-final/media/exploit-2-1.png | Bin 0 -> 46589 bytes documentation/slides-final/media/getdirentries.png | Bin 0 -> 135007 bytes .../slides-final/media/player-meme-hashfunc.png | Bin 0 -> 221940 bytes .../slides-final/media/player-meme-struggling.png | Bin 0 -> 99623 bytes documentation/slides-final/media/readdir.png | Bin 0 -> 119892 bytes documentation/slides-final/media/readdir_more.png | Bin 0 -> 124526 bytes documentation/slides-final/media/search.gif | Bin 0 -> 60562 bytes documentation/slides-final/media/socat.gif | Bin 0 -> 19413 bytes documentation/slides-final/media/stl1.png | Bin 0 -> 17519 bytes documentation/slides-final/media/stl2.png | Bin 0 -> 19783 bytes documentation/slides-final/media/stl3.png | Bin 0 -> 16751 bytes documentation/slides-final/media/stldoc.png | Bin 0 -> 114257 bytes documentation/slides-final/media/stldoc_dead.png | Bin 0 -> 686794 bytes .../slides-final/media/stldoc_dead_offline.png | Bin 0 -> 142293 bytes .../slides-final/media/stldoc_dead_r17.png | Bin 0 -> 148922 bytes .../slides-final/media/stldoc_dead_r432.png | Bin 0 -> 267521 bytes .../slides-final/media/stldoc_dead_r469.png | Bin 0 -> 250294 bytes documentation/slides-final/slides.md | 253 +++++++ documentation/slides-final/stldoctor.pdf | Bin 0 -> 2073788 bytes 29 files changed, 1022 insertions(+) create mode 100644 documentation/slides-final/.gitignore create mode 100644 documentation/slides-final/index.html create mode 100644 documentation/slides-final/media/dirlist.png create mode 100644 documentation/slides-final/media/enowars5-timeout.png create mode 100644 documentation/slides-final/media/enowars5.png create mode 100644 documentation/slides-final/media/exploit-1-1.png create mode 100644 documentation/slides-final/media/exploit-1-2.png create mode 100644 documentation/slides-final/media/exploit-1-3.png create mode 100644 documentation/slides-final/media/exploit-1-4.png create mode 100644 documentation/slides-final/media/exploit-1-5.png create mode 100644 documentation/slides-final/media/exploit-2-1.png create mode 100644 documentation/slides-final/media/getdirentries.png create mode 100644 documentation/slides-final/media/player-meme-hashfunc.png create mode 100644 documentation/slides-final/media/player-meme-struggling.png create mode 100644 documentation/slides-final/media/readdir.png create mode 100644 documentation/slides-final/media/readdir_more.png create mode 100644 documentation/slides-final/media/search.gif create mode 100644 documentation/slides-final/media/socat.gif create mode 100644 documentation/slides-final/media/stl1.png create mode 100644 documentation/slides-final/media/stl2.png create mode 100644 documentation/slides-final/media/stl3.png create mode 100644 documentation/slides-final/media/stldoc.png create mode 100644 documentation/slides-final/media/stldoc_dead.png create mode 100644 documentation/slides-final/media/stldoc_dead_offline.png create mode 100644 documentation/slides-final/media/stldoc_dead_r17.png create mode 100644 documentation/slides-final/media/stldoc_dead_r432.png create mode 100644 documentation/slides-final/media/stldoc_dead_r469.png create mode 100644 documentation/slides-final/slides.md create mode 100644 documentation/slides-final/stldoctor.pdf (limited to 'documentation/slides-final') diff --git a/documentation/slides-final/.gitignore b/documentation/slides-final/.gitignore new file mode 100644 index 0000000..e4e7469 --- /dev/null +++ b/documentation/slides-final/.gitignore @@ -0,0 +1 @@ +slides diff --git a/documentation/slides-final/index.html b/documentation/slides-final/index.html new file mode 100644 index 0000000..b7457ef --- /dev/null +++ b/documentation/slides-final/index.html @@ -0,0 +1,768 @@ + + + + + + STLDoctor + + + +
+
+
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/documentation/slides-final/media/dirlist.png b/documentation/slides-final/media/dirlist.png new file mode 100644 index 0000000..68985ad Binary files /dev/null and b/documentation/slides-final/media/dirlist.png differ diff --git a/documentation/slides-final/media/enowars5-timeout.png b/documentation/slides-final/media/enowars5-timeout.png new file mode 100644 index 0000000..2dfecb2 Binary files /dev/null and b/documentation/slides-final/media/enowars5-timeout.png differ diff --git a/documentation/slides-final/media/enowars5.png b/documentation/slides-final/media/enowars5.png new file mode 100644 index 0000000..4dbba87 Binary files /dev/null and b/documentation/slides-final/media/enowars5.png differ diff --git a/documentation/slides-final/media/exploit-1-1.png b/documentation/slides-final/media/exploit-1-1.png new file mode 100644 index 0000000..b251075 Binary files /dev/null and b/documentation/slides-final/media/exploit-1-1.png differ diff --git a/documentation/slides-final/media/exploit-1-2.png b/documentation/slides-final/media/exploit-1-2.png new file mode 100644 index 0000000..e63f7d0 Binary files /dev/null and b/documentation/slides-final/media/exploit-1-2.png differ diff --git a/documentation/slides-final/media/exploit-1-3.png b/documentation/slides-final/media/exploit-1-3.png new file mode 100644 index 0000000..4dc961d Binary files /dev/null and b/documentation/slides-final/media/exploit-1-3.png differ diff --git a/documentation/slides-final/media/exploit-1-4.png b/documentation/slides-final/media/exploit-1-4.png new file mode 100644 index 0000000..2d75f2f Binary files /dev/null and b/documentation/slides-final/media/exploit-1-4.png differ diff --git a/documentation/slides-final/media/exploit-1-5.png b/documentation/slides-final/media/exploit-1-5.png new file mode 100644 index 0000000..874529b Binary files /dev/null and b/documentation/slides-final/media/exploit-1-5.png differ diff --git a/documentation/slides-final/media/exploit-2-1.png b/documentation/slides-final/media/exploit-2-1.png new file mode 100644 index 0000000..91b0df7 Binary files /dev/null and b/documentation/slides-final/media/exploit-2-1.png differ diff --git a/documentation/slides-final/media/getdirentries.png b/documentation/slides-final/media/getdirentries.png new file mode 100644 index 0000000..e19c3e7 Binary files /dev/null and b/documentation/slides-final/media/getdirentries.png differ diff --git a/documentation/slides-final/media/player-meme-hashfunc.png b/documentation/slides-final/media/player-meme-hashfunc.png new file mode 100644 index 0000000..04077ca Binary files /dev/null and b/documentation/slides-final/media/player-meme-hashfunc.png differ diff --git a/documentation/slides-final/media/player-meme-struggling.png b/documentation/slides-final/media/player-meme-struggling.png new file mode 100644 index 0000000..9863892 Binary files /dev/null and b/documentation/slides-final/media/player-meme-struggling.png differ diff --git a/documentation/slides-final/media/readdir.png b/documentation/slides-final/media/readdir.png new file mode 100644 index 0000000..a211c1f Binary files /dev/null and b/documentation/slides-final/media/readdir.png differ diff --git a/documentation/slides-final/media/readdir_more.png b/documentation/slides-final/media/readdir_more.png new file mode 100644 index 0000000..c24c582 Binary files /dev/null and b/documentation/slides-final/media/readdir_more.png differ diff --git a/documentation/slides-final/media/search.gif b/documentation/slides-final/media/search.gif new file mode 100644 index 0000000..de4ed18 Binary files /dev/null and b/documentation/slides-final/media/search.gif differ diff --git a/documentation/slides-final/media/socat.gif b/documentation/slides-final/media/socat.gif new file mode 100644 index 0000000..38f1e93 Binary files /dev/null and b/documentation/slides-final/media/socat.gif differ diff --git a/documentation/slides-final/media/stl1.png b/documentation/slides-final/media/stl1.png new file mode 100644 index 0000000..cef284a Binary files /dev/null and b/documentation/slides-final/media/stl1.png differ diff --git a/documentation/slides-final/media/stl2.png b/documentation/slides-final/media/stl2.png new file mode 100644 index 0000000..1201981 Binary files /dev/null and b/documentation/slides-final/media/stl2.png differ diff --git a/documentation/slides-final/media/stl3.png b/documentation/slides-final/media/stl3.png new file mode 100644 index 0000000..49045cc Binary files /dev/null and b/documentation/slides-final/media/stl3.png differ diff --git a/documentation/slides-final/media/stldoc.png b/documentation/slides-final/media/stldoc.png new file mode 100644 index 0000000..f276ef7 Binary files /dev/null and b/documentation/slides-final/media/stldoc.png differ diff --git a/documentation/slides-final/media/stldoc_dead.png b/documentation/slides-final/media/stldoc_dead.png new file mode 100644 index 0000000..6838fbf Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead.png differ diff --git a/documentation/slides-final/media/stldoc_dead_offline.png b/documentation/slides-final/media/stldoc_dead_offline.png new file mode 100644 index 0000000..8cc3faa Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_offline.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r17.png b/documentation/slides-final/media/stldoc_dead_r17.png new file mode 100644 index 0000000..0fef751 Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r17.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r432.png b/documentation/slides-final/media/stldoc_dead_r432.png new file mode 100644 index 0000000..5985a1a Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r432.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r469.png b/documentation/slides-final/media/stldoc_dead_r469.png new file mode 100644 index 0000000..d202b69 Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r469.png differ diff --git a/documentation/slides-final/slides.md b/documentation/slides-final/slides.md new file mode 100644 index 0000000..54b1fa8 --- /dev/null +++ b/documentation/slides-final/slides.md @@ -0,0 +1,253 @@ +title: STLDoctor +output: index.html +controls: false + +-- + + + +-- + + + +# STLDoctor 💉 + +-- + +### Index 🗄️ + +- Service recap +- Optimization +- ENOWARS 5 +- Reflection + +-- + +### Refreshing Memories 💾 + +- Plaintext service written in C +- Users upload STL files for parsing +- Private and public storage (2 flagstores) +- 1. Vuln: Deserialization +- 2. Vuln: Hash preimage + + + +-- + +### Since Last Meeting ⏩ + + + +- Performance improvements +- Added service fluff + + + + + + + +-- + +### Issues 😒 + + + +- Slow search / list operations +- Enochecker memory leak without patch +- Engine error on worker restart with patch +- Logs not showing up in ELK + +-- + +### Solutions 💡 + +- Index files with locks for directory listing +- Refactored checker for asyncio +- Condensed checker functionality +- Increase docker-compose log size + +-- + +# ENOWARS 5 + +-- + +### OSError 💢 + +- Checker throws `INTERNAL_ERROR` on bad connection +- Fixed in c97789ad.. of enochecker3 + + + +-- + +### Checker Overload 💥 + + + +- Checker tasks being aborted for every team + + + +-- + +### Checker Overload 💥 + + + + +-- + +### Anomaly 👽 + + + + + +-- + +### Feedback 🤔 + +- 1. flagstore exploited after ~4h (R190) +- 2. flagstore not exploited + + + + + +-- + +### Conclusion 🎉 + +- Relatively good uptime +- Not too easy / hard +- Users found vulns interesting +- No (known) unintended vuln +- Had a lot of fun + +-- + +-- + +### Slow IO 🐌 + + + +- Enumerating files in a directory is expensive +- Index file per directory containing file names +- File locks to ensure exclusive writes + + + +-- + +### Investigating `readdir(..)` 🔍 + + + +`__readdir(..)`: + + + +-- + +### Investigating `readdir(..)` 🔍 + +`__get_dir_entries(..)`: + + + +-- + +### Checker Overload + + + +-- + +### Checker Overload + + + +-- + + + + + + diff --git a/documentation/slides-final/stldoctor.pdf b/documentation/slides-final/stldoctor.pdf new file mode 100644 index 0000000..6667621 Binary files /dev/null and b/documentation/slides-final/stldoctor.pdf differ -- cgit v1.2.3-71-gd317