[Music]
well hello and welcome everyone you know
i hope that you had a really good
defcon and you enjoy all the activities
in the red team village that we actually
had at def con with me i have the
red team village core team
and without any further ado i'm actually
going to pass it right to west to go
over
an overview you know of the ctf and what
actually took place
in vegas
virtually not only in vegas
thank you omar for the uh intro there uh
for the calls i'm actually gonna turn it
over to barry let him kind of talk a
little bit through of uh you know some
of the amazing work that our team did on
the on the calls and then i'll jump into
the finals a little bit later
first off i just want to thank the team
that put it together uh there's a lot of
work that we put into it uh there's over
a dozen folks that help contribute to
the qualifiers as well as the the final
scenario last year was full remote so we
put together a uh a fairly immersive
scenario based around an old movie
called office space and then this year
we had two networks for every single
team in finals and the two uh the two
themes there was silicon valley and the
office and so this year we knew we had
to run a hybrid event and so we knew the
assets were going to be up in the cloud
but we had a lot of logistics in terms
of having an area there on the contest
floor we would interact with uh with
players we knew that a lot of our
players were international and weren't
able to travel because of those
restrictions so we wanted to make sure
that that it was accessible to everybody
across the board
this year we had a qualifying event that
started the the friday of defcon and
then rolled into
into saturday um the the break that we
had in the middle there we you probably
wouldn't do that in the future just
because it was a little bit of a um uh
it was it was hard schedule wise but we
had a lot of players play that uh i felt
like our infrastructure was good we had
all pretty much all new challenges
except i know that we used these older
uh beginner challenges that we've done
they're not really worth a whole lot of
points but we'd like to have a have
something for everybody uh on the
qualifier we took those top 20 teams we
announced who was progressing uh forward
into finals we took a one-hour break
which may have not been enough time for
everyone to recoup and then we went
right into finals and we had 20 teams
advance so we actually deployed 40
networks out to out into aws
we we really loved the feedback we got
from the players in the defcon discord
channel it was great to actually meet
some of the players that were there uh
in in vegas i know that uh there's a
couple of folks from um
uh from different teams and finals that
we've only talked virtually in so it's
great to put a face to a to a name or to
a handle and so that was that was
awesome and then uh and then we left
that network uh open overnight uh you
know different teams were were fighting
their way through the two different
networks in the end though ai generated
uh came out ahead they uh they secured a
lead in the front they were able to get
past that initial fish uh take uh uh
execute the supply chain attack the
software supply chat
software supply chain attack that then
took them down into the other network
and for anybody who wasn't able to get
eyes on those networks we're actually
show the network map and i'm going to
hand it over to wes now and he's going
to talk through the scenario what we
built and and why
thanks barry so yeah definitely you know
as asberry was discussing a lot of
similarities to uh last year in regards
of you know the finals round uh you know
on a few repeat teams uh so that was
really nice you know having that
familiarity uh of those teams kind of
coming back to us and understanding what
that challenge is
uh so with that you know with the finals
uh you know depending on uh you know
what perspective you had and how your
team divvied it up you know you probably
saw a few different things so what i'm
going to show here is actually the
network map and to kind of give you an
idea of how we kind of designed this so
this isn't uh the final map but this is
pretty close to
uh what we came up with and then went
into uh actual you know devin this out
and building this out and some kind of
tweaks on here so you know some of some
of the uh names you know like the final
challenge or whatever uh you know
we obviously figured that out so we'll
go through here uh at the beginning you
know there's a lot of uh issues on the
uh you know getting your payloads to
land and execute and not getting caught
by defender so that was uh you know i
think a learning event for everyone
and then
with that uh once you know if you're
able to get actual foothold and get
going with actual payloads
we disabled defender on that
but once you get that initial foothold
then you're kind of in that network and
then you're able to start poking around
so we had quite a few different things
on there we tried to uh you know litter
the box with kind of clues as you go
along through the scenario try to
understand some of the different pieces
as you kind of move through that human
resources you know there's a few little
side quests as far as picking up some
additional information
going off um you know there's emails
different traffic like that to kind of
get some of the clues on where you
actually you know whether it's
credentials to be able to log into boxes
a little later on
but with that
you eventually move from that uh you
know human resources department cut over
into the developer section that's where
we actually ended up having a
couple like a windows box and a mac box
and with that with those two we just
wanted you to kind of see
part of the uh the source code you know
some teams obviously saw it and then uh
i think that you know definitely gave
them a leg up as they moved on to the
next box but there's quite a few teams
who just kind of burned through uh
especially on the back box kind of
missing some of that source code so they
had a lot of troubles as they're like
interacting with that's the icd pipeline
uh you know trying to figure out what to
actually kind of enter uh what's changed
kind of live on there and
uh that was definitely a challenge for
some folks we saw you know some teams uh
kind of brick the service that was doing
some of the deployments
so it's definitely super interesting to
kind of watch the teams as they kind of
move through what decisions they made
what kind of um
you know
kind of payloads they put in there and
what they had going
uh so it once you're kind of successful
and you're able you know to get a ci cd
actually deploy and go through with that
you'd landed that dunder muffin uh
network
uh in that regard you know you can kind
of see some of our support boxes for smb
window shares things like that
uh but again you know kind of moving
that through we had some internal kind
of web services
uh with that like creed thoughts going
through there
some internal blogs things like that
um
and with that you could be able to
actually get a back door get into like
the shipping department kind of
warehouse area
um
and from there you know each step you
know we're laying the kind of groundwork
a lot of the clues kind of laying you
through like where to go what's next
uh trying to litter it through so uh i
think this is where some of the larger
teams struggled and definitely where we
had a lot of the
you know kind of clues and hints and
points of
uh you know hey we just don't not sure
like how to do this next thing or you
know we're obviously missing a piece uh
we think there probably should be
credentials to this but we can't find
them and a lot of it is just you know
going back kind of communicating with
the team
understanding what they found where and
where they found it
so with that uh they're able to kind of
move it along
go in through the sales department
there's you know a vulnerable internal
kind of sales website they're able to
kind of move along
and then definitely uh another couple
internal websites
the final piece though is when they got
into accounting
there there's a website where you'd uh
essentially do some privilege escalation
uh
get you know remote code execution on
the website so as a local user once
you're there there's uh we had a binary
uh where you could get you know your
actual privilege escalation there get
the final flags
uh definitely you know some great
feedback from some of the teams out
there of how they kind of solved that
last challenge you know maybe not our
most intended one uh
so with all that though like i know not
every team was kind of successful uh
getting through this but number of teams
at least you know they got that foothold
they kind of enumerated that first
network you know uh a decent portion of
them kind of made in that second network
so that's why we just kind of wanted to
talk a little bit at that high level
kind of see you know here is i would say
most of the boxes and to include support
boxes that we kind of needed to build to
kind of make the scenario happen
so uh with all of that you know uh
please we love the write-ups we love
seeing the feedback we love seeing how
you solve this uh you know definite
lesson learned uh you know there's
there's a prevest we missed
uh that we thought we were patched on
and uh we weren't so we were a little
disappointed that you know we kind of
missed out on one piece there but uh it
was definitely fun uh our team
definitely had fun watching all the
players go through and uh you know kind
of seeing that different perspective of
how the players looked at it and kind of
troubleshooting things that we went
through uh so
with all that i'm gonna turn it over to
savannah she's gonna kind of go through
uh a lot of kind of like the stats and
numbers of uh everything that we did
uh yeah so hi everyone so for uh the
quals we had 600 over 600 teams and over
2 000 players that play the quals and
then 20 teams for the actual finals
itself and we actually have a few of the
players from the finals team so we have
the ept team and then we also have
people from hack street boys that are
going to be joining us on the stream
today
so omar if you want to add them in we
can kind of introduce them so
there they are they're all coming in
uh
yeah so do you guys want to introduce
yourself on the stream
either one anyone can go first it's up
to you
we can start with hightail
right um hi i'm hightail um i'm one of
the founders of actually boys and we're
hailing from the philippines
um
with me is ian
who is one of our
kind of a red team members
so just a quick background of half
street boys we are formed
by professional members
um and we kind of separate ourselves
into the blue team and the red team so
this red team ctf was kind of a
kind of a guide
for for the blue teamers um made by the
red teamers uh in order to guide us
uh into how how to solve like red team
ctf problems and everything
so
awesome i'll pass it back to you uh
hsb iron so hsbn
hi thank you omar so um
i'm ian i'm one of the members of half
street boys we particularly
play capture the flag events and try to
enhance our skills through these
challenges
awesome
and ept
i think you're a mute
and once again actually
for those of you watching i'm part of
the ept team and we're a team
[Music]
no we can hear you oh thank you well uh
yeah i'm one of teams and one of the
members of the ept team we are
we can hear you okay
and then while we
you know solve the technical issues
there
first first of all is actually thank you
guys
some of you is extremely early in the
morning and some of you is extremely
that night or even in the into almost
the morning so thank you for for making
the timing here well i'm going to pass
it back again to you and one more try
ept
all right so
there's another player that actually
just joined and i'm going only by your
handle here right so
cymex 73
yeah uh
hello there you go uh
yeah my handle is like hard to pronounce
i know
uh
i'm simon
schumacher's seismics from male
generated
very very cool
you're norway right as well right
uh no uh we're like from all over the
world uh some from germany some from
poland
some i think canada and uk
excellent
and can you tell us a little bit you
know how big was your team
you know your strategy
we were originally 10 people
uh
but ended up with nine because one had
to
uh go play the main.com
nice and and you guys won last year you
were first placed last year
so this makes two yeah yeah we
yeah we did although i wasn't there for
the win i all enjoyed this year
it was a lot of fun playing with with
everyone uh
i got up to finals last year too uh
this year's network was also a lot of
fun playing
but there were some oversights with some
unintended which
kind of allowed us to
speed through some of the boxes
but
overall it was a
nicely designed network and really
enjoyed it
nice i love hearing that
if i would ask a question to all of you
you know what was the
the favorite part of the ctf for you
like the favorite challenge or the most
challenging one or
anybody
man when everybody goes on
when i start picking on people so it's
like my keeper
yeah uh
at least for me uh the whole supply
chain attack part with the cict blocks
was
very interesting and
we spent a while on it uh partially
because of the broken bot on the other
network which uh
yeah there was a lot of debugging on on
the box we
that we had to do
to figure out what was wrong but
uh it ended up working after all
so
yeah it was a
very nice part part of the sdf
very cool how about you hi till
um
the supply chain attack as well uh it
was very interesting for us
and coming from a blue team background
it
it's actually my first time to actually
um
experience it
like first hand
um and
so so we ended up with like uh blue team
skills too in order to debug why it was
working and why it wasn't working so we
had we we relied heavily on tcp though
in order to check if if the binaries
were getting uh downloaded or not
um so yeah yeah uh it was really really
fulfilling and um challenging for us
very cool
yeah same for me um we had particularly
challenges when uh we were doing the
cicd um supply chain attack so
just to mention that we enjoyed it a lot
uh those uh struggles and obstacles uh
we learned a lot and one of our
teammates hawk curry actually created a
light up on the supply chain attack
because we enjoyed it a lot and it was
quite a struggle to answer it but it's
quite interesting
how the infrastructure was set up and uh
it's really a unique experience
oh very cool and i'm gonna try one more
time ept
let's see if
your audio is coming through now
yeah we can try one more time do you
hear me better now
we can hear you
no
at least for two seconds
one of the members of the team of the
colleagues in
one and
one company in norway
and as as the other had said we had a
lot of fun doing this so we
we ended up
hiring a cabin so everybody joined in
the same
time it was quite fun and we had a lot
of fun with the challenges
so and and we had the same kind of big
challenge with the the supply chain
attack
and so that's gonna that was really nice
i think we went a real big detour in
owning and rooting the
box
we were root on it
the build server before we
and as a matter of fact i'm showing a
picture of that cabin right
yeah that's the
picture of one of them
yeah that's the cabin that was the
conference room between the two cabins
that were built together like one big
cabin so we had yeah it was quite fun
that was very cool i'm jealous
we definitely uh took some inspiration
from you you all uh last year because we
saw the cabin and we were doing it all
remote and we're like you know we need
to come together and do this all
together and not spread out next time so
we're super excited we got that airbnb
kind of off the strip and kind of two
twofold purposes all the streaming that
we did is kind of have all the team
together uh let's kind of take a cue out
of your playbook uh and do all the
logistics and everything and you know
build some camaraderie there so thanks
for the idea
yeah i can really
recommend that it's super fun it makes
it like twice this fun
remotely separately so
if you're sure just do it
very very true
and once again thank you for
participating
savannah i'm going to pass it back to
you for some of the statistics
oh uh so
the players uh read over 2000 players
oh we're good we're good i think it's
over to me now i think uh maybe uh
i
i just had i had one comment um we
really love the fact that everyone liked
that supply chain attack uh when we
started coming up with the scenario it
was right when the solar winds came out
and uh and right around that time those
maybe four or five pretty big uh supply
chain attacks that happened and so we're
like oh this is great we'll do this
theme and we thought when we started
then that that would still be the hot
topic by the time we got to defcon
little did we know that there was going
to be massive ransomware attacks that
you know took over the news before we
got to defcon but uh but yeah we're we
were hoping that uh that was enjoyable
that uh you know just just how easy it
is to to uh do that supply chain uh
interdiction especially when it's
software driven and it's uh and it's
really hard to uh hard to detect and so
for anybody out there who didn't see it
the way we had it set up was it was a ci
cd pipeline that would uh generate uh an
installer for this this fake software
and then in the other network we had a
script that exactly like a bot it would
go and it would check uh periodically
for any updated software and then if it
got that software if it saw that there
was an update because it was doing a
hash match then it would download and
execute it
so great to hear the feedback
um
and have any other questions for for the
players uh really do appreciate everyone
dialing in kind of telling us firsthand
uh how you like the event
yeah thank you so much and thank you for
participating and always
supporting the red team village i know
that it's not the first time for
a lot of you and as a matter of fact not
the first time winning either so uh
kudos and and thank you for your support
hope to see you in the next one huh
all right so with that uh we just want
to kind of thank everyone that kind of
participated in our prize giveaway kind
of filled out our forms everything else
so
uh you know
big shout out to uh sector seven
uh they're able to offer up uh a number
of uh 50 off for their malware
essentials courses uh you know i've
taken this myself it's an amazing course
a lot of good information
uh you know sector seven kind of always
came comes through with us they both
offered you know uh kind of prizes for
our finalists
everything as well so a huge huge shout
out to them so with that uh
big thanks for everyone that took the
time to fill out the form and on the
screen here you can see
uh these are the winners uh
i
we're trying to pronounce them earlier
i'm not gonna attempt to read them now
uh but big thanks uh if your name's on
here uh
you won uh one of the 50 off coupons for
malware essentials from sector seven and
with that we'll also reach out directly
to you and let you know uh that you won
so again big thanks to sector seven
awesome
i just i just wanna remind everyone uh
you'll get email from pony pie
with the prizes
so they'll be coming out from uh 45 and
i'll go ahead and switch it back to omar
to go ahead and go through sometimes
that's awesome from now on
from this stream onwards
we're going to pronounce pony ip as pony
pi
it's dyslexic so it's nothing personal
just his dyslexia just it's pony pie so
he just he spells it wrong
that's that's the reason that we're
laughing you know behind the scenes so
but thank you again sector seven and as
a matter of fact thank you to all our
sponsors
without you
none of these will actually would be
happening
um
not only the impact to the to the red
team village but the impact to the
community as a whole right so our goal
is to always have
you know
an industry-wide
international you know opportunity for
people to learn
and that's actually our mission you know
it's actually to bring
learning environments that you can
actually practice your skills in a safe
environment learn from each other
collaborate and network
so um i'm gonna share real quick you
know all our sponsors
a lot of them in here right from sector
server to bishop fox to hack the box to
optiv to spectre ups
and the list goes on and on right so
thank you thank you thank you and um
with that i think that is everything um
that we have for today any quick
round table if i miss anything uh
if not uh thank you again
yeah
i've got one rook real quick uh if if
you're not on the discord you join the
discord there's a lot of good
conversation there uh we've got some
events coming up we're participating in
activity con with uh with hacker one uh
that's gonna be uh in a little less than
a month now so we have that cfp open if
you've got if you've got a talk uh also
for the different events that we get
involved with you know it's all just
volunteers jumping in so if you've got
something you want to talk about maybe
you want to run a workshop or or help
with the ctf you know please uh you know
please reach out on uh
on discord and uh and we can always use
the help
you
you remind me of the biggest thing in
there of course our next event and let
me actually share that in the screen
real quick
as a pony ip mentioned you know please
please please uh you know participate in
this event
and it's a
it's a conference even though it's
hosted by hacker one it's actually built
by the community for the community we're
gonna have tons of speakers multiple
villages we're not the only ones there
as well and
the cfp as he mentioned is actually open
and if you also click on the little icon
in the screen it will take you to this
page and
it's september 18th
and again it's an international
conference and it's free
so with that thank you again for all
your time and i'll see you on the next
one