Escaping VirtualBox 6.1: Part 1

Re:Escaping VirtualBox 6.1: Part 1 by nneonneo on Friday January 15, 2021 @06:21PM (#25797954)

Hey, I played in that CTF! Although, I ended up spending most of my time pwning QEMU instead. There was an easier challenge, aptly named Easy Escape, in which the organizers added a vulnerable memory-mapped device to QEMU. The device had the ability to read and write certain memory, so the exploit ended up being an attack where you triggered a memory operation which accessed the device's own memory - essentially causing the device's MMIO handler to recurse. That in turn set up a use-after-free situation which could be exploited for the win.

I love Real World CTF. In 2018 I participated in the finals round held in Zhengzhou, and there was a problem that involved Java and the RMI protocol. We ended up exploiting two zero-days in Java, reported them to Oracle and got a CVE: CVE-2019-2684. That was very exciting to me - to discover and exploit a bug in real software in less than 48 hours :)

Kudos to the VirtualBox hackers for doing that on such a high-profile bit of software - amazing work!

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by J-Kuhn on Saturday January 16, 2021 @04:25AM (#25801159)

Just a question:

Do the organizers know about the security vulnerability?

Where do they get the vulnerabilities from?

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by WGH_ on Saturday January 16, 2021 @02:18PM (#25804618)

Lots of CTF organizers are security researchers. This particular CTF is organized by people from Chaitin Tech, which is a cybersecurity company. They emphasize that their challenges are based on real vulnerabilities (found in their research, I presume).

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by WGH_ on Saturday January 16, 2021 @02:15PM (#25804588)

The QEMU task was likely inspired by a real vulnerability as well: https://mail.gnu.org/archive/html/qemu-devel/2020-09/msg0090... (discovered by CTF organizers, I think)

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by freedomben on Friday January 15, 2021 @08:49PM (#25799117)

Are these CTFs recorded and/or streamed? It just occurred to me that would be really fun to watch.

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by saagarjha on Friday January 15, 2021 @11:03PM (#25799916)

CTFs are not usually streamed, as that would give a leg up to other teams watching it :P Not sure if anyone records their work for later viewing, though.

[ Parent | on HN ]

Re:Escaping VirtualBox 6.1: Part 1 by marcelm72 on Saturday January 16, 2021 @09:41AM (#25802456)

You might like LiveOverflow 's video about playing the Google CTF finals hackceler8: https://www.youtube.com/watch?v=DGuRI_SPZYg

[ Parent | on HN ]