Capture the Flag: Using a Rootkit to Block Other Teams

Probably most evi1 was when we used some technical prowess to keep Sk3wl from getting credit for many points last year, for several periods of several hours. This year, Sk3wl multiplied both the evi1 as well as the technical awe of our attack from last year, instead, denying any of our teams the ability to score. How they did this, I can’t say specifically, but let’s just say they pwned the services themselves and made their own version of a “service-r00tkit”, modifying information to either prevent us from gaining shell on the box or changing the contents of keys so we received bogus keys and our overwrites were dorked as well.


Good way to act like a virus: bust in, and then lock everyone else out with bad data. Machiavelli and Darwin smile on them.

Leave a Reply

Your email address will not be published.