Capturing the Flag with GPT-4

https://micahflee.com/2023/04/capturing-the-flag-with-gpt-4/

by hiddencost • 3 years ago

235 54 3 years ago

yao420• 3 years ago

I used it on the htb cyber apocalypse ctf a few weeks ago. It did phenomenal and I was able to get a ton of flags on the crypto and ML challenges I otherwise would not have even tried.

edfletcher_t137• 3 years ago

And this time, I did it with the help of GTP-4

Should've had *GPT*-4 proofread this.

isaacfrond• 3 years ago

Hehe, I make the typo all the time! I need to consciously remind myself: Generative Pre-trained Transformer.

pmoriarty4• 3 years ago

Just remember the letters are in alphabetical order.

dataangel• 3 years ago

Especially because this challenge actually includes a very tricky part related to base-27

It looks like a bog standard function for converting to a base X number. All GPT-4 had to do was paste 27 in.

cjbprime4• 3 years ago

Neat! My mind-blown moment with GPT-4 was realizing that it will often be able to tell you the output of the (unique, not available in training data) scripts it writes for you.

aix1• 3 years ago

Relevant: https://www.engraved.blog/building-a-virtual-machine-inside/

politelemon• 3 years ago

That is very interesting, which I'd like to try once GPT4 is widely available. I did try GPT3 with a CTF a few weeks ago, and it gave seemingly plausible code but outright incorrect answers.

yreg• 3 years ago

I did some advent of code exercises with GPT-3 and it often ended the script with something like

    // returns 1337
    return result;

Sometimes the comment stated the correct answer to the puzzle, but the script returned something else since it had a bug.

erfgh• 3 years ago

Hum... maybe it runs the scripts and sees the output?

SargeZT• 3 years ago

It does not. Regular ChatGPT without plugins does not have access to any tools. Throw it a script with some weird outputs and it'll definitely fail, every time. While the script 'evaluation' stuff can be pretty decently impressive, it is not actually executing anything.

wokwokwok3• 3 years ago

It is impressive, but no, it won’t.

It’ll tell you what a typical output for the command might be, and the more complex the script, the more wrong and full of hallucinations it will be.

There’s a huge difference.

Specifically, you have no way of knowing the difference between accurate outputs and inaccurate outputs, without running the command yourself, making it largely worthless.

Without access to environment, it’s not possible to magically know what the output of a command will be, it doesn’t have an embedded understanding of code, specifically not iterations and mapped data or mathematical functions.

For trivial obvious outputs it’s good, but it’s not executing the code; it’s generating what seems like plausible output; and if the output is trivially derived from the input, it’ll be impressively accurate.

…but, as the complexity of the task increases or the task deviates from “standard problem space” the triviality of generating accurate output decreases and it stops generating impressive outputs.

Tldr; yes, but it doesn’t scale well beyond trivial outputs.

ben_w• 3 years ago

Specifically, you have no way of knowing the difference between accurate outputs and inaccurate outputs, without running the command yourself, making it largely worthless.

The former is necessarily the case given the Halting Problem; the latter is falsified by the fact we can reason about code despite the Halting Problem.

pmoriarty4• 3 years ago

It’ll tell you what a typical output for the command might be, and the more complex the script, the more wrong and full of hallucinations it will be.

It doesn't even have to be complex. Ask it about a program in a language that's not very popular and the odds that it'll completely screw up its answers is high.

reaperman• 3 years ago

Tldr; yes, but it doesn’t scale well beyond trivial outputs.

I understand that the current LLM architectures are fundamentally incapable of goal-seeking and that they lack any concept of "correctness". However, I also recognize that somehow, the incredibly "wrong" architecture of ChatGPT is able to be useful.

I'd like to think that with access to a sandbox runtime environment, a significantly larger context window, and perhaps additional copies of the LLM "supervising/orchestrating" multiple "lower" copies of the LLM by breaking down large work into smaller tasks, that the current ChatGPT architecture could scale well beyond trivial scripts.

And then I hope we abandon this LLM architecture and develop architectures which can actually internally work towards "going beyond" in terms of quality of output for a given task.

DennisP• 3 years ago

the more complex the script, the more wrong and full of hallucinations it will be

I often have that same problem myself.

cjbprime4• 3 years ago

Obviously I wouldn't have been impressed by hallucinated output. I'm talking about correctly modeling a variable's state through its conception of what a Python interpreter does, which requires building a model of that interpreter and extracting consequences from it, rather than pure language statistics.

I agree that LLMs will often hallucinate. There is obviously no guarantee that the output is correct. But sometimes it is correct anyway, which I notice by actually running the code.

Here is a trivial example which I only mention to bring the conversation back to the reality of GPT-4 actually being able to do things like this:

Me:

You are a Python interpreter. Please give the correct output of the supplied code, with no commentary.

  >>> a = ["wokwokwok", "says", "i", "have", "no", "understanding", "of", "code"]
  >>> a.append("!")
  >>> " ".join([w.upper() for w in a])

GPT-4, on first attempt:

WOKWOKWOK SAYS I HAVE NO UNDERSTANDING OF CODE !

dist-epoch• 3 years ago

That's provably only possible for "small" scripts, due to the halting problem and all that.

web3-is-a-scam2• 3 years ago

I was actually working on something in this vain yesterday, asking it for output and found it often generated the output I asked for, it was not actually the output of the SQL query that it wrote.

The query it wrote wasn't even valid SQL but it was close enough to make you think it would work.

saulpw• 3 years ago

Yeah I asked it a Python question and got back an answer with some Python code to demonstrate. The Python code worked great but demonstrated the exact opposite of the answer that was given.

bumbledraven• 3 years ago

Are you sure you were using GPT-4? If so, can you provide a transcript or screenshot?

HPMOR• 3 years ago

I know this is extremely unnecessary and pedantic but I think you meant "in this vein" instead of "in this vain".

charcircuit• 3 years ago

I was hoping for someone to have poisoned GPT4's training data with a flag you had to get it to say.

It would be a pretty big flex.

cjbprime4• 3 years ago

Especially since they would have had to do it in 2021!

The MIT Mystery Hunt has occasionally managed to get the NYT crossword on the day of the hunt to contain a clue answer or two.

divbzero• 3 years ago

The spinning globe in the background appears to have an East Pole and a West Pole.

zitterbewegung• 3 years ago

I tried using gpt4 on the qualifier rounds for hackasat and I think you need to know the basics of what is a good answer (or maybe satellite red teaming is too obscure) but I never got a flag out of it .

rfoo• 3 years ago

Hehe, you can solve the two "Street" challenges with GPT-4, they are bog standard entry-level competitive programming challenge disguised as a reverse engineering challenge.

amrb• 3 years ago

I appreciate they say they need to learn more about 'exec' when asking GPT4, it also plays well into some of the reading strategies I've seen to get a high-level understanding then read the documentation with more general idea going in, could also lower frustration for new engineers so they push through to the end!

gjadi2• 3 years ago

I get that it's a way to find out what GPT4 is capable of, but IMHO that defeats the point of a game like CTF.

It's like playing with an aimbot. You may be beating the other players, but where's the fun?

blowski• 3 years ago

I often use cheats and walkthroughs, to the chagrin of my gamer friends. I have fun though, so who cares?

ryan-c2• 3 years ago

I've run CTF games at major conferences. The point is to solve the challenges by any means necessary within the rules... and that which is not forbidden is allowed.

If I, as a person running a CTF, did not want my players to do this, I would set up a few problems which would have incorrect (but not obviously so) "solutions" generated when fed to LLM.

The Shamir's Secret Sharing reminds me of the time I was playing DEF CON CTF Quals, and had the bright idea to try to scan for challenges. I found one - it involved hiding fragments of a split secret in a modified version of ADVENT. I solved it. Even when the board was fully opened, it was nowhere to be seen. You does your hacks and you takes your chances...

pmoriarty4• 3 years ago

it involved hiding fragments of a split secret in a modified version of ADVENT. I solved it. Even when the board was fully opened, it was nowhere to be seen

Can you explain what this means? I don't understand, except for the split secret part.

Also: How did you do it?

gjadi2• 3 years ago

My comment was negative and didn't bring anything. I should have refrain.

Sorry to the author and thanks for the article, I learned about lagrange interpolation.

d23• 3 years ago

I think it’s a reasonable thing to consider, and you brought it up in a healthy, non-inflammatory way.

pmoriarty4• 3 years ago

It's like using a calculator on a math test. On some tests they're allowed, on others using one would be cheating.

fsniper2• 3 years ago

I thought "/shurdles" problem was to be solved via "chroot".

pizzalife2• 3 years ago

You need to be root or have CAP_SYS_CHROOT to use the chroot system call. You can however create a new user and mount namespace on distros that allow unprivileged namespaces (Ubuntu) and then chroot away. The challenge could have been solved that way depending on the kernel used and if the binary was a suid reading a flag file.

But the way the challenge was designed, it's more about just changing argv[0] rather than the actual executable path.

Matir• 3 years ago

Yep, challenge author here, and it was definitely to teach that `argv[0]` is not trustworthy. I've seen privileged processes try to re-invoke themselves (as, say, a child process) by looking at `argv[0]` rather than something like `/proc/self/exe` (which is also subject to race conditions if the directory is writable).

The binary was not setuid, but was only executable (not readable) by the user used.

fsniper2• 3 years ago

Yes. Thank you. I just missed that part.

It's been a long while since doing basic linux administration. I am getting rusty.

dsign• 3 years ago

Chat-GPT is quite capable of doing some "reasoning", but assume for a second it's not, and all it does is to search for human-written solutions and adapt them a little to your question. That alone is incredibly helpful.

Capturing the Flag with GPT-4

Related Stories