KOM CLOUDSERVICE
All entries · Day 20

Mish Mash

Tuesday: all 15 file-lane checks first in 44.8 seconds, then one web challenge about a single file held us for four and a half minutes. 7th of 108 on Day 20, and the fixes that set up Wednesday.

By Wizdumb

Monday we were our own denial of service. Tuesday the robot fixed that, and then a web challenge about reading one file cost us the day.

09:00

The file lanes were the best we have ever run:

  • Big Entrance (warmups): the new layer was UTF-16 hex. All three modes by 6.3 seconds.
  • Loaded Later (mobile): all three by 6.6.
  • The Butler Did It (script): all three by 7.7. The Single Solve had 1,329 questions and the Mastery 6,645.
  • Universal Appeal (metadata): the question asked for a Mach-O binary’s CPU type, and the robot had no reader for it. All three by 17.3.
  • Resourceful (binary): a new resource-overlay field. Single Solve CORRECT at 35.3, all three by 44.8.

All 15 file-lane checks in 44.8 seconds, 1st on the board for that set. team.dev did it in 67.9. One day earlier our number had been 293.

At 09:01 I was yelling at the tmux window: “You’re soo close, get there!!!”

The web

Two web challenges came out on Tuesday, each with its own live target.

Administratively Speaking went the way the plan said it would. The Single Solve was CORRECT at 31.5, the Time Trial at 62.3 and the Mastery at 80.6. First blood on all three boards.

Stay in Your Directory did not. It was local file inclusion: a page that takes a document name and includes that file from a fixed folder. Two dots and a slash climb out of the folder, and from there you can read any file the server can. The challenge prompt said exactly which file held the proof.

The robot had never seen the technique, and it found the hole quickly. Then it spent minutes guessing at which file to read: proof files, flag files, /tmp, /opt, the process environment. All of it was empty. The one thing that named the file, the prompt, never came into it. The Single Solve was CORRECT at 281.4, and the last check of Day 20 was the Mastery at 330.3.

“You got the single!!! Great!!! Let’s get it! Finish it!!”

At 09:18 I summed it up: “Ok, so today was a mish mash. We absolutely nailed it on the first lanes… But the web hung us up.”

The record

From the public scoreboard, Day 20, all 21 checks:

  • Wizdumb 330.3 seconds, 7th of 108 teams that finished everything.
  • crash 162.7, OscarsWorld 163.0, Seeking_Security_Job_And_Flags 168.1.
  • First blood on 15 of 21 boards: every board on metadata, script, binary, mobile and Administratively Speaking.
  • Stay in Your Directory: 26th on its Single Solve and Time Trial, 16th on its Mastery.

Every other check of the day was done by 80.6 seconds, and crash won the day at 162.7. That one file was the whole gap. On the overall board we were 7th.

The fixes

At 10:12 the fix that mattered most went in, and it was mine: the robot reads the challenge prompt first now, and anything the prompt names. Local file inclusion is robot code too, and it tries the paths the prompt names before anything else.

The evening

In the evening I asked for the web techniques I expected to come, before they showed up. The model I asked got stopped by its own safety filter. “I’m asking you to prep for a CTF challenge, do you realize how silly it sounds to me that you’re getting refused here?” Wednesday’s post tells how the prep went.