Прошлогодний флаг (Last Year's Flag)

Platform: bug-makers | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-27 | Status: Solved Techniques: api_endpoint_extraction, binary_string_analysis, parameter_tampering, time_manipulation

Summary

Task: ELF binary sends POST request with current year to API endpoint, server rejects it. Solution: extract API endpoint from binary strings, send request directly with year=2025 (last year) to get the flag.

Прошлогодний флаг (Last Year's Flag) — BugCTF 2026

Description

— У вас флаг свежий? — Нет, прошлогодний!

English summary: A binary file last_years_flag is provided. The challenge name translates to "Last Year's Flag" with a dialog: "Is your flag fresh? — No, last year's!" The goal is to obtain the flag from the binary/service.

Analysis

The provided file is an ELF 64-bit x86-64 dynamically linked binary, not stripped. It uses libcurl for HTTP requests and the nlohmann JSON library for JSON construction. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key strings found in the binary:

• https://last-year-flag.t1.bug-makers.ru/get_flag — the API endpoint
• Content-Type: application/json and Accept: application/json — HTTP headers
• year — JSON field name
• localtime — libc function used to get current time

Reverse engineering the main() function reveals the following logic:

1. Takes user input as a "name" parameter
2. Calls localtime() to get the current system time
3. Extracts the year as tm_year + 1900 (= 2026, the current year)
4. Constructs a JSON payload: {"name": "<user_input>", "year": 2026}
5. Sends a POST request to https://last-year-flag.t1.bug-makers.ru/get_flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server rejects requests with year=2026 (the current year). The challenge name "Прошлогодний флаг" (Last Year's Flag) is the key hint — the server only returns the flag when year = 2025 (last year). Since the binary always sends the current year, it will never work as-is.

Solution

The solution is to bypass the binary entirely and call the API directly with year=2025:

 bash read-only • copy allowed Copy
curl -s -X POST "https://last-year-flag.t1.bug-makers.ru/get_flag" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","year":2025}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

 json read-only • copy allowed Copy
{"message":"Вот ваш флаг: BugCTF{REDACTED}"}

Alternative approaches that would also work:

• LD_PRELOAD: Hook localtime() to return a struct tm with tm_year = 125 (2025 - 1900)
• faketime: Use faketime '2025-01-01' ./last_years_flag to run the binary with a spoofed system clock
• Binary patching: Modify the year calculation in the binary to subtract 1

The simplest approach is the direct API call since the endpoint and expected JSON format are visible in the binary's strings. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍