RUCTFE

Platform: spbctf | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2019-11-17 | Status: Solved Techniques: duplicate_flag_submission, race_condition_exploitation

Summary

Server: nc 2019-11-17-ructfe.ctf.su 11533

RUCTFE — spbctf

Description

"Однажды Никита нашел Race Condition в журейке RUCTFE. А сможешь ли ты?" ("Once Nikita found a Race Condition in the RUCTFE jury system. Can you?")

Server: nc 2019-11-17-ructfe.ctf.su 11533

Analysis

When connecting to the server, we get a prompt:

RUCTFE* Check system! Pass flags one per line:

This is a simulation of a check system (jury system) for an Attack-Defense CTF that accepts flags for verification and scoring.

Behavior investigation:

1. Empty input — only the prompt, no response
2. Multiple different lines — some are accepted with random points:

 bash read-only • copy allowed Copy
printf "flag1\nflag2\nflag3\nflag4\nflag5\nflag6\nflag7\nflag8\nflag9\nflag10\n" | nc -w 5 2019-11-17-ructfe.ctf.su 11533
# RUCTFE* Check system! Pass flags one per line:
# Flag accepted. 1.5258304822731175 points earned
# Flag accepted. 5.371638036173191 points earned
# Flag accepted. 8.282957543483978 points earned

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The key hint is in the description: Race Condition in the jury system.

In real Attack-Defense CTFs, a race condition in the check system means the ability to submit the same flag multiple times and earn points for each submission (flag double-spending). This is a classic TOCTOU (Time-of-Check to Time-of-Use) vulnerability.

Solution

Send the same flag multiple times in a single connection:

 bash read-only • copy allowed Copy
printf "test\ntest\ntest\ntest\ntest\n" | nc -w 5 2019-11-17-ructfe.ctf.su 11533

Server response:

RUCTFE* Check system! Pass flags one per line:
Wow, race condition detected! Your flag is spbctf{REDACTED}
Wow, race condition detected! Your flag is spbctf{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The system detected that we submitted duplicate flags (simulating race condition exploitation) and gave us the flag.

Notes

• The flag contains "nsychev" — likely the nickname of Nikita Sychev, who found the original race condition bug in the real RUCTFE jury system
• The task is more conceptual/trivia: you need to understand what race condition means in a check system and reproduce it by submitting duplicates
• Empty lines give no response; unique flags are sometimes accepted with random points; but duplicates trigger the race condition detection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍