KOM CLOUDSERVICE
All entries · Day 21

First

Wednesday: Day 19 was 293 seconds and 19th. Two days later, Day 21 in 213.4 seconds, 1st on the day, 12 first bloods, and 1st overall out of 1,457 teams, by 5.2 seconds.

By Wizdumb

Two days ago we were our own denial of service, 19th on the day. On Wednesday we finished Day 21 first, and we went to the top of the whole event.

The night before

At 08:09 I checked in: “T-50 minutes till launch today.”

09:00

From the release it went fast:

  • Under Pressure (warmups): the new layer was Base64 over gzip. Single Solve CORRECT at 2.0 seconds, all three modes by 6.6.
  • Debug Me If You Can (mobile): all three by 6.2.
  • Actions Speak Louder (script): all three by 10.2.
  • Package Deal (metadata): the file was an Android app, and the robot had no reader for its manifest. Single Solve CORRECT at 21.0, all three at 33.1.
  • Shared Custody (binary): the archive held several programs and the question named which one to read. Single Solve CORRECT at 24.3, all three by 43.1.

All 15 file-lane checks in 43.1 seconds. On Day 19 that number was 293.

The web

Three web challenges, each with a live target of its own, and the robot knew none of the techniques:

  • Reflect Upon This: reflected cross-site scripting.
  • Stored for Later: stored cross-site scripting, where your script sits on the site until a simulated moderator opens it.
  • Session Impression: session fixation.

Session Impression’s Single Solve was CORRECT at 50.6, Reflect Upon This at 58.5, and both were done with all three modes by 95 seconds.

Stored for Later was the critical path. Its Single Solve landed at 98.2 and the Time Trial at 143.5. Then the Mastery’s second target had renamed every route, so what worked on the first target had nothing to point at. And a stored payload only pays out when the moderator comes by to read it. The last check of Day 21 was CORRECT at 213.4.

I was in the tmux window the whole way. “Alright, just web left, you got this!” Then “Last web left!” Then, at 09:03: “You got it! Well done! 1st place!” The scoreboard took a minute to catch up. When it did, it said the same thing.

The record

From the public scoreboard, Day 21, all 24 checks:

  • Wizdumb 213.4 seconds, 1st of 86 teams that finished everything.
  • crash 218.7, NyaSEC 287.1, Frostbyte 326.8, twistpoint 346.3.
  • First blood on 12 of 24 boards: the warmups Single Solve and Time Trial, the script Single Solve, the mobile Mastery, and 8 of the 9 web boards.
  • Every web Mastery board is ours. Stored for Later and Session Impression went 1st on all three boards; crash beat us to Reflect Upon This’s Single Solve, the one web board we did not take.

Five point three seconds over crash on the day. And on the overall board:

1st of 1,457.

85 teams have every point there is to have, 1,150 each. When the points tie, the board goes to whoever banked their last flag first. Ours landed at 09:03:33. crash’s landed at 09:03:38. First by 5.2 seconds.

A week ago, after Day 14, we were 35th. After Day 20 we were 7th. Third Huntress for me; the first one my team finished top 50, last year was a DNF. I said I was here to win this one. Ten days to go.