deuterium Himanshu Sheoran's blog on tech, security, CTFs and cryptography
2021.06.04Blog on CTFs

Challenge archive: zh3r0 CTF V2 2021 - cheater mind

zh3r0 CTF 2021 - Miscellaneous.

Section
Blog on CTFs
Event began
Markdown sourceRead article

By deuterium.

Original description

Hey, I dont want you to win. Mind if i cheat a little bit?

Read this challenge as plain text or JSON.

Browser practice

cheater mind terminal

Practice only. Rewards are public dummy values, not event flags. Completion is saved separately on this device when storage is available. Nothing runs until you choose Start.

Browser practice needs JavaScript and module Worker support.

Enter sends; Shift+Enter adds a line. Input is not echoed in program output. Stop interrupts computation; Reset clears the session without starting another.

Browser limits and console API

Limits use UTF-8 bytes: 2 MiB per input line, 4 MiB and 4096 lines per batch (including separators), 8 MiB output per operation, and a 1 MiB visible transcript. Earlier output is replaced with a truncation notice. Setup progress is separate, capped at 1024 characters and four updates per second. Original challenge deadlines still apply after setup; there is no extra setup deadline.

The console API is window.challengePractice: start(), send(stringOrLines), stop(), and reset(). Select the version above before starting. Start and Send resolve at the next input prompt or program exit with {output, state, solved}; output contains only that operation's program text. Concurrent operations are rejected. Stop, Reset, deadlines and Worker failures reject in-flight operations; terminal errors carry partial output in error.result.

Strings accept LF or CRLF; a final newline ends the last line without adding another blank line. An empty string sends one blank line. Arrays contain literal lines without LF. Unused lines are discarded if the program exits. Reset keeps saved completion. Public dummy rewards do not unlock the original answer checker.

Files

These files describe the original interactive service. The browser practice above is local; no TCP endpoint or retired remote service is connected.

The handout omits the secret module. Browser practice uses a public dummy reward in place of the event flag; the original remote service is retired.

Download

Sh 
mkdir -p zh3r0-2021-cheater-mind
cd zh3r0-2021-cheater-mind
curl --fail --location --output challenge.txt \
  "https://deut-erium.github.io/challenges/zh3r0-2021/cheater-mind/challenge.txt"
curl --fail --location --output challenge.json \
  "https://deut-erium.github.io/challenges/zh3r0-2021/cheater-mind/challenge.json"
curl --fail --location --output cheater-mind-76c6bf15e3b565583a26f5936b9faef6a7ee2c46.tar.gz \
  "https://deut-erium.github.io/assets/challenges/zh3r0-2021-cheater-mind/cheater-mind-76c6bf15e3b565583a26f5936b9faef6a7ee2c46.tar.gz"

Sources and solutions (spoilers)

The linked writeup is by qxxxb (ARESx); it also preserves the challenge's author credit.

All challenges · CTF tutorials