Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack your way through Stripe's Capture the Flag

stripe.com

Post reply on HN
Print view View original

161–170 of 219 posts

Re: Hack your way through Stripe's Capture the Flag

#161

Post by mpetrov »

saurik wrote: post #156

FYI: the worker process for level05 isn't working anymore (I'm pretty confident it was not me that broke it, btw ;P); even with the simple "hello friend" example (exactly as given in the MOTD on the account), the server always returns "job timed out" (it is now about 3am PST). (edit:) ...and as of almost 3:30am PST, it is no longer possible to log in to the server. :( (...and while typing the next paragraph, I finall…

I'm also stuck at this point. Have the python exploit working on my localhost, now just need to run it live.

Re: Hack your way through Stripe's Capture the Flag

#162

Post by saurik »

mpetrov wrote: post #161
saurik wrote: post #156

FYI: the worker process for level05 isn't working anymore (I'm pretty confident it was not me that broke it, btw ;P); even with the simple "hello friend" example (exactly as given in the MOTD on the account), the server always returns "job timed out" (it is now about 3am PST). (edit:) ...and as of almost 3:30am PST, it is no longer possible to log in to the server. :( (...and while typing the next paragraph, I finall…

I'm also stuck at this point. Have the python exploit working on my localhost, now just need to run it live.

Yeah, same here. :( Part of me wonders whether someone with access to level06 went mucking around in the /tmp/level05 folder (which is itself 770 root.level06, so a level06 user can probably chmod 000 the queue folders) to keep other people from being able to get past that point.

Re: Hack your way through Stripe's Capture the Flag

#163

Post by Drbble »

milkshakes wrote: post #160
lkozma wrote: post #159

Earlier quoted context omitted.

I am surprised by the attitude against what he did, both on reddit and even more so here. Afterall this is "hacker news" and the submission is called "hack your way...". Any definition of hacking that I know includes cleverly exploiting the limitations and boundary cases of a system. I see this attitude as part of a larger trend of "sandbox"-ification, "theme park"-ization of computing.

the competition wasn't "DOS the box", it was "capture the flag". this is charlie sheen "winning" at best

The competition was "Teach Stripe the fundamentals of computer security". Resource quotas is one of those fundamentals.

Re: Hack your way through Stripe's Capture the Flag

#165

Post by lkozma »

milkshakes wrote: post #160
lkozma wrote: post #159

Earlier quoted context omitted.

I am surprised by the attitude against what he did, both on reddit and even more so here. Afterall this is "hacker news" and the submission is called "hack your way...". Any definition of hacking that I know includes cleverly exploiting the limitations and boundary cases of a system. I see this attitude as part of a larger trend of "sandbox"-ification, "theme park"-ization of computing.

the competition wasn't "DOS the box", it was "capture the flag". this is charlie sheen "winning" at best

Not sure about Charlie Sheen, but hacking is all about ignoring what the competition is supposed to be and doing what is possible.

Re: Hack your way through Stripe's Capture the Flag

#166

Post by Drbble »

ab wrote: post #85
rottencupcakes wrote: post #73

Earlier quoted context omitted.

Maybe they should just publish a VM image.

Not a bad idea, but how do you keep people from peeking at the passwords with root access on their own VM?

How do you keep yourself from rifling through the deck to find the Aces when you play solitaire?

Re: Hack your way through Stripe's Capture the Flag

#167

Post by mpetrov »

saurik wrote: post #162
mpetrov wrote: post #161

Earlier quoted context omitted.

I'm also stuck at this point. Have the python exploit working on my localhost, now just need to run it live.

Yeah, same here. :( Part of me wonders whether someone with access to level06 went mucking around in the /tmp/level05 folder (which is itself 770 root.level06, so a level06 user can probably chmod 000 the queue folders) to keep other people from being able to get past that point.

I actually just found a way to kill the worker process remotely (on my localhost). Perhaps they don't have it hooked up to supervisord for autorestart. It's almost trivial to run sys.exit() on that worker.

That being said, your tmp folder permissions theory is much more interesting though and that would be a brilliant way keep everyone else from catching up. :)

Re: Hack your way through Stripe's Capture the Flag

#168

Post by liquidsnake »

lkozma wrote: post #159
tzs wrote: post #136

The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?

I am surprised by the attitude against what he did, both on reddit and even more so here. Afterall this is "hacker news" and the submission is called "hack your way...". Any definition of hacking that I know includes cleverly exploiting the limitations and boundary cases of a system. I see this attitude as part of a larger trend of "sandbox"-ification, "theme park"-ization of computing.

It is against the rules (and against common etiquette) to DOS the machine in CTF events. I don't see how fork bombing the machine helped him solve any challenges so I can't see how someone could approve to that.

Re: Hack your way through Stripe's Capture the Flag

#169

Post by milkshakes »

Drbble wrote: post #163
milkshakes wrote: post #160

Earlier quoted context omitted.

the competition wasn't "DOS the box", it was "capture the flag". this is charlie sheen "winning" at best

The competition was "Teach Stripe the fundamentals of computer security". Resource quotas is one of those fundamentals.

Your goal is to read the contents of /home/level02/.password.

Not sure how exhausting resources will advance you toward that goal.

Re: Hack your way through Stripe's Capture the Flag

#170

Post by gravitronic »

tzs wrote: post #136

The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?

LETS HACK HIM

Seriously though, fuck that guy. Half my night was spent waiting on vi.

Post reply on HN