HI Cyber Con CTF 2026. Binary exploitation.
Apex Engine
Two races in one binary, one for free credit and one for a forbidden file. The lab won both in 6 minutes.
Published 2 November 2026. Challenge by otolk1.
The brief
Welcome to the Apex Multi-Threaded Settlement Engine, a high-frequency asset custody vault built for low-latency asynchronous transaction processing. Our internal risk model asserts that funds cannot be double-spent, and classified vault records are completely shielded from non-root clearance. Can you identify the flaws and recover the flag?
- pwn-apex-engine.zip, 6 KB
In short
A stripped, multi threaded vault binary with two races between a check and its use. Two transfers sent together wrap the balance and make VIP free. A path swapped during the enclave's 25 ms sleep reads /flag.
A vault that runs on threads
The file is one stripped 64-bit Linux binary of 14,472 bytes. It runs a vault menu with escrow transfers, a VIP tier for 10,000 credits and a VIP only enclave that streams documents. A new account holds 100 credits.
Check first, pay 25 ms later
Every transfer is settled by its own thread. The menu checks the balance and starts that thread, which reads the balance, sleeps 25 ms and only then subtracts. There is no lock and no second check.
Two transfers, one balance
The lab sent two transfers of 100 credits in a single write. Both passed the check before either paid, and the unsigned 64-bit balance wrapped to 18,446,744,073,709,551,516 credits. VIP was free.
A path check that sleeps
The enclave thread checks a slot's path for /flag, sleeps 25 ms, then opens the same live buffer. The root clearance that would waive the check is never set, so /flag is always refused. The open does not look again.
Swapped inside the sleep
The lab made slot 0 with its default path, /tmp/preview.txt, and started the stream. About 2 ms later, inside the sleep, it edited the slot to /flag. The open read a path that was never checked.
Out through the enclave stream
Chained in one connection, the four steps print the flag in the enclave's data stream. The lab ran the chain on the binary first, then twice against the live service, with the same flag both times.
The insight
Both guards check a value, sleep, then use it, so anything that changes the value inside the sleep walks straight past them.
The flag
hiCTF{t0ct0u_mult1thr34d_r4c3_c0nd1t10n_w1n_8d3f_be15e1666e}