Titan Relay

The brief

A relay console is open to operators. Recover the flag.

• titan-relay.zip, 143 KB

In short

Titan Relay runs bytecode capsules in a virtual machine written in Rust. One store opcode accepts negative indices and reaches two gate fields the machine never sets. The lab read the seal from the machine's own vault, forged the gate and called the handler that prints the flag file.

Bytecode in a masked capsule

The relay runs a small virtual machine written in Rust, served under Wine. It takes capsules of hex encoded bytecode, and every 32 byte block is masked with one 16 byte XOR vector, applied twice.

Two gate fields nobody sets

The machine keeps a seal for each run at offset 0x00 of its state. Two fields at 0x08 and 0x10 guard a privileged call, and nothing ever writes them. The capsule's memory starts at 0x58.

A store that reaches backwards

Store opcode 0x32 takes a signed index from -10 to 15, at 8 bytes per step. Index -10 lands 80 bytes below the memory, right on the gate field at 0x08, and -9 on the one at 0x10.

The seal, read from its own vault

Gate 0x08 must equal the seal and gate 0x10 the handler address 0x1400018c0. The first memory slot points at the vault at 0xd8, and opcode 0x71 reads both halves of the seal out of it.

A gate opened from inside

With both fields forged and a fake order record in memory, gated call 0x51 runs the handler. It checks the record's seal, its payload pointer, the XOR of the two seal halves and the constant 11.

Eleven bytes to the flag file

The handler unmasks 12 payload bytes into a file path and wants the last one to be zero. Eleven characters is exactly Z:\flag.txt, the Wine name for /flag.txt, and the relay printed the file.

The insight

A store index allowed to go negative reached two gate fields the machine never set, and the seal they had to match sat in its own vault.

The flag

hiCTF{ru5t_vm_g4te_and_h4ndler_ch41n_077cf09252}