Stripe CTF3: Distributed Systems is live

https://stripe-ctf.com

by jazzychad • 13 years ago

160 118 13 years ago

stripe-ctf.com

danielweber4• 13 years ago

"An unexpected error occurred"

When I make an account.

EDIT I probably already had one. Maybe I failed level -1 for that.

jazzychad• 13 years ago

should be fixed now

CWilliams1013• 13 years ago

Looks like the git repositories used to submit solutions are over SSH? Unfortunately this won't work in an environment that requires outbound traffic to go over an authenticated proxy. Any chance of getting git-over-HTTPS support?

pbiggar• 13 years ago

Try Corkscrew - it lets you tunnel SSH over http proxies: http://www.agroman.net/corkscrew/

jwcrux3• 13 years ago

I'm pulling an empty repo for level1.

Isn't it supposed to start with a TXT file and a sample?

gdb10• 13 years ago

Sorry about that -- should be fixed.

jwcrux3• 13 years ago

Can confirm it's fixed - thanks for the update.

blktiger2• 13 years ago

It's only open for 1 week? :(

gdb10• 13 years ago

Yep — it's a lot of work for us to keep these running. (See https://news.ycombinator.com/item?id=7074064 for a blow-by-blow account of previous CTFs.)

gsastry• 13 years ago

What are the options for us after the week is up if we want to do it?

drux2• 13 years ago

No t-shirts this time ?

pc• 13 years ago

Hm? From the post: "If you complete all the levels, we'll send you a special-edition Stripe CTF3 T-shirt."

drux2• 13 years ago

Ups, my bad

antonyme2• 13 years ago

This is awesome! Except - I haven't finished the Matasano CTF yet! Too many flags, not enough time. :/

tptacek3• 13 years ago

Ours will be up for awhile. Stripe's is time-limited. If you're interested in what Stripe's doing here, I'd do theirs first.

aparadja• 13 years ago

Part of me wishes that you too would have a tight time limit. Your level 19 still keeps me up at night. It disturbs my work. It makes me slightly worse as a person.

antonyme2• 13 years ago

Ah great, ok. I'm really enjoying them, and would really like to finish both!

danielweber4• 13 years ago

Run one in one window, one in another!!

But seriously, spacing would be awesome.

tptacek3• 13 years ago

We had Nicholas for the last two weeks only (he was on break). Turning our hacknight project into a real CTF was his intern project last year. His help at launch was more or less indispensable. Our scheduling was not discretionary.

I'm sure Stripe has a similar story.

We all agree, more careful spacing would be great. Oh well! :)

lpgauth2• 13 years ago

remote: > We're temporarily out of available test cases. This probably means we're under pretty heavy load, but don't worry -- we're creating more right now. Please try again in a few minutes.

meh.

gdb10• 13 years ago

Sorry, should be fixed now! Turns out lots of people want to score their solutions :).

lpgauth2• 13 years ago

Also, looks like you can get very different scores depending on which VM you get... Pushed a second time and jumped to 148 from 119.

dclara20• 13 years ago

Are we allowed to discuss solution here? Or everybody has to work out the results separately?

I don't know Ruby, but I can guess what it is doing basically:

1. Read a list of words from a file with an input path or a default path

2. Take the runtime input from the user with any number of words before carriage return (I guess the words are separated by spaces)

3. Do a loop to compare each of the input words to lower case against the words in the list loaded from the file. If there is a match print out the original word, other wise print out something wrap up the word.

It's a O(NxM) algorithm. If the data set is small, we won't see to much difference. Otherwise, we need to concern about better algorithm to improve the speed.

1. Sort the list from the file (remove duplicates)

2. Always check the either half to reduce the number of checking in the list

3. Sort the input list (save the number of duplicates)

4. Print the duplicates directly without comparison again etc.

This way the runtime can be improved to O(N*lg M). This may not be the best algorithm. I'd like to hear from you about better solutions.

thezoid2• 13 years ago

Or just populate a hash with the input and see if the entries exist in the hash. If they do print it otherwise print the non matchy one.

jwcrux3• 13 years ago

Exactly- hashes and sets are much more efficient than arrays.

webreac• 13 years ago

That's exactly what I did. My fixed code is smaller than the original code and fast enough to go to level 1. It is in perl (I am not fluent in ruby).

jaredsohn3• 13 years ago

This solution won't give the correct results because when you sort and count duplicates, the text you output could be in a different order.

Edit: And to be clear, you should use the hash solution anyway since it is O(n+m).

dclara20• 13 years ago

Nice catch. I should eliminate the sorting on the input words anyways, but save the duplicates in the neighbors, i.e. cache the previous ones.

It does not affect the Big O level I mentioned in sorting of the word list loaded from the file. Looks like it's the necessary step.

dclara20• 13 years ago

Thank you for giving out the Big O. Now I did the search and found that hash map is O(n) or O(1) here:

http://stackoverflow.com/questions/1055243/is-a-java-hashmap...

But I couldn't agree with you about O(n+m) because we cannot hash on the input set as well since that way we will lost the sequence order. Then the caching may help or use LinkedHashmap.

goodwink2• 13 years ago

Any chance this will be open sourced later so that we can run the docker stuff locally for our own team's usage for training etc.?

drharris2• 13 years ago

Man, no way this is going to run on any sort of Windows environment. Guess I won't get to sneak in CTF time at work this time around.

mjallday• 13 years ago

Try vagrant (http://www.vagrantup.com/) and spin up a VM!

drharris2• 13 years ago

I figured I could either spend the next week fighting script execution on Windows or just spin up a linux VM and be good to go. I wound up installing ubuntu manually on a VirtualBox instance. Had heard of Vagrant, but didn't realize what it offered!

jweather• 13 years ago

Working great with vagrant+VirtualBox here on Windows. I initially set it up to try out the CTF docker image, but it's working fine straight out of the precise64 box (+ an apt-get git)

jamesgeck0• 12 years ago

Note that `vagrant up` NEEDS to be run from an admin console for Level 2. The sample application is written in node, and npm wants to make symlinks on the mounted Windows filesystem, which is apparently a privileged operation.

It's a bit of a shame the test harness isn't Windows compatible; it's rather small, and it doesn't look like the fixes required would have been very difficult.

scotch_drinker• 13 years ago

I have not gotten the test harness (written in python) to run on windows yet but the level0 executable is just a ruby script and can be run on Windows with some modifications. If you try to run "python test/harness", it will pull the dictionary down locally in the test folder. Once that's done, make the following modification to the level0 file:

contents = ARGV.length > 1 ? File.read(ARGV[1]) : $stdin.read

That's just allowing you to send the test files in on the command line. From there, you can measure the time using PowerShell's Measure-Command like so:

Measure-Command {ruby .\level0 "test/data/words" "long.txt"}

Assuming ruby is in your PATH and the "test/data/words" is a renamed words dictionary file. It's a little work but you can definitely do it on Windows. I'm working on getting the python test harness to work on Windows.

dkhenry3• 13 years ago

Well my first thought was to use c++11 to do the same thing to give me a better basis for moving forward, and I can't seem to use anything outside the c++ standard libraries. Thats cool because we can always staticly link everything and be done with it and

    version `GLIBCXX_3.4.18' not found (required by ./level0)

:-(

gdb10• 13 years ago

As a note, if you send us requests for Ubuntu packages, we'll happily install them — just send an email to ctf@stripe.com.

dkhenry3• 13 years ago

The missing package that started all this with the boost regex library. I sent an E-mail asking for all the libboost-dev to get installed that should be more then enough for any problem that you could throw at a c++ developer.

nelhage• 13 years ago

You're getting that even with a statically-compiled binary? What's the output of "file ./level0"?

dkhenry3• 13 years ago

level0: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=0x0c727bf14da1597acf7c74b4258e2875f4e9ef21, not stripped

And then the output of ldd on ./level0

linux-vdso.so.1 => (0x00007fff5cdca000) libstdc++.so.6 => /lib64/libstdc++.so.6 (0x0000003337400000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x0000003333c00000) libc.so.6 => /lib64/libc.so.6 (0x0000003332800000) libm.so.6 => /lib64/libm.so.6 (0x0000003332c00000) /lib64/ld-linux-x86-64.so.2 (0x0000003332400000)

I know the problem is I am still dynamically linking glibc and whatever system I am running on doesn't have a new enough glibc. I am going to take another crack at it later and try to get it fully statically linked, but once you get to statically linking the C runtime I need to invoke my google foo and it is more time then I had on my lunch break.

mbrameld• 13 years ago

Anybody else timing out when trying to push the solution?

jonbwhite• 13 years ago

Yep, there system seems to be having some problems.

gdb10• 13 years ago

We're on it! Will be fixed shortly.

gdb10• 13 years ago

(Has now been fixed for a few minutes.)

grey-area12• 13 years ago

yep.

lukasm3• 13 years ago

Can I use python?

eieio• 13 years ago

As far as I know just about any language works. I know python works: I submitted a python solution for level 0.

Just make sure that the level0 file is an executable file and change the crunchbang to run python instead of ruby.

gleenn• 13 years ago

Level0 was fun, Level1 threw me immediately into "This looks like it's gonna suck". I know Git fairly well, but I don't know it that well. I poked at the shell script a bit, but I just ain't seeing it. It's also a lot harder to work on without the support of the easy benchmarking ability that was provided in Level0. How do I know if I'm actually improving.

Props in general, I just feel like Level1 was kind of a brick wall for me.

jyothepro• 13 years ago

yes i felt the same

ch0wn• 13 years ago

I thought the shell script was actually a really great way of introducing you to the subject. You can basically look at the script, make out the "hot" part, optimize that part and you're done.

nayefc3• 13 years ago

How would you optimise internal git commands or a loop that will still need to brute-force either way?

grey-area12• 13 years ago

The link to the git docs is fairly illuminating - there's only a very small part you need to understand. In particular, look at Object Storage under the Git Objects link.

It is a bit tricky because you're competing against random timings for the bot miners, but you need to mine before the bots do, so you need to speed up finding a commit hash, then do the commit. I hope that is useful without giving too much away.

lukasm3• 13 years ago

Cannot push

It looks like you have another in-progress Git operation, and we limit you to one concurrent operation. Waiting 2s (attempt 1/3) It looks like you have another in-progress Git operation, and we limit you to one concurrent operation. Waiting 2s (attempt 2/3) It looks like you have another in-progress Git operation, and we limit you to one concurrent operation. Waiting 2s (attempt 3/3) ERROR: Timed out waiting for your other Git operation to complete. Try again once it has finished. fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists.

gdb10• 13 years ago

Yep, that happens if you try pushing from multiple clients at once (in order to prevent people from spamming us with solutions). If you're still getting that even after a few minutes, ping us at ctf@stripe.com and see what's going on.

lukasm3• 13 years ago

I tried once, but it stoped. I waited a couple of minutes and then ctrl+C'd it.

first push:

git push warning: push.default is unset; its implicit value is changing in Git 2.0 from 'matching' to 'simple'. To squelch this message and maintain the current behavior after the default changes, use:

  git config --global push.default matching

To squelch this message and adopt the new behavior now, use:

  git config --global push.default simple

See 'git help config' and search for 'push.default' for further information. (the 'simple' mode was introduced in Git 1.7.11. Use the similar mode 'current' instead of 'simple' if you sometimes use older versions of Git)

Counting objects: 37, done. Delta compression using up to 4 threads. Compressing objects: 100% (33/33), done. Writing objects: 100% (36/36), 897.66 KiB | 0 bytes/s, done. Total 36 (delta 4), reused 14 (delta 0)

codygman• 13 years ago

I hope Haskell is installed, I just wrote a quick solution which worked with my local dictionary. However, I need to add argument parsing. Yawn. I guess I'll see tomorrow!

tel• 13 years ago

GHC 7.6.2 is installed (I checked the container) and you can use cabal as though you had a sandbox due to the containment.

lasryaric• 13 years ago

Getting the following output when pushing my code:

remote: > Your submission has been placed in the queue. remote: > Kicking off a build for your submission (running `./build.sh`). remote: > `./build.sh` succeeded remote: > Kicking off 3 trials. Here goes... remote: > Started running Trial 0 remote: > Started running Trial 1 remote: > ERROR: There was an internal error scoring Trial 0. If this error persists, please let us know at ctf@stripe.com and include the following error token: err_3MRLt7sxWqqD4C To lvl0-xkzdabbt@stripe-ctf.com:level0 7fcfd3d..17d0e35 master -> master

My code looks to be working because the test ./test/harness says that tests pass.

biscarch• 13 years ago

I was getting a similar error. Ends up I forgot a `require` statement in the ruby code.

thomaslutz• 13 years ago

Known issue, but the team seems to be asleep. Seems like we have to wait.

grey-area12• 13 years ago

I was getting the same on lvl2, seems to be fixed now, so perhaps try again. The performance after it works does seem to be extremely variable though.

grey-area12• 13 years ago

Is anyone else having trouble compiling level3.jar on OS X? I get a lot of this:

[error] import java.nio.file._

abbeyj• 13 years ago

I'm not on OS X but I could only get it working after installing OpenJDK 7. I was trying with OpenJDK 6 and getting errors similar to what you're seeing.

Stripe CTF3: Distributed Systems is live

Related Stories