It occurred to me about a month ago that I never published author writeups for the “Toaster Wars: Going Rogue” CTF problems from PicoCTF 2017 and PlaidCTF 2017, which is particularly troubling since one of them wasn’t actually solved in contest! To remedy this, and in celebration of the release of a new game in the series that inspired these problems later this week, I’ll be posting writeups for all of the Toaster Wars problems over the course of the week.

For day three, I’ll be covering the first of the three Toaster Wars problems from PlaidCTF 2017: the Light Flag.

Toaster Wars: Going Rogue, Episode 2.5 – Light Flag

I’d heard of the weird region-specific edition of TW:GR, but I didn’t know they were planning on bringing it to the masses. And as a neat online game, no less! They just put out a public beta.

Light Flag (225 points): I found a locked box in Undersea Cavern once… and I think I saw a key in Calm Crystal Reef somewhere? Can you break the lock?

Since we’ve reached the Plaid problems now, we have all new source code to work with. A significant part of these three challenges is working through the large quantity of source you’re given (10.5k lines) to figure out what’s relevant. I’ll be largely glossing over that here since I don’t have much to say about it beyond that taking a targeted approach is probably required to solve the problem in a reasonable amount of time.

Unlike in the PicoCTF versions of this game, when you begin this game, you appear in an overworld hub that you can use to select one of several dungeons:

The hint mentions two dungeons, Undersea Cavern and Calm Crystal Reef. As it suggests, in Undersea Cavern a “locked box” will always spawn on 3F…

…while in Calm Crystal Reef a key will always spawn on 3F.

Either item on its own doesn’t do anything, but we can see that the key will transform a locked box in the players inventory into the light flag when used:

export let key: ItemBlueprint = {
	name: "Key",
	description: "Can be used to open an equipped locked box.",
	graphics: "item-key",
	actions: {
		use: ["use"]
	},
	handlers: {
		use(entity: CrawlEntity, state: InProgressCrawlState, item: Item, held: boolean, eventLog: LogEvent[]): void {
			crawl.propagateLogEvent(state, {
				type: "message",
				entity: {
					id: entity.id,
					name: entity.name,
					graphics: entity.graphics
				},
				message: `<self>${entity.name}</self> used the <item>Key</item>!`
			}, eventLog);

			let index = entity.items.held.items.findIndex((it) => it.name === "Locked Box");

			if (index >= 0) {
				let it = entity.items.held.items[index];
				Object.assign(it, lightFlag);
			}
		}
	}
};

So how can we get both in our inventory at the same time?

When you’re done going through one dungeon, you’re not returned to the overworld hub as you might expect; the game just ends. So it’s not as easy as just playing the game twice.

The key here lies in some faulty logic when transitioning from the overworld game state to an in-dungeon (“crawl”) game state. To understand what’s going on here, we first need to understand how the game handles interacting with an entity or hotzone in the overworld. Every interactable entity and hotzone implements a interact function that returns a JS iterable. This allows an entity to yield one step of its interaction, then continue when it receives the response from the player, eventually returning some value that ends the interaction. For example, the interact method used by the blender in the overworld yields a couple of "speak" commands, then gets a response from the user and sends them to a dungeon based on their response.

It’s also important to know how the game sets up and tears down these interactions. Here’s all of the relevant code:

/**
 * Initializes an overworld scene.
 * @param scene - The overworld scene to initialize.
 */
public initOverworld(scene: OverworldScene): void {
	/* ...some irrelevant setup code... */

	this.socket.removeAllListeners("overworld-interact-entity");
	this.socket.removeAllListeners("overworld-interact-hotzone");

	this.socket.on("overworld-interact-entity", (id: string) => {
		log(`I ent ${this.socket.id}`);
		let entities = scene.entities.filter((ent) => ent.id === id);

		if (entities.length > 0 && entities[0].interact) {
			this.handleInteraction(entities[0].interact());
		} else {
			log(`I end ${this.socket.id}`);
			this.socket.emit("overworld-interact-end");
		}
	});

	this.socket.on("overworld-interact-hotzone", (id: string) => {
		log(`I hz ${this.socket.id}`);
		let hotzones = scene.hotzones.filter((hz) => hz.id === id);

		if (hotzones.length > 0 && hotzones[0].interact) {
			this.handleInteraction(hotzones[0].interact());
		} else {
			log(`I end ${this.socket.id}`);
			this.socket.emit("overworld-interact-end");
		}
	});
}

/**
 * Handles an interaction with an entity in the overworld.
 * @param interaction - The iterator describing the interaction.
 */
private handleInteraction(interaction: IterableIterator<Interaction>): void {
	let advance = ({ value, done }: IteratorResult<Interaction>) => {
		if (!value) {
			this.socket.emit("overworld-interact-end");
			return;
		}

		switch (value.type) {
			case "speak":
				log(`I cont ${this.socket.id}`);
				this.socket.emit("overworld-interact-continue", value);

				this.socket.once("overworld-respond", (response: ClientInteractionResponse) => {
					log(`I res ${this.socket.id}`);
					if (done) {
						log(`I end ${this.socket.id}`);
						this.socket.emit("overworld-interact-end");
					} else {
						advance(interaction.next(response));
					}
				});
				break;

			case "crawl":
				log(`I end ${this.socket.id}`);
				this.initCrawl(value.dungeon);
				break;

			case "transition":
				this.socket.emit("overworld-interact-end");
				this.entity.position = value.start.position;
				this.initOverworld(value.scene);
				break;
		}
	};

	advance(interaction.next());
}

/* ...some irrelevant functions... */

/**
 * Initializes a crawl.
 * @param dungeonName - The key of the dungeon in which to start the crawl.
 */
private initCrawl( dungeonName: string): void {
	this.getLogicNodeAssignment()
		.then(() => {
			let dungeon = dungeons.get(dungeonName);
			this.checkGraphics(dungeon.graphics);
			this.socket.removeAllListeners("overworld-interact-entity");
			this.socket.removeAllListeners("overworld-interact-hotzone");
			/* ...a bunch of irrelevant initalization code... */
		});
}

There are a couple of issues of particular note here:

• There is no locking mechanism to ensure that the player only has one active interaction at a time
• Any time an "overworld-interact-continue" event is received, it will be forwarded to all active interactions
• The "overworld-interact-continue" event listener is not cleaned up at all when starting a crawl
• The iterators underlying the interactions are not cleaned up at all when starting a crawl

Putting all of this together, we can transport the box from one dungeon to the other by taking the following series of actions:

1. Launch the game

2. Start an interaction with the blender

3. Start an interaction with the hotzone for Undersea Cavern

4. Send an "overworld-interact-continue" event with a value of 0

5. Play the game to 3F and grab the box

6. Send an "overworld-interact-continue" event with any value

7. Send an "overworld-interact-continue" event with a value of 2

8. Send an "overworld-interact-continue" event with any value

At this point, all that’s left is to play the game to 3F, grab the key, use it to get the flag, and then use the flag!