Randomize flags per challenge instance

I’m working through the Starting Point machines and I’ve noticed that the flags for each challenge remain the same across instances, and over time.

Since you’re using docker to spin up instances, it should be possible in principle to create a new randomized flag for each instance for a challenge, pass it as a parameter to docker run or however you spin up each instance, and store the flag externally (i.e. wherever you are storing the IP address of the machine for displaying on the challenge’s dashboard).

This reduces relying on community suppression of the flag string, and thus bolsters the strength of your ranking as a signal about the account owner’s actual ability to solve challenges.

For the Starting Point challenges, the walkthroughs typically have the flag value in them. If you randomize the flag, then the final question for each challenge (what is the flag?) will actually measure whether the user has followed the steps in the walkthrough. These challenges have questions targeting specific lessons in the walkthroughs, which serves a related purpose: did you either read the walkthrough or at least already know the lesson?

I am doing the challenges on a macbook, so while there is a lot of overlap in tools with Linux (assumed by walkthroughs), there are also some important differences (e.g. there is no smbclient on osx, but there are analogous tools, like smbutil) which I could have ignored if all I cared about were making it look like I’ve passed the challenge. With a randomized flag, I would not have passed the challenge without actually learning how to mount drives over the network using my own setup.

Static flag value is by design and true across every challenge so not likely to change.

When it comes to “cheating”, Starting Point is literally presented as a way to get an introduction, and as such nobody is looking at completed SP flags as a sign of knowledge since they’re all accompanied by explicit walkthroughs from the start.

At the end of the day you’re only fooling yourself if you cheat on guided exercises, not sure who else is affected if you just copy paste the flag values without doing/understanding the tasks that led up to it.

Having the flag change every time an instance is restarted would be an annoyance for any multistep challenges where you’re not doing a consecutive sitting but rather tinkering on them now and then, and with so many challenges being compiled binaries to reverse engineer or do forensics analysis on (with flags being hidden in everything from log files to registry hive dumps to URLs in browser history) it might be doable for a few (where it’s a matter of a simple user.txt/root.txt) but not really feasible for the majority of them.

Good points. I also realized after I wrote that that there’d be further annoyance any time you don’t finish a challenge in one go, and need to spin up a new instance.

1 Like