Angada: The Unshaken Oath

By Team Cryptonite · 1 min read

About the CTF: Pinaka CTF

The chancery scribe clears every document in his own time. An oath, once sworn, is unshaken - but what may a faithful envoy carry?

**Pinaka CTF 2026** · Web · Team Cryptonite · All 44 Pinaka write-ups

>The chancery scribe clears every document in his own time. An oath, once sworn, is unshaken - but what may a faithful envoy carry? Connection: http://130.210.48.10:9011/

Solve:

• I read the README provided to understand whats happening in the chall.

• To send a POST to /chancery/enroll, you need a X-Session-Id header

• Ok, now with the session id sess_cfa8b7b0,

{
    "head": "r_001",
    "id": "doc_war_terms",
    "owner": "vibhishana",
    "revisions": {
        "r_001": {
            "cls": "sealed",
            "content": null,
            "note": "war-council terms",
            "redacted": true
        }
    },
    "subject": "rama"
}
{
    "delegations": [
        {
            "clearance": "normal",
            "delegate": "angada",
            "delegator": "herald",
            "doc": "doc_war_terms",
            "id": "deleg_8af6ce0b",
            "permission": "dispatch",
            "sig": "30d7ab1300913ca221508e8be8dd0334"
        },
        {
            "clearance": "normal",
            "delegate": "angada",
            "delegator": "herald",
            "doc": "doc_war_terms",
            "id": "deleg_a4fb9f12",
            "permission": "revise",
            "sig": "bd9f9ddbc74f99e3ca9357f9f7287f5a"
        }
    ]
}

• But when i tried reading the doc, it still showed me an error,

{"error":"the current revision is not cleared for dispatch"}

• then I figured out that the document immediately needed to rollback on r_001 because that is where the flag is. it was essentially a race condition.

{"doc_id":"doc_war_terms","note":"the scribe commits a certificate after deliberation","queue_position":1,"queued":true,"rev_id":"r_002"}

• If I try to read the document now,

{
    "audit": [
        {
            "action": "author",
            "actor": "vibhishana",
            "cls": "sealed",
            "doc": "doc_war_terms",
            "rev": "r_001",
            "t": 0.0
        },
        {
            "action": "revise",
            "actor": "angada",
            "cls": "normal",
            "doc": "doc_war_terms",
            "rev": "r_002",
            "t": 254.249
        },
        {
            "action": "submit_review",
            "actor": "angada",
            "doc": "doc_war_terms",
            "rev": "r_002",
            "t": 269.103
        },
        {
            "action": "rollback",
            "actor": "angada",
            "doc": "doc_war_terms",
            "rev": "r_001",
            "t": 269.196
        },
        {
            "action": "certify",
            "actor": "scribe-worker",
            "doc": "doc_war_terms",
            "rev": "r_001",
            "t": 269.715,
            "verdict": "cleared"
        }
    ]
}
{"dispatched":true,"doc_id":"doc_war_terms","response":"PINAKA{angada_the_unshaken_oath}","rev_id":"r_001","subject":"rama"}

• In the response, I got the flag.

Flag:

PINAKA{angadatheunshaken_oath}

Read this post on CyberHx →