Hanuman: The Unknown Messenger

By Team Cryptonite · 1 min read

About the CTF: Pinaka CTF

A vanara messenger relay speaks JSON. Probe its endpoints, reverse the delegation protocol, and escalate from an ordinary courier to royal authority to dispatch the war-writ.

**Pinaka CTF 2026** · Web · Team Cryptonite · All 44 Pinaka write-ups

>A vanara messenger relay speaks JSON. Probe its endpoints, reverse the delegation protocol, and escalate from an ordinary courier to royal authority to dispatch the war-writ. Connection: http://130.210.48.10:9006/

Solve:

• These are the endpoints we had:

- /court/principals -> exposed roster (names + ranks)

- /court/open -> open a relay session (returns token, session_key, self-grant)

- /court/session -> inspect current session state

- /court/reseal -> re declare the principal relay carries

- /court/dispatch -> dispatch a sealed scroll

• in court/principals, the roster only showed sugriva as royal, whereas everyone else was duta
• session auth was Authorization: Duta <session_token>, i found this by bruting header/query/cookie shapes
• /court/reseal lets you set onbehalf to literally anything without verification, so we had to somehow declare onbehalf: sugriva
• /court/dispatch checks three things in order -

- if seal = base64url(HMAC-SHA256(session_key, sid + "|" + sha256(scroll).hex))

- signed grant

- authority of real (should be royal)

• So I had to open a session, then reseal on_behalf=sugriva, seal the scroll and then dispatch with own guild grant
• Script:

• With this, i got the flag:

"flag": "PINAKA{kishkindha_the_exile_meets_the_outcast_king}"

Flag:

PINAKA{kishkindhatheexilemeetstheoutcastking}

Read this post on CyberHx →