Hack The Box Business CTF 2024

In May of this year, my work colleagues and I participated in the Hack The Box Business CTF 2024. It was a hacking competition that took place worldwide from May 18th to May 22nd, and it attracted over 900 teams from various businesses located all over the world. This was the first ever CTF (capture the flag) competition that I had participated in. It was a ton of fun to take part in, and actually taught me a lot more than I thought it would. In this post, I want to explain the various things that I took away from this experience.

The competition kicked off at 13:00 UTC (01:00 NZST), so we began on Sunday May 19th. Given that the team and I do also have day jobs, Sunday was the time when we could dedicate the biggest block of time towards solving challenges. Due to the semi-last minute assembly of the team, we played remotely, communicating over Discord. It was here that I learnt the first lesson of CTFs.

Be In The Same Room

Because of our last-minute assembly, we weren’t able to secure a room for the whole team to play the CTF in. Sure, Discord servers can work since everyone can hop into a voice channel to communicate, and it worked well for us. However, you do inevitably run into issues like someone’s internet connection not being good enough, or their speakers/microphone/whatever not being good enough to communicate well with you. There’s no substitute for in-person interactions and collaboration. It’s so much easier to just walk over to someone and ask them a question, or view what they’re doing just by watching over their shoulder. Discord has screen sharing, but the text on your terminal can become blurry while being streamed if you’re operating over a congested network and not paying for Discord Nitro.

Once we got started, we were on a roll. Two flags were captured within the first hour of starting and they just kept coming in as the day progressed, which was extremely motivating. Time really does fly when you’re having fun. We started at 10:00, and before I knew it, it was 17:30. I barely even noticed the time going by as I was glued to my terminal. It was genuinely surprising how quickly the day just flew by. This was the second lesson.

Take A Break

When the work week began again, we were our normal I.T. professional selves by day, and ethical hackers by night. For me, it was straight from work and into the hacking challenges. I already spent a lot of time playing Hack The Box before the CTF, so this kind of schedule really wasn’t anything new to me. At one point, I was up until after midnight trying to get my code to work (and it did eventually work, more on that in a sec). I already knew logically that taking a break was important, but the CTF reminded me why.

Taking a break helps you reset and give your mind a chance to relax. It also gives your eyes and back a breather too. While you’re on your break and thinking about something else, your brain is subconciously trying to find novel solutions to the problem that you were working on. Before you know it, you’ve got a new idea or a new strategy to try. When you’re in the zone, it feels like taking a break is going to cause you to lose your train of thought. Yet, the opposite is true. CTFs and ethical hacking are fun, but the mind does need a chance to rest (while you’re awake). When you’re in the zone and making progress, keep going. But when you’re stuck, and have been stuck for ages, get up and go do something else for a bit. Low Level has a great video/rant on the topic.

Playing in a team really put a fun spin on the usual HTB grind that I’m used to, and this was my third takeaway from the experience.

Teamwork Is Fun

Playing a CTF as a member of a team was way more fun than playing any of the boxes that I’ve done on Hack The Box in the past. When you’re in a team, you’re struggling together. When you’re stuck, you’ve got people to turn to. People that have the same goal, and will encourage and help you when you’re stuck. It also makes every victory feel that much sweeter because you know that your flag submission is going to propel the entire team further up the leaderboard. Teams are a great way to make friends too, and I know that I’ll be reaching out to my teammates again when the next CTF comes along.

Few things unite people more than a shared goal/struggle. Speaking of struggles…

The Struggle

Despite having been a Hack The Box player for a couple of years, there is still so much knowledge that I have yet to acquire. To me, this is both a blessing and a curse. On one hand, the unknown is what motivates me to keep learning. I want to know what I don’t know. I want to know how to do more. On the other hand, not knowing can mean that I have no idea where to start. However one night of the CTF contained more struggles than the others.

On the night that I was up until after 00:00, I was looking for a way to pipe data from nc into python, and then back to nc. Somehow I’ve never had to do this before. I tried methods involving using a bash script to communicate with nc and pass the data to my python script, but got nowhere fast. I also tried to pipe and redirect the data streams on the command line, but that didn’t work either. Finally, I found a Stack Overflow answer that answered my prayers 🙏:

 1import subprocess
 2
 3# Open new subprocess and run nc in a shell, pipe stdin, stdout and stderr
 4proc = subprocess.Popen(["nc 123.123.123.123 1111"], shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 5while True:
 6    response = proc.stdout.readline()
 7    if response == b"OK\n":
 8        # Write back to the process
 9        proc.stdin.write(b"Got it!\n")
10        proc.stdin.flush()
11    elif response == b"EXIT\n":
12        print("Client is closing")
13        break
14    else:
15        print(response)
16
17# Terminate process
18proc.terminate()

This snippet of python code from that Stack Overflow thread worked brilliantly. After editing and inserting it into my existing script, watching the vast quantity of numbers fly up the screen as it worked away was one of the best feelings in the world. A few minutes went by, and then out popped the flag:

That snippet is definitely going into my notes as I bet I’m going to need it again pretty soon.

Results

Out of the 943 teams that registered, our team placed 172nd after capturing 20/63 flags. This put us in the top 20%. I’m so so happy with how we did. The challenges that we played were expertly crafted, and playing them taught me so many valuable things that I can now record and curate inside my Obsidian vault to take with me to the next CTF.

Upon conclusion of the competition, everyone in the team was able to claim their own certificate of participation. Here’s mine:

With the competition having finished, I’m going to spend the next few days reading through the official writeups of the challenges that stumped me. I’m also planning to create my own writeups for the challenges that I completed, which you’ll be able to find here once they’re ready.

I can’t wait for the next CTF.