Skip to main content
Room Icon

Towel on the Sunbed

Ponzi set his towel down for one 24-hour reward claim. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

medium

45 min

153

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

No chart data to display.
No chart data to display.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
 
 
 
Hacker Holidays · The Byte Lotus Hotel
Towel on the Sunbed
  🐚  
🐚
 
 
 
 
 
 
🌴
🌴
🥥
🥥
🍦
🍹
 
Points
90
Category
Web
Difficulty
Medium
 
🛎️ Concierge Briefing

Ponzi found the resort's wellness portal running a little side project called Ponzi — a crypto rewards app, poolside edition. He set his towel down, claimed his daily reward, and went to reapply sunscreen. He came back to find the sunbed had been "claimed" three times over while he wasn't looking.

He's convinced the app owes him a spot in the Whale Vault. The app disagrees, politely, once every 24 hours. Somewhere between his request and the server's clock, there's a gap wide enough to walk a whale through.

🗝️ ROOM ACCESS
Lab Machine
://MACHINE_IP:3000
App
Ponzi — Wellness Rewards
🏖️ TODAY'S ITINERARY
 Create a guest account and explore Ponzi's daily reward mechanism.
 Work out exactly what's standing between you and Whale Vault status.
 Find your way past it and retrieve the flag from the vault.
📸 @0xMia's STORY
  @0xMia · posted 40 min after room unlock

"ponzi guy has been refreshing his dashboard for an HOUR waiting on this timer 💀 bro really thinks the clock is the only thing checking him #HackerHolidays"

Web Exploitation Business Logic Abuse
Answer the questions below

What is the flag?