# HKCERT CTF 2023: MarsATM

## Part 1: The Issue
There is an ATM with $200 in an account to withdraw. There is also a shop that you can purhcase the flag for $800.
You have nowhere near enough enough money (Maximum 1/4 of the money needed) to purchase the flag if you withdraw the $200 then going to the shop.

## Part 2: Observations
Let's have a closer look at the process of withdrawing money from the ATM.

When we type any value between 0 and 200 and click enter, it displays the following in order:

1. Checking Bank Balance
2. Deducting Amount from Bank Balance
3. Dispensing Coins
4. Thank You and Bye

:::info
Observation 1: Each action is done with a delay of 1-2 seconds.
:::

When you enter the ATM screen, you can see the message "Welcome, " followed by some seemingly random characters. That is your ID that is being tracked by the API. What if you open two tabs on the same browser?

:::info
Observation 2: If you open multiple tabs, the ID is still the same (i.e. the API treats both tabs as the same instance).
:::

## Part 3: Theoretical Solution
Since there is a delay of 1-2 seconds between "Checking Bank Balance" and "Deducting Amount from Bank Balance", and multiple tabs open are still considered as the same instance, if you open two tabs and go to the ATM, then withdraw $200 from each within a short enough time period, you will gain $400.
This is because when you withdraw $200 from the second tab, the withdrawal has already been approved on the first tab, but the money has not been deducted from the bank due to the delay between the actions done, allowing the second withdrawal to be approved by the API too.
If we do this with 4 tabs, we are theoretically able to obtain $800.

## Part 4: Execution
The map loops every so often and a "new" ATM appears. It may be necessary to go to different ATMs for all 4 tabs as the API may check for the ATM position as well.
Type 200 in the text box beforehand, then click the confirm button as quick as possible on all 4 tabs. If done correctly (ie. within the delay time), you should have $800.
Go to the shop on any of the tabs and purchase the flag.