Original Writeup on seall.dev

When connecting to the instance, we are given this:

$ nc chals.secedu.site 5005
New session started
LOGIN >

Thinking of some usernames from earlier, I think of Layton! We try:

layton
Layton
laypay
lpayden
laytonpayden
layton_payden
LaytonPayden
LPayden

But, its LAYTON that opens the puzzle, great…

$ nc chals.secedu.site 5005
New session started
LOGIN > LAYTON
Welcome. You may "add" hours to your worksheet here

We can add hours, ok!

> add
You have added an hour. You are now on 4 hours.

If we keep entering add we hit the following: Too many hours entered (35 is the max). Resetting to zero.

OK, let’s open two instances and try to exploit a potential race-condition, we work it up to 35 and then enter two add’s:

> add
You have added an hour. You are now on 37 hours.
SECEDU{st0l3n_funds_h3r3}

Flag: SECEDU{st0l3n_funds_h3r3}