Haruul Zangi 2026 Final – Technical information

You are viewing the public guide. A separate version with venue-specific instructions is available on the competition intranet. Connect to the venue network and open the intranet guide for complete participant instructions. See basic network configuration to get connected.

Equipment

Each team will be provided with the following equipment:

Competition image and VirtualBox

The final competition image will be provided as an OVA file. VirtualBox is required to import and run it. Download VirtualBox and install it before the competition.

Basic network configuration

  1. Connect your computer to your team's provided Ethernet connection at the venue.
  2. In your Ethernet adapter's IPv4 settings, select automatic addressing (DHCP) for the IP address, subnet mask and default gateway.
  3. DHCP also supplies the venue DNS server. If you configure DNS manually, set the DNS server to 10.13.37.131 on that Ethernet adapter.
  4. Open https://101.final.haruulzangi.mn while connected to the venue network and follow the intranet guide.

If the intranet hostname does not resolve, check that your Ethernet connection is active and uses DNS server 10.13.37.131. Browser Secure DNS or DNS-over-HTTPS settings may bypass the venue DNS; use the system DNS setting for venue access. Ask the organizers for help if access still fails.

These settings apply at the venue. The intranet DNS server is a private address and is not reachable from the public Internet. Obtain any required manual IP settings from the organizers or the intranet guide.

Scoreboard URL: https://final.haruulzangi.mn/scoreboard

Flag signatures

Flags are stored and transported into so-called capsules. A capsule looks like this: HZ{eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJmbGFnIjoiYTRhYmIzZTU0ODM2MTNkNWMzMmY0NjIyYjkzMDE0ZDU9In0.8Dg2FOnWz_dAbT4m2nKCvTb_tjPO1gsZR63NA2md7zclb2DMUb_GND7Lg2YsrunS5uFiTkqAyrqGlMMDeB5qDQ}

Data between HZ{ and } is a JSON Web Token signed using ES256 algorithm. You will need an ACS public key to decode a capsule and obtain a flag from it. Flag format is ^[\da-f]{32}=$.

Public key (for the sample capsule) -----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeiZb279aIyoK2tSQrwv6y604xcxszChanXuH/Kjr
jUxmeXFh5amKIh3SOatcfebOoa/zlrthu3P09jQbRtm9mg==
-----END PUBLIC KEY-----

Submitting flags

You should submit flags to the REST API server: https://final.haruulzangi.mn (base URL).

Each flag's lifetime is 7 minutes.

API

Open Data

Open data is public traces that some service checkers expose to facilitate flag discovery. For instance, open data might contain usernames that a checker generated and used to sign up for a service and to push flags there.

Every time open data is fetched, the response is limited to the available information on the live (not expired) flags. There is no way to fetch open data on expired flags (historical data).

Open data format is plain text, however it might be encoded (e. g. in json or base64) depending on a service checker. If it is encoded, the format is clear from the data shape. Public API libraries provide helpers to facilitate decoding.

Rate limits

An insight into ACS

A game is divided into 2-minute rounds.

When a new round is triggered, ACS tries to push flags (transported in capsules) to every service of every team. If a push attempt of a flag is successful, this particular flag is marked as active. ACS immediately tries to pull active flags.

Every flag expires 7 minutes after it has been marked as active.

Additionally, in each round ACS launches 3 polls: it pulls one randomly chosen active flag from each service from each team.

Scores are updated when all active flags issued in a particular round become expired.

Availability

1 availability point for a flag (AvPflag) is given if all attempts to pull this flag were successful (UP state). Otherwise, a fraction of a point is given according to the equation:

AvPflag = SPAflag / TPAflag,

where SPA stands for the number of successful pull attempts and TPA stands for the total number of pull attempts.

Defence

By default, no defence points for any flag from any service are given.

Defence points for flags from a service are to be awarded starting from the next round a flag from this very service is successfully submitted into ACS by any team (first blood). 1 defence point (DPflag) is given if all attempts to pull a flag were successful and no-one has stolen and submitted this particular flag into ACS.

Attack

1 attack point (AtPflag) is given for each stolen flag.

A team cannot submit a flag stolen from a service X if a state of a service X in their vulnbox is not UP.

Total

Total team score (TtS) is calculated as a sum of total scores (tS) in each category:

TtS = tSattack + tSdefence + tSavailability

In case of equal TtS a team who performed the last attack before the other team is placed higher in the scoreboard.