A login ends.
Access shouldn't linger.
Morgan Vale has access to the research vault. Send Morgan a sign-in link, investigate where the identity flow leads, and find a way to return after the browser session has expired.
Your objective: recover the vault flag, formatted ctf{32 lowercase hex characters}. All activity belongs to this isolated training realm.
Send Morgan a link
Start with the portal's authorization URL. Morgan will sign in, then visit the callback once.
Waiting for an authorization URL.
Use your own publicly reachable HTTPS callback on port 443. Morgan's simulator makes one GET request; it does not execute callback JavaScript. Visits are limited to one every 10 seconds.
Identity service details
Client ID: keycee-portal
Realm: ctf
Authorization flow: code
Access that survives
Present Morgan's access token to begin the vault's 95-second time lock. When it opens, return with a newly issued token from the same login session.
Vault locked.
Portal API
POST /api/portal/stage1GET /api/portal/stage2/{ticket}
Both accept Authorization: Bearer <access_token>. The time lock is tied to a login session; signing in again creates a different session.