It begins, as most things do, at 3:42 in the morning.
Three people. A kitchen that smelled of coffee and cold screens. A CTF scoreboard frozen at position 47. A pot of pelmeni on the stove because someone had the foresight to make food, even if no one would eat it until the contest was over.
The challenge was called DOUGH_OVERFLOW. It had been sitting unsolved for 19 hours. The category was pwn. The point value was 500. Nobody had solved it yet.
At 4:17am, it fell.
FLAG{f1rst_bl00d_4t_4_17_4m_still_t4stes_sw33t}
The team needed a name. Someone had already eaten half the dumplings. The rest were getting cold.
"Pelmeni," said one of them. Not as a suggestion. As a statement.
The others looked at the pot. Then at the scoreboard. Then at each other.
"Pelmeni," they agreed.
There was no deeper meaning at the time. The deeper meaning came later, when they realized that pelmeni are the perfect metaphor for their approach to security:
The pot has never been empty since. Not symbolically. Also literally. There is always a pot.
The team grew. Not quickly. CTF teams do not advertise openings. They find people by watching them think.
b01l_0verfl0w was recruited after solving a reverse engineering challenge in 12 minutes that the rest of the field averaged 8 hours on. Nobody asked how.
fill1ng_hunt3r was found through a web challenge writeup so elegant it was quoted in three different conference talks without attribution. They took it as a compliment.
st34m_1nj3ct0r, cr4zy_dumpl1ng, and sp1cy_s4uc3 arrived in their own ways, through their own exploits, at their own 4am moments. The pot was always on when they arrived.
The process of joining is not documented. If you are meant to find it, you will find it.
The team has three rules. They are not written down anywhere official. They are understood.
1. The exploit is not finished until it is elegant.2. If someone is still awake, someone is still working.3. When in doubt, make more pelmeni.
There is a fourth rule that is never stated but always followed: never explain the flag to the person who found it last. They will figure it out.
FLAG{thr33_rul3s_and_0n3_unspok3n}
There is a flag somewhere in this site that nobody has found yet. This is not a hint. This is documentation.
The team leaves things hidden on purpose. Not to frustrate. To reward the kind of person who looks at a webpage and sees a puzzle, not a brochure.
If you have read this far, you are that kind of person.
Welcome.
You are reading a classified document on a team website that most people will never find. Take a moment to appreciate where curiosity got you.
FLAG{cur10s1ty_1s_th3_0nly_r3al_3xpl01t}
— Pelmeni CTF, est. 2023