> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2024/greyctf-2024/baby-web.md).

# Baby Web

## Description

I just learnt how to design my favourite flask webpage using htmx and bootstrap. I hope I don't accidentally expose my super secret flag. Comment Suggest edit

Author: Junhua

<http://challs.nusgreyhats.org:33338>

<https://storage.googleapis.com/greyctf-challs/dist-baby-web.zip>

***

## Code Analysis

The app is extremely straight forward flask application.

```python
import os
from flask import Flask, render_template, session

app = Flask(__name__)
app.secret_key = "baby-web"
FLAG = os.getenv("FLAG", r"grey{fake_flag}")


@app.route("/", methods=["GET"])
def index():
    # Set session if not found
    if "is_admin" not in session:
        session["is_admin"] = False
    return render_template("index.html")


@app.route("/admin")
def admin():
    # Check if the user is admin through cookies
    return render_template("admin.html", flag=FLAG, is_admin=session.get("is_admin"))

### Some other hidden code ###


if __name__ == "__main__":
    app.run(debug=True)

```

It signs a cookie with the app.secret\_key, which is stored as plain text in the application

***

## Exploit

Using[ flask-unsign](https://github.com/Paradoxis/Flask-Unsign), we are able to forge a token and login as admin to retrieve the flag.

<figure><img src="/files/JmoypyPAKAt2QhXIoktH" alt=""><figcaption></figcaption></figure>

After modifying the cookies, we are able to access the admin endpoint, however there is no flag.

<figure><img src="/files/uDtLWIjhTtfFIOtdpNra" alt=""><figcaption></figcaption></figure>

Looking at the page source, we saw that there was a hidden endpoint at `/flag`

<figure><img src="/files/XB9T0pOfcl459JrDSr1C" alt=""><figcaption></figcaption></figure>

Visiting `/flag` leaks the code.

<figure><img src="/files/xDNL1PZ8XnzLd2MAcW5y" alt=""><figcaption></figcaption></figure>

Flag: grey{0h\_n0\_mY\_5up3r\_53cr3t\_4dm1n\_fl4g}