Baby Web

Description

I just learnt how to design my favourite flask webpage using htmx and bootstrap. I hope I don't accidentally expose my super secret flag. Comment Suggest edit

Author: Junhua

http://challs.nusgreyhats.org:33338

https://storage.googleapis.com/greyctf-challs/dist-baby-web.zip

---

Code Analysis

The app is extremely straight forward flask application.

import os
from flask import Flask, render_template, session

app = Flask(__name__)
app.secret_key = "baby-web"
FLAG = os.getenv("FLAG", r"grey{fake_flag}")


@app.route("/", methods=["GET"])
def index():
    # Set session if not found
    if "is_admin" not in session:
        session["is_admin"] = False
    return render_template("index.html")


@app.route("/admin")
def admin():
    # Check if the user is admin through cookies
    return render_template("admin.html", flag=FLAG, is_admin=session.get("is_admin"))

### Some other hidden code ###


if __name__ == "__main__":
    app.run(debug=True)

It signs a cookie with the app.secret_key, which is stored as plain text in the application

---

Exploit

Using flask-unsign, we are able to forge a token and login as admin to retrieve the flag.

After modifying the cookies, we are able to access the admin endpoint, however there is no flag.

Looking at the page source, we saw that there was a hidden endpoint at /flag

Visiting /flag leaks the code.

Flag: grey{0h_n0_mY_5up3r_53cr3t_4dm1n_fl4g}