miscProhard

EvilBabyKalmarCTF

kalmarctf

Task: CTFd with scraper bot running ctfd-download from /tmp. Solution: Chain CTFd RCE to serve malicious Python via Jinja2 template override, exploit markdown image path traversal to write tqdm.py to /tmp, hijack Python import to exfiltrate flag via notifications API.

$ ls tags/ techniques/
path_traversalctfdpython_module_hijackingscraperctfd_downloadmarkdown_imagesys_pathtqdmjinja2_template_overrideapi_token_exfil
markdown_image_path_traversalctfd_zip_import_path_traversalpython_pth_rcejinja2_template_overridepython_sys_path_hijackingapi_token_exfiltration
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups