webProhard

RootBabyKalmarCTF

kalmarctf

Task: CTFd 3.8.1 with admin credentials, flag at /flag2-*.txt, container runs as root. Solution: ZIP import path traversal via uploads// double-slash bypass to write .pth file, trigger RCE via second import subprocess.

$ ls tags/ techniques/
rcearbitrary_file_writectfdzip_slippth_filepython_pthadmin_to_rcectfd_3.8.1
ctfd_zip_import_path_traversalpython_pth_code_executiondouble_slash_path_bypasstwo_stage_import_trigger
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups