MYTHOS

GoogleCTF2025

Task: Python Flask + Perl Dancer2 text-adventure game with recursive deep merge (class pollution), session forging, and Perl namespace injection. Solution: Overwrite Flask SECRET_KEY via __class__.__init__.__globals__ traversal, forge session with crafted items payload, inject UNIVERSAL::can override to trigger arbitrary file read of flag.txt.