Archonyx

CACTF2026

Task: Node.js Express app with [email protected] archive extraction, Less CSS rendering, and a Puppeteer bot with SameSite-disabled cookies. Solution: CSRF the bot via top-level form navigation (bypassing PNA) to trigger archive extraction; exploit decompress hardlink race in Promise.all to overwrite db.json and theme.js; login as ledgermaster and trigger Less @plugin RCE to execute SUID readflag.