PatriotCTF 2024 Open Sesame Writeup

Here's my writeup for the PatriotCTF 2024 Open Sesame challenge Challenge notes Does the CLI listen to magic? http://chal.competitivecyber.club:13336 Flag format: CACI{.*} Author: CACI Screenshot of landing page at / Open in new tab (full image size 20 KiB) Flask server In the server.py Flask server code you can execute arbitrary commands by calling the get_cal() function at /api/cal. This works as long as you have the correct cookie. Here's how server.py defines the get_cal() method: # server.py SECRET = open("secret.txt", "r").read().strip() # … @app.route('/api/cal', methods=['GET']) def get_cal(): cookie = request.cookies.get('secret') if cookie == None: return '{"error": "Unauthorized"}' if cookie != SECRET: return '{"error": "Unauthorized"}' modifier = request.args.get('modifier', '') return ( '{"cal": "' + subprocess.getoutput( "cal " + modifier ) + '"}' ) Admin bot The admin.js file holds the entire admin bot code. This includes templates and client-side JavaScript code. Take…