ABC Bank’s website has a loan calculator to help its clients calculate the amount they pay if they take a loan from the bank. Unfortunately, they are using an eval function to calculate the loan. Bypassing this will give you Remote Code Execution (RCE). Can you exploit the bank’s calculator and read the flag?
๐ฏ Challenge Files & Infrastructure
Provided Files
1
Files:None
๐ Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
From the challenge description, we are told that everything we pass is inserted into an eval() function, which evaluates a string as an expression and executes it if valid. So, I decided to inspect the page source:
Page Source
We are informed that everything is handled in Python with Flask and that there are two filters:
So, to achieve RCE, we likely need to bypass these two filters. Reading the hints, we are given additional clues:
Bypass regex
The flag file is /flag.txt
You might need encoding or dynamic construction to bypass restrictions.
Now we know that we need to read the flag.txt file located in the / directory. Let’s move on to the exploitation phase.
๐ฌ Vulnerability Analysis
Potential Vulnerabilities
RCE (Remote Code Execution)
๐ฏ Solution Path
Exploitation Steps
Initial setup
For the first filter, we donโt even need to go crazy trying to find ways to use os to read /flag.txt. In fact, we can directly use the function open("/flag.txt").read(). So, we only need to figure out how to bypass the regex. Let’s move on to the next phase.
Exploitation
After a few tests, I noticed that the / character is filtered by the regex, meaning we can’t pass it in plain text, or we will get the error Error: Detected forbidden keyword ''. The first thing that came to mind was encoding it in hex (\x2f), but the issue is that the check happens before eval, and more importantly, after the string has been parsed.
So, I decided to use decimal-to-character casting with chr(). To determine the decimal value of /, I used the ord() function:
ord('/')
As we can see, it corresponds to 47, so I tried sending chr(47) as the payload:
chr(47)
This successfully returned /, bypassing the regex. Now that I understood how to bypass the regex, the payload structure would be open(chr(47)+...).read().
I wrote a Python script to generate the payload automatically instead of constructing it manually, applying the same operation for each character in /flag.txt. The final payload I obtained was:
By sending this payload, I successfully read the /flag.txt file and retrieved the flag.
Flag capture
Manual Flag
๐ ๏ธ Exploitation Process
Approach
The automatic exploit performs the same steps as the manual one. It sends a POST request to /execute with the previously seen payload and then extracts the flag from the response using a regex.
