📊 Challenge Overview

Category	Details	Additional Info
🏆 Event	SwampCTF-2025	Event Link
🔰 Category	Web	🌐
💎 Points	150	Out of 500 total
⭐ Difficulty	🟢 Easy	Personal Rating: 0/10
👤 Author	Unknown	Profile
🎮 Solves (At the time of flag submission)	152	solve rate
📅 Date	31-03-2025	SwampCTF-2025
🦾 Solved By	mH4ck3r0n3	Team: havce

📝 Challenge Information

I took a few hours to create a simple HTML/CSS previewer system. Since there’s no way to add JavaScript then my server should be safe, right? Grab the flag from the http://chals.swampctf.com:47821/flag.txt file on the server to show that this isn’t the case. The flag is in the standard format. Good luck! http://chals.swampctf.com:47821

🎯 Challenge Files & Infrastructure

Provided Files

Files:

•  Attached Files

🔍 Initial Analysis

First Steps

Initially, the website appears as follows:

Since I didn’t find anything interesting here, I moved on to analyzing the attached files. This is a Flask challenge where we need to access the /flag.txt route. Direct access results in a Forbidden response:

1 2 3 4 5 6 7 8 9 10 11 12

@app.route("/", defaults={"path": "index.html"}) @app.route("/<path:path>") def serve_files(path):     try:         return send_from_directory(app.static_folder, path)     except:         referer = request.headers.get("Referer", "")         if not referer or not (referer.startswith("http://127.0.0.1:5000/") or referer.startswith("http://localhost:5000/")):             print(referer)             abort(403, description="Forbidden: Accessing files directly is not allowed... You didn't think it'd be that easy did you.")         return send_from_directory("/app/", path)

As we can see, if the Referer header is not set to http://127.0.0.1:5000/ or http://localhost:5000/, we receive a 403 status code. Initially, I thought it would be enough to make a request like this:

1	curl http://chals.swampctf.com:47821/flag.txt -H "Referer: http://localhost:5000/"

to access the /flag.txt route, but this returned Forbidden:

Let’s move on to the exploitation phase.

🔬 Vulnerability Analysis

Potential Vulnerabilities

• 403 Bypass (?)

🎯 Solution Path

Exploitation Steps

Initial setup

To better understand the challenge and how it works, the first thing I did was test it locally. When I tried sending the same request as before:

1	curl http://localhost:5000/flag.txt -H "Referer: http://localhost:5000/"

I was able to retrieve the flag:

How is this possible? At first, I thought the challenge was broken… let’s move on to the next phase to analyze everything more thoroughly.

Exploitation

The first thing I did was import sys to use sys.stdout.flush() and add print() debug statements to understand how the challenge works. However, focusing on the fact that it worked with Host: localhost:5000 and Referer: http://localhost:5000/, I tried the same approach for the remote challenge by sending a request with identical Host and Referer headers:

1	curl http://chals.swampctf.com:47821/flag.txt -H "Referer: http://chals.swampctf.com:47821/"

Using this method, just like with localhost, I obtained the flag. I then thought that the implementation on the server might be different (?).

Flag capture

🛠️ Exploitation Process

Approach

The automatic exploit performs a simple GET request by setting the Referer: http://chals.swampctf.com:47821/ header and prints the response.

•  Exploit

🚩 Flag Capture

Flag

swampCTF{c55_qu3r135_n07_j5}

Proof of Execution

Screenshot of successful exploitation

🔧 Tools Used

Tool	Purpose
Python	Exploit

💡 Key Learnings

Skills Improved

• Binary Exploitation
• Reverse Engineering
• Web Exploitation
• Cryptography
• Forensics
• OSINT
• Miscellaneous

📊 Final Statistics

Created: 31-03-2025 • Last Modified: 31-03-2025 Author: mH4ck3r0n3 • Team: havce