Daily AlpacaHack: 🐈

index

Description

Nyan Cat!

http://34.170.146.252:14102

Initial Analysis

We are provided with source code files. Let’s extract and examine them:

┌──(chjwoo㉿hackbox)-[~/…/ctfs/alpacahack/web/cat]
└─$ tar -zxvf cat.tar.gz
cat/
cat/web/
cat/web/requirements.txt
cat/web/Dockerfile
cat/web/flag.txt
cat/web/app.py
cat/compose.yaml

From the extracted files, we can identify the important components:

Dockerfile - Container configuration
requirements.txt - Python dependencies
app.py - Main application code
flag.txt - The flag we need to capture
compose.yaml - Docker compose configuration

Let’s start by checking the Dockerfile:

FROM python:3.14.0-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install -r requirements.txt

COPY . .

USER 404:404
CMD ["gunicorn", "--workers", "8", "--bind", "0.0.0.0:3000", "app:app"]

This confirms that the challenge runs a Flask application behind Gunicorn, listening on port 3000.

Now let’s focus on app.py, where the real logic lives.

1
from flask import Flask, request
2
from pathlib import Path
3
import subprocess
4

5
app = Flask(__name__)
6

7
@app.get("/")
8
def index():
9
    return """
10
<head>
11
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/simpledotcss/2.3.7/simple.min.css" integrity="sha512-taVA0VISClRMNshgWnlrG4lcEYSjwpgpI8vaoT0zGoPf9c74DA95SXMngcgjaWTrEsUbKmfKqmQ7toiXNc2l+A==" crossorigin="anonymous" referrerpolicy="no-referrer" />
12
</head>
13
<body>
14
  <main>
15
    <h1>cat🐈</h1>
16
    <form action="/" method="get">
17
      <input name="file" placeholder="app.py" required>
18
      <button type="submit">Read</button>
19
    <form>
20
    <pre><code id="code"></code></pre>
21
  </main>
22
  <script>
23
    const file = new URLSearchParams(location.search).get("file");
24
    if (file) {
25
      fetch("/cat?file=" + encodeURIComponent(file))
26
        .then((r) => r.text())
27
        .then((text) => document.getElementById("code").textContent = text);
28
    }
29
  </script>
30
</body>
31
    """.strip()
32

33
@app.get("/cat")
34
def cat():
35
    file = request.args.get("file", "app.py")
36
    if not Path(file).exists():
37
        return "🚫"
38
    if "flag" in file:
39
        return "🚩"
40

41
    return subprocess.run(
42
        ["cat", file],
43
        capture_output=True,
44
        timeout=1,
45
        stdin=open("flag.txt"),  # !!
46
    ).stdout.decode()
47

48
if __name__ == "__main__":
49
    app.run(debug=True, host="0.0.0.0", port=3000)

The /cat endpoint accepts a file parameter and has the following security checks:

Path existence check: Returns 🚫 if the file doesn’t exist
Keyword blacklist: Returns 🚩 if the string “flag” appears in the filename

This blacklist mechanism prevents direct access to flag.txt by filtering any request containing the word “flag”. The vulnerability lies in this code:

1
    return subprocess.run(
2
        ["cat", file],
3
        capture_output=True,
4
        timeout=1,
5
        stdin=open("flag.txt"),  # !!
6
    ).stdout.decode()

The application runs the cat command using subprocess.run(), but it also redirects flag.txt into the process’s standard input (stdin).

In Unix-like systems:

stdin is file descriptor 0 (fd 0)
It can be accessed via /dev/stdin

This means that even if we are blocked from reading flag.txt by name, its contents are still being fed into the process via stdin. If we can convince cat to read from stdin instead of a normal file, we can leak the flag without triggering the blacklist.

Solution

First, let’s open Burp Suite and send a request to http://34.170.146.252:14102/cat without any parameters:

Somehow, even without specifying a file parameter, we can read the source code of app.py (this is because the default value is "app.py" in the code). Let’s send this request to Repeater for further testing.

Now let’s try accessing flag.txt directly by modifying the request in Repeater:

As expected, the blacklist filter blocks any filename containing “flag”.

Before exploiting stdin, let’s confirm whether this endpoint is vulnerable to Local File Inclusion (LFI) by reading /etc/passwd.

Yep, LFI confirmed. Since flag.txt is being passed as stdin to the cat command, all we need to do is tell cat to read from file descriptor 0.

We do this by requesting /dev/stdin:

/?file=/dev/stdin

And just like that, we got the flag 🎉

Flag

Alpaca{https://http.cat/100}