CTF Try Out: JailBreak, Time KORP, and Guild Master

This CTF Try Out collection covers three web challenges. The key findings are an XML external entity issue in JailBreak, command injection in Time KORP, and a server-side template injection lead in Guild Master. Screenshots are included alongside the observed evidence.

JailBreak: XML external entity (XXE)

The ROM feature accepts an XML configuration and reflects the value of its <Version> element in the response. Because the XML parser accepts external entities, a crafted document can define an external entity that points to a local file and reference it from the reflected field. This creates a local file disclosure primitive.

The important behavior to verify is that attacker-controlled XML is parsed with external entity resolution enabled and the resulting value is returned in the response. Disable DTD and external entity processing in the parser, and avoid reflecting parsed values without validation.

Time KORP: command injection

The Time KORP screenshots document the command injection discovery and its confirmation. The application accepts input that reaches a command execution path, allowing shell syntax to alter the intended operation. The evidence and challenge flag are shown in the screenshots below.

Treat user input as data rather than concatenating it into shell commands. Prefer safe library calls and allowlisted arguments; if a process must be launched, pass arguments separately and avoid invoking a shell.

Guild Master: Flask/Jinja2 template injection

Guild Master reports that the chosen username or email is already in use, suggesting an account with that identifier exists. A first template probe, {{7*7}}, did not pass the application's input validation. The filter rejects a list of characters and words often used in template payloads, including *, __, class, mro, os, and popen.

The arithmetic expression {{7+7}} passed the filter and evaluated to 14 in the rendered profile. That confirms user-controlled bio content is being interpreted as a template expression and is consistent with Flask/Jinja2 server-side template injection (SSTI).

The observed filter logic is shown here:

def checkInput(bio):
    payloads = [
        "*", "script", "alert", "debug", "%", "include", "html", "if",
        "for", "config", "img", "src", ".py", "main", "herf", "pre",
        "class", "subclass", "base", "mro", "__", "[", "]", "def",
        "return", "self", "os", "popen", "init", "globals", "request",
        "attr", "args", "eval", "newInstance", "getEngineByName",
        "getClass", "join"
    ]
    for blocked in payloads:
        if blocked in bio:
            return True
    return False

After confirming expression evaluation, the remaining screenshots capture the follow-up challenge investigation and evidence.

The general fix for SSTI is to keep user-controlled text out of template source. Pass it as ordinary data to a trusted template, use context-aware output escaping, and do not rely on a blacklist as a security boundary.

4 more writeups added soon!