247ctf SecuredSession Writeup

If you can guess our random secret key, we will tell you the flag securely stored in your session.

• Skip the secret key parameter because its a dead end by design.
• The bug is in one line up:

session['flag'] = flag

• The default session of flask is signed and not encrypted. The flag gets serialized into the session cookie and handed back in the Set-Cookie header on every request to /flag.
• First step:

Grab the cookie:

curl -sv https://a1164a0ab36f98ff.247ctf.com/flag 2>&1 | grep -i set-cookie

Decode the cookie using 3 options:

1. Flask unsign:

flask-unsign --decode --cookie 'session=<paste the whole value>'

2. Manually through:

 echo '<payload>' | base64 -d 2>/dev/null 

3. Using cyber chef where we convert from base 64 to ASCII text.

The cookie was double encoded :

• The first layer isa clask session payload (URL-safe base64): decodes to {“flag}:{“b”:”..”}}.
• The “ b” key is a Flask’s TaggedJSONSerializer tag for a bytes object because the flag from flag.py is bytes, not a str. Flask base64-encodes bytes values inside the JSON.

The flag: 247CTF{da80795f8a5cab2e037d7385807b9a91}