← US Cyber Open Season VI Writeups
We’re given a site and source code. Interestingly that source code has dependencies written by the challenge author as well.
The bottom two aren’t online on github, but the first one is.
And mux has a dependency to another package also written by the author, interesting. I decided to download that one as well to make sure I can see all the custom code.
Wow, it has yet another dependency by the author. This one has two go files linked.
diag.go has a very interesting function which parses the X-Forwarded-Context header on requests:
Looks like we just need base64(0xdeadbeef + <filepath>) as the header value to get an arbitrary file read. Maybe we can literally just do X-Forwarded-Context: b64(0xdeadbeef+'/flag.txt') then:
Flag: SVIUSCG{4cf633164913a50c191142efa65dac01}