Midnight Feedback

450 points. The blurb carried three instructions in one paragraph: reach the reviewer, slip into the hollow, and take what the staff keep there.

The service was intermittently unreachable during the first ten minutes. Port 8111 answered exactly once during initial probing, then went silent. Raw socket tests timed out, and once it began refusing connections it did so immediately rather than timing out, the difference between a filtered and a closed port. The endpoint was provisionally classified as an undeployed challenge on the same pattern seen elsewhere in the event, which turned out to be wrong. A small retrying fetch helper removed the loss of whole probes to this flakiness.

What it was

Birchwood Post: a Flask application served by gunicorn with a woodland theme, consistent with the blurb. The home page carries a feedback form called Leave a note on the hill, posting a name and a message to /feedback, which redirects to /thanks. A link in the corner points to /admin/login, the Keeper's desk, and a health endpoint at /api/health returns {"service":"feedback-portal","status":"ok"}.

The route surface is small. The 30,000-word raft list was run at the root and again under /admin, filtering out the 404 body. Root returned feedback and admin. Under admin, only login. The complete inventory is /, /feedback, /thanks, /api/health, /admin/login, and /admin/notes.

The gate

/admin/notes returns 403 with a twelve-byte body reading Unauthorized. This is the review console, the component the blurb describes as not as careful as it looks.

Most of the effort here went into an incorrect theory. The working hypothesis was that the console rendered submitted notes through an unsafe template engine, making the flaw server-side template injection. Testing it required seeing a note rendered, so a reflection point was sought: notes containing marker strings and Jinja2 arithmetic were submitted, and /thanks, /, and the login error page were grepped for any echo. Nothing reflected anywhere. SQL injection on the login form produced a uniform Invalid credentials for every username, with no enumeration signal. Provoking a 500 to obtain a traceback, which would have exposed source alongside the flag, likewise returned nothing. All four attempts came back clean.

None of that mattered. The requests were spent proving an absence rather than establishing a present.

The anomaly that was not followed up

The auth on /admin/notes was fuzzed with a batch of guesses. One line of the output differed from the rest:

Cookie: role=admin                        <!doctype html><html lang="en"><head><me

Every other line in that batch printed the word Unauthorized. This one printed the start of an HTML document. It was not examined immediately. The other four header bypasses were re-run, the anomaly was buried under a wordlist run of the admin area, and it was returned to later by inference rather than by observation.

That was the answer, present in the output itself. Any line that differs from its neighbours warrants inspection at the point of difference.

The bypass

The review console decides who is a keeper by reading a cookie the client is free to set. There is no session, no signature, and no server-side state. A forged cookie is a valid credential.

$ ffcurl -s -H 'Cookie: role=admin' http://54.72.82.22:8111/admin/notes

That is the whole exploit. The returned page is titled The hollow, carries the line Keeper's eyes only, tucked away where wanderers can't reach, and contains the flag in a gold dashed box.

safctf{f0e94a82-6662-4649-8b44-cb6fd2f8323a}

A second request returned the identical string.

Why the hints line up

Slip into the hollow is literal: the hollow is the name of the page, not a metaphor. Reach the reviewer is the console, and the obstacle was not a password but a piece of data the browser owns, which is why it could be forged. Take what the staff keep there is the gold box.

The review console that is not as careful as it looks did not concern template injection. It concerned trusting the client for an authorization decision.

Method notes

Fuzzing the auth gate precedes theorising about the vulnerability. The working bypass was in hand within ten minutes, after which an elaborate account of template injection, reflection points, and tracebacks was constructed, none of which existed. The entire cost of this solve was ignoring the one line in the output that did not match.

The line of inquiry concerning a bot reading the submitted notes was also unproductive. The blurb states that a keeper reads the board every few minutes, which invited a model built around an automated reviewer, for which no evidence was found. There was no reviewer to reach. There was only a cookie.