Challenge

10.1.1.7:7860. Port 7860 is the Gradio default, so the app was a Gradio (Python ML demo) front end. Submitting a name returned a weak-looking session hash and an event id like {"event_id":"ce75c3979b1b413898d811e757f14398"}, but the real bug was in Gradio’s file handling.

Approach

Gradio’s file endpoint is susceptible to a path-traversal arbitrary file read. We confirmed it by reading /etc/passwd, then walked it straight to the flag:

read /flag.txt

Flag

Recovered by reading /flag.txt through the traversal.