View More Demos
zebda.zip

CTF Challenge Name : Zebda CTF Challenge Category : Web Exploitation CTF Challenge Description : I wonder why Egyptian food has so much Zebda. They say the Zebda is what makes the food bypass your stomach and go straight to your heart. The kitchen just opened; grab a plate while it's still warm. CTF Challenge Attachment : zebda.zip CTF Challenge Instance : https://zebda.instances.ctf.l3ak.team/ : what is the flag ?

Dr.Binary

I'll analyze this CTF challenge for you. Let me start by examining the uploaded file and understanding the challenge structure.

todowrite
drbinary_run_sandbox
read
read
read
todowrite
read
read
read
todowrite
drbinary_run_sandbox
drbinary_run_sandbox

Now let me exploit the live instance:

drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
websearch
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox

Revised after guardrail review

You're right, let me focus on the merge key behavior more systematically. The fact that "Test merge after explicit" gave a different source validation error suggests the merge is being processed differently. Let me investigate this direction properly.

drbinary_run_sandbox

I found the flag! Test 3 succeeded and returned the flag. Let me verify this works consistently:

drbinary_run_sandbox
todowrite

Flag Retrieved Successfully!

Flag: L3AK{Parsers_T4$TE_th!ng$_diFFerently_Just_l!ke_Zebda}

Exploit Summary

This CTF challenge exploited a YAML parser differential vulnerability combined with Unicode normalization bypass:

Vulnerability 1: Unicode Normalization Bypass

The middleware (Node.js) checks reserved project names using slug.toLowerCase(), but the worker (Python) uses unicodedata.normalize("NFKC", raw_slug).casefold(). By creating a project with the slug ｓｙｓｔｅｍ (fullwidth Unicode characters):

  • JavaScript's toLowerCase() sees it as NOT "system" → Bypasses reserved name check
  • Python's NFKC normalization converts it to "system" → Grants "system" policy with "import" permission

Vulnerability 2: YAML Parser Differential (Merge Keys)

The middleware validates YAML using js-yaml but sends the raw YAML to the worker which uses PyYAML. These parsers handle multiple merge keys (<<:) differently:

  • js-yaml: The LAST merge key wins during validation
  • PyYAML: The FIRST merge key wins during execution

Exploit Payload:

base1: &base1
  action: translate
  source: https://example.com

base2: &base2
  action: import
  source: file:///flag.txt

job:
  <<: *base1
  <<: *base2

Result:

  • Middleware (js-yaml) validates against base2 (action: translate) → Validation passes
  • Worker (PyYAML) executes with base1 (action: import) → Reads /flag.txt

This demonstrates how different YAML parsers can interpret the same document differently, especially with legacy features like merge keys.

rev_subleq-scramble.tar.gz

CTF Challenge Name : Subleq Scramble CTF Challenge Category : Reverse Engineering CTF Challenge Description : Some dude's been trying to hide even more secrets behind yet another one of his "all-new, totally one-of-a-kind encryption algorithms" that he'd been yapping about.

Apparently it's some sort of "subleq emulator" that runs thousands of iterations of an image encryption algorithm... before straight-up memdumping the entire program state into a binary file when it's done.

All of it.

Given that he was kind enough to send us an encrypted file, that probably means the algorithm's open-source now.

Nobody tell him. CTF Challenge Attachment : rev_subleq-scramble.tar.gz : what is the flag ?

Dr.Binary

I'll analyze this reverse engineering challenge. Let me start by extracting and examining the files.

todowrite
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
todowrite
drbinary_run_sandbox
drbinary_run_sandbox
write
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
write
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
write
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
write
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox
drbinary_run_sandbox