http://www.adhikariashwin0.com.np/tags/lactf/ Recent content in Lactf on the008Killer Hugo en Wed, 11 Feb 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/ctfs/lactf2026/ Wed, 11 Feb 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/ctfs/lactf2026/ <h2 id="webblogler">Web/Blogler</h2> <p><img alt="web-blogler" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/lactf2026/assets/blogler.png"></p> <p>There was a login and register page and after registering a user we get into this web page where we have config editor which seems to take in yaml configuration and another upload blog section.</p> <p><img alt="web page" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/lactf2026/assets/blogler_web.png"></p> <h3 id="analysing-the-contents-of-bloglerzip">Analysing the contents of blogler.zip</h3> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">. </span></span><span class="line"><span class="cl">├── app.py </span></span><span class="line"><span class="cl">├── Dockerfile </span></span><span class="line"><span class="cl">├── static </span></span><span class="line"><span class="cl">│   ├── main.js </span></span><span class="line"><span class="cl">│   └── style.css </span></span><span class="line"><span class="cl">└── templates </span></span><span class="line"><span class="cl"> ├── blog.html </span></span><span class="line"><span class="cl"> ├── index.html </span></span><span class="line"><span class="cl"> └── login.html </span></span></code></pre></div><p>The core vulnerability in this challenge lies in a logic flaw within the <code>validate_conf</code> function combined with the behavior of the <code>display_name</code> function and <em><strong>YAML anchors</strong></em>. <img alt="Blogler bug" loading="lazy" src="http://www.adhikariashwin0.com.np/writeups/ctfs/lactf2026/assets/blogler_bug.png"></p>