# ▼▼▼Slash Slash(Web:50、174/696=25％)▼▼▼
This writeup is written by [**@kazkiti_ctf**](https://twitter.com/kazkiti_ctf)
```//Author: maskofmydisguise
handout_slashslash.7z
```
---
## 【Confirmation of attached file】
All source code was presented.
---
application.py
↓
```import osfrom flask import Flask, render_template, jsonify
app = Flask(__name__)
''' secret_key using python3 secrets module'''app.secret_key = "9d367b3ba8e8654c6433379763e80c6e"
'''Learn about virtualenv here:https://www.youtube.com/watch?v=N5vscPTWKOk&list=PL-osiE80TeTt66h8cVpmbayBKlMTuS55y&index=7'''
FLAG = os.getenv("FLAG", "encryptCTF{}")
@app.route('/')def index():	return render_template('index.html')
@app.route('/encryptCTF', methods=["GET"])def getflag():	    return jsonify({	        'flag': FLAG	    }) if __name__ == '__main__':    app.run(debug=False)```
↓
`FLAG = os.getenv("FLAG", "encryptCTF{}")`
It is obtained from **environment variable FLAG**.
---
## 【Way of thinking】
There is no need to build an environment and do a black box test.
It is better to look at the source code.
↓
From now on, it searches for the file which sets the environment variable.
---
## 【searches for the file which sets the environment variable】
/app/env/bin/activate
↓
```# This file must be used with "source bin/activate" *from bash*# you cannot run it directly
deactivate () {    unset -f pydoc >/dev/null 2>&1
    # reset old environment variables    # ! [ -z ${VAR+_} ] returns true if VAR is declared at all    if ! [ -z "${_OLD_VIRTUAL_PATH+_}" ] ; then        PATH="$_OLD_VIRTUAL_PATH"        export PATH        unset _OLD_VIRTUAL_PATH    fi    if ! [ -z "${_OLD_VIRTUAL_PYTHONHOME+_}" ] ; then        PYTHONHOME="$_OLD_VIRTUAL_PYTHONHOME"        export PYTHONHOME        unset _OLD_VIRTUAL_PYTHONHOME    fi
    # This should detect bash and zsh, which have a hash command that must    # be called to get it to forget past commands.  Without forgetting    # past commands the $PATH changes we made may not be respected    if [ -n "${BASH-}" ] || [ -n "${ZSH_VERSION-}" ] ; then        hash -r 2>/dev/null    fi
    if ! [ -z "${_OLD_VIRTUAL_PS1+_}" ] ; then        PS1="$_OLD_VIRTUAL_PS1"        export PS1        unset _OLD_VIRTUAL_PS1    fi
    unset VIRTUAL_ENV    if [ ! "${1-}" = "nondestructive" ] ; then    # Self destruct!        unset -f deactivate    fi}
# unset irrelevant variablesdeactivate nondestructive
VIRTUAL_ENV="/home/eshaan/Desktop/CTFs/Abs0lut3Pwn4g3_CTF/encrypt-ctf-2019/web/100_Slash_Slash/handout/env"export VIRTUAL_ENV
_OLD_VIRTUAL_PATH="$PATH"PATH="$VIRTUAL_ENV/bin:$PATH"export PATH
# unset PYTHONHOME if setif ! [ -z "${PYTHONHOME+_}" ] ; then    _OLD_VIRTUAL_PYTHONHOME="$PYTHONHOME"    unset PYTHONHOMEfi
if [ -z "${VIRTUAL_ENV_DISABLE_PROMPT-}" ] ; then    _OLD_VIRTUAL_PS1="${PS1-}"    if [ "x" != x ] ; then        PS1="${PS1-}"    else        PS1="(`basename \"$VIRTUAL_ENV\"`) ${PS1-}"    fi    export PS1fi
# Make sure to unalias pydoc if it's already therealias pydoc 2>/dev/null >/dev/null && unalias pydoc || true
pydoc () {    python -m pydoc "$@"}
# This should detect bash and zsh, which have a hash command that must# be called to get it to forget past commands.  Without forgetting# past commands the $PATH changes we made may not be respectedif [ -n "${BASH-}" ] || [ -n "${ZSH_VERSION-}" ] ; then    hash -r 2>/dev/nullfi
# export $(echo RkxBRwo= | base64 -d)="ZW5jcnlwdENURntjb21tZW50c18mX2luZGVudGF0aW9uc19tYWtlc19qb2hubnlfYV9nb29kX3Byb2dyYW1tZXJ9Cg=="```
↓
`# export $(echo RkxBRwo= | base64 -d)="ZW5jcnlwdENURntjb21tZW50c18mX2luZGVudGF0aW9uc19tYWtlc19qb2hubnlfYV9nb29kX3Byb2dyYW1tZXJ9Cg=="`
↓
`ZW5jcnlwdENURntjb21tZW50c18mX2luZGVudGF0aW9uc19tYWtlc19qb2hubnlfYV9nb29kX3Byb2dyYW1tZXJ9Cg==`
↓　decode by base64
`encryptCTF{comments_&_indentations_makes_johnny_a_good_programmer}`
---
## ★★important★★They guess that they miss the combination of **ENV** and **shash shash** titles and problems...
**shash shash** → **/●●●/●●●**→**/whatsthetime/123**  can be easily imagined!!