## TLDR
- Port 80 exposed a `git` repository- Downloading it revealed the AWS credentials and the use of lambda functions- The lambda function contains code with a JWT secret- You can forge the authentication cookie with the JWT secret to login into the port 5000 website- There is a Server Side Template Injection in the `/order` endpoint which gives you a shell and therefore the flag
Full writeup: [https://radboudinstituteof.pwning.nl/posts/htbunictfquals2021/epsilon/](https://radboudinstituteof.pwning.nl/posts/htbunictfquals2021/epsilon/)