Room / Challenge: QnQSec Portal (Web)
Metadata Author: jameskaois CTF: QnQSec CTF 2025 Challenge: QnQSec Portal (web) Target / URL: http://161.97.155.116:5001/ Points: 50 Date: 20-10-2025 Goal We have to get the flag by get access as admin.
My Solution First we have to examine the app.py. There are some noticable routes:
/login route:
@app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'GET': return render_template('login.html') username = (request.form.get('username') or '').strip() password = request.form.get('password') or '' if not username or not password: flash('Missing username or password', 'error') return render_template('login.html') db = get_db() row = db.execute( 'select username, password from users where username = lower(?) and password = ?', (username, md5(password.encode()).hexdigest()) ).fetchone() if row: session['user'] = username.title() role = "admin" if username.lower() == "flag" else "user" token = generate_jwt(session['user'],role,app.config['JWT_EXPIRES_MIN'],app.config['JWT_SECRET']) resp = make_response(redirect(url_for('account'))) resp.set_cookie("admin_jwt", token, httponly=False, samesite="Lax") return resp flash('Invalid username or password', 'error') return render_template('login.html') /account route:
...
