brachiosaurus

The brief

Gresslyosaurus, the local post officer has unfortunately lost access to the service managing the delivery of letters (the dino swears that he typed the password correctly, he tried it twice). Gressly remembers there being a backup-account with the username backbrachioup, but unfortunately the saurus does not remember this password either (cut him some slack though, it has been a few million years since he last used it).

In short

The post office app was locked, but the meme on its sign up page carried a backup login in its EXIF data. That account unlocked the source and a SQL console that runs psql, and psql runs shell commands. File sizes carried the hidden mail back out.

A password inside the meme

The sign up page shows an elephant meme, a 40 KB JPEG of 500 by 573 pixels. Its EXIF UserComment field holds the backup login in plain text, backbrachioup with the password IsThisAMeteoriteInTheDistance.

The backup account opens the code

As backbrachioup, the app offers a mail list that shows senders but no messages, a debug page and a code backup. The backup is the whole Flask app in 14 files, and debug.py shows what the debug page really does.

A SQL console that runs shell commands

The debug page saves the posted SQL to a file and runs psql on it as the postgres user. psql treats a line that starts with a backslash as its own command, and one of those opens a shell. Nothing comes back to the page.

Reading the mail through file sizes

Another route, /verify_file, returns the size of any file. The lab dumped the 967 byte mail table and cut it into 484 files, each sized to spell two bytes. A file of 24,932 bytes is 0x6164, the letters ad.

Mail row 4

Reading the 484 sizes back rebuilt every message. Rows 1 and 2 reset Gressly's password, row 3 is his apology, and row 4 is his third new password, the flag. Seven minutes in all.

The insight

A console that hands text to psql is a shell, because psql runs its own backslash commands before any SQL reaches the database.

The flag

dach2026{gr355ly_d0n7_f0rg37_th15_0n3_pl3453_1f01da122a05}