Made Sense

i couldn’t log in to my server so my friend kindly spun up a server to let me test makefiles. at least, they thought i couldn’t log in :P

https://madesense-okntin33tq-ul.a.run.app

Visiting the website brings us to a page where we can enter a “Target name” and something into a text box and click “make”. We are also linked to a source file:

1
import os
2
from pathlib import Path
3
import re
4
import subprocess
5
import tempfile
6

7
from flask import Flask, request, send_file
8

9
app = Flask(__name__)
10
flag = open('flag.txt').read()
11

12

13
def write_flag(path):
14
    with open(path / 'flag.txt', 'w') as f:
15
        f.write(flag)
16

17

18
def generate_makefile(name, content, path):
19
    with open(path / 'Makefile', 'w') as f:
20
        f.write(f"""
21
SHELL := /bin/bash
22
.PHONY: {name}
23
{name}: flag.txt
24
\t{content}
25
""")
26

27

28
@app.route('/', methods=['GET'])
29
def index():
30
    return send_file('index.html')
31

32

33
@app.route('/src/', methods=['GET'])
34
def src():
35
    return send_file(__file__)
36

37

38
# made sense
39
@app.route('/make', methods=['POST'])
40
def make():
41
    target_name = request.form.get('name')
42
    code = request.form.get('code')
43

44
    print(code)
45
    if not re.fullmatch(r'[A-Za-z0-9]+', target_name):
46
        return 'no'
47
    if '\n' in code:
48
        return 'no'
49
    if re.search(r'flag', code):
50
        return 'no'
51

52
    with tempfile.TemporaryDirectory() as dir:
53
        run_dir = Path(dir)
54
        write_flag(run_dir)
55
        generate_makefile(target_name, code, run_dir)
56
        sp = subprocess.run(['make'], capture_output=True, cwd=run_dir)
57
        return f"""
58
<h1>stdout:</h1>
59
{sp.stdout}
60
<h1>stderr:</h1>
61
{sp.stderr}
62
    """
63

64

65
app.run('localhost', 8000)

These are the checks being run on our Makefile code:

1
if not re.fullmatch(r'[A-Za-z0-9]+', target_name):
2
    return 'no'
3
if '\n' in code:
4
    return 'no'
5
if re.search(r'flag', code):
6
    return 'no'

So alphanumeric only for the name, one line, and not allowed to include “flag”.

I’ve never used a Makefile before, so I did a little bit of research on it. I quickly realized it just executed shell commands, so I figured I could probably just do some bash magic to print the flag. I put the “Target name” as something random and then put cat fl* into the text box.

Clicked make and got the flag!

1
wctf{m4k1ng_vuln3r4b1l1t135}