[Original writeup](https://github.com/StroppaFR/CTF-Writeups/blob/master/2019/Evlz-CTF-2019/Portability.md)

The zip files contains a Web API using Python and Flask.

When reading the **application.py** file, we notice that the flag is loaded from an environment variable.
> FLAG = os.getenv("FLAG", "evlz{}ctf")

Obviously our environment doesn't contain the flag but we can look around for the "setenv" or "export" string.

`grep -r ./ -e setenv -e export`

One interesting commented line comes out:
> \# export $(echo RkxBRwo= | base64 -d)=ZXZsenthbHdheXNfaWdub3JlX3RoZV91bm5lY2Nlc3Nhcnl9Y3RmCg==

The first base64 string is FLAG and the second the actual flag:
> evlz{always_ignore_the_unneccessary}ctf