XXE injection to read flag.
[wp](http://note.taqini.space/#/ctf/TGHACK-2020/?id=extract-this-93pt)

Original writeup (http://taqini.space/2020/04/08/TG-Hack-CTF-Pwn-writeup/#Extract-this-93pt).