Rating:

# TUCTF 2022 writeup

## Challenge description
![Challenge description](assets/Description.png)

When we folow our network activites we can find that a cookies is present with boolean value :

![Cookie](assets/cookie.png)

I changed its value to "yes" insted of "no"..Nothing happening :(

When we send input we have a hidden message in namecheck page:

![Hidden](assets/hidden.png)

I tried many values for the cookie but nothing happend, next i did few researchs about Tornado and i found that's a python server and one of its vulnirabilities is that we can inject some python code like this {{your_code}}

I typed this one and i ve got an interesting error :

![Error](assets/error.png)

as we can see we have the path of the script, let's try to open it with this comand:

```
{{open("/app/web2.py").read()}}
```
Amazing we have our flag!

![Flag](assets/flag.png)

Original writeup (https://github.com/nass15456/CTFs/blob/main/TUCTF/Tornado.md).