CURL RCE and kind off kvstore something challenge, i think its cloud SAML challenge

• Attachments
• References

• solution 1
• solution 2
• solution 3

we can use like {} below to bypass blacklist

subprocess.check_output(['curl','{h}ttps://google.com'])

subprocess.check_output(['curl','http[a-z:1]://google.com'])

curl -K ssrf?

in curl we can use -k option without any space to specify a curl config file

example in htbctf 2024 challenge percetron https://trixterthetux.notion.site/HTB-Cyber-Apocalypse-2024-web-Percetron-07e517143f9f4753941efc24b72640e1

curl config will ignore an giberish in start or end of a config file, ex you can see in writeup above

This means we can either hope that the random data before and after isn’t causing any issues, or we can make our username look something like this with the help of newlines in the username: