[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_161":162,"_163":156},"routes/_root/_root",{"_158":-7,"_41":159,"_136":-7,"_160":-7},"routes/_root.challenges",{"_37":154,"_155":156,"_157":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_69":70,"_71":72,"_73":74},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","Kakuzuke","canonicalName","kakuzuke",{"_28":62,"_30":63,"_32":64,"_34":16,"_35":16,"_36":16,"_37":65,"_39":66,"_41":42,"_43":16,"_44":67},{"_28":55,"_30":56,"_32":57,"_34":16,"_35":16,"_36":16,"_37":58,"_39":59,"_41":42,"_43":16,"_44":60},{"_28":49,"_30":50,"_32":51,"_34":16,"_35":16,"_36":16,"_37":38,"_39":52,"_41":42,"_43":16,"_44":53},{"_28":29,"_30":31,"_32":33,"_34":16,"_35":16,"_36":16,"_37":38,"_39":40,"_41":42,"_43":16,"_44":45},"author",{"_20":46,"_47":48},"writeupElementId","6a2a3dd2","writeupId","6a2a3dd2-a334-4ece-a7d3-091ca62a16b4","canEdit","canLike","likedByViewer","title","Writeup for Kakuzuke","url","https://github.com/tadanobutubutu/kakuzuke-solve/blob/main/README.md","language","ja","isOfficial","createdAt",["D",1779304048299],"tadanobutubutu","gravatarHash","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":54,"_47":-5},"a3885446","a3885446-e807-4832-bb1c-3ff6eab1494b","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026May/Kakuzuke",["D",1779291541401],"goroshirow",{"_20":61,"_47":-5},"d310fb90","d310fb90-5f0c-4c48-9aa2-0924cad23bc5","Writeup for Daily AlpacaHack 5/18-5/24","https://pan-pudding.com/contents/1780116377190.html",["D",1780116685783],"labpump",{"_20":68,"_47":-5},"c851fbc7","c851fbc7-ef93-491e-b87e-88bef71410de","Daily AlpacaHackに挑戦するつくよみちゃん 05/20 web/Kakuzuke/tchen","https://www.nicovideo.jp/watch/sm46336634",["D",1779292982837],"tsukuyomi-chan","challenge",{"_20":21,"_22":23,"_78":79,"_80":81,"_82":83,"_84":85,"_86":87,"_88":89,"_90":91,"_92":16,"_93":-7,"_94":95,"_96":-7,"_97":-7,"_36":16,"_98":99,"_100":101,"_102":16,"_103":-7,"_104":16,"_105":-7,"_106":-7,"_107":108,"_109":-7,"_110":-7,"_111":-7,"_112":113,"_114":16,"_115":113,"_35":113,"_116":-7,"_117":118,"_119":120,"_121":122,"_123":124},"availablePages",[75,76,77],"canonicalUrl","https://alpacahack.com/challenges/kakuzuke","Description","Solves","Writeups","solves",116,"flagFormat","Alpaca{...}","categories",[151],"attachments",[147],"remote",{"_144":145,"_146":113},"description","CTF Player Ranking Test\n

Beginner Hint 1: Overview of the Challenge

\n\n- In `POST /`, you can read files under the `choices` directory.\n- The goal is to read `/flag.txt`.\n- Strings like `../` do not seem to be filtered, but the 5-character limit appears to prevent path traversal.\n\n

Beginner Hint 2: How to Approach the Challenge

\n\n- The code assumes that `req.body.choices` is a string, but is that really true?\n- However, you cannot send JSON. You need to send the body as `application/x-www-form-urlencoded`.\n\n

\n","descriptionJa","CTFプレイヤー格付けチェック\n

初心者向けヒント1: この問題の概要

\n\n- `POST /`では、`choices`ディレクトリ下のファイルを読み込むことができます\n- 目標は`/flag.txt`を読むことです\n- `../`のような文字列はフィルタリングされていないようですが、5文字の制限によりパストラバーサルが防がれているように見えます。\n\n

初心者向けヒント2: 問題のアプローチ

\n\n- `req.body.choices`は文字列であるという前提のコードですが、果たして本当にそうでしょうか？\n- ただし、JSONを送ることはできません。`application/x-www-form-urlencoded`でボディを送る必要があります。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[141],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[138],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_125":126,"_107":108,"_127":128,"_129":130,"_131":132,"_133":134},"nextDailyCanonical","python-impossible","httpsProxyHostname","kakuzuke.chal.alp4ca.com","program",{"_22":118,"_20":135,"_136":137},"scheduledDate",["D",1779202800000],"releaseAt",["D",1779202800000],"status","PUBLISHED","plannedTopic","LFI","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":139,"_22":140},"Local File Inclusion","local-file-inclusion",{"_20":142,"_47":143},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_148":149,"_39":150},"fileName","kakuzuke.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/12799bbe-dacb-49eb-b38b-74eb978760f2/kakuzuke.tar.gz",{"_20":152,"_22":153},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_164":165,"_166":113,"_167":168,"_169":168,"_170":171,"_172":173,"_174":16,"_175":156},"cspNonce","firebaseOptions",{"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":171},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]