[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_145":146,"_147":140},"routes/_root/_root",{"_142":-7,"_39":143,"_120":-7,"_144":-7},"routes/_root.challenges",{"_35":138,"_139":140,"_141":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_53":54,"_55":56,"_57":58},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25],"name","Kakuzuke","canonicalName","kakuzuke",{"_26":46,"_28":47,"_30":48,"_32":16,"_33":16,"_34":16,"_35":49,"_37":50,"_39":40,"_41":16,"_42":51},{"_26":27,"_28":29,"_30":31,"_32":16,"_33":16,"_34":16,"_35":36,"_37":38,"_39":40,"_41":16,"_42":43},"author",{"_20":44,"_45":-5},"writeupElementId","c851fbc7","writeupId","c851fbc7-ef93-491e-b87e-88bef71410de","canEdit","canLike","likedByViewer","title","Daily AlpacaHackに挑戦するつくよみちゃん 05/20 web/Kakuzuke/tchen","url","https://www.nicovideo.jp/watch/sm46336634","language","ja","isOfficial","createdAt",["D",1779292982837],"tsukuyomi-chan","gravatarHash",{"_20":52,"_45":-5},"a3885446","a3885446-e807-4832-bb1c-3ff6eab1494b","Writeup for Kakuzuke","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026May/Kakuzuke",["D",1779291541401],"goroshirow","challenge",{"_20":21,"_22":23,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":16,"_77":-7,"_78":79,"_80":-7,"_81":-7,"_34":16,"_82":83,"_84":85,"_86":16,"_87":-7,"_88":16,"_89":-7,"_90":-7,"_91":92,"_93":-7,"_94":-7,"_95":-7,"_96":97,"_98":16,"_99":97,"_33":97,"_100":-7,"_101":102,"_103":104,"_105":106,"_107":108},"availablePages",[59,60,61],"canonicalUrl","https://alpacahack.com/challenges/kakuzuke","Description","Solves","Writeups","solves",88,"flagFormat","Alpaca{...}","categories",[135],"attachments",[131],"remote",{"_128":129,"_130":97},"description","CTF Player Ranking Test\n

Beginner Hint 1: Overview of the Challenge

\n\n- In `POST /`, you can read files under the `choices` directory.\n- The goal is to read `/flag.txt`.\n- Strings like `../` do not seem to be filtered, but the 5-character limit appears to prevent path traversal.\n\n

Beginner Hint 2: How to Approach the Challenge

\n\n- The code assumes that `req.body.choices` is a string, but is that really true?\n- However, you cannot send JSON. You need to send the body as `application/x-www-form-urlencoded`.\n\n

\n","descriptionJa","CTFプレイヤー格付けチェック\n

初心者向けヒント1: この問題の概要

\n\n- `POST /`では、`choices`ディレクトリ下のファイルを読み込むことができます\n- 目標は`/flag.txt`を読むことです\n- `../`のような文字列はフィルタリングされていないようですが、5文字の制限によりパストラバーサルが防がれているように見えます。\n\n

初心者向けヒント2: 問題のアプローチ

\n\n- `req.body.choices`は文字列であるという前提のコードですが、果たして本当にそうでしょうか？\n- ただし、JSONを送ることはできません。`application/x-www-form-urlencoded`でボディを送る必要があります。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[125],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[122],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_109":110,"_91":92,"_111":112,"_113":114,"_115":116,"_117":118},"nextDailyCanonical","python-impossible","httpsProxyHostname","kakuzuke.chal.alp4ca.com","program",{"_22":102,"_20":119,"_120":121},"scheduledDate",["D",1779202800000],"releaseAt",["D",1779202800000],"status","PUBLISHED","plannedTopic","LFI","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":123,"_22":124},"Local File Inclusion","local-file-inclusion",{"_20":126,"_45":127},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_132":133,"_37":134},"fileName","kakuzuke.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/12799bbe-dacb-49eb-b38b-74eb978760f2/kakuzuke.tar.gz",{"_20":136,"_22":137},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_148":149,"_150":97,"_151":152,"_153":152,"_154":155,"_156":157,"_158":16,"_159":140},"cspNonce","firebaseOptions",{"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":155},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]