Тест по YAML

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: yaml_version_difference_exploitation, octal_number_interpretation, dual_parser_bypass

Summary

Walkthrough of the CUSTOM Web Тест по YAML. Task: YAML quiz app requires score of 1337 but max quiz score is 7; server parses YAML with both v1.1 and v1.2 and requires different results. Solution: exploit YAML 1.1 octal interpretation — submit

Description

Чтобы получить флаг, нужно набрать 1337 баллов.

English summary: A YAML knowledge quiz web application. The frontend presents 7 questions about YAML parsing quirks, then submits the score to the server. The server checks the score and returns the flag if it equals exactly 1337. However, the maximum possible quiz score is only 7 (one point per correct answer). The server source code (index.js) is provided in test-yaml.zip.

Analysis

The server receives a result parameter via POST and parses it as YAML twice with different version settings: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 javascript read-only • copy allowed Copy
const result_parsed_1 = YAML.parse(result, null, { version: '1.1' });
const result_parsed_2 = YAML.parse(result, null, { version: '1.2' });

const score_1 = result_parsed_1?.result?.[0]?.score ?? 0;
const score_2 = result_parsed_2?.result?.[0]?.score ?? 0;

if (score_1 !== score_2) {
  score = score_1;
}

Two conditions must be satisfied simultaneously:

1. score_1 !== score_2 — the parsed scores must differ between YAML 1.1 and 1.2
2. score === 1337 — the YAML 1.1 parsed score must equal exactly 1337 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The frontend sends the score as a plain integer (e.g., score: 7), which parses identically in both versions, so score_1 === score_2 and the score stays at 0. Even if we could bypass this, the quiz only awards up to 7 points.

Key Insight: YAML 1.1 vs 1.2 Octal Number Handling

The critical difference between YAML versions is how they interpret numbers with leading zeros:

YAML 1.1 follows the convention where a leading 0 signals an octal (base-8) literal, similar to C/JavaScript. YAML 1.2 dropped this behavior — all bare integers are decimal regardless of leading zeros.

Converting 1337 to octal: 1337₁₀ = 2471₈, so the YAML representation is 02471.

Verification:

• 02471 parsed by YAML 1.1 → octal 2471 → decimal 1337 ✓
• 02471 parsed by YAML 1.2 → decimal 2471
• 1337 !== 2471 → difference check passes ✓
• score = score_1 = 1337 → flag returned ✓ ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Convert 1337 to octal

 python read-only • copy allowed Copy
>>> oct(1337)
'0o2471'

The octal representation is 2471. In YAML 1.1 format with leading zero: 02471.

Step 2: Craft the YAML payload

The expected YAML structure (from the frontend code) is:

 yaml read-only • copy allowed Copy
result:
  - score: 02471

Step 3: Send the exploit

 bash read-only • copy allowed Copy
curl -s -X POST https://quiz-yaml.t1.bug-makers.ru/submit \
  -d 'result=result:%0A  - score: 02471'

Response:

 json read-only • copy allowed Copy
{"pass":true,"flag":"BugCTF{REDACTED}"}

The flag name itself is a hint: REDACTED → "decimal to octal yaml" — confirming the intended solution path. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering yaml_version_difference_exploitation, octal_number_interpretation, dual_parser_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-25 • CUSTOM • Тест по YAML • Difficulty: Easy