# 2️⃣ Web 300: BlinkerFluids

<figure><img src="/files/Qf8ivQtHE2CBbMDDvW02" alt=""><figcaption></figcaption></figure>

The challenge contains of web app and a source code. The page contains of markdown editor and after submission it convert the text to pdf.

Reviewing the source code and its node.js, basically checking the packages.json for possible vulnerable packages, that's where I notice the md-to-pdf package.

<figure><img src="/files/w79IK1isYzHLXs9u0znr" alt=""><figcaption></figcaption></figure>

Then I tried to searched for possible exploit and found RCE on snyk.io : <https://security.snyk.io/vuln/SNYK-JS-MDTOPDF-1657880>

<figure><img src="/files/EXSID6Q0e8kN0JQAtEGM" alt=""><figcaption></figcaption></figure>

Which leads me to check to the github issues where I found an interesting comment.

<figure><img src="/files/wgh3C5rfpA3DHoVDov8x" alt=""><figcaption></figcaption></figure>

I created an RCE code and supplied it to the markdown editor and I click submit.

<figure><img src="/files/0DWMvCBwvfDcWuAjZUmS" alt=""><figcaption></figcaption></figure>

Then, I created another markdown to check if the rce2.txt is created, and it listed all the files which the rce2.txt has been created.

<figure><img src="/files/ka62ODRkziyzIGW8nafa" alt=""><figcaption></figcaption></figure>

I created a final markdown content to read the rce2.txt, then i got the flag.

<figure><img src="/files/C6pgXRrdWwMjvQbm0ngj" alt=""><figcaption></figcaption></figure>

Conclusion: ***Package vulnerabilities help me get the flag that highlighted the importance of source code review.***


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ctf.laet4x.com/ctf-2022/htb-cyber-apocalypse-2022-intergalactic-chase/2-web-300-blinkerfluids.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.