HKCERT25 (WEB) - easy lua

December 12, 2025 · 1 min read

1. Challenge Information

  • Category: Web

  • Difficulty: Easy

  • Challenge Description / Prompt:

    A Lua online executor

2. TL;DR Solution Summary

There’s a secret function that can execute os command that can be used to read flag.txt

3. Exploitation

  • The app allows user to execute Lua codes

  • My initial guess is to use os.execute() function to run some shell commands, but when I try it, returns an error suggesting that the os module is deliberately removed from the environment (Lua includes os module by default)

  • Lua stores modules in _G variables, so i write a for loop to loop through all modules in the environment:

    for k, v in pairs(_G) do
  print(k, type(v))
end

  • The app returned list of modules, one interesting entry is S3cr3t0sEx3cFun function

  • Since it’s a function, my guess is that it behave the same as os function, where it takes shell command as it input

  • I use it to traverse the file system, and then retrieve the flag using print(S3cr3t0sEx3cFun(”cat ../flag”))