Wrap, Then Decrypt
A token's wrapping key was also given decrypt rights. That single misconfiguration is enough to extract a key that was never supposed to leave.
A token holds a symmetric key, K2, configured with both CKA_WRAP and CKA_DECRYPT set to true — a real, documented PKCS#11 misconfiguration. It also holds a second, sensitive key marked CKA_SENSITIVE = true and CKA_EXTRACTABLE = false, which should never be readable in the clear.
An application with API access (but no way to directly read CKA_SENSITIVE objects) called C_WrapKey on the sensitive key using K2 and mechanism CKM_AES_CBC_PAD, producing the wrapped blob below. You have K2 and the IV used for that call.
Recover the sensitive key's value — it's the flag.
a42a2fde0f4622cc162cdf8bb87b2e94181f75b60a561e333e09b7383a5428de
808496962f1a599d3231ac0244fdf696
2dafc2d9de247073064a8b8fba9cee654c07a9a5a76e508c4fca53eb6722c5802b0a5ea4c305a51a744c2f7424a2bbcf
Hints
Checked entirely in your browser — nothing you submit here leaves your device.
Background on this technique