This was a CTF challenge hosted in INE's CTF Arena and started 07/01/2024 and ended on 07/15/2024.
Last updated
"This challenge requires a blend of cracking tokens, identifying parameters, vulnerability exploitation, and strategic thinking to navigate and compromise the web application successfully. Each stage is built upon the previous one, showcasing the importance of a methodical and thorough approach in web app security testing."
Going into this CTF i was a bit worried if i had what it takes to actually exploit the web application and get all of the flags. I have add a bit of experience when it comes to Web Application Exploitation through NCL. But this definitely seemed a bit more realistic. But like all CTF's, it was definitely a learning journey, and i definitely had fun along the way. If you are reading this i hope you are able to learn a thing or two just as i did :)
Go easy on me, I'm still trying to improve my write up skills
I definitely forgot to take some screenshots, like the actual main site of the page
Some of the tools that were used:
gobuster/ffuf
Burp Suite
Wappalyzer
Foxy Proxy
Directory Brute Forcing/Fuzzing
Intercepting and Manipulating HTTP Requests Headers by using a Web Proxy
JWT Tokens
Command Injection
As soon as we connected to the lab we are prompted to:
Enumerate the provided web application, identify any vulnerabilities, and exploit them to obtain all the flags
As we go to the web app we are met with a "Clouds App" Landing page, i click around some links and forms but nothing looks interesting
Wappalyzer gives us the following tech stack used:
Apache 2.4.52
JS Libraries(Jquery,Lightbox,OWL Carousel)
Templated by Webthemez
This does give us an idea of the technology used by the Web Server, but let's go ahead and enumerate directories on the web app.
/admin
This directory definitely looks interesting, maybe there is some sort of admin panel or stored credentials?
Let's further enumerate the /admin endpoint for any potential files or additional directories using gobuster.
/admin/exec
command injection vulnerability possibly?
we are given the error message "no token found in the header"
/admin/.config
this can definitely store hard coded configuration files
It turns out there was, and this was the flag for the first question, nice!
Now, at this point i was asking myself what is this API_KEY used for? How can we leverage this to gain some sort of privileged access?
Based on our previous gobuster output, i decided to checkout /admin, which in this case was the restricted section of the web app
If we checkout /admin/routes, we are able to find /admin/routes/app.php
This reveals some crucial information as to how the web app generates tokens
Note: I tried using this flag for the second question, but it simply wasn't the answer
(it was the flag to the 3rd question)
I then used Dev Tools to Edit and Resend a POST request /admin/routes/app.php along with the accepted data to see what would happen
Note: You could've also used "Copy as curl" and edit the request or Burp Suite Repeater to do the same thing
A JWT token for the admin was generated!
If we look at this token using jwt.io we see the following
Recap
By fuzzing for directories again, we found /admin/exec/test revealing how the /admin/exec endpoint works
It looks like /admin/exec only requires
a POST request
the "admin" parameter
a valid admin JWT token
A comment also reveals a whitelist of commands for possible command injection in the admin parameter?
Using the token and the admin parameter, i tested for command execution, and it was successful!
But again, it could have been done using curl as well
I then checked for what sort of files and directories were in the usual web root of /var/www/html
/admin looks interesting, let's go ahead and checkout what sort of files are in that directory
and finally let's read index.php for some information disclosure
The flag for this question was the value of HTTP_X_REAL_IP
Now we can access /admin using the following headers
X-REAL-IP: 49.36.83.96
X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
I know, didn't we see this exact same flag earlier? It turns out it was the answer for this particular question
The flags for this CTF were all over the place and i kinda had to guess which flag the CTF wanted for each question
If you look closely, the secrey key is "barcelona"
Using the command injection at the /admin/exec endpoint we used earlier to read /var/www/html/admin/index.php and discover the real IP the /admin endpoint was expecting, we can also read the FINAL-FLAG
Overall this CTF was nice!
Feedback for INE
Better flag placement( not revealing flag 3 if it was supposed to be hidden behind /admin)
It would have been nice to see more command injection restrictions that would have required bypassing
Looks like we need a valid API key
Valid IP Address
We have a valid API KEY
Valid admin token
Valid IP?
Note: I initially did all of this in Burp Suite, but i forgot to take screenshots, so i did it using Dev Tools?! lmao
Voila, we now know what headers the /admin endpoint is expecting
I don't exactly recall if i used this secret key in jwt.io to sign the token? , but looking at the code now, i'm pretty sure i did
