DamCTF Web Challenge

Name: Hacker Camp

tags: CTF DamCTF web hacker camp

Challenge

Solution

By following the provided link https://hacker-camp.chals.damctf.xyz/we are presented with a login page

So we have a PHP application requesting for a username and password. We did some directory brute forcing with gobuster but didn't get much result, so we proceeded to bypass the login page using SQLi. Providing ' or 1=1# as the username (any SQLi login bypass payload will work, you can find some here) and any password, we are logged in as the user rhonda.daniels

Then we have a list of students, looks like rhonda.daniels is a staff

Going back to the challenge description, we notice that we cannot find our target student Natasha Drew on the list of students and also we do not have a way of updating grades, so we keep digging. Looking through the source page we discover the following:

there is a base64 encoding on each student record which translates to the the format lastname_firstname and also a script that shows the admin status of the user, turns out our user is not an admin after all.

The next line of action would be to make our user an admin or find a way to perform admin operations. Looking further at the source, we found a JS file at /assets/js/app.min.js with the following code:

(function(s, objectName) {
    setupLinks = function() {
        if (s.admin) {
            var sl = document.getElementsByClassName("student-link");
            for (i = 0; i < sl.length; i++) {
                let name = sl[i].innerHTML;
                sl[i].style.cursor = 'pointer';
                sl[i].addEventListener("click", function() {
                    window.location = '/update-' + objectName + '/' + this.dataset.id;
                });
            }
        }
    }
    ;
    updateForm = function() {
        var submitButton = document.getElementsByClassName("update-record");
        if (submitButton.length === 1) {
            submitButton[0].addEventListener("click", function() {
                var english = document.getElementById("english");
                english = english.options[english.selectedIndex].value;
                var science = document.getElementById("science");
                science = science.options[science.selectedIndex].value;
                var maths = document.getElementById("maths");
                maths = maths.options[maths.selectedIndex].value;
                var grades = new Set(["A", "B", "C", "D", "E", "F"]);
                if (grades.has(english) && grades.has(science) && grades.has(maths)) {
                    document.getElementById('student-form').submit();
                } else {
                    alert('Grades should only be between A - F');
                }
            });
        }
    }
    ;
    setupLinks();
    updateForm();
}
)(staff, 'student');

Following the code, after it checks if the user is an admin it obtains the student record with the "student-link" class and then extract the id which is the base64 encoding of the format lastname_firstname we saw earlier and the location is at '/update-' + objectname + '/' + this.dataset.id. We can obtain the id for each student, then the objectname is 'student' by looking that the app.min.js, it's now time to see if we can update a student's record. By picking the first student on the table Brett, Nancie with id TmFuY2llX0JyZXR0 which when decoded translates to Nancie_Brett, we can construct our url to be https://hacker-camp.chals.damctf.xyz/update-student/TmFuY2llX0JyZXR0

Nice. So we know to update we just need the id of the target student. Our student is Natasha Drew so let's make a base64 encoding using the format lastname_firstname, that is Drew_Natasha and try to update her record, https://hacker-camp.chals.damctf.xyz/update-student/RHJld19OYXRhc2hh

But then we get a student record invalid. Okay let's change the format and use the base64 encoding of Natasha_Drew, https://hacker-camp.chals.damctf.xyz/update-student/TmF0YXNoYV9EcmV3

Now we have her records (poor grades, explains why she couldn't attend Hacker Camp xD). Let's upgrade her records to all A's.

And we have the flag

Flag

dam{n0w_w3_c4n_h4ck_th3_pl4n3t}