Skip to main content

How I enumerated flags of all the problems in CTFLearn | Part 1

What is CTFLearn?

CTFLearn is a jeopardy-style CTF where points are received after solving the problems and gaining the flag. The player with highest number of points is on top of the leader-board. However, unlike other CTFs where a party makes the question and players solve it, CTFLearn allows you to post your own questions too.

 

What was the vulnerability?

The edit functionality in the application allows the problem creator to edit the problem. If an user tries to edit a problem that he doesn't own then he will be redirected to the view problem functionality. However, in the redirection HTTP response, the body of edit problem functionality is thrown. Hence, the edit problem functionality discloses the flag when accessed by user who didn't create the problem. I will go into details of this on the upcoming parts. This was an information disclosure vulnerability caused due to broken access control.

 

What was the impact?

 The flag was being disclosed which means that the players could get flags without solving problems. This impacted highly in platform confidentiality.

 

How to exploit the vulnerability by yourself?

 1. Login to CTFLearn



 2. Note the problem id of a problem



 

4.  Replace the problem_id parameter in the following URL to the problem_id you noted in Step 2: https://CTFLEARN_V1_URL/view/index.php?action=show_edit&problem_id=1

5. Open the URL you created at Step 4 in a web browser, intercept the request in Burp Suite and send it to repeater

 



 

 6. Find the request in repeater tab and send it. Do not follow redirection.

7. Find the flag in HTTP Response:



 

Conclusion

I reported this vulnerability and it has already been patched. However, you can clone the old version by visiting LukeLaScala's Github repository on this link and try to exploit this vulnerability by yourself.

 

 


 

 

 
 

 

Labels:

Comments

Post a Comment

Popular posts from this blog

Mysterious Javascript Code Found Infecting Hundreds of Websites

  After installing Wappalyzer in my browser, I decided to test its functionality by visiting a familiar website. To my surprise, I was unexpectedly redirected to a spear phishing campaign. Knowing the website's usual practices, it seemed highly unlikely that they would intentionally redirect their visitors in such a manner. Intrigued by this anomaly, I took it upon myself to investigate the underlying cause of this redirection.   I have not yet known how threat actors implanted the Javascript Code in the victim's application but this is what it looked like.         What does the code do?   The code is simply importing script from biggerfun[.]org domain. In other words, it's simply doing <script src="biggerfun[.]org"></script> Further investigation I wanted to check if others think the website is bad, so I looked into it more. I observed they do things similar to another group called TA569. You can learn more about TA569 here: ...
Post a Comment
Read more

Typographical Errors | Diving Deep into Typographical Errors and Mistakes

Typographical Errors     Most of this blog was put together with the help of ChatGPT. This was put together to create a typographical error generator given any string.   What is a Typographical Error? A typographical error, commonly known as a "typo," is a mistake made in the typing or printing process of written material. These errors can arise from inadvertent keystrokes, inattention, or misjudgment during the editing phase. While they might seem minor, typos can sometimes alter the meaning of a sentence or lead to misunderstandings. They occur in various forms, including the omission, addition, transposition, or substitution of characters. With the advent of digital writing tools, auto-correct functions have also become a frequent source of unintentional typos. Regardless of their origin, it's essential for writers, editors, and publishers to thoroughly review content to ensure clarity and accuracy.   What are the types of Typographical Errors?   1. Substitut...
Post a Comment
Read more