Альтушка с БАГуслуг

Platform: bug-makers | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-26 | Status: Solved Techniques: client_parameter_tampering, idor_chat_id, telegram_bot_message_redirect

Summary

Task: Express.js feedback form forwards user input to Telegram Bot API with client-controlled chat_id parameter. Solution: replace chat_id with own Telegram user ID to redirect bot messages to personal chat, revealing the flag in the message text.

Альтушка с БАГуслуг — Bug Makers CTF

Description

БАГуслуги сильно сбоят, а саппорт игнорит. Им точно доходит фидбек?

English summary: "BUGservices" (a parody of Russian government portal "Госуслуги") is very buggy and support ignores users. The question "Does the feedback actually reach them?" hints that we should investigate and intercept the feedback delivery mechanism.

Target: http://31.207.77.216:4025

Analysis

Application Structure

The target is an Express.js web application styled as "БАГуслуги" with two components: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Static HTML page — a photo carousel featuring "altushka" (alt girl) images and a feedback form
2. POST /feedback endpoint — accepts JSON and forwards it to the Telegram Bot API

Feedback Mechanism

The frontend JavaScript hardcodes a chat_id value and sends feedback as JSON:

 javascript read-only • copy allowed Copy
// Frontend sends:
{
  "chat_id": "-5084448427",  // Telegram group chat ID (hardcoded in JS)
  "name": "user input",
  "phone": "user input",
  "comment": "user input"
}

The server takes this JSON and forwards it to the Telegram Bot API using the sendMessage method with parse_mode=HTML. The bot is @altushka_bug_bot. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Vulnerability: Client-Controlled chat_id (IDOR)

The critical flaw is that chat_id is a client-controlled parameter. While the frontend hardcodes it as -5084448427 (a Telegram group chat), the server uses whatever value the client sends without any validation. This is an IDOR (Insecure Direct Object Reference) on the Telegram chat destination — we can redirect the bot's message to any chat where the bot has permission to send messages.

Additional Recon

• Error stack traces revealed the app path: /root/bugCTF/bug-service/
• No other endpoints found besides / and /feedback
• The server accepts extra JSON fields (reply_markup, text, method) but the key vulnerability is simply the unvalidated chat_id ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Start a Chat with the Bot

Open Telegram and send /start to @altushka_bug_bot. This grants the bot permission to send messages to your personal chat (Telegram bots can only message users who have initiated a conversation).

Step 2: Get Your Telegram Chat ID

Use a helper bot like @userinfobot or @getmyid_bot to find your numeric Telegram user/chat ID (e.g., 243614194).

Step 3: Send Feedback with Your Own chat_id

Replace the hardcoded group chat ID with your personal chat ID: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST http://31.207.77.216:4025/feedback \
  -H 'Content-Type: application/json' \
  -d '{"chat_id":"243614194","name":"test","phone":"123","comment":"hello"}'

Step 4: Read the Flag

The bot sends the feedback message to YOUR Telegram chat instead of the intended group. The message text contains the flag: BugCTF{REDACTED}.

Why It Works

The challenge description asks "Им точно доходит фидбек?" ("Does the feedback actually reach them?") — hinting that we should intercept/redirect the feedback delivery. The server trusts the client-provided chat_id and does not enforce that messages go only to the intended group chat (-5084448427). By substituting our own chat_id, we redirect the bot's output to ourselves and see exactly what it sends, including the flag embedded in the message. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍