OmniWatch

Platform: HackTheBox | Category: Web | Type: Challenge | Difficulty: Hard | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-29 | Status: Solved Techniques: bot_timing_attack, cookie_stealing, crlf_header_injection, jwt_forgery, lfi_path_traversal, reflected_xss, stacked_sqli, varnish_cache_poisoning

Summary

1. Access admin panel with forged JWT to get flag

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260129_htb_omniwatch
• Tags: SQLi, lfi, race_condition, jwt, xss, crlf_injection, cache_poisoning, varnish, zig
• Indicators: Varnish cache, http.zig backend, CacheKey header, os.path.join with user input, f-string SQL
• Source: 20260129_htb_omniwatch.md

Foothold

Vulnerability / Misconfiguration

1. Bot_timing_attack
2. Cookie_stealing
3. Crlf_header_injection
4. Jwt_forgery
5. Lfi_path_traversal

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• bot_timing_attack
• cookie_stealing
• crlf_header_injection
• jwt_forgery
• lfi_path_traversal
• reflected_xss
• stacked_sqli
• varnish_cache_poisoning
• Tags: SQLi, lfi, race_condition, jwt, xss, crlf_injection, cache_poisoning, varnish, zig

Original Writeup

<details><summary>Click to expand original content</summary>

OmniWatch - HackTheBox

Challenge Info

Description

The crew has uncovered the IP address of a web interface used by the mercenary group called "Gunners" to track and spy on their enemies. To locate an elusive black market dealer for a critical trade, the team must hack into this gunners network and retrieve the last known location of a caravan that was recently ambushed in the wasteland.

Architecture Overview

The challenge consists of multiple services working together:

                    ┌─────────────────────────────────────────────────────┐
                    │                   Varnish Cache                      │
                    │              (cache.vcl configuration)               │
                    └─────────────────┬───────────────────┬───────────────┘
                                      │                   │
                    ┌─────────────────▼─────────┐ ┌───────▼───────────────┐
                    │     Controller Service     │ │    Oracle Service     │
                    │   (Python/Flask :3000)     │ │  (Zig/http.zig :4000) │
                    │                            │ │                       │
                    │ - Authentication           │ │ - Device location API │
                    │ - Device management        │ │ - CRLF vulnerable     │
                    │ - Firmware updates (LFI)   │ │                       │
                    │ - Admin panel              │ │                       │
                    └─────────────────┬──────────┘ └───────────────────────┘
                                      │
                    ┌─────────────────▼──────────┐
                    │         MySQL DB           │
                    │                            │
                    │ - Users table              │
                    │ - Signatures table         │
                    │ - Devices table            │
                    └────────────────────────────┘
                    
                    ┌────────────────────────────┐
                    │      Chromium Bot          │
                    │  (runs every 30 seconds)   │
                    │                            │
                    │ 1. Visit login page        │
                    │ 2. Wait 3 seconds          │
                    │ 3. Login as moderator      │
                    │ 4. Wait 3 seconds          │
                    │ 5. Visit /oracle/json/{id} │
                    └────────────────────────────┘

Vulnerability Analysis

1. CRLF Injection in http.zig (CVE-like)

The Oracle service is built with Zig's http.zig library. Route parameters are URL-decoded and reflected in response headers without proper sanitization.

Exploitation:

• deviceId parameter is URL-decoded
• Reflected in DeviceId response header
• Inject %0d%0a (CRLF) to add arbitrary headers
• Key headers to inject: CacheKey: enable and Content-Type: text/html

2. Varnish Cache Poisoning

The Varnish configuration uses a custom cache key mechanism:

Impact:

• All requests without CacheKey header share the same cache entry
• Injecting CacheKey: enable via CRLF causes response to be cached
• Subsequent requests receive the cached (poisoned) response

3. Reflected XSS

The mode parameter in /oracle/:mode/:deviceId is reflected in the HTML body. Combined with Content-Type injection enables full XSS execution.

4. Race Condition in Bot Timing

The bot has a predictable timing pattern with /controller/bot_running endpoint revealing bot status.

5. Local File Inclusion (LFI)

The firmware endpoint uses os.path.join() insecurely - absolute paths bypass the base directory.

6. SQL Injection with Stacked Queries

The device endpoint uses f-string formatting with multi=True allowing stacked queries.

Attack Chain

1. Set up cookie catcher on VDS server
2. Timed cache poisoning with XSS payload during bot login window
3. Receive stolen JWT from moderator bot
4. LFI to read JWT secret via /controller/firmware
5. Forge administrator JWT with stolen secret
6. SQL injection to insert forged signature into database
7. Access admin panel with forged JWT to get flag

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR