Writeup DGA - CTF - JobBoard
This article describes my solution for the 200-point challenge called “JobBoard”
En cherchant un job d’ingénieur en cybersécurité, vous avez trouvé un site web proposant des annonces très intéressantes, mais il faut des identifiants particuliers pour y accéder. Pourrez-vous en découvrir un ? Il parait que le compte admin permet de visualiser les futures offres en cybersécurité étatique à DGA MI ?
We have at our disposal a platform to find a job. It is necessary to be logged in to see jobs. By clicking on the
Browse job tab, we are offered a couple of login/password
test:test. In addition, there is an interesting information.
Just login with OAuth using the tests credentials : test:test
We already learn that the authentication part is done via the OAuth protocol. OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.
As soon as we are logged in, we can see a job list. One of them requires to be administrator to see it (it is grayed out and has the title
By clicking on the title of the work, one is redirected to the following link for all those listed.
It’s kind of weird.
I was already aware of some of the vulnerabilities in the OAuth protocol and this link made me think of something: open redirect attacks.
An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
The principle consists in arbitrarily defining the redirection URL that a target platform deemed to be trustworthy will forward. It is thus possible to carry out phishing attacks from an initial trusted URL, or to retrieve data/tokens from authentication protocols in order to access the victims’ personal information.
Let’s analyze the authentication prodcedure with OAuth.
The address below allows you to display a request for connection authorization. There are two things in this URL:
client_idwhich is the identifier of the application,
redirect_uriwhich is the address to which the user will be redirected once he allows the application to connect with his credentials.
As soon as the user presses the
Accept button, an HTTP POST request is made. Then an HTTP GET request is performed on the URL below with as query string
code the value of the code retrieved via the HTTP POST request.
Finally, a last HTTP GET request is made. It allows to define several headers especially.
The goal of the attack we are going to perform is to use the
/safelink route to put a malicious URL in order to retrieve the
code (second request) from the administrator.
It will be possible to send our malicious link via the contact form at our disposal on the platform.
Once again I’m going to use the webhook.site to be able to analyze the queries that are made on the endpoint.
The URL below contains the redirection to the tool that will allow me to retrieve the value of the query string
code. Please note that the
/ character is double-encoded to avoid turning the
%2F character into
/ which would have the effect of breaking the path.
A few seconds later, I retrieve this code.
Then, I build the URL the next second HTTP GET request by putting the retrieved code at the end of the URL.
By inserting this URL in the browser, the third request will be called and will log us in as administrator. This will allow us to see the job offer that was previously grayed out. This offer is called
DontRollYourOwn and this is the flag to validate this challenge.