OmniWatch - HackTheBox

Challenge Info

Property	Value
Event	HackTheBox
Category	Web
Difficulty	Hard
Flag	HTB{REDACTED}

Description

The crew has uncovered the IP address of a web interface used by the mercenary group called "Gunners" to track and spy on their enemies. To locate an elusive black market dealer for a critical trade, the team must hack into this gunners network and retrieve the last known location of a caravan that was recently ambushed in the wasteland.

Architecture Overview

The challenge consists of multiple services working together:

                    ┌─────────────────────────────────────────────────────┐
                    │                   Varnish Cache                      │
                    │              (cache.vcl configuration)               │
                    └─────────────────┬───────────────────┬───────────────┘
                                      │                   │
                    ┌─────────────────▼─────────┐ ┌───────▼───────────────┐
                    │     Controller Service     │ │    Oracle Service     │
                    │   (Python/Flask :3000)     │ │  (Zig/http.zig :4000) │
                    │                            │ │                       │
                    │ - Authentication           │ │ - Device location API │
                    │ - Device management        │ │ - CRLF vulnerable     │
                    │ - Firmware updates (LFI)   │ │                       │
                    │ - Admin panel              │ │                       │
                    └─────────────────┬──────────┘ └───────────────────────┘
                                      │
                    ┌─────────────────▼──────────┐
                    │         MySQL DB           │
                    │                            │
                    │ - Users table              │
                    │ - Signatures table         │
                    │ - Devices table            │
                    └────────────────────────────┘
                    
                    ┌────────────────────────────┐
                    │      Chromium Bot          │
                    │  (runs every 30 seconds)   │
                    │                            │
                    │ 1. Visit login page        │
                    │ 2. Wait 3 seconds          │
                    │ 3. Login as moderator      │
                    │ 4. Wait 3 seconds          │
                    │ 5. Visit /oracle/json/{id} │
                    └────────────────────────────┘

Vulnerability Analysis

1. CRLF Injection in http.zig (CVE-like)

The Oracle service is built with Zig's http.zig library. Route parameters are URL-decoded and reflected in response headers without proper sanitization.

Exploitation:

• deviceId parameter is URL-decoded
• Reflected in DeviceId response header
• Inject %0d%0a (CRLF) to add arbitrary headers
• Key headers to inject: CacheKey: enable and Content-Type: text/html

2. Varnish Cache Poisoning

The Varnish configuration uses a custom cache key mechanism:

Impact:

• All requests without CacheKey header share the same cache entry
• Injecting CacheKey: enable via CRLF causes response to be cached
• Subsequent requests receive the cached (poisoned) response

3. Reflected XSS

The mode parameter in /oracle/:mode/:deviceId is reflected in the HTML body. Combined with Content-Type injection enables full XSS execution.

4. Race Condition in Bot Timing

The bot has a predictable timing pattern with /controller/bot_running endpoint revealing bot status.

5. Local File Inclusion (LFI)

The firmware endpoint uses os.path.join() insecurely - absolute paths bypass the base directory.

6. SQL Injection with Stacked Queries

The device endpoint uses f-string formatting with multi=True allowing stacked queries.

Attack Chain

1. Set up cookie catcher on VDS server
2. Timed cache poisoning with XSS payload during bot login window
3. Receive stolen JWT from moderator bot
4. LFI to read JWT secret via /controller/firmware
5. Forge administrator JWT with stolen secret
6. SQL injection to insert forged signature into database
7. Access admin panel with forged JWT to get flag