webfreemedium

Hydroadmin

hackthebox

Task: Fix a GraphQL batching vulnerability that allows PIN brute-force bypass of rate limiting. Solution: Use the online code editor API to read index.js, change allowBatchedHttpRequests from true to false in Apollo Server config, save the patched file, restart the server, and verify the fix to receive the flag.

$ ls tags/ techniques/
graphqlapi_exploitationbatching_attackrate_limit_bypasscode_editorpatch_challenge
graphql_batchingpin_bruteforcefile_manipulationserver_restart

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Hydroadmin - HackTheBox Challenge

Description

"With reservoirs sealed and cities teetering on thirst, our heroes storm the HydroAdmin control room to reopen valves and restore the flow of water."

Target: 83.136.249.164:45091

Analysis

Initial Reconnaissance

Discovered an online code editor called "HTB Editor" at the target with the following API endpoints:

  • /api/directory - list files
  • /api/file?path=X - read file content
  • /api/create-file - create new file
  • /api/rename - rename files
  • /api/restart - restart the server
  • /api/verify - verify if vulnerability is patched

Source Code Analysis

Key files discovered:

index.js - Main server with Apollo GraphQL server configured with vulnerable batching:

const server = new ApolloServer({
  ...armor.protect(),
  introspection: false,
  typeDefs,
  allowBatchedHttpRequests: true,  // VULNERABLE!
  resolvers
});

models/ControlPin.js - PIN generation (4-digit, 1000-9999) and verification logic

schema/resolvers.js - GraphQL resolvers including PIN verification

exploit/solver.py - A script showing how to exploit GraphQL batching to brute-force PINs

The Vulnerability

The GraphQL server had allowBatchedHttpRequests: true which allows:

  • Sending multiple GraphQL queries in a single HTTP request
  • Bypassing rate limiting (10 requests per minute)
  • Brute-forcing all 9000 possible PINs (1000-9999) in just a few batch requests

The Twist

This challenge required PATCHING the vulnerability, not exploiting it! The /api/verify endpoint checked if the vulnerability was fixed.

Solution

Exploitation Steps

  1. Rename original file: Backup the vulnerable index.js
  2. Read backup: Get the original content
  3. Patch content: Change allowBatchedHttpRequests: true to allowBatchedHttpRequests: false
  4. Create patched file: Write the fixed version
  5. Restart server: Apply changes
  6. Get flag: Verify the patch

Exploit Script

#!/usr/bin/env python3
"""
Hydroadmin - GraphQL Batching Patch Challenge
HackTheBox Challenge
"""
import requests

BASE_URL = "http://83.136.249.164:45091"

...

$ grep --similar

Similar writeups