Phoenix Pipeline — HackTheBox

Description

"With the NecroNet defeated, the Citadel unveils the Phoenix Pipeline, rebirthing global services in a resilient web — ushering in a secure, enduring tomorrow."

Two ports provided:

• 154.57.164.67:30603 — web application (HTB Editor + PHP app)
• 154.57.164.67:32715 — connection refused (unused)

This is a secure coding challenge: identify two vulnerabilities in a PHP web application, patch them via a web-based IDE (Socket.IO save protocol), and pass the automated verifier to get the flag.

Analysis

Reconnaissance

Port 30603 served an "HTB Editor" — a React-based web IDE (Vite + Monaco Editor + Socket.IO) with a file explorer, code editor, and a "Verify" button.

The IDE exposed a REST API at /api/*:

Endpoint	Method	Description
/api/directory	GET	File tree listing
/api/file?path=...	GET	Read file content
/api/verify	GET	Check if vulnerabilities are patched, returns flag on success
/api/create-file	POST	Create new file (409 if exists)

Socket.IO at /socket.io for real-time file saving with messages:

{"type": "save", "data": {"fileName": "...", "content": "...", "md5": "..."}}

The /challenge/ path served the actual PHP web application ("Phoenix Pipeline - Global Infrastructure Status") with login/register, operator dashboard, admin dashboard, and reports with photo upload.

Source Code Structure

The /api/directory endpoint revealed the full PHP application:

app/
  Controllers/
    AuthController.php        # Authentication (login/register)
    OperatorController.php    # Operator dashboard, report submission, file upload
    AdminController.php       # Admin dashboard
    ApiController.php         # API endpoints
  Models/
    Database.php              # SQLite database singleton
exploit/
  exploit_session_puzzling.py # PoC for vulnerability 1
  exploit_file_upload.py      # PoC for vulnerability 2

The GET /api/verify endpoint initially returned:

{"error": "Vulnerability 1 is not patched."}

Vulnerability 1: Session Puzzling (Admin Auth Bypass)

...