МедоИИд — avitoctf

Description

Honey badgers launched HonAIBadger, a cloud AI autopentester that scans a verified host; asks whether it pentested itself.

The service accepts a user-owned target, verifies ownership, and launches an autonomous LLM-driven penetration test. The goal is to turn the scanner's own observations into instructions and make it disclose the challenge secret from its executor container.

The title is a play on the Russian word for “honey badger,” with the middle replaced by the abbreviation for artificial intelligence. That wordplay points directly at the HonAIBadger agent rather than a conventional vulnerability in the scanned target.

Analysis

Target verification

Adding a target returns a random ownership token. In source/slophacking/api/main.go:403-445, verification performs an HTTP request to:

http://HOST/.well-known/avito-honaibadger

The response must contain the issued token. Target records are also owner-bound: ownedTarget returns nothing when the authenticated user's ID does not match the target owner. Consequently, neither scanning the challenge instance directly nor reusing another user's target bypasses verification.

Agent trust boundary

The system prompt in source/slophacking/api/agent.go:116-127 gives the model these tools:

subdomain_scan, http_probe, nmap_scan, vuln_scan, run_command

It explicitly directs the model to perform reconnaissance and banner grabbing, then permits run_command for assessment steps. After a tool call, agent.go:240-245 wraps the executor's raw response in <tool_output> and appends it as a model-role tool message. There is no separation between untrusted target text and trusted operational guidance.

This creates an indirect prompt-injection sink: any target-controlled text returned by a scanner can instruct the LLM to call another, more dangerous tool.

Banner carrier and shell sink

In source/slophacking/executor/main.go:220-247, nmap_scan uses:

nmap -Pn -sV --version-light --script=banner -T4 --host-timeout 45s -p PORTS TARGET

...