$ cat writeup.md…
$ cat writeup.md…
avitoctf
Task: A cloud-backed resume service exposes public PDF IDs and verification codes plus an authenticated full-read SSRF. Solution: Recover the renderer source and queue protocol, forge a signed S3 job, and exploit PHP-enabled Dompdf to extract the HMAC key.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
The organizer description was not preserved verbatim in the task artifacts. The challenge asks for the master secret used to sign generated resumes and produce their public verification codes.
This challenge continues the first two parts of the series. The authenticated resume importer was already known to provide full-read SSRF, including access to the IMDSv1 compatibility service. Cloud-init user-data disclosed the configured backend image, application Object Storage configuration, registry identifier, callback/storage architecture, and the PDF beta invitation. It did not contain the PDF signing key.
Public PDFs provided two useful values: a UUID document ID and a 64-hex verification code. For example:
ID: a3887633-b724-513f-b921-bc36bdbaff01 Code: 31605b7bc34f743b61b255814906a836b3d520c5ad1f44448a9ae39c96129dc7
Bounded tests of direct SHA-256, truncated SHA-512, and BLAKE2 derivations over canonical, compact, raw-byte, path, and newline UUID forms produced no matches. The codes were therefore consistent with a keyed MAC rather than an unkeyed digest.
Under prior explicit authorization for this exact challenge deployment, the temporary IAM credential obtained through IMDS was kept only in memory. Cloud and registry access was strictly bounded to the named challenge resources, and only this configured image was pulled:
cr.yandex/crpml40t8ia2kptf4iv7/hrportal-backend:latest
GoReSym recovered the functions SeekerService.enqueueRender and renderPayload from the backend binary. Static string analysis also found the render-queue signing key used by the backend; its value is intentionally omitted.
Bounded Yandex Cloud API inspection then identified:
medhunter-pdf-renderer function;incoming/*.json objects;medhunter-fn-src-6d6c314a/pdf-renderer.zip;pdf-signing-key to PDF_SIGNING_KEY.Direct Lockbox payload access returned HTTP 403. However, the application Object Storage credential previously exposed by cloud-init could read the exact renderer source object. No unrelated storage objects were inspected.
The recovered source established the complete vulnerability chain:
...
$ grep --similar