Corridor — A Simple Web CTF That Made Me Look Twice

Summary

Corridor — A Simple Web CTF That Made Me Look Twice I started the Corridor room with a basic Nmap scan. Here’s how I worked through it and what I tried along the way. Starting With Nmap I began with an Nmap scan against the target: nmap -A The scan showed that port 80 was open and running HTTP. It also gave me the title of the web application: So I opened the target IP in the browser. The Corridor The webpage showed a corridor with 12 doors. There wasn’t much else to look at, so I checked the page source. Checking the Source Code In the source, I found that the corridor image was using an HTML image map: there were several tags below it. Each one had an href , and the values looked like hashes. I took one of the hashes and checked it with CrackStation. It was identified as MD5 and returned 1 . I then checked the other values to see whether they followed the same pattern. They did. Get Athulya Biju’s stories in your inbox Join Medium for free to get updates from this writer. The hashes corresponded to the numbers 1 through 13. Another Thing I Tried While looking through the source, I also noticed a SHA-384 value in the Bootstrap stylesheet’s integrity attribute. I copied that value into CyberChef and tried the Magic operation. CyberChef returned: “Nothing of interest could be detected about the input data. Have you tried modifying the operation arguments?” I noticed the part about modifying the operation arguments, so I tried changing the settings instead of leaving it there. Testing the Idea Since the hashes matched the numbers 1 through 13, and the room was about IDOR, I tried another value that wasn’t one of the doors shown on the page. I tried 0 and generated its MD5 hash: echo -n “0” | md5sum This gave me MD5 hash for 0 . I put the generated hash into the URL and opened it in the browser. http://<TARGET_IP>/ Finding the Flag The page opened, and I found the flag. I’m leaving the actual flag out so anyone who hasn’t completed the room can still solve it themselves. What I Learned This room made me pay more attention to how values are used in URLs. At first, I was mainly looking at the webpage and the doors. After checking the source code, I found the hashes behind them and started comparing them. Once I realized they were MD5 hashes of numbers, the IDOR part of the room made more sense. I also learned that a vulnerability isn’t always obvious from the webpage itself. Checking the source and seeing how the application handles the input can reveal things that aren’t visible on the page. Final Thoughts I liked this room because the actual webpage was simple, but there was more going on behind it. The part I found most interesting was figuring out what the hashes represented and then trying another value. I’m continuing to document the TryHackMe rooms I solve because writing about them helps me remember the steps and, more importantly, the reasoning behind them.

By Athulya Biju

Original Article