Dark Runes

Technical Walkthrough

Writeup

Challenge

• Name: Dark-Runes
• Category: Web
• Difficulty: Easy
• Mode: hybrid

Summary

Dark Runes is a source-provided Express/EJS web challenge. The application has a weak admin model and an unsafe PDF export chain:

• any user can register with the username admin
• the admin middleware only checks req.user.username === "admin"
• admin users can export their own stored documents as PDF
• sanitized document content can be transformed back into raw HTML through node-html-markdown
• markdown-pdf renders the result with PhantomJS from a file:// context

The solve registers as admin, stores an encoded local-file iframe inside an allowed <pre> tag, exports the document, and extracts the flag text from the generated PDF.

Artifact Inventory

Key artifacts:

• files/a12c73ac-7e6c-4d41-bb9e-75cb112a35c0.zip: original challenge archive
• files/extracted/src/routes/auth.js: registration/login and signed cookie issuance
• files/extracted/src/middlewares.js: authentication and username-only admin check
• files/extracted/src/routes/documents.js: document creation and sanitizer configuration
• files/extracted/src/routes/generate.js: admin PDF export routes
• files/extracted/src/utils/exporter.js: markdown-pdf/PhantomJS rendering
• files/extracted/Dockerfile: places the flag at /flag.txt
• analysis/source-audit.md: exploit decision and source-backed reasoning
• analysis/local-transform-validation.txt: local sanitizer/renderer transform validation
• solve/solve.py: reproducible remote solver

Analysis

The first key issue is authorization. The app does not store a role for users. It signs a cookie containing { username, id }, validates the signature, then treats any authenticated user named admin as an admin. Since /register does not reserve or block the admin username, self-registering admin unlocks the admin-only export route.

The second key issue is the PDF pipeline. /documents sanitizes submitted content with sanitize-html, but default allowed tags include <pre>. If encoded HTML is placed inside <pre>, the sanitizer keeps it as text. node-html-markdown then converts the sanitized HTML to Markdown and emits <pre> contents without escaping. That turns encoded HTML back into raw HTML.

The export route passes that Markdown to markdown-pdf with HTML enabled. markdown-pdf uses PhantomJS and sets a file:// base URL. Local validation showed that raw iframe/object/embed/script payloads can load a local text file into the PDF text layer.

The working payload pattern was:

<pre>&lt;iframe src="file:///flag.txt"&gt;&lt;/iframe&gt;</pre>

After transformation, PhantomJS receives a real iframe pointing at /flag.txt, and the resulting PDF contains the flag text.

Solve

Run:

python3 Web/Dark-Runes/solve/solve.py \
  --base-url http://<TARGET>:31106 \
  --output Web/Dark-Runes/loot/flag-candidate.txt \
  --pdf-output Web/Dark-Runes/loot/generated.pdf \
  --transcript Web/Dark-Runes/analysis/remote/solve-transcript-redacted.txt
python3 scripts/challenge_harness.py capture-flag Web/Dark-Runes --from loot/flag-candidate.txt

The solver:

1. registers and logs in as admin
2. creates a document containing the encoded iframe payload
3. exports that document through /document/export/:id
4. stores the generated PDF under loot/
5. runs pdftotext on the PDF
6. writes the HTB-format flag candidate under loot/
7. writes only a redacted transcript under analysis/remote/

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Username-based admin checks are fragile when registration can claim the privileged name.
• Sanitizer output should not be fed into a second parser that can reinterpret encoded text as executable or loadable HTML.
• PDF renderers that run from file:// contexts can become local file read gadgets.
• A source-provided challenge should still validate library behavior locally before remote exploitation.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Dark-Runes
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:31106
• Start time: 2026-06-08T04:06:37Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Dark-Runes
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Registration allowed the username admin.
2. The admin middleware trusted only the username value from the signed cookie.
3. An admin-owned document could be exported to PDF.
4. Encoded HTML inside an allowed <pre> tag survived sanitization as text.
5. node-html-markdown emitted <pre> contents without escaping, turning encoded iframe HTML back into raw HTML.
6. markdown-pdf rendered the raw iframe with PhantomJS from a file:// context.
7. The iframe loaded the local flag file into the PDF text layer, and the solver extracted the HTB-format flag from the PDF text.

Reusable Lessons

• If admin is represented only as a username, test whether that username can be self-registered.
• Sanitizer bypasses can appear across parser boundaries, especially when safe text is later decoded or emitted without escaping.
• PDF/HTML renderers can be local file read gadgets when they render user-controlled HTML from a file-origin page.
• Avoid unnecessary brute force when a normal, authenticated feature chain reaches the same sink.

Dead Ends

• The debug export route requires a rotating access pass. It was not needed because the normal admin export route was reachable through self-registration.

Tool Quirks

• Full local app install failed on the host because the native SQLite dependency did not build against the host Node version.
• Docker CLI was present, but the daemon was not running.
• Pure JS transform packages were installed in analysis/js-transform-test/ for local sanitizer and Markdown conversion validation.
• Generated PDFs that may contain raw flag material are kept under loot/.

Evidence Paths

• analysis/source-audit.md
• analysis/local-transform-validation.txt
• analysis/remote/solve-transcript-redacted.txt
• solve/solve.py
• loot/flag.txt
• loot/generated.pdf

Ingestion Decision

• Proposed for LightRAG: yes, after user approval
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Dark-Runes
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Registration allowed the username admin.
2. The admin middleware trusted only the username value from the signed cookie.
3. An admin-owned document could be exported to PDF.
4. Encoded HTML inside an allowed <pre> tag survived sanitization as text.
5. node-html-markdown emitted <pre> contents without escaping, turning encoded iframe HTML back into raw HTML.
6. markdown-pdf rendered the raw iframe with PhantomJS from a file:// context.
7. The iframe loaded the local flag file into the PDF text layer, and the solver extracted the HTB-format flag from the PDF text.

Reusable Lessons

• If admin is represented only as a username, test whether that username can be self-registered.
• Sanitizer bypasses can appear across parser boundaries, especially when safe text is later decoded or emitted without escaping.
• PDF/HTML renderers can be local file read gadgets when they render user-controlled HTML from a file-origin page.
• Avoid unnecessary brute force when a normal, authenticated feature chain reaches the same sink.

Dead Ends

• The debug export route requires a rotating access pass. It was not needed because the normal admin export route was reachable through self-registration.

Tool Quirks

• Full local app install failed on the host because the native SQLite dependency did not build against the host Node version.
• Docker CLI was present, but the daemon was not running.
• Pure JS transform packages were installed in analysis/js-transform-test/ for local sanitizer and Markdown conversion validation.
• Generated PDFs that may contain raw flag material are kept under loot/.

Evidence Paths

• analysis/source-audit.md
• analysis/local-transform-validation.txt
• analysis/remote/solve-transcript-redacted.txt
• solve/solve.py
• loot/flag.txt
• loot/generated.pdf

Ingestion Decision

• Proposed for LightRAG: yes, after user approval
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Dark-Runes
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:31106
• Start time: 2026-06-08T04:06:37Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.