Desires

Technical Walkthrough

Writeup

Challenge

• Name: Desires
• Category: Web
• Difficulty: Easy
• Mode: hybrid

Summary

Desires is a source-provided web challenge built from a Go Fiber frontend, a local Node SSO service, and Redis-backed file sessions. The SSO correctly creates only normal users, but the Go frontend trusts attacker-controlled session metadata in two places:

• failed logins still write a Redis username -> sessionID pointer before SSO authentication is checked
• authenticated routes ignore the real session cookie value and resolve the session file using the username cookie

The solve uploads a fake admin session file into a normal user's upload directory, poisons Redis with a traversal username, and then makes /user/admin load that uploaded JSON as the current session.

Artifact Inventory

Key artifacts:

• files/a12c7330-7ca9-4da3-845a-993bcec029e1.zip: challenge archive
• files/extracted/challenge/service/services/http.go: Go route handlers, login order, upload handler, admin guard
• files/extracted/challenge/service/services/sessions.go: Redis pointer and file-backed session loader
• files/extracted/challenge/sso/index.js: Node SSO with user-only registration
• analysis/source-audit.md: source-backed exploit decision
• solve/solve.py: reproducible remote solver

Analysis

The first candidate path was Zip Slip into /tmp/sessions/admin, because the upload route extracts an archive with archiver.Unarchive(tempFile, userFolder). That was closed after checking github.com/mholt/archiver/v3 v3.5.0: ZIP extraction calls CheckPath() before writing entries and rejects traversal outside the destination directory.

The stronger path is application-native path traversal through session lookup:

1. LoginHandler calculates sessionID = sha256(unix_second).
2. It calls PrepareSession(sessionID, credentials.Username) before validating credentials against the SSO.
3. A failed login can therefore set a Redis pointer for an arbitrary username string.
4. SessionMiddleware only checks that session is non-empty, then calls GetSession(username) using the attacker-controlled username cookie.
5. GetSession(username) reads filepath.Join("/tmp/sessions", username, sessionID).
6. A traversal username like ../../app/service/files/<normal_user> resolves that read into the normal user's uploaded file directory.
7. If a file named with the predicted sessionID contains {"username":"admin","id":1,"role":"admin"}, /user/admin renders the flag.

The remote run confirmed the chain in analysis/remote/solve-transcript-redacted.txt: registration and normal login succeeded, archive upload returned 202, the failed traversal login returned 400 as expected, and the first admin request returned 200 with an HTB-format flag captured by the harness.

Solve

Run:

python3 Web/Desires/solve/solve.py \
  --base-url http://<TARGET>:30575 \
  --output Web/Desires/loot/flag-candidate.txt \
  --transcript Web/Desires/analysis/remote/solve-transcript-redacted.txt
python3 scripts/challenge_harness.py capture-flag Web/Desires --from loot/flag-candidate.txt

The solver:

1. registers a normal user
2. logs in and keeps the real user cookies
3. creates a ZIP with many predicted sha256(unix_second) filenames around the server clock
4. uploads the ZIP through /user/upload
5. sends a failed login as ../../app/service/files/<normal_user> to poison Redis
6. requests /user/admin with session: <redacted> and the traversal username
7. writes the flag candidate under loot/ without printing it

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For source-provided web challenges, check operation ordering before looking for complex primitives. Here, PrepareSession() before authentication was the key bug.
• Do not assume archive upload means Zip Slip. Validate the extraction library before committing to that path.
• Cookie trust bugs can combine with filesystem joins even when account registration filters path characters.
• Predictable session IDs are especially dangerous when the server reads session files from attacker-influenced paths.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Desires
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30575
• Start time: 2026-06-08T03:47:11Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Desires
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Source audit found that the Go login handler writes a Redis username-to-session pointer before SSO authentication succeeds.
2. The session middleware ignores the real session cookie value and loads the session file using the username cookie.
3. Uploading a normal archive can place attacker-chosen filenames under /app/service/files/<normal_user>.
4. A failed login using ../../app/service/files/<normal_user> as the username poisons Redis for that traversal key.
5. GetSession() then resolves the session read into the uploaded files directory and deserializes attacker-controlled admin JSON.
6. /user/admin renders the flag when the loaded JSON has role admin.

Reusable Lessons

• Validate library protections before pursuing an expected primitive. In this case, the archive library blocked ZIP traversal, but the application session loader still provided a traversal path.
• Look for pre-auth state mutation. Failed authentication can still leave useful server-side state.
• If a session cookie is only checked for presence and not used for lookup, another cookie or parameter may become the real authority.
• Time-derived session IDs can be handled by uploading a window of predicted hashes rather than racing a single value.

Dead Ends

• Direct Zip Slip to /tmp/sessions/admin was closed because github.com/mholt/archiver/v3 performs path traversal checks before ZIP extraction.

Tool Quirks

• The solver keeps raw flag output in loot/ only and writes a redacted transcript under analysis/remote/.
• The source archive uses the standard HTB extraction convention.

Evidence Paths

• analysis/source-audit.md
• analysis/remote/solve-transcript-redacted.txt
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes, after user approval
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Desires
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Source audit found that the Go login handler writes a Redis username-to-session pointer before SSO authentication succeeds.
2. The session middleware ignores the real session cookie value and loads the session file using the username cookie.
3. Uploading a normal archive can place attacker-chosen filenames under /app/service/files/<normal_user>.
4. A failed login using ../../app/service/files/<normal_user> as the username poisons Redis for that traversal key.
5. GetSession() then resolves the session read into the uploaded files directory and deserializes attacker-controlled admin JSON.
6. /user/admin renders the flag when the loaded JSON has role admin.

Reusable Lessons

• Validate library protections before pursuing an expected primitive. In this case, the archive library blocked ZIP traversal, but the application session loader still provided a traversal path.
• Look for pre-auth state mutation. Failed authentication can still leave useful server-side state.
• If a session cookie is only checked for presence and not used for lookup, another cookie or parameter may become the real authority.
• Time-derived session IDs can be handled by uploading a window of predicted hashes rather than racing a single value.

Dead Ends

• Direct Zip Slip to /tmp/sessions/admin was closed because github.com/mholt/archiver/v3 performs path traversal checks before ZIP extraction.

Tool Quirks

• The solver keeps raw flag output in loot/ only and writes a redacted transcript under analysis/remote/.
• The source archive uses the standard HTB extraction convention.

Evidence Paths

• analysis/source-audit.md
• analysis/remote/solve-transcript-redacted.txt
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes, after user approval
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Desires
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30575
• Start time: 2026-06-08T03:47:11Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.