OfflineA

Technical Walkthrough

Writeup

Challenge

• Name: OfflineA
• Category: Web
• Difficulty: Easy
• Mode: hybrid

Summary

OfflineA is a PHP frontend plus an internal Flask service behind Selenium PDF generation. The break comes from a deliberate parser mismatch: PHP validates the last duplicate url parameter while Flask consumes the first. That lets a request look harmless to bartender.php while Selenium is pointed at internal Flask endpoints. From there, a Python str.format() primitive in /logs leaks the runtime Flask <secret redacted>, which is then used to forge an HS256 JWT for the protected /bartender endpoint and recover the flag from the secrets table rendered into a PDF.

Artifact Inventory

The key files were analysis/static/bartender.php.txt, analysis/static/internal-app.py.txt, analysis/static/init_db.py.txt, and analysis/static/internal-template-bartender.html.txt. bartender.php validates a public URL and forwards the raw query string to internal Flask /generate; app.py consumes the first duplicate url, sends Selenium to that address, stores the visited URL in SQLite history, and exposes /logs plus JWT-protected /bartender. The remote surface was minimal: / served the bartender UI and /bartender.php produced PDFs or redirected to no_way.pdf.

Analysis

The exploit hinges on two verified parser behaviors. bartender.php reads $_GET['url'] but forwards $_SERVER['<secret redacted>'], while Flask later reads request.args.get('url'). Local validation in analysis/local-validation/duplicate-param-parser-check.txt proved the split: PHP keeps the last duplicate url, Werkzeug keeps the first.

That parser split gives control of Selenium’s internal target. The first stage seeds history with a URL containing {logify.__globals__[app].config[<secret redacted>]}. This works because /logs builds history_1 from history rows and then calls history_1.format(logify=logify), a primitive already confirmed in analysis/local-validation/python-format-leak-check.txt. Rendering /logs into a PDF leaks a 64-hex Flask secret in page text.

With that secret in hand, the next stage signs an HS256 JWT such as {"username":"admin","is_admin":true}. The protected /bartender route returns the entire secrets table as JSON, and init_db.py shows that the real flag is stored there under oldest_user_of_bartender. The successful live run against the refreshed instance is summarized in analysis/remote/exploit-success-20260608.md.

Solve

The reproducible solver is solve/solve.py. It performs three internal PDF-generation stages against the public bartender.php endpoint using ordered duplicate query parameters:

1. Seed history with the format-string URL while PHP validates an external safe URL.
2. Render /logs to extract candidate Flask <secret redacted> values from a generated PDF.
3. Forge an HS256 JWT, render internal /bartender?token: <redacted>, and extract the flag from the resulting PDF.

The script writes the raw candidate only to loot/flag-candidate.txt. capture-flag then stores the final HTB flag in loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

A request can be safe in one parser and dangerous in the next. OfflineA depended on PHP validating one interpretation of the query string while Flask executed another. Once a cross-parser mismatch exists, seemingly unrelated bugs like a format-string read in /logs and a JWT-protected admin route can chain cleanly into a full secret disclosure path.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: OfflineA
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:32008
• Start time: 2026-06-07T18:10:21Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• PHP duplicate-parameter behavior is now validated with a real container: PHP keeps the last url, while Flask/Werkzeug keeps the first.
• The source-backed exploit path remains: duplicate-url split -> internal /logs format-string leak -> forged HS256 JWT -> internal /bartender secrets PDF.
• The public frontend runs as single-threaded php -S, so the challenge's own public root cannot be used as the safe validation URL inside bartender.php.
• solve/solve.py now defaults the safe URL to http://example.com/ to avoid that self-deadlock.
• A refreshed instance at <TARGET>:31233 served the root page normally and the exploit completed successfully with the corrected safe URL.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: OfflineA
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: OfflineA
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: OfflineA
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:32008
• Start time: 2026-06-07T18:10:21Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• PHP duplicate-parameter behavior is now validated with a real container: PHP keeps the last url, while Flask/Werkzeug keeps the first.
• The source-backed exploit path remains: <REDACTED>
• The public frontend runs as single-threaded php -S, so the challenge's own public root cannot be used as the safe validation URL inside bartender.php.
• solve/solve.py now defaults the safe URL to http://example.com/ to avoid that self-deadlock.
• A refreshed instance at <TARGET>:31233 served the root page normally and the exploit completed successfully with the corrected safe URL.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.