TornadoService

Technical Walkthrough

Writeup

Challenge

• Name: TornadoService
• Category: Web
• Difficulty: Medium
• Mode: hybrid

Summary

TornadoService exposes a dashboard backed by Tornado and a Selenium report bot. The intended chain was not a direct login bypass: it required abusing the report bot as a localhost browser, then using a recursive object-update bug to replace the in-memory USERS list. After that mutation, normal login to /login issued a secure cookie and /stats returned the flag.

Artifact Inventory

Relevant artifacts:

• files/extracted/challenge/application/main.py: route definitions for /report_tornado, /update_tornado, /login, and /stats.
• files/extracted/challenge/application/util/general.py: recursive update_tornados() helper that writes attacker-controlled keys into objects and dictionaries.
• files/extracted/challenge/application/util/bot.py: Selenium bot that visits http://<ip>/agent_details.
• solve/solve.py: reproducible exploit using Webhook.site forwarding plus a form-based localhost POST.

Analysis

The important source facts were:

• /update_tornado only accepts requests from <TARGET> or ::1.
• /report_tornado?ip=... launches headless Chrome against http://<ip>/agent_details.
• update_tornados(data, tornado) recursively follows attacker-supplied keys. A payload through __class__.__init__.__globals__ reaches application.main globals and can replace USERS.
• /login checks the first user entry and sets a Tornado secure cookie on success.
• /stats reads /flag.txt for any authenticated user.

The first callback attempts proved useful negative cases:

• Cloudflared quick tunnel hostnames did not resolve in this environment.
• Direct local IPv4/IPv6 callbacks were not reachable by the remote bot.
• Serveo worked locally but the remote bot did not hit it.
• Webhook.site static responses were reachable by the bot, but their CSP blocked inline JavaScript.
• Webhook.site CLI forwarding removed the CSP issue and delivered the local payload to the bot.

The final blocker was browser-side Private Network Access/CORS behavior. A direct fetch() from a public origin to <TARGET> did not mutate the service, so the payload switched to an auto-submitted enctype="text/plain" form. The form body was constructed so the browser-added = became part of a harmless JSON string value, leaving the request body valid JSON.

Solve

Run:

cd <local workspace>
python3 scripts/challenge_exec.py Web/TornadoService --phase <secret redacted> --output analysis/flag-candidate.txt -- \
  python3 Web/TornadoService/solve/solve.py \
    --base-url http://<TARGET>:31743 \
    --webhook-forward \
    --output Web/TornadoService/analysis/flag-candidate.txt
python3 scripts/challenge_harness.py capture-flag Web/TornadoService --from analysis/flag-candidate.txt
rm -f Web/TornadoService/analysis/flag-candidate.txt

The solver:

1. Reads a live machine_id from /get_tornados.
2. Builds a class-pollution JSON payload that replaces USERS.
3. Serves /agent_details locally.
4. Creates a Webhook.site token and forwards that public URL to the local callback server.
5. Triggers /report_tornado with a path/query-shaped ip value so the forced /agent_details suffix is harmless.
6. Uses a form POST from the bot to http://<TARGET>:1337/update_tornado.
7. Logs in with the inserted first user and reads /stats.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For bot challenges, “callback reached” and “payload executed” are separate gates.
• Public static HTML services may inject CSP that silently breaks inline JavaScript payloads.
• Chrome Private Network Access can break public-origin fetch() to localhost even when the target sets permissive CORS headers.
• HTML form submission can be a practical fallback for localhost-only POST routes when the body format can be made valid for the backend parser.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: TornadoService
• Category: Web
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:31743
• Start time: 2026-06-12T10:39:34Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory