# HackDonalds Intigriti CTF Challenge: Target: ## Enumeration The web application is pretty small so the culprit can be spotted I assume pretty easily. We see a menu, a home page, and a login/admin page. When attempting to login the request is as follows:

Other requests look like this:

I thought of LFI due to how the images are generated, but decided to first google the components and the endpoints first and foremost. We know it is a next.js application based on the "X-Powered-By" header.

We also see a request to an "admin.json" endpoint.

If we try to access "/admin" endpoint directly, it redirects us to "/login". So we should google the URL components and see whether this is a common thing.

And uh, it's pretty much pointless, I read things, but nothing helped. Well okay, let's look for a new term, we know we're trying to access the "admin.json" endpoint, but the application is redirecting us towards the "/login" page due to insufficient permissions.

{% embed url="" %} {% embed url="" %} ## Exploitation We just follow the instructions, get ModHeader (or we can do this through Burp with match and replace, but this is also an easy way). We just need step 5 to execute the concept, everything else is for knowledge sake. {% embed url="" %} And we add the header.

Do a request to /admin and now we have access ^^.

The only endpoint that exists is "/ice-cream-machines" all the others are fluff.

When you open their settings you see an XML parser and machine settings.

Now all we need is to read up on XXE. {% embed url="" %} When clicking on parse settings the following happens:

We need the following payload from the Burp explanation. ``` ]> &xxe; ``` We ofcourse change foo to machine and just add \&xxe; to the \ parameter instead. So our payload will look like this: ``` ]> 1 &xxe; -18 75 2025-03-15 Daily ``` And the output will look like this:

Okay, now we need to find the flag, this is just enumeration at this point and attempting to seek out important endpoints. The flag is located in package.json, so we can just extract it with the following payload: ``` ]> 1 &xxe; -18 75 2025-03-15 Daily ```

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://minatours-notes.gitbook.io/blog/ctfs/hackdonalds-intigriti-ctf.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.