> For the complete documentation index, see [llms.txt](https://minatours-notes.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://minatours-notes.gitbook.io/blog/ctfs/hackdonalds-intigriti-ctf.md). # HackDonalds Intigriti CTF Challenge: Target: ## Enumeration The web application is pretty small so the culprit can be spotted I assume pretty easily. We see a menu, a home page, and a login/admin page. When attempting to login the request is as follows:
Other requests look like this:
I thought of LFI due to how the images are generated, but decided to first google the components and the endpoints first and foremost. We know it is a next.js application based on the "X-Powered-By" header.
We also see a request to an "admin.json" endpoint.
If we try to access "/admin" endpoint directly, it redirects us to "/login". So we should google the URL components and see whether this is a common thing.
And uh, it's pretty much pointless, I read things, but nothing helped. Well okay, let's look for a new term, we know we're trying to access the "admin.json" endpoint, but the application is redirecting us towards the "/login" page due to insufficient permissions.
{% embed url="" %} {% embed url="" %} ## Exploitation We just follow the instructions, get ModHeader (or we can do this through Burp with match and replace, but this is also an easy way). We just need step 5 to execute the concept, everything else is for knowledge sake. {% embed url="" %} And we add the header.
Do a request to /admin and now we have access ^^.
The only endpoint that exists is "/ice-cream-machines" all the others are fluff.
When you open their settings you see an XML parser and machine settings.
Now all we need is to read up on XXE. {% embed url="" %} When clicking on parse settings the following happens:
We need the following payload from the Burp explanation. ``` ]> &xxe; ``` We ofcourse change foo to machine and just add \&xxe; to the \ parameter instead. So our payload will look like this: ``` ]> 1 &xxe; -18 75 2025-03-15 Daily ``` And the output will look like this:
Okay, now we need to find the flag, this is just enumeration at this point and attempting to seek out important endpoints. The flag is located in package.json, so we can just extract it with the following payload: ``` ]> 1 &xxe; -18 75 2025-03-15 Daily ```