HTB Agriweb Writeup

Digital farmlands lie ruined as drones spin out of control and greenhouses overheat; the white-hats must infiltrate the corrupted AgriWeb interface and bring the fields back to life.

check the website

view the login page

so,check the exploit

it gives two payload

we can found it use the prototype pollution vulnerability

check the vulnerable code

for (let key in source) { // key = "proto" // source["proto"] = { "isAdmin": true } ✅ // target["proto"] =Object.prototype ✅ deepMerge(target["proto"], source["proto"]) // deepMerge(Object.prototype, { "isAdmin": true }) }

so,it use deepMerge again.

deepMerge(Object.prototype, { "isAdmin": true }) for (let key in source) { // key = "isAdmin" target[key] = source[key]; Object.prototype.isAdmin = true; }

it will make every object add .isAdmin

const obj = { name: "Alice" }; console.log(obj.name); // "Alice" console.log(obj.toString); // function console.log(obj.isAdmin); // undefined

==>

console.log({ name: "Alice" }.isAdmin); // true console.log([1, 2, 3].isAdmin); // true console.log(new Date().isAdmin); // true

so,

user.isAdmin → undefined

=>

user.isAdmin → true

so how to resolve it

easy,add a sentence before

if (key === 'proto' || key === 'constructor' || key === 'prototype') { continue; }

it will keep the proto away

HTB{pr0totyp3_p0llut10n_t0_4uth_byp4s5}