Valenfind-THM

Recon:

I started with nmap for any other interesting port(s). though we were told that -p5000 is the home port for the challenge

going from there, directory bruteforcing came to my mind in a sec! Our directory scanning is running, lets access the web.

Because of time, I think there is nothing intersting in this place, accessing the website, I found a login and register page… trying some basic sql injection, it does not work, I bruteforce with intruder for both username and password, nothing interesting. then I registered an account to see where we are heading to.

created an account with username XXXXXX and password XXXXXXXXXX, lets login in to my account.

As I saw this interface, many vulns testing came to my mind, SSTI, XSS and IDOR because I could see some user_profile there. I tried mutiple payloads, but all to no avail. after that I navigated to the user_profile for another hunt, also here….checking source codes yielded nothing

Then I check the user profile for another hunt. I found out that user could send gift to other users, seeing this I intercepted with burp before sending and I found another interesting thing in the cookie part

I decoded the request cookie and found out that it is sending in json format with user_id and username. then the response cookie contains a signature that must be provide before tamepring with when I check with jwt.io website

this became so rough that I couldnt proceed anymore, I cant bruteforce the signature or any other hint…then I just checked the source code of the user (romeo_montague) and found something interesting. this is where I go to my deepseek for help

LFI confirmed!

The app is built with flask as you can see, lets look for the source. Also I found out a path /api/fetch_layout?layout=/opt/Valenfind/app.py that made us know that there is a database as cupid.db, now lets read for access key

What can We do with the key? The key authenticates to /api/admin/export_db via the X-Valentine-Token header. Sending it returns the full SQLite database (cupid.db) as a download. Now lets craft it as a token and send.

flag: THM{v1be_c0ding_1s_n0t_my_cup_0f_t3a}

As you can see, we dumped the database and also, I can see some usernames and their passwords. Hacking is fun!