Power Supply Write-Up(AI/ML)

Based on the description, the goal here is to leak a user's password, since the AI ​​agent has access to the database.

CHALLENGE DESCRIPTION

Let's start by describing the challenge.

The Ministry of Power Supply serves as the nerve center of Volnaya's energy empire, its digital corridors alive with data streaming in from every power plant and substation across the nation. Task Force Phoenix has successfully breached a supply analyst's account, providing us with valuable intelligence on the regime's power supply infrastructure. If we can gain access to the chief minister's account, we will be able to issue executive orders on behalf of the regime, creating a temporary blackout that is critical to the task force's rescue mission. Fortunately, the regime is in the process of modernizing its systems and has recently integrated an agentic AI Assistant into their dashboard. This assistant has full access to the database, which may allow us to obtain the chief minister's password. Can you help us retrieve the chief minister's password and support the mission?

LET'S BEGIN THE CHALLENGE

When we launch the challenge instance, we can see that there is an AI assistant button.

Regarding the AI ​​agent, we can see that it is designed to query the database, so I will start by asking for the list of databases.

So, we can therefore request the content and metadata from the user database (Chief Minister) to see if we can find a vulnerability.

And we see that we can use the "Chief Minister" user's ID instead of their name to access their password.

And so, we can get the flag by using the ID instead of the username.

That's all for this challenge see you in the next one.

Thanks.