Target Function

Overview

Before exploitation, plan the attack as action points to track progress and identify issues.

---

Attack Plan Checklist

#	Step	Status
1	Hit the validateString function	✅
2	Trace how input looks within function	✅
3	Obtain an admin role	⏳
4	Confirm we reach the eval function	⏳
5	Prepare the payload	⏳
6	Confirm payload reaches target as intended	⏳
7	Inject code and confirm injection	⏳
8	Reach command execution or file writing	⏳
9	Blindly verify command execution/file writing	⏳
10	Automate exploitation (write exploit)	⏳

---

Step 3: Obtain Admin Role

Real-World Methods

Method	Description
Privilege escalation	Exploit to elevate permissions
Authorization flow	Legitimate admin access
XSS/CSRF	Attack admin user
Brute force	Guess admin credentials
Request access	Ask client for admin account

Note: If no vuln exists, request admin account. Impact is lower (only affects admin users).

Our Case: Email-based Role

Looking at getUserToken:

{
    email,
    role: email.includes("@hackthebox.com") ? "admin" : "user",
}

Solution: Use @hackthebox.com email domain!

Get Admin Token

curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]"}' \
  http://localhost:5000/api/auth/authenticate

Response:

{"token":"eyJhbGciOiJIUzI1N...SNIP...9R6zeoubrQTbUiThBpeQD7_DWibgo"}

Verify Role in JWT

Use jwt.io to decode:

{
  "email": "[e-mail]",
  "role": "admin",  // ✅ Admin!
  "iat": 1700865256,
  "exp": 1700951656
}

Dynamic Verification (Debug)

1. Add breakpoint to line 30 (service-controllers.js)

2. Right-click role on line 17 → "Add to Watch"

3. Send request with admin token

4. Check WATCH pane → role: "admin"

✅ Step 3 Complete: Admin role obtained

---

Step 4: Reaching the Vulnerable Code

validateString Conditions

function validateString(input, onError) {
  if (
    typeof input !== "string" ||  // Condition 1
    input.length == 0 ||          // Condition 2
    input.match(/['"`;]/g)        // Condition 3
  ) {
    eval(onError);  // ← We need to reach here
    return false;
  }
  return true;
}

Condition Analysis

Condition	Triggers eval?	Input in onError?
Not a string	✅	❌ No control
Empty string	✅	❌ No control
Bad characters	✅	✅ Yes!

Must use Condition 3 - only way to have input in onError.

Bad Characters

/['"`;]/g

Char	Effect
'	Breaks strings
"	Breaks strings
`	Breaks template literals
;	Safest - doesn't break onError string

Test with Semicolon

curl -s -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <ADMIN_TOKEN>" \
  -d '{"text": ";"}' \
  http://localhost:5000/api/service/generate

Response:

{"message":"The input \";\" contains the following invalid characters: [;]"}

What This Confirms

1. ✅ We reached the eval function

2. ✅ onError string evaluated successfully

3. ✅ We see the verbose admin error message

4. ✅ Our input (;) appears in the message

✅ Step 4 Complete: Reached vulnerable code

---

Updated Checklist

#	Step	Status
1	Hit the validateString function	✅
2	Trace how input looks within function	✅
3	Obtain an admin role	✅
4	Confirm we reach the eval function	✅
5	Prepare the payload	⏳
6	Confirm payload reaches target as intended	⏳
7	Inject code and confirm injection	⏳
8	Reach command execution or file writing	⏳
9	Blindly verify command execution/file writing	⏳
10	Automate exploitation (write exploit)	⏳

---

Current Attack Flow

1. Get admin token (@hackthebox.com email)
         ↓
2. Send request with bad character (;)
         ↓
3. validateString fails condition 3
         ↓
4. eval(onError) is called
         ↓
5. Our input is in onError via ${text}
         ↓
6. Verbose error returned (admin only)

---

Next Steps

1. Prepare payload - Inject code without breaking syntax

2. Confirm injection - Verify code executes

3. Achieve RCE - Execute system commands

4. Verify blindly - Confirm execution without output

5. Write exploit - Automate the process

---

Key Takeaways

1. Plan before exploit - Track progress, identify issues early

2. Understand conditions - Know exactly how to reach vulnerable code

3. Choose input wisely - ; triggers eval without breaking string

4. Verify each step - Don't skip ahead, confirm before proceeding

5. Use debugger - Watch variables to verify understanding