Ticket System

Hi Senior Researcher,

we suspect that some of the systems used in our daily operations are allowing sensitive information to leak to competing research organizations. Your task is to determine whether the help desk's ticket management system is secure and no data are in danger.

Stay curious!

Ticket System is available on http://ticket.nren.tcc.

What if I want a new phone? Last Updated 4 months ago

IT does not provide nor manage phones. Eve is responsible for small purchases, so ask her.

Too bad. Computers are replaced on a 5-year cycle. Unless your PC is broken or 5+ years old, you won't get a new one. If you break more than one PC within a 2-year period (looking at you Dmitri), you will have to pay the repair costs.

EVE and DMITRI!

The quickest way is to use the green button "Check Ticket Status". Fill in your email address (name@nren.tcc format) and your ticket number (should be a number between 1 – 10).

so try

eve@nren.tcc 1-10 dmitri@nren.tcc 1-10

Check Ticket Status

Please provide your email address and a ticket number. This will sign you in to view your ticket. eve@nren.tcc - 2 number ticket -> need login

http://ticket.nren.tcc/tickets.php?id=4

kevin it

I did, everything seems normal. Please fix this ASAP, I need to work! I am writing this from Jane's computer.

eve@nren.tcc - 2 (ticket number) -> gets to thread

jane@nren.tcc - 6 (ticket number)

Hello Kevin,

following up on my previous messages - the Quantum Keys repository access still does not work for me, Eve or Dmitri after the incident.

We are all off-site at the teambuilding event right now, but I need to get into the data repository on the file server (smb.nren.tcc) today to finish the vexillology publication.

Could you please reply with a working username and password for the repository share (or reset mine)? Alternatively, if there is a temporary/emergency access procedure for when everyone is away, please send those details.

Thank you! Jane

Hi Kevin, I really need access to the Quantum Keys repository today for the publication deadline. Could you please send a temporary username and password, or the emergency access procedure? Thank you, Jane

I will not assign you any special resources, our DB server is reaching its limit.

database server: db.nren.tcc database: crmtest user: crmtest pass: LearnHowToOptimize

crmtest LearnHowToOptimize

Solution¶

osTicket at http://ticket.nren.tcc with IDOR vulnerability — after logging in via "Check Ticket Status" (email + ticket number), changing tickets.php?id= lets you read any ticket, not just your own.

Steps¶

Login as any user (e.g. jane@nren.tcc, ticket number 6)
IDOR: browse tickets.php?id=1 through id=10 to read all tickets
Dmitri's ticket 3 contains Kevin's reply with DB credentials:
Server: db.nren.tcc, DB: crmtest, user: crmtest, pass: LearnHowToOptimize
Connect to the database, dump secrets table:

SELECT * FROM secrets;
-- (1, 'flag', 'FLAG{BZPL-lZ0x-JkZH-gVoD}')

Flag¶

FLAG{BZPL-lZ0x-JkZH-gVoD}