Challenge creation

Inspiration

• moodle CVE-2025-26529: posoning admin logs to full admin account takeover
• @ref: https://www.youtube.com/watch?v=dhVF6hQUzWU
• @ref: https://github.com/NightBloodz/moodleTestingEnv
• @ref: https://medium.com/@Nightbloodz/admin-account-takeover-in-moodle-093708a0f749

Initial idea

I have the following ctf challenge idea:

1. create a web application that has three actors in place: admin, student (i'll theme this to my liking) and guest.
2. Guest can view student accounts through the famous protocol "webfinger".
3. you can supply a custom url and the application visits that.

Now, the attacker sees this as an opportunity to retrieve the flag. But the flag in this case is hidden in an internal endpoint whose access is impossible. The response from this endpoint IS the flag, but you get 403 unauthorized.

4. Meanwhile, user activities are logged to the admin. If the attacker finds that their URL is logged, he can inject [email protected] and attacker.com will contain a redirection to ANY url (it doesn't matter) appended to it a Cookie stealer.

@ref (webfinger): https://www.youtube.com/watch?v=Y26c9MNQLyc You could attach anything to your email address (which is a uri)??

---

The steps the attacker would go over are:

1. Input injection (custom WebFinger URL)
2. SSRF-like fetch + open redirect
3. Stored XSS in logs
4. Session hijack
5. Privileged endpoint access (403 bypass)

@ref: https://github.com/moodle/moodle Inspire from reports/... files to carry the live logs feature

Challenge description

Check ./challenge.md