Gatery

Scenario Description

Lysa Harrowmere reaches Crownspire with proof that a trusted castle informant is selling patrol routes to the enemy. The information is being used to ambush messengers, delay supplies, and keep Stormbound’s allies divided. The only person who can act on the proof is inside the castle for a closed council, but Lysa’s name has been removed from the entry list and the guards have orders to admit no unscheduled visitors. If she waits, the council ends and the traitor disappears with the next route packet. If she speaks openly at the gate, the proof is seized before it reaches the right hands. Lysa must trick the guarded passage, get inside, and place the evidence with the one ally who can expose the leak before the enemy moves again.

Solution

Loading up the web challenge shows that we need to authenticate in order to enter inside the castle. At first, I tried a SQL injection. Any attempts did not work.

We are provided with the web app files. While looking at app/index.tsx we can notice that in the beginning, an admin password is randomly generated and does not seem to be printed anywhere. Brute forcing the password will not be possible.

Looking ahead, there is this code logic:

.get('/api/me', ({ cookie: { session }, set }) => {
  if (session.value !== 'admin' && session.value !== 'inside') {
    set.status = 401
    return { authenticated: false }
  }

  return {
    authenticated: true,
    user: {
      username: 'admin',
      role: 'admin'
    },
    gateOpen: true,
    insideGate: session.value === 'inside'
  }

This tells you that if session.value is not admin or inside you will not be let in. We can try to set one of the two to be true as that will authenticate us.

We can create a session cookie with the value admin using the dev tools (F12) and going to the Application section. After refreshing, the gate opens. We can then find the NPC and ask for the flag and that will reveal the flag.