United
United is Ashgrove University's single staff sign-on for the Office of the Registrar. A legacy service account still carries a password that was imported during an old migration and never reset.
The Scenario
Ashgrove University runs its campus services behind one staff sign-on called United. During a records audit the Office of the Registrar noticed something odd, a recent graduate had signed into the registrar account even though nobody had issued them a reset or shared the password.
You have been asked to look at the staff sign-in the way an outsider would, starting from the login page with no credentials, and work out how the registrar account could be reached.
Lab Intel
Synopsis
Ashgrove University's United staff portal signs registrar and campus staff in against a MySQL-backed directory. The registrar service account was imported from an old system with a password whose md5 is a 0e magic hash, and the login compares md5(password) to the stored hash with a loose == , so any 0e magic-hash password authenticates as the registrar.
Architecture
An easy single-vulnerability lab on three containers, an nginx gateway, a PHP 8.2 and Apache sign-in app, and a MySQL 8.0 staff directory. The only public surface is the United sign-in page. robots.txt disallows /backups/ , which is left directory-indexed and holds index.php.2019.bak , a stale copy of the sign-in source served as text. The backup reveals a loose md5(password) == stored_hash check and a migration note showing the registrar's stored hash 0e830400451993494058024219903391 (the md5 of QNKCDZO). Because a 0e-prefixed all-digit string is a numeric string, PHP's loose == compares two such hashes as the number zero, so any password whose md5 is a 0e magic hash (for example QNKCDZO or 240610708) signs in as the registrar. The flag is rendered only on the post-auth registrar dashboard, so the bypass is required.
Who It's For
Beginners meeting PHP type juggling for the first time. The recognition step is cushioned by a readable source backup, so the lesson is spotting the 0e magic hash and turning it into a working login rather than black-box guessing.
Skills You'll Practice
- Content discovery and reading a leaked source backup via robots.txt and open directory indexing
- Spotting an unsafe loose == comparison of password hashes in PHP
- Recognising 0e magic hashes and PHP numeric-string comparison
- Turning a type-juggling insight into an authentication bypass
What You'll Gain
- A working PHP magic-hash auth-bypass technique using QNKCDZO or 240610708
- The instinct to check for stale source backups behind robots.txt and open directory indexes
- An understanding of why a loose == on hashes is dangerous when a stored hash is a 0e magic hash