Exploit for db-security-ctf

## https://sploitus.com/exploit?id=31C32BF5-F1A7-5713-9CC5-1FF04BDCBF9E
# Database Security – CTF Vulnerability Lab

## SEC304 / CN5134 – Database Security Assignment 1

A Dockerized CTF-style lab environment containing **three distinct database vulnerabilities** spanning multiple course topics. Each vulnerability is exploitable and has a unique flag that proves successful exploitation.

---

## 🏗️ Architecture

```
┌──────────────────────────────────────────────────────────────────┐
│                        Docker Compose                            │
│                                                                  │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐  │
│  │  vuln1-app      │  │  vuln2-app      │  │  vuln3-redis    │  │
│  │  Flask :8081    │  │  Flask :8082    │  │  Redis :6379   │  │
│  │  (NoSQL Inj.)   │  │  (Priv Esc.)    │  │  SSH   :8083   │  │
│  │       │         │  │       │         │  │  (RCE)          │  │
│  │       ▼         │  │       ▼         │  │                 │  │
│  │  vuln1-mongo    │  │  vuln2-postgres │  │                 │  │
│  │  MongoDB :27017 │  │  PostgreSQL     │  │                 │  │
│  │                 │  │  :5433          │  │                 │  │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘  │
│     vuln1-net            vuln2-net            vuln3-net          │
└──────────────────────────────────────────────────────────────────┘
```

## 📋 Vulnerability Summary

| #   | Name                          | Category            | DB          | Severity   | Flag |
|-----|-------------------------------|---------------------|-------------|------------|------|
| 1   | NoSQL Injection               | Injection           | MongoDB 6.0 | Critical (9.8) | `FLAG{nosql_injection_mongo_bypass}` |
| 2   | SECURITY DEFINER Priv Esc     | Privilege Escalation| PostgreSQL 15| High (8.8) | `FLAG{security_definer_privesc_pg}` |
| 3   | Unauthenticated Redis RCE     | In-Memory Database  | Redis       | Critical (9.8) | `FLAG{redis_unauthenticated_rce_config_write}` |

## 🚀 Quick Start

### Prerequisites

- Docker & Docker Compose (v2+)
- Python 3.8+ (for solve scripts)
- `ssh-keygen` and `ssh` client (for Vuln 3)

### Setup

```bash
# Clone the repository
git clone 
cd assignment1-vuln-lab

# Start all services
docker compose up --build -d

# Verify services are running
docker compose ps
```

### Verify Services

| Service        | URL / Port                     | Expected Response |
|----------------|-------------------------------|-------------------|
| Vuln 1 (Web)   | http://localhost:8081          | Login page        |
| Vuln 1 (Health) | http://localhost:8081/health  | `{"status":"ok"}` |
| Vuln 2 (Web)   | http://localhost:8082          | Employee search   |
| Vuln 2 (Health) | http://localhost:8082/health  | `{"status":"ok"}` |
| Vuln 3 (Redis)  | `redis-cli -p 6379 PING`     | `PONG`            |

### Stop

```bash
docker compose down -v
```

---

## 🏴 Exploitation

Each vulnerability has:
- A `WRITEUP.md` with full root cause analysis, kill chain, and exploitation steps
- A `solve/exploit.py` script that captures the flag automatically

### Vuln 1 – NoSQL Injection

```bash
cd vuln1/solve
pip install requests
python exploit.py
```

### Vuln 2 – SECURITY DEFINER Privilege Escalation

```bash
cd vuln2/solve
pip install requests
python exploit.py
```

### Vuln 3 – Redis Unauthenticated RCE

```bash
cd vuln3/solve
python exploit.py
```

---

## 📁 Repository Structure

```
assignment1-vuln-lab/
├── docker-compose.yml
├── README.md
├── vuln1/                          # NoSQL Injection (MongoDB)
│   ├── Dockerfile
│   ├── WRITEUP.md
│   ├── src/
│   │   ├── app.py                  # Vulnerable Flask app
│   │   └── requirements.txt
│   ├── init/
│   │   └── init-mongo.js           # MongoDB seed data
│   └── solve/
│       └── exploit.py              # Automated exploit
├── vuln2/                          # Privilege Escalation (PostgreSQL)
│   ├── Dockerfile
│   ├── WRITEUP.md
│   ├── src/
│   │   ├── app.py                  # Flask app calling SECURITY DEFINER func
│   │   └── requirements.txt
│   ├── init/
│   │   └── init.sql                # Schema with vulnerable function
│   └── solve/
│       └── exploit.py              # Automated exploit
├── vuln3/                          # In-Memory DB RCE (Redis)
│   ├── Dockerfile
│   ├── WRITEUP.md
│   ├── src/
│   │   └── entrypoint.sh           # Starts Redis + SSH
│   ├── config/
│   │   └── redis.conf              # Insecure Redis config
│   └── solve/
│       └── exploit.py              # Automated exploit (SSH key write)
└── report/
    └── (Assignment1 Report.pdf)    # Penetration testing report
```

## 🛠️ Technologies Used

| Component   | Technology         | Version |
|-------------|--------------------|---------|
| Container   | Docker Compose     | v2+     |
| Vuln 1 DB   | MongoDB            | 6.0     |
| Vuln 2 DB   | PostgreSQL         | 15      |
| Vuln 3 DB   | Redis              | Latest  |
| App Framework| Flask (Python)    | 3.0.0   |
| Language     | Python             | 3.11    |