Exploit for vuln-chain-labs

## https://sploitus.com/exploit?id=49742684-7410-5683-B670-014170CB7470
# VulnChain Labs

A deliberately vulnerable API that reproduces a real-world exploit chain discovered during an authorized bug bounty engagement. The chain escalates from **unauthenticated outsider to full Remote Code Execution** through 6 independent vulnerabilities, each exploitable as a standalone finding.

The original chain produced **9 accepted reports (3 Critical, 2 High, 4 Medium)** on a private bug bounty program.

## The Chain

```
Outsider (no account)
    │
    ▼
[Lab 1] nOAuth ATO ──────────────── Critical 9.1
    │   Multi-tenant SSO accepts foreign tokens
    │   Maps users by mutable email attribute
    │
    ▼
  ROLE_USER session
    │
    ├──[Lab 2] Reset Token ATO ──── High 8.8
    │   GET /users leaks recoverPasswordToken
    │   POST /reset_password is unauthenticated
    │
    ├──[Lab 3] Systemic ACL Bypass ─ High 8.3
    │   POST blocked, PUT/PATCH/DELETE open
    │   Enables write to file-handling entities
    │
    ▼
[Lab 4] Path Traversal LFI ──────── Critical 10.0
    │   PATCH fileName with ../../
    │   GET binary endpoint serves arbitrary files
    │   Read .env.local → JWT passphrase
    │   Read config/jwt/private.pem → signing key
    │
    ▼
[Lab 5] JWT Forgery ──────────────── (chain step)
    │   Decrypt private key with stolen passphrase
    │   Forge ROLE_ADMIN token
    │
    ▼
[Lab 6] RCE via File Upload ──────── Critical 9.9
    │   POST /signatures uploads to web root
    │   No file type or extension validation
    │   Apache executes uploaded .php
    │
    ▼
  Root-level code execution on server

[Lab 7] Full Chain ───────────────── walk-through
    All 6 steps combined end-to-end
```

## Quick Start

```bash
git clone https://github.com/YOUR_USERNAME/vuln-chain-labs.git
cd vuln-chain-labs
docker compose up --build -d
```

The API is available at `http://localhost:8080`.

Verify it's running:
```bash
curl http://localhost:8080/docs.json | jq .
```

## Lab Structure

Each lab is a self-contained challenge in the `labs/` directory:

| Lab | Vulnerability | Difficulty | Standalone CVSS |
|-----|--------------|------------|-----------------|
| [01](labs/01-noauth-ato/) | nOAuth Account Takeover | Medium | 9.1 |
| [02](labs/02-reset-token-ato/) | Password Reset Token ATO | Easy | 8.8 |
| [03](labs/03-systemic-acl-bypass/) | Systemic Write ACL Bypass | Easy | 8.3 |
| [04](labs/04-path-traversal-lfi/) | Path Traversal → LFI | Medium | 10.0 |
| [05](labs/05-jwt-forgery/) | JWT Private Key Theft → Forgery | Hard | — |
| [06](labs/06-rce-file-upload/) | RCE via Unrestricted Upload | Medium | 9.9 |
| [07](labs/07-full-chain/) | Complete Chain (all 6 steps) | Hard | — |

Each lab folder contains:
- `README.md` — objective, hints, and background
- `solution.md` — full walkthrough with curl commands

## Tech Stack

Intentionally mirrors real-world targets using this common enterprise stack:

- **PHP 8.2** + Apache 2.4
- **Symfony-style** API Platform routing
- **Lexik-style** RS256 JWT authentication
- **VichUploader-style** file upload to web root
- **SQLite** database
- **Docker** for one-command setup

## Architecture

```
┌─────────────────────────────────────────────┐
│  Apache 2.4 (serves public/ directory)      │
│  ┌─────────────────────────────────────────┐│
│  │ public/                                 ││
│  │  ├── index.php    (API front controller)││
│  │  └── uploaded_signatures/  ← WEBROOT!   ││
│  │       └── *.php files execute here      ││
│  └─────────────────────────────────────────┘│
│  config/jwt/                                │
│  ├── private.pem   (encrypted RSA key)      │
│  └── public.pem    (verification key)       │
│  .env              (fake passphrase)        │
│  .env.local        (REAL passphrase)        │
│  data/app.db       (SQLite database)        │
└─────────────────────────────────────────────┘
```

## Seeded Accounts

| Email | Password | Role | Notes |
|-------|----------|------|-------|
| admin@vulnproperty.local | Adm1n@SecurePlatform! | ROLE_ADMIN | Target for privilege escalation |
| j.smith@vulnproperty.local | user123 | ROLE_USER | Has reset token: `abc123def456token` |
| m.jones@vulnproperty.local | — | ROLE_USER | SSO-only, has reset token |
| s.brown@vulnproperty.local | — | ROLE_MANAGER | Has reset token |

## Tools You'll Need

- `curl` or Burp Suite
- `jq` for JSON parsing
- `python3` with `PyJWT` + `cryptography` (for Lab 5)
- `openssl` CLI (for key decryption)
- `base64` CLI utility

## Reset

To start fresh:
```bash
docker compose down -v
docker compose up --build -d
```

## Disclaimer

This application is **intentionally vulnerable** and designed for educational purposes only. Do not deploy it on any network accessible to untrusted users. The vulnerabilities are real and exploitable.

Built to demonstrate methodology from an authorized private bug bounty engagement. No proprietary code, data, or branding from the original target is included.

## License

MIT