# Shady Oaks

> With todays hint of ***tampering*** I struggled a bit to find the exploit.&#x20;

I immediately noticed some new functionality that enabled a user to get *insights* into the market. So once I upgraded a user, I noticed that that user got the role of *insider.*

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2Fudd4mz6hyF6D76qvUMP7%2Fafbeelding.png?alt=media&#x26;token=25075a0d-91a9-41b6-bb13-1580e2a681f5" alt=""><figcaption></figcaption></figure>

My next step was to try assign that role on the creation of a new user, but that did not work. With updating a user, I was also unsuccessful in upgrading a user.

So mass assignment was not the way to go. I went back to the app and tried basically every endpoint, with every possible attack I could think of, but nothing really stuck. So I went back to the new functionality.

Then it hit me, inside the code, there wasn't gonna be a check for the input. So maybe I could become administrator?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FfoOkf0pQl5v37dGtgASt%2Fafbeelding.png?alt=media&#x26;token=0f6ce11e-b0a6-4a38-a939-5daab5a6b53f" alt=""><figcaption></figcaption></figure>

And sure enough, that worked! I had to fumble around with `admin` for a while before I tried `administrator` but hey, that's hacking!

So after that, the admin panel showed up, but once I clicked on that, I got a error loading the flag. Was this an extra bug I found, was the app broken, or was I just stupid?

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FKImDcSUAJkviXN2IDf1G%2Fafbeelding.png?alt=media&#x26;token=fd8ee542-976f-4b98-b405-4ef97aac4c2a" alt=""><figcaption></figcaption></figure>

Turns out, it was a classic case of PEBCAK (*problem exists between chair and keyboard*), Of course I had to update my local storage with my new JWT I got when updating my role!

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2F26SNCqNRQy6iRqvTVI8m%2Fafbeelding.png?alt=media&#x26;token=affdde14-4e3d-4aa1-96b0-76d778bac1bf" alt=""><figcaption></figcaption></figure>

Once I did that, I could navigate to the admin panel.

<figure><img src="https://2622029278-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OebgUO4GDe408WfphF%2Fuploads%2FvYJBubjIB0miEoUbBOWS%2Fafbeelding.png?alt=media&#x26;token=e5bbe26c-70ff-4935-aa6d-de6b0b48f4f8" alt=""><figcaption></figcaption></figure>

And in big beautiful font, my flag was there! 🇧🇪
