Trending Tags
Heisenberg's Forgotten Lab
Heisenberg’s Forgotten Lab
Challenge Description
An abandoned digital laboratory has resurfaced. Most systems were supposedly shut down years ago, but some archived laboratory records remain accessible.
The objective is to investigate the forgotten laboratory system, discover the hidden information, obtain administrator access, and recover the final flag.
Exploit Path
The intended solution follows this chain:
- Discover the Chemical Inventory.
- Identify the SQL Injection vulnerability.
- Enumerate the SQLite database.
- Discover the hidden
batch_recordstable. - Find the first successful Blue Crystal batch:
B-17. - Discover the hidden laboratory note.
- Use the note to determine that
B-17became the administrator password. - Authenticate as
admin. - Access the legacy terminal.
- Recover the final flag.
Vulnerability — SQL Injection
The Chemical Inventory search functionality is vulnerable to SQL Injection because user-controlled input is incorporated into the SQL query without sufficient separation between data and SQL syntax.
This allows a participant to alter the intended query and use UNION SELECT statements to retrieve information from other tables within the vulnerable SQLite database.
The vulnerable query is:
1
2
query = f"SELECT * FROM chemicals WHERE name LIKE '%{search}%'"
cursor.execute(query)
Database Enumeration
The inventory search functionality can be used to enumerate the SQLite database schema.
The discovered tables include:
chemicalsbatch_recordslab_notes
Query:
1
' UNION SELECT 1,name,sql,'x' FROM sqlite_master WHERE type='table' --
The database-enumeration result is shown in images.md as Image 01 and Image 02.
Discovering the Batch Records
The batch_records table contains archived laboratory production records.
The relevant record is:
- Batch Code:
B-17 - Compound:
Blue Crystal - Note: First successful archived batch. Moved to the old terminal.
This establishes B-17 as an important value for the next stage.
Query:
1
' UNION SELECT id,batch_code,compound,notes FROM batch_records --
The retrieved batch record is shown in images.md as Image 03.
Discovering the Password Clue
The lab_notes table contains a terminal memo.
The important message states that the old terminal still accepts the administrator account and that, after the shutdown, the password was changed to the batch code of the first successful Blue Crystal run.
The previously discovered batch record identifies that batch as:
1
B-17
Query:
1
' UNION SELECT id,title,content,'x' FROM lab_notes --
The retrieved terminal memo is shown in images.md as Image 04.
Administrator Authentication
Using the discovered credentials, authenticate through the laboratory login page.
1
2
Username: admin
Password: B-17
After successful authentication, the participant reaches the Admin Dashboard.
The dashboard contains an entry point to the legacy terminal. The dashboard screenshot is shown in images.md as Image 05.
Legacy Terminal
The legacy terminal is protected by the Flask session and cannot be accessed after logout.
Access the terminal from the authenticated Admin Dashboard to retrieve the recovery message and final flag.
Final Flag
1
CYS{B17_the_lab_remembers}
The recovered terminal message and final flag are shown in images.md as Image 06.
Vulnerability Mitigation
The SQL Injection vulnerability can be prevented by using parameterized SQL queries instead of concatenating user input directly into the SQL statement.
Unsafe approach:
1
2
query = f"SELECT * FROM chemicals WHERE name LIKE '%{search}%'"
cursor.execute(query)
Safer approach:
1
2
3
4
cursor.execute(
"SELECT * FROM chemicals WHERE name LIKE ?",
(f"%{search}%",)
)
With parameterized queries, the search value is treated as data rather than executable SQL syntax. This prevents the user from altering the structure of the SQL statement.
Challenge Design
- Theme: Breaking Bad / Heisenberg
- Core Vulnerability: SQL Injection
- Database: SQLite
- Authentication: Flask session-based authentication
- Difficulty: Easy / Medium
Screenshots
The following screenshots are embedded directly in this Markdown file so the writeup can be submitted as a single document.
Image 01
Image 02
Image 03
Image 04
Image 05
Image 06
Flag
CYS{B17_the_lab_remembers}