Advent of CTF 2025: Day 5 - Kramazon

Day 5 of Advent of CTF 2025 takes us into web application security with an investigation of “Kramazon,” a suspicious e-commerce platform operated by the Krampus Syndicate to disrupt Santa’s delivery network.

Challenge Overview

Category: Web Exploitation
Difficulty: Intermediate
Target: https://kramazon.csd.lol/
Scope: https://kramazon.csd.lol/* only

Challenge Description

Intelligence analysts from the North Pole Logistics Directorate (NPLD) have uncovered a covert online storefront operated by the KRAMPUS Syndicate called Kramazon. This distribution front is used to intercept gifts, reroute sleigh cargo, and undermine Santa’s global delivery network.

The platform contains a critical flaw: customers with ordinary elf-level accounts can somehow receive Santa-priority shipping status, which should only be assigned through Santa’s authenticated sleigh-routing systems.

Mission: Exploit this flaw to obtain Santa Priority Delivery and reveal the restricted Priority Route Manifest containing the flag.

Initial Reconnaissance

Understanding the Application

Kramazon appears to be a typical e-commerce platform with:

• Product catalog
• Shopping cart functionality
• User authentication system
• Order processing workflow
• Shipping priority levels

Identifying the Vulnerability

The challenge description hints at a privilege escalation vulnerability where regular users can gain Santa-level shipping privileges through some implementation flaw.

Solution Analysis

Cookie-Based Authentication Investigation

Initial investigation reveals the application uses cookie-based authentication with a suspicious pattern.

The authentication cookie contains a Base64-encoded value that appears to control user privileges.

JavaScript Analysis

Examining the client-side JavaScript reveals a critical function:

function santaMagic(n) {
    return n ^ 0x37;  // XOR with 0x37
}

This function suggests that user privileges are controlled through XOR operations with the value 0x37.

Cookie Manipulation Strategy

To gain Santa privileges, we need to find a value n such that:

santaMagic(n) = 1
n ^ 0x37 = 1
n = 1 ^ 0x37 = 54 (0x36)

Implementing the Exploit

Step 1: Delete Existing Cookie

First, we clear any existing authentication cookies:

document.cookie = "auth=; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC;";

Step 2: Create Santa Cookie

We create a new cookie with the calculated Santa privilege value:

document.cookie = "auth=Ng==; path=/";  // Base64 of 0x36

Where Ng== is the Base64 encoding of 0x36 (54 decimal).

Step 3: Exploit the Workflow

The intended exploitation flow should be:

1. Create Order with Santa Cookie: Use Cookie: auth=Ng==
2. Verify Privilege Escalation: Check that status responses include "user": 1
3. Finalize Order: Complete the purchase process
4. Access Priority Manifest: Gain access to restricted content containing the flag

Technical Analysis

XOR-Based Privilege System

The vulnerability lies in the client-side XOR function that determines user privileges:

// Normal user: santaMagic(someValue) = 0
// Santa user: santaMagic(54) = 1
function santaMagic(n) {
    return n ^ 0x37;
}

Base64 Encoding Chain

The privilege value goes through this encoding chain:

1. Decimal Value: 54
2. Hexadecimal: 0x36
3. Base64: Ng==
4. URL Encoded: Ng%3D%3D (if needed)

Cookie Structure

The authentication cookie structure:

auth=<Base64-encoded-privilege-value>

Where the decoded value determines user privileges through the XOR function.

Key Learning Points

This challenge demonstrates several important web security concepts:

Client-Side Security Flaws

• Never trust client-side validation for security decisions
• Privilege determination should always happen server-side
• Cookie manipulation is trivial for attackers

Cryptographic Weaknesses

• Simple XOR operations provide no real security
• Predictable algorithms can be easily reversed
• Client-side crypto is fundamentally flawed for security

Web Application Architecture

• Separation of concerns between client and server
• Proper authentication mechanisms using secure tokens
• Server-side validation of all security-critical operations

Defensive Recommendations

To prevent similar vulnerabilities:

1. Server-Side Validation: All privilege checks must occur server-side
2. Secure Session Management: Use cryptographically secure session tokens
3. Principle of Least Privilege: Users should have minimal necessary permissions
4. Input Validation: Validate and sanitize all client inputs
5. Security Testing: Regular penetration testing of authentication mechanisms

Real-World Applications

This type of vulnerability is common in:

• E-commerce platforms with flawed privilege systems
• SaaS applications with client-side role determination
• Mobile applications trusting client-side data
• Legacy systems with outdated authentication mechanisms

Challenge Limitations

During testing, the expected server behavior (including "user": 1 in status responses) was not consistently observed, suggesting either:

• Implementation differences from the description
• Additional conditions or steps required
• Potential challenge environment issues

However, the core vulnerability concept remains valid and educationally valuable.

Tools and Techniques

Browser Developer Tools were essential for:

• Cookie manipulation and inspection
• JavaScript analysis and execution
• Network request monitoring
• Response analysis

Conclusion

Day 5 highlights critical web application security principles, particularly the dangers of client-side security decisions. The Kramazon challenge demonstrates how seemingly minor implementation flaws can lead to complete privilege escalation.

Understanding cookie manipulation, client-side cryptography weaknesses, and proper authentication mechanisms is essential for both offensive security testing and defensive application development.

The challenge serves as an excellent reminder that security must be built into the server-side architecture, not relied upon through client-side controls that attackers can easily manipulate.

This writeup is part of my Advent of CTF 2025 series. Web application security challenges like this one teach fundamental concepts that apply to real-world penetration testing and secure development practices.