E-corp OSINT challenge: a misconfigured API

A short write-up of an E-corp OSINT challenge I really enjoyed during a CTF on 20 January 2021. The challenge hint was:

Log in to the API.

Table of contents

OSINT E-corp

The website URL was https://e-corp.fr (the challenge was due to stay online for about a month, so feel free to have a go while it’s up). For those reading this later, here’s what the website looked like:

Wrong turn

At first, the CTFd platform wasn’t online and I hadn’t heard the hint announced out loud, so I started by reading the source code, which is very basic:

<!doctype html>
<html lang="fr">
<head>
  <meta charset="utf-8">
  <title>E-CORP France</title>
  <link rel="stylesheet" href="css/styles.css?v=1.0">
</head>
<body>
  <div class="bgimg">
    <div class="topleft">
      <img src="/images/logo.png" style="width:20%;">
    </div>
    <div class="bottomleft">
      <p>Nous vous présentons nos excuses pour l'incident survenu récemment sur ce site.</br>Nous avons mis tous les moyens pour augmenter le niveau de sécurité.</br>Nos employés ont changé leur mot de passe.</br></br>E-corp France</p>
    </div>
  </div>
</body>
</html>

So I downloaded the image to look for anything interesting… in vain.

OSINT E-corp: the pivot

Once the CTFd platform was online, I was reminded that the main goal was to log in to the API. I’d run Dirbuster right at the start and it hadn’t found e-corp.fr/api/, so I tried api.e-corp.fr and bingo!

We land on a page that returns an error. I run my friend Dirbuster again, and it finds api.e-corp.fr/login.

dirb https://api.e-corp.fr/

 URL_BASE: https://api.e-corp.fr/
 WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
                                                
 ---- Scanning URL: https://api.e-corp.fr/ ----
 https://api.e-corp.fr/login (CODE:200|SIZE:48)
 
 DOWNLOADED: 4612 - FOUND: 2

Now things get tricky. I’ve found the login URL and I know the two fields to fill in, but I have no idea what the email address and password are.

Just in case, I try a POST request with cURL:

curl -X POST https://api.e-corp.fr/login -d email=contact@e-corp.fr -d password=azertyuiop
"email" or "password" invalid…

A long period of thinking and searching follows. A friend suggests checking the site’s history, since the home page mentions a recent incident.

18 January 2021

Url : https://web.archive.org/web/20210118215823/https://e-corp.fr/

19 January 2021

Url Wayback Machine : https://web.archive.org/web/20210119091625/https://e-corp.fr/

At this point, I think it’s in the bag: all that’s left is to try every possible combination (thanks to Audrey for testing them all). To save time, we used Postman, a tool whose public workspaces are themselves a goldmine for OSINT with Postmaniac.

Suspicious connection detected please use the "security" field with response of your security question : "What is your
favorite restaurant ?"

Well, I’m disappointed: I thought we were nearly done. But this is also what makes the challenge so interesting.

I start searching online for every restaurant featured in Mr Robot. In a fit of desperation, I even start downloading season 4, which I hadn’t watched. Fortunately, a new hint is given: “You need to use Google”.

At first I thought it was trolling, but something intrigued me: why were there Gmail addresses at the end of the leak page?

personal email of the direction

tyrell.wellick@gmail.com
kevin.shelvern@gmail.com
alivia.murabahti@gmail.com
kara.mulrigan@gmail.com
eric.nessberg@gmail.com
karen.ivanthal@gmail.com
john.tholdon@gmail.com
mike.lowdell@gmail.com
myhoa.kulaimo@gmail.com

We realise that jtholdon@e-corp.fr matches the email address john.tholdon@gmail.com.

I then typed “OSINT Gmail” into my friend Google and came across: https://medium.com/hacking-info-sec/how-to-gmail-osint-like-a-boss-1ca4f55f55e2.

OSINT E-corp with Gmail

I quickly open Gmail, add the address john.tholdon@gmail.com and open the network tab.

When you hover over a Gmail account’s email address, a small card with buttons pops up.

Behind the scenes, hovering triggers an Ajax request via XHR. To get information about someone (here, their email address and a way to message them, for example), you need their ID, and the XHR response contains it:

etc.. [[\"111152226550336376669\", etc...

Enter Google Maps

Now we can check whether this person has contributed to Google Maps, for example, by querying the URL: https://www.google.com/maps/contrib/111152226550336376669/

There’s one contribution:

I immediately go back to Postman, add the “security” key with the value “Le Diplomate” and… bingo!

Thanks

Thanks to my teammates Arnaud, another Arnaud (not the same one), Audrey, Thomas and Maxime for their moral and technical support.

Thanks to Anthony for creating this challenge.