offsec-web-300

Use the provided exploit template built on the requests library with a session object that performs its own login. The script must run with one command, contain no input() prompts, no hardcoded sessions, and demonstrate the full chain from initial access to retrieving Local.txt and Proof.txt.

Search the codebase for sinks like BinaryFormatter.Deserialize(), LosFormatter.Deserialize(), or Newtonsoft.Json with TypeNameHandling enabled. Then generate a payload with ysoserial.net using a gadget chain such as TypeConfuseDelegate matched to the target's serializer and .NET version.

Burp Suite Community, dnSpy, JD-GUI, Visual Studio, and Python are permitted. SQLmap, Burp Suite Pro automation, source code analyzers, and AI tools are explicitly forbidden, so all SQL injection must be performed manually.

Loose comparison operators like == coerce types, so magic hashes starting with 0e evaluate as float zero and match each other. Passing an array to strcmp() returns null, which loosely equals zero, granting access when the code checks strcmp($_POST['password'], $hash) == 0.

Gadget chains are .NET framework version dependent, so verify the target's .NET version before generating the payload. Also confirm you selected the correct formatter (LosFormatter vs BinaryFormatter) and check whether the serialized data is encrypted with a key you must extract from the source first.

The exam lasts 47 hours 45 minutes with three machines worth 20, 35, and 45 points, requiring 85 out of 100 to pass. A professional report must be submitted within 24 hours after the exam ends, and privilege escalation is always required since Proof.txt sits at a higher privilege level than Local.txt.