Barrier

Overview

Barrier is a medium-rated Linux box themed around Single-Sign-On. The foothold chains three services: a SAML signature-confusion bypass in GitLab (CVE-2024-45409) forges an administrative login, GitLab’s CI/CD variables leak a long-lived Authentik API token, and that token is effectively IdP admin — enough to set a user’s password and impersonate them. Driving Guacamole’s SAML flow as that impersonated user mints a session token, and Guacamole hands back a stored SSH private key in cleartext, giving a shell as maki. This post stops at the user flag.

Recon

Port	Service	Notes
22	SSH	OpenSSH
8080	HTTP	Apache Tomcat → Apache Guacamole (/guacamole)
9443	HTTPS	Authentik identity provider
—	HTTP	GitLab (SSO client)

nmap -sC -sV 10.129.8.85

The site uses barrier.vl and subdomains (gitlab.barrier.vl, authentik.barrier.vl), so add them to /etc/hosts. Tomcat exposes /guacamole, which redirects to Authentik for login — the SSO relationship between GitLab, Authentik, and Guacamole is the whole story of the box.

Enumeration

GitLab authenticates via SAML against Authentik. The bundled ruby-saml version is vulnerable to CVE-2024-45409: it validates the signature of one assertion but reads the identity from another, so any captured valid SAMLResponse can be re-wrapped to log in as an arbitrary user (e.g. the GitLab admin akadmin).

# Forge an admin SAMLResponse from a captured valid one
python3 CVE-2024-45409.py -r saml.xml -n akadmin -e -o response.xml

As GitLab admin, the project’s CI/CD variables leak a static AUTHENTIK_TOKEN. That token is a full Authentik API key — it can read users, set passwords, and impersonate. From here the path is pure API abuse.

Foothold

The Authentik token lets us drive Authentik’s flow-executor API headlessly to authenticate as maki (whose password we set), then complete Guacamole’s SAML SSO. The key detail: Guacamole’s SAML must be SP-initiated so the SAMLResponse carries an InResponseTo value Guacamole can correlate — IdP-initiated logins fail.

# 1. Guacamole issues the SAMLRequest (SP-initiated)
curl -s -o /dev/null -w "%{redirect_url}" \
  "http://barrier.vl:8080/guacamole/api/ext/saml/login"

# 2. Feed it to Authentik (authenticated as maki), POST the SAMLResponse back to
#    /guacamole/api/ext/saml/callback, then replay the returned state= to mint a token
curl -s -X POST "http://barrier.vl:8080/guacamole/api/tokens" \
  --data-urlencode "state=<state_from_acs_redirect>"
# -> {"authToken":"<redacted>","username":"maki","dataSource":"saml"}

With the authToken, Guacamole’s API returns the stored connection’s parameters — including the SSH private key in cleartext.

curl -s "http://barrier.vl:8080/guacamole/api/session/data/mysql/connections/1/parameters?token=<authToken>"

Save the key and SSH in as maki:

ssh -i maki_id_rsa -o HostKeyAlgorithms=+ssh-rsa [email protected]

User flag

cat /home/maki/user.txt   # HTB{...}

Access as maki achieved through pure SSO/API abuse — no exploit binary required once the Authentik token is in hand.

Foothold complete. Privilege escalation is left as an exercise — this post stops at user.