Author: vilkius

OmniCTF 2026 - permissiondenied

Author: tab4

Description

OmniCTF has just opened its public Minecraft server for testing. It’s possible that not everything is configured as intended. Can you find your way to the answer?

Flag: OmniCTF{y0U_ar3_a_p3rm1ss1on5_pr0_gw4rf23}

Initial Reconnaissance

This challenge appears to be related to incorrectly configured Minecraft plugin permissions.

We can run:

/pl

to list the installed plugins and click on them for additional information.

The interesting plugins are:

• GroupManager
• CTFHandler
• CustomDemotion

Enumerating Groups

From the GroupManager GitHub repository, we can see that GroupManager commands usually start with man.

Typing:

/man

shows the commands available to us.

We can use:

/manglist

to list all configured groups.

The available groups include:

Admin
Builder
Default
Helper
Limited
Moderator
Prisoner
Restricted

Finding the Required Permission

We can inspect the permissions of the Admin group using:

/manglistp Admin

The Admin group has the following permission:

flaghandler.flag

This permission is required to execute:

/flag

Therefore, our goal is to somehow move ourselves from the Default group to the Admin group.

Inspecting Our Permissions

Since we start in the Default group, we can inspect its permissions with:

/manglistp Default

The permission that stands out is:

customdemotion.demote

This allows us to use the command provided by the CustomDemotion plugin.

CustomDemotion Logic

Running:

/demote

shows the group ranking indexes.

The important indexes are:

3 -> Default
7 -> Admin

We are currently at index 3, while the Admin group is at index 7.

The /demote command is intended to move a player downward by subtracting the supplied number from the current rank.

However, the plugin does not properly validate negative values.

By supplying -4, the calculation becomes:

3 - (-4) = 7

Instead of demoting us, the command moves us four ranks upward to Admin.

Privilege Escalation

We run:

/demote -4

This changes our group from Default to Admin.

We can now execute:

/flag

and receive the flag.

Vulnerability

The vulnerability is an integer input validation issue in the CustomDemotion plugin.

The plugin accepts a negative demotion value and subtracts it from the player’s current group index. Subtracting a negative number results in addition, allowing the player to move upward through the permission hierarchy.

In simplified form:

new_rank = current_rank - supplied_value

With a negative input:

new_rank = 3 - (-4)
new_rank = 7

Final Flag

OmniCTF{y0U_ar3_a_p3rm1ss1on5_pr0_gw4rf23}