Dev Admin

Overview

• Overall difficulty for me: Very easy

In this challenge, we can spawn a docker instance:

Find the flag

Home page:

The reason why it said Not Authorized!, is becase when we go to this page (index.php), it sets a cookie for us!

We have a cookie is set, and the key name called dev_session!

The %3D is URL encoded, let’s decode that:

It’s a base64 encoded string! Let’s decode that via base64 -d!

┌──(root🌸siunam)-[~/ctf/GuidePoint-Security-Oct27-2022/Web/Dev-Admin]
└─# echo "YWRtaW5pc3RyYXRvcjpmYWxzZQ==" | base64 -d
administrator:false

Nice! What if we set the false value to true?? Will I become authorized?

To do so, I’ll reverse the above processes: (-n for no new line character)

┌──(root🌸siunam)-[~/ctf/GuidePoint-Security-Oct27-2022/Web/Dev-Admin]
└─# echo -n "administrator:true" | base64          
YWRtaW5pc3RyYXRvcjp0cnVl

Edit the cookie:

Then hard refresh the page: (Ctrl + Shift + R)

We got the flag!

Conclusion

What we’ve learned:

1. Authentication Bypass via Weak Cookie Value