3dub 1：badmedicine
In this problem, we only see a login form.
After we login with some username. We get the login successful page.
But it show that "the key is only for the admin"
And if we try to login with admin. The message "admin login disabled" showed.
Then we return to login by other account and observe the behavior of web page by tamper data.
With tamper data, we observe the cookie "username" was set.
After try to login with different username
admin1 : 09c8259ca01f
admiN : 09c8259c80
We can find that most part of cookie are the same and only differ lightly.
Therefore we can guess that cookies are encrypt by xor operator.
Finally we can find the cookie of admin
admin : 09c8259ca0
Then we change the value of cookie and resend the page to get the key.
reference
there are some write up about this problem.
沒有留言:
張貼留言