Inspecting the cookies (given the title of the challenge), I found a session cookie:
Cookies
And after trying to decode it from base64, I got the following output:
Base64 Cookies Decode
It’s highly likely that very_auth is the header that determines some kind of privilege for access. While reviewing the code in the attached file, I found some vulnerable parts:
1
2
cookie_names=["snickerdoodle","chocolate chip","oatmeal raisin","gingersnap","shortbread","peanut butter","whoopie pie","sugar","molasses","kiss","biscotti","butter","spritz","snowball","drop","thumbprint","pinwheel","wafer","macaroon","fortune","crinkle","icebox","gingerbread","tassie","lebkuchen","macaron","black and white","white chocolate macadamia"]app.secret_key=random.choice(cookie_names)
As we can see, the secret_key is easily deducible if it’s taken from a list of known plain text values. Continuing to read through the function for the /display route, I found something interesting:
1
2
3
4
5
6
7
8
9
10
11
12
13
@app.route("/display",methods=["GET"])defflag():ifsession.get("very_auth"):check=session["very_auth"]ifcheck=="admin":resp=make_response(render_template("flag.html",value=flag_value,title=title))returnrespflash("That is a cookie! Not very special though...","success")returnrender_template("not-flag.html",title=title,cookie_name=session["very_auth"])else:resp=make_response(redirect("/"))session["very_auth"]="blank"returnresp
Indeed, if the very_auth cookie is set to admin, the page containing the flag is returned. The goal of the challenge is therefore to change our privileges by forging admin cookies to access the flag. After doing some research, I found this: https://www.bordergate.co.uk/flask-session-cookies/. Now that I understand how cookies are composed in Flask, we can proceed to the exploitation phase.
Then, I created a file wordlist.txt since we know the set of keys that contains the valid one used to sign the cookies. I did this directly with bash using sed, copying the code line from the list of keys:
Now that we have everything needed, we can proceed to the actual exploitation phase.
Exploitation
The first step is to find the secret_key from the previously seen list that was used to sign the cookie. I can copy the session cookie directly with ChromeDevTools or I can also extract it using bash from the CLI with curl:
1
curl -I http://mercury.picoctf.net:65344/
Now, just copy the session cookies and use flask-unsign with the previously created wordlist to find the secret_key used to sign the cookies:
Once this is done and we have the forged cookie with admin privileges to access the flag, all that’s left is to send a request by modifying the session cookie value via ChromeDevTools, with the newly forged cookie, and refresh the page (F5). This will give us the flag.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The automatic exploit makes a GET request to the page to extract the session cookies. Then, using the list of keys with which the session cookie is generated, it extracts the correct key used to sign the original cookie. Once the key is extracted, it forges the new cookie with the value set to admin, and sends another request to /display with the newly forged cookie, extracting the flag from the response using a regex.
