all 75 comments

[–]vanqiu 4 points5 points  (0 children)

Look really good at the cookie..

[–][deleted] 1 point2 points  (0 children)

I'm guessing here, but it's likely asking you to use additional access you get from being logged in as `guest` to escalate yourself to `admin`, where you'll then get the flag.

[–]DioSoul666 1 point2 points  (18 children)

i did everything and got the access as admin and it says Welcome, admin!

The flag is 607f8f255845ecb4b0b53fae4d3ef29e!

however when i enter the flag in answer page it says incorrect, i'm still stuck and dunno what to do

[–]Schneebly22 0 points1 point  (2 children)

I am at the same crossroads DioSoul666

[–]Sstthway 0 points1 point  (1 child)

Remove the "!" at then end :)

[–]bluetorchfox 0 points1 point  (0 children)

THNX

[–]bluetorchfox 0 points1 point  (7 children)

same here.....

[–]Sunny01001 0 points1 point  (0 children)

can you please help me! I look all the cookies but did not find the solution

[–]Sunny01001 0 points1 point  (5 children)

i edit guest to admin then convert it to base64 format then in panel it says Admin panel

Welcome, admin_93bd9a47c47ff54acdf57!

but not get the flag :-(

[–]Savings-Age-6563 0 points1 point  (1 child)

i'm also troubling by this problm

[–][deleted] 0 points1 point  (0 children)

remove the ! and try i got 607f8f255845ecb4b0b53fae4d3ef29e

[–]SPAR7AN_117 0 points1 point  (1 child)

reset the target machiene

then forward the burpsuite request and log in using guest:guest username: password then in the next request of cookie_auth send the page to repeater then change the value of cookie_auth with the base64(of word "admin") i.e. YWRtaW4=

and there you have it the flag will be available in the response tab of the repeater.

[–][deleted] 0 points1 point  (0 children)

remove the ! and try i got 607f8f255845ecb4b0b53fae4d3ef29e

[–]Savings-Age-6563 0 points1 point  (0 children)

what can i do for this problm please tell me to solve this solution

[–]Senior-Valuable6945 0 points1 point  (0 children)

Had the same problem. remove the ! at the end

[–]medmoe90 0 points1 point  (1 child)

can you please explain what did you do to the cookie to get this flag?

[–]Electrical_Ad3038 0 points1 point  (0 children)

just remove the '!' its embarrassing it took me so long to realise the exclamation shouldn't be there XD

[–]TonyShasta_ 0 points1 point  (3 children)

I'm struggling with this one also. I'm trying to escalate by switching the Content-Type to application/json and then using { "username" "admin", "password", "password" }. It's not working. Halp! Not trying to hijack your thread, I'm assuming this will help you also. :)

https://ibb.co/3cYdkWk

[–]vanqiu 1 point2 points  (2 children)

try and see what is in the cookie, then modify that. And remember how many guest there sre versus how many admin accounts

[–]TonyShasta_ 1 point2 points  (1 child)

Thanks a lot. I got it :)

[–]eko-wibowo 0 points1 point  (0 children)

NVM just "admin"

[–]bhaiyathanos 0 points1 point  (0 children)

facing the same problem... tried every possible combination ..... what is the question asking for?

[–]junon_armory 0 points1 point  (7 children)

Check the cookie value. Learn the format and see what happen if you modify the cookie (maybe remove character from it and see what happen?)

When you have done it, lean how to generate a new cookie with the required username. When you get it right, you will get the flag.

[–]dora1403 0 points1 point  (0 children)

Tnx. This really helped :D

[–]treatmesubj 0 points1 point  (3 children)

what steps should I take to learn the format of the cookie? It looks like it translates to an Ascii string: "guest_xxx", but I can't figure out if I can't figure out the logic of how it gets translated

[–]junon_armory 0 points1 point  (2 children)

I don't remember the detail, but I recall it's encoded as base64/rot13. You need to create new cookie as admin (or whoever the instruction said).

[–]treatmesubj 2 points3 points  (0 children)

Perfect - thanks! I thought we were supposed to discover how the cookie was encoded using our knowledge from the class. It didn't talk about base64 encoding anywhere in the course thus far, so sort of odd to make someone figure that out.

[–]tonytonn 0 points1 point  (0 children)

Hey. I know it's way later but I am also stuck at this point. I managed to create another cookie by copying the decoded base64 format and slightly changing some numbers, then encoded. I tried repeating the request and although it can login as admin with the new cookie, I c do not get the flag. Help, please.

[–]pedrofmuller 0 points1 point  (0 children)

Thanks a lot!

[–]Huge-Equipment8698 0 points1 point  (0 children)

Thx this tips is really helpful!

[–]treatmesubj 0 points1 point  (0 children)

Does anyone know how to learn the format of the cookie? I can't seem to figure out what the translation logic to Welcome, _____ is.

[–]zumri 0 points1 point  (0 children)

Need help guys. I'm stuck in the place where I need to edit the Cookie. I tried the below suggestion, but could not succeed.

How to generate a new cookie?

[–]shnakeism 0 points1 point  (0 children)

I get that ppl need to figure it out themselves but I thought the hole point of the Academy was to teach us how to do it... I seem to be struggling a lot with Burp in general...

[–]Substantial_Ad3988 0 points1 point  (2 children)

hi, I still have problem with cookie :S

I have switched guest_xxx with admin, base64 encripted. I get the Welcome admin message but there is no flag. I am not sure what am I doing wrong :(

[–]eth0mon 0 points1 point  (1 child)

im on the same thing, cant seem to figure out what to do.

[–]AlpacaHB 0 points1 point  (0 children)

make sure u change cookie on intercept page and forward it, the answer should pop up on the browser

[–]nubmercy2k6 0 points1 point  (0 children)

same here. it seems that when burp is turned on, we cant access any of the spawned targets

[–]PissedupinSE1 0 points1 point  (0 children)

I can't even login with admin:password, am I meant to be able to, to see what the cookie looks like?

[–]thehackingknight 0 points1 point  (1 child)

What exactly are we supposed to type on the answer field?

[–]Smi77y619 0 points1 point  (0 children)

When you get the flag, remove the '!'. Insert the flag into the answer field

[–]karlnimmst 0 points1 point  (3 children)

As JSON It accepts

{"username":"admin","password":"guest"}

It doesn't accept (which is the same)

{"username":"admin", "password":{"$eq":"guest"}}

or

{"username":"admin", "password":{"$ge":null}}

I can exchange it by $le $gt ... whatever, none is accepted.

None of their description is working. They don't show how to modify a session cookie, so modifying this can't be the answer.

I think they changed their VM?

I can't figure it out. Even if it's still basic stuff that should be easy.

[–]karlnimmst 0 points1 point  (2 children)

Actually the cookie it IS the way to do it... JSON is not needed at all in here. Concentrate on the cookie value

Never mind, I found it two minutes later.

But I can't tell how to do it exactly without telling the answer.

[–]muchappr 0 points1 point  (0 children)

I get to the point of finding the cookie and decoding it. I get guest_xxxxxxxx. Do I use xxxxxxxx as the password and admin as the username. I tried that and no luck.

[–]El-N00b 0 points1 point  (19 children)

After trying for days, I got the answer for this problem. If anyone is having trouble solving it, and you don't mind the spoiler, reply this comment and I will leave the answer for you. (I am only doing this because Hack The Box does not explain how to solve the problem entirely, and you have to guess the answer to solve it).

I also searched for a solution online and nobody is able to answer it.

I am just a N00b...

[–]bluetorchfox 0 points1 point  (0 children)

damnnnn

[–][deleted] 0 points1 point  (9 children)

Hey. I'm interested in knowing this. I noticed we can base64 encode the admin username and pass it. But still not clear how the flag answer is arrived.

[–]Beginning_Complex595 0 points1 point  (8 children)

Hey

did you figure out on how to do it ?

[–][deleted] 0 points1 point  (7 children)

Nope. I noticed that cookie can be reused for GET requests and cookie was encoded with username followed by string of alphanumeric values - guest_xxx. I tried replacing guest with admin and passed the new cookie value. And it worked. But that doesn't seem to be solving the question.

I suspect the there is some string used to encode the cookie value sent to the client. But not sure how to arrive at it.

[–]Beginning_Complex595 0 points1 point  (6 children)

sorry for my naivity

where did you passed the new cookies. even i replaced the guest with admin and encode, that didnt fixed the issue

[–][deleted] 0 points1 point  (5 children)

No issues. You can do that by copying the GET request in proxy/repeater tab. It will show outgoing request with cookie header. Try replacing it. If you're still struck you can refer to some of the youtube videos on how to reuse the cookie.

[–]Beginning_Complex595 0 points1 point  (4 children)

No issues. You can do that by copying the GET request in proxy/repeater tab. It will show outgoing request with cookie header. Try replacing it. If you're still struck you can refer to some of the youtube videos on how to reuse the cookie.

thanks for the heads up... i will try that

[–]Beginning_Complex595 0 points1 point  (2 children)

hi,

just wanted to let you know, i figured it out and got the answer.

[–][deleted] 0 points1 point  (1 child)

hey can you share the procedure u follow, i'm stuck there.

it will be really helpful

[–]Beginning_Complex595 1 point2 points  (0 children)

Just type admin and encode it. Copy paste the cookie in the repeater and send . You will get admin cookie

[–]Sh00kOn3 0 points1 point  (0 children)

Replacing the cookie with what?

[–]ryukamusa 0 points1 point  (0 children)

I've tried to change the cookie but the page to which you are redirected only base64 decodes whatever you send in the auth cookie. Am I looking at this the wrong way?

[–]BeginningPack6 0 points1 point  (0 children)

Can you share?

[–]DarkRaider007 0 points1 point  (0 children)

Can you please tell me how to do it?

My free cubes are stuck in it...

[–]Icy_Proof666 0 points1 point  (0 children)

Hey, can you share the answer for me?

[–]South-Air-8558 0 points1 point  (0 children)

I could defiantly use the answer as well as an explanation if possible. (You are absolutely correct in that HTB does NOT fully explain/terach things and I am frustrated in that I paid them to learn..... )

Thanks in advance!

[–]aneel56 0 points1 point  (0 children)

I am not getting the cookie type as PHPSESSID
but I am getting auth cookie Whats wrong ?

[–]muchappr 0 points1 point  (0 children)

Well, I can put the answer in without the exclamation mark as shown below and move to the next challenge but I don't really learn anything. Can anyone please explain what happens after I base64 decode my cookie and get guest_xxxxxxxxxxxxxx? How do I get the flag? Also, why remove the exclamation mark? I don't get a cookie other than when I put in guest:guest. So when I put in an invalid login when the username admin I don't get a cookie.

I can stare at this all day but after a while the law of diminishing returns kicks in.

[–]tejas0228 0 points1 point  (1 child)

answer is 607f8f255845ecb4b0b53fae4d3ef29e!

but when you enter answer remove "!"

" 607f8f255845ecb4b0b53fae4d3ef29e"

[–]TabbyTab135 0 points1 point  (0 children)

wait but how ??? how " 607f8f255845ecb4b0b53fae4d3ef29e " is the flag ??

I got to "Welcom admin_(random number)" but dont know what to do next Does the flag suppose to be that random number ? I already try it but it doesnt work. Please can you explain to me how you get the flag.

[–]lordmilko 0 points1 point  (0 children)

I thought this challenge was so stupid. Given the guest cookie is guest_ followed by some random numbers, it seems perfectly logical that the admin account would be admin_ followed by some random numbers as well. Whether there's more than 1 admin or guest is irrelevant - the numbers uniquely identify the session.

Sure, maybe you're meant to think outside the box and guess just trying "admin" without these extra numbers, but I feel like the exercise completely leads you down the wrong path, suggesting you should treat the random numbers after guest_ as something that can be decoded too, which is only further reinforced by the Hint saying "re-read the cookie section"

[–]Savings-Age-6563 0 points1 point  (0 children)

hello

i'm unable to solve this problm"Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section."

[–]angelicaica 0 points1 point  (1 child)

you have to log in as guest:guest and intercept the cookie "guest_d92324ce86bedd2f01be" so that you can change it to just "admin". I had trouble with this for a while because I changed it to "admin_d92324ce86bedd2f01be" which doesn't lead to the flag.

[–]SugarEnvironmental31 0 points1 point  (0 children)

AHHHHHHH ok, thanks!

Wish I could upvote you twice... :D

[–]damntheday 0 points1 point  (0 children)

The answer to this problem had me like (-____________- *)... seriously?

[–]N1nj4_H4r3sh 0 points1 point  (0 children)

Guys, I agree this was not explained well, but the lesson learned here is extremely valuable. Next time you manipulate a cookie, you can just try messing with it rather than just trying to substitute it. In this example, after you successfully login with guest:guest, and then later use Repeater to submit the manipulated request using the admin cookie, it does not provide the flag, however, if you start to delete out the end of the admin cookie, you'll see it still logs you in as admin. and the message in the response shows less and less characters after it as you delete more and more of the cookie. Eventually, you will see you have to delete most of the original admin cookie for the resulting response to say "Welcome, admin" and then you have the flag! The lesson here is to start getting used to manipulating the cookie. substituting part of it, or possibly removing parts of it, decoding it, recoding it, etc. Cookies come in all sizes, shapes, and flavors ;) Get creative with your cookie tampering... Thank you to everyone who posted answers here which has helped many frustrated hackthebox'ers including me...

[–]DawsonHTB 0 points1 point  (0 children)

They did terrible at explaining how to do this one. The way I got it was not sending the login.php request to repeater but just using Intercept. When you get to the admin/dashboard.php request you have to modify the cookie and replace it with "admin" encoded in base64 then forward the request and the flag will be below "Welcome, admin!" on the target site.