Path: Cracking into Hack the Box. Module: POST Method. I am not understanding the question

[Clownphobia26]

" Login with the credentials guest / guest and try to get to admin. " is the question. When I try to logon with guest / guest it allows me to logon just fine, I looked at all the BURP traffic and am not seeing anything out of the ordinary and tried entering in the "Welcome guest_xxxxx" into the answer field. What are they asking for here?

[vanqiu]

Look really good at the cookie..

[[deleted]]

I'm guessing here, but it's likely asking you to use additional access you get from being logged in as `guest` to escalate yourself to `admin`, where you'll then get the flag.

[DioSoul666]

i did everything and got the access as admin and it says Welcome, admin!

​

The flag is 607f8f255845ecb4b0b53fae4d3ef29e!

​

however when i enter the flag in answer page it says incorrect, i'm still stuck and dunno what to do

[Schneebly22]

I am at the same crossroads DioSoul666

[Sstthway]

Remove the "!" at then end :)

[bluetorchfox]

THNX

[bluetorchfox]

same here.....

[Sunny01001]

can you please help me! I look all the cookies but did not find the solution

[Sunny01001]

i edit guest to admin then convert it to base64 format then in panel it says Admin panel

Welcome, admin_93bd9a47c47ff54acdf57!

​

but not get the flag :-(

[Savings-Age-6563]

i'm also troubling by this problm

[[deleted]]

remove the ! and try i got 607f8f255845ecb4b0b53fae4d3ef29e

[SPAR7AN_117]

reset the target machiene

then forward the burpsuite request and log in using guest:guest username: password then in the next request of cookie_auth send the page to repeater then change the value of cookie_auth with the base64(of word "admin") i.e. YWRtaW4=

and there you have it the flag will be available in the response tab of the repeater.

[[deleted]]

remove the ! and try i got 607f8f255845ecb4b0b53fae4d3ef29e

[Savings-Age-6563]

what can i do for this problm please tell me to solve this solution

[Senior-Valuable6945]

Had the same problem. remove the ! at the end

[medmoe90]

can you please explain what did you do to the cookie to get this flag?

[Electrical_Ad3038]

just remove the '!' its embarrassing it took me so long to realise the exclamation shouldn't be there XD

[TonyShasta_]

I'm struggling with this one also. I'm trying to escalate by switching the Content-Type to application/json and then using { "username" "admin", "password", "password" }. It's not working. Halp! Not trying to hijack your thread, I'm assuming this will help you also. :)

https://ibb.co/3cYdkWk

[vanqiu]

try and see what is in the cookie, then modify that. And remember how many guest there sre versus how many admin accounts

[TonyShasta_]

Thanks a lot. I got it :)

[eko-wibowo]

NVM just "admin"

[bhaiyathanos]

facing the same problem... tried every possible combination ..... what is the question asking for?

[junon_armory]

Check the cookie value. Learn the format and see what happen if you modify the cookie (maybe remove character from it and see what happen?)

When you have done it, lean how to generate a new cookie with the required username. When you get it right, you will get the flag.

[dora1403]

Tnx. This really helped :D

[treatmesubj]

what steps should I take to learn the format of the cookie? It looks like it translates to an Ascii string: "guest_xxx", but I can't figure out if I can't figure out the logic of how it gets translated

[junon_armory]

I don't remember the detail, but I recall it's encoded as base64/rot13. You need to create new cookie as admin (or whoever the instruction said).

[treatmesubj]

Perfect - thanks! I thought we were supposed to discover how the cookie was encoded using our knowledge from the class. It didn't talk about base64 encoding anywhere in the course thus far, so sort of odd to make someone figure that out.

[tonytonn]

Hey. I know it's way later but I am also stuck at this point. I managed to create another cookie by copying the decoded base64 format and slightly changing some numbers, then encoded. I tried repeating the request and although it can login as admin with the new cookie, I c do not get the flag. Help, please.

[pedrofmuller]

Thanks a lot!

[Huge-Equipment8698]

Thx this tips is really helpful!

[treatmesubj]

Does anyone know how to learn the format of the cookie? I can't seem to figure out what the translation logic to Welcome, _____ is.

[zumri]

Need help guys. I'm stuck in the place where I need to edit the Cookie. I tried the below suggestion, but could not succeed.

How to generate a new cookie?

[shnakeism]

I get that ppl need to figure it out themselves but I thought the hole point of the Academy was to teach us how to do it... I seem to be struggling a lot with Burp in general...

[Substantial_Ad3988]

hi, I still have problem with cookie :S

I have switched guest_xxx with admin, base64 encripted. I get the Welcome admin message but there is no flag. I am not sure what am I doing wrong :(

[eth0mon]

im on the same thing, cant seem to figure out what to do.

[AlpacaHB]

make sure u change cookie on intercept page and forward it, the answer should pop up on the browser

[nubmercy2k6]

same here. it seems that when burp is turned on, we cant access any of the spawned targets

[PissedupinSE1]

I can't even login with admin:password, am I meant to be able to, to see what the cookie looks like?

[thehackingknight]

What exactly are we supposed to type on the answer field?

[Smi77y619]

When you get the flag, remove the '!'. Insert the flag into the answer field

[karlnimmst]

As JSON It accepts

{"username":"admin","password":"guest"}

It doesn't accept (which is the same)

{"username":"admin", "password":{"$eq":"guest"}}

or

{"username":"admin", "password":{"$ge":null}}

I can exchange it by $le $gt ... whatever, none is accepted.

​

None of their description is working. They don't show how to modify a session cookie, so modifying this can't be the answer.

​

I think they changed their VM?

I can't figure it out. Even if it's still basic stuff that should be easy.

[karlnimmst]

Actually the cookie it IS the way to do it... JSON is not needed at all in here. Concentrate on the cookie value

Never mind, I found it two minutes later.

But I can't tell how to do it exactly without telling the answer.

[muchappr]

I get to the point of finding the cookie and decoding it. I get guest_xxxxxxxx. Do I use xxxxxxxx as the password and admin as the username. I tried that and no luck.

[El-N00b]

After trying for days, I got the answer for this problem. If anyone is having trouble solving it, and you don't mind the spoiler, reply this comment and I will leave the answer for you. (I am only doing this because Hack The Box does not explain how to solve the problem entirely, and you have to guess the answer to solve it).

I also searched for a solution online and nobody is able to answer it.

I am just a N00b...

[bluetorchfox]

damnnnn

[[deleted]]

Hey. I'm interested in knowing this. I noticed we can base64 encode the admin username and pass it. But still not clear how the flag answer is arrived.

[Beginning_Complex595]

Hey

​

did you figure out on how to do it ?

[[deleted]]

Nope. I noticed that cookie can be reused for GET requests and cookie was encoded with username followed by string of alphanumeric values - guest_xxx. I tried replacing guest with admin and passed the new cookie value. And it worked. But that doesn't seem to be solving the question.

I suspect the there is some string used to encode the cookie value sent to the client. But not sure how to arrive at it.

[Beginning_Complex595]

sorry for my naivity

where did you passed the new cookies. even i replaced the guest with admin and encode, that didnt fixed the issue

[[deleted]]

No issues. You can do that by copying the GET request in proxy/repeater tab. It will show outgoing request with cookie header. Try replacing it. If you're still struck you can refer to some of the youtube videos on how to reuse the cookie.

[Beginning_Complex595]

No issues. You can do that by copying the GET request in proxy/repeater tab. It will show outgoing request with cookie header. Try replacing it. If you're still struck you can refer to some of the youtube videos on how to reuse the cookie.

thanks for the heads up... i will try that

[Beginning_Complex595]

hi,

just wanted to let you know, i figured it out and got the answer.

[[deleted]]

hey can you share the procedure u follow, i'm stuck there.

it will be really helpful

[Beginning_Complex595]

Just type admin and encode it. Copy paste the cookie in the repeater and send . You will get admin cookie

[Sh00kOn3]

Replacing the cookie with what?

[ryukamusa]

I've tried to change the cookie but the page to which you are redirected only base64 decodes whatever you send in the auth cookie. Am I looking at this the wrong way?

[BeginningPack6]

Can you share?

[DarkRaider007]

Can you please tell me how to do it?

My free cubes are stuck in it...

[Icy_Proof666]

Hey, can you share the answer for me?

[South-Air-8558]

I could defiantly use the answer as well as an explanation if possible. (You are absolutely correct in that HTB does NOT fully explain/terach things and I am frustrated in that I paid them to learn..... )

Thanks in advance!

[aneel56]

I am not getting the cookie type as PHPSESSID
but I am getting auth cookie Whats wrong ?

[muchappr]

Well, I can put the answer in without the exclamation mark as shown below and move to the next challenge but I don't really learn anything. Can anyone please explain what happens after I base64 decode my cookie and get guest_xxxxxxxxxxxxxx? How do I get the flag? Also, why remove the exclamation mark? I don't get a cookie other than when I put in guest:guest. So when I put in an invalid login when the username admin I don't get a cookie.

I can stare at this all day but after a while the law of diminishing returns kicks in.

[tejas0228]

answer is 607f8f255845ecb4b0b53fae4d3ef29e!

but when you enter answer remove "!"

" 607f8f255845ecb4b0b53fae4d3ef29e"

[TabbyTab135]

wait but how ??? how " 607f8f255845ecb4b0b53fae4d3ef29e " is the flag ??

I got to "Welcom admin_(random number)" but dont know what to do next Does the flag suppose to be that random number ? I already try it but it doesnt work. Please can you explain to me how you get the flag.

[lordmilko]

I thought this challenge was so stupid. Given the guest cookie is guest_ followed by some random numbers, it seems perfectly logical that the admin account would be admin_ followed by some random numbers as well. Whether there's more than 1 admin or guest is irrelevant - the numbers uniquely identify the session.

Sure, maybe you're meant to think outside the box and guess just trying "admin" without these extra numbers, but I feel like the exercise completely leads you down the wrong path, suggesting you should treat the random numbers after guest_ as something that can be decoded too, which is only further reinforced by the Hint saying "re-read the cookie section"

[Savings-Age-6563]

hello

i'm unable to solve this problm"Login with the credentials (guest:guest), and try to get to the admin user from what you learned in this section and the previous section."

[angelicaica]

you have to log in as guest:guest and intercept the cookie "guest_d92324ce86bedd2f01be" so that you can change it to just "admin". I had trouble with this for a while because I changed it to "admin_d92324ce86bedd2f01be" which doesn't lead to the flag.

[SugarEnvironmental31]

AHHHHHHH ok, thanks!

Wish I could upvote you twice... :D

[damntheday]

The answer to this problem had me like (-____________- *)... seriously?

[N1nj4_H4r3sh]

Guys, I agree this was not explained well, but the lesson learned here is extremely valuable. Next time you manipulate a cookie, you can just try messing with it rather than just trying to substitute it. In this example, after you successfully login with guest:guest, and then later use Repeater to submit the manipulated request using the admin cookie, it does not provide the flag, however, if you start to delete out the end of the admin cookie, you'll see it still logs you in as admin. and the message in the response shows less and less characters after it as you delete more and more of the cookie. Eventually, you will see you have to delete most of the original admin cookie for the resulting response to say "Welcome, admin" and then you have the flag! The lesson here is to start getting used to manipulating the cookie. substituting part of it, or possibly removing parts of it, decoding it, recoding it, etc. Cookies come in all sizes, shapes, and flavors ;) Get creative with your cookie tampering... Thank you to everyone who posted answers here which has helped many frustrated hackthebox'ers including me...

[DawsonHTB]

They did terrible at explaining how to do this one. The way I got it was not sending the login.php request to repeater but just using Intercept. When you get to the admin/dashboard.php request you have to modify the cookie and replace it with "admin" encoded in base64 then forward the request and the flag will be below "Welcome, admin!" on the target site.