I Know Mag1k

i ve decrypted the cookie and modified it ,but it doesn t work .(I tried a lot of different settings but still no succes), can someone please tell me what i m doing wrong

Thanks

This was a very interesting challenge. I didn’t know this kind of attack was possible and so easy (with the right tools of course).

Thanks all for the hints that are posted in this topic. Without it I wouldn’t have found out where to start looking. Once you know what the vulnerability is and you know what tool you can use, it becomes relatively straight forward.
I am still interested to see how this attack could be done via BurpSuite. Could someone point me into the right direction?

Got stuck and Don’t know where to start

figured it out

Im still lost, can anyone msg me with some help. I understand that a cookie must be busted and I have some program to do that. I don’t understand how it all works and if there is something I need to do before hand.

Can someone provide a hint, please?

Type your comment> @fl337 said:

Last hint for everyone hehehe

Should I really be using plaintext?? XDD

Also… is the admin user ‘admin’?

hehe good luck all just solved this ■■■■ took me all god daum day stupid oracles…

not sure if this was supposed to help or confused - it was the latter for me :-(.

Managed to crack it, lots of helpful tips in this threat. Thank you all.

PM if need help/guidance.

EDIT: if that helps there is a recipe for “Escape String” in CyberChef :slight_smile:

I had a ton of fun with this one. Some hints:

-BUSTER, you better get some PAD thai for lunch
-Then youll have a SUITE of gaseous emissions out of your mouth; excuse your belches.
-Try hard, and be patient because running the first hint can take awhile.

PM me if you need further help :3

Hi!
I’m stuck at the point where I have to decrypt the cookie.
I use the p*b tool but I can’t hit the syntax.

Heeeeeeeeeeeeelppppp

Hi,
I’m stuck with this… I use p**b****r, i decrypt things but i can encrypt… I add the “plaintext” admin blabla but it’s always encrypt 2 blocks and no 4… Someone can help ?

Hi all, I got the following error: “Database Connection Error: SQLSTATE[HY000] [2002] No such file or directory”. I tried to recreate challenge instance and reconnect but it doesn’t help.

Did someone face with it?

@PackageFrom5ka i have seen this multiple times lately, wrote a note in the discord chat for the support but heard nothing back :slight_smile:

Type your comment> @PackageFrom5ka said:

Hi all, I got the following error: “Database Connection Error: SQLSTATE[HY000] [2002] No such file or directory”. I tried to recreate challenge instance and reconnect but it doesn’t help.

Did someone face with it?

I had the same issue. Worked after I regenerated the connection pack and reconnected.

@YouCanMakeIt I’m stuck on Database Connection Error too, I’ve stopped and restarted the challenge machine, but always got that error and I cannot proceed.

I think there is an issue with the box !
Database Connection Error: SQLSTATE[HY000] [2002] Connection refused
Register/Login are stuck… @rkmylo may know what’s wrong

Hmm, good challenge but it really took a lot of time to convert the plaintext into the ciphertext.

For anybody who’s solving the challenge, I’d say look for some padding attack involving different cookies.

I need some help with this, iam able to see inside the cookie, and i was also able to encrypt it again with my payload (already tried with \ and without \ )
When i change the encrypted cookie in burp or in the web browser nothing happens.
I have already done Grammar, its similar. Dont understand whats happening.

Type your comment> @Nt3c said:

I need some help with this, iam able to see inside the cookie, and i was also able to encrypt it again with my payload (already tried with \ and without \ )
When i change the encrypted cookie in burp or in the web browser nothing happens.
I have already done Grammar, its similar. Dont understand whats happening.

Did you got it? i got stuck there as well. just found my mistake, was missing very minor thing. Let me know, if you still need help?

I’m unable to register a new user… anyone else has the same problem?

root@chromeos:~# curl http://docker.hackthebox.eu:30838/
Database Connection Error: SQLSTATE[HY000] [2002] Permission denied

Can anyone give me any kind of hint?//