PicoCTF[Write-up] — No FA

I. Thong tin ve thu thach:

CTF name: PicoCTF — medium

Challange name: No Fa

Description:

Seems like some data has been leaked! Can you get the flag.

II. Giai quyet thu thach:

• Khi chay thu thach chung ta duoc cung cap 2 file.

FIle “users.db” chua thong tin ve tai khoan va mat khau da bi hash cua nguoi dung.

• File con lai la app.py chua ma nguon trang web.
• Nhin vao doan code duoi day ta thay rang, muc tieu dau tien cua ta la dang nhap voi username la “admin”. Sau khi dang nhap thanh cong, se co mot ma otp duoc tao ra va gan vao session.

Su dung cong cu nay de cracking mat khau da bi hash cua tai khoan admin ta thu duoc password “apple@123”. Sau do dang nhap.

• Sau khi dang nhap thanh cong, ta duoc chuyen huong den trang /two_fa, kem theo mot session da duoc khoi tao bang flask.

• Toi tim hieu va biet duoc rang Flask tao ra session bang cach ma hoa base64 json. Chung ta co the decode no thong qua cong cu nay.

• Nhap ma OTP va tim duoc flag thanh cong.