# old-tickets

| Info       | Details              |
| ---------- | -------------------- |
| Category   | **Web Exploitation** |
| Difficulty | **Medium**           |

## Challenge Overview

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F4BDTzjKCJs2NO2ct6QUg%2Foverview.png?alt=media&#x26;token=0b948b12-2722-4177-ac35-d2a600ae2b14" alt=""><figcaption></figcaption></figure>

We've got to deal with a **web challenge** that's about some **misconfigured ticket system**.

Firstly, analyzing **page source (CTRL + U)** we see this suspicious line:

> Our first bug was: d63af914bd1b6210c358e145d61a8abc. Please fix now!

We'll come later to this line

Also,\
`<form class="form-inline" action="/" method="PUT">`

this line is weird because **html can only accept POST and GET methods**. So that means when a **name or message** it's written in the form, the request is automatically set to **GET Method**, that's why we don't get anything when we press **'Submit ticket'**

Let's change this with **Burp Suite** and add **POST** instead of **GET**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FazplBoJnc9MckjUTjZOJ%2Fburp%201.png?alt=media&#x26;token=7dc98ea1-f7af-451e-aeb7-7adce714b66e" alt=""><figcaption><p>KeyError: 'code'</p></figcaption></figure>

> **Note:** You can use **BurpSuite Render mode** on **Repeater** to see the interface of the website, instead of **'pretty'** option which shows you the page source. That helped me to see the errors better.

We see that error, **KeyError: 'code'**.\
This is a clear hint that the server waits for a **code**, and we can either sent it with **curl** or **burp**. My go-to here is **BurpSuite** and it will always be.

So, we come back to the begging. **d63af914bd1b6210c358e145d61a8abc** is a **MD5 hash** that is already cracked on [**hashes.com**](https://hashes.com) -> **1628168161**.\
**1628168161** it's a **timestamp (Thu 5 August 2021 12:56:01 UTC)**.

The logic now is obvious, we can analyze tickets and hope we get a **flag**, by sending the timestamp to the server in a **md5 hash format**. Let's try with the one they gave to us.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fbx5y5eDT7YKRXNK46tHf%2Fburp2.png?alt=media&#x26;token=7c01c219-c3b4-4c8e-aa0f-8ada128e92e1" alt=""><figcaption><p>POST, Content-Type and code</p></figcaption></figure>

**Note:** It's crucial not to forget to add **Content-Type: application/x-www-form-urlencoded**, so we can send that code. It's not here by-default because the default method that **html** use is **GET**, which doesn t include **Content-Type header**.

> **Name:** Nice one\
> **Message:** Try harder!

Let's make a script to **bruteforce timestamp values**.

## Bruteforce Python Script

```python
import hashlib
import requests

base = 1628168161
url = "http://34.159.240.221:31225/"

def check_code(base_value):
    hashed = hashlib.md5(str(base_value).encode()).hexdigest()
    response = requests.post(url, data={"code": hashed})

    if "ctf{" in response.text:
        print(f"[+] Found something at base {base_value}!")
        print(response.text)
        print("-" * 50)


for i in range(0, 1000):
    check_code(base + i)
```

We receive the **flag** and the **correct code** from the **script**: 1628168340.

*made by k0d*
