Challenge: Easyauth ----------------------------------------Category: Web ----------------------------------------30 points ----------------------------------------
```Description:
Can you gain admin access to this site?http://easyauth-afee0e67.ctf.bsidessf.net
file: easyauth.php
```
``` php
Login successful!</h1>\n";      print "Setting cookie: <tt>auth=$cookie</tt>\n";    } else {      print "<h1>Username or password was incorrect!</h1>\n";    }    print "Click here to continue!\n";    exit(0);  }
Setting cookie: <tt>auth=$cookie</tt>
Click here to continue!
  if(!isset($_COOKIE['auth'])) {    require_once('./login_form.php');    exit(0);  }  $cookie = $_COOKIE['auth'];
  $pairs = explode('&', $cookie);  $args = array();  foreach($pairs as $pair) {    if(!strpos($pair, '='))      continue;
    list($name, $value) = explode('=', $pair, 2);    $args[$name] = $value;  }  $username = $args['username'];
  print "<h1>Welcome back, $username!</h1>\n";  if($username == 'administrator') {    print "Congratulations, you're the administrator! Here's your reward:\n";    print "" . FLAG . "\n";  } else {    print "It's cool that you logged in, but unfortunately we can only give the flag to 'administrator'. :(\n";  }  print "Log out\n";?>```We know now that we need to log in as administrator !!!Connect to site.
Congratulations, you're the administrator! Here's your reward:
" . FLAG . "
It's cool that you logged in, but unfortunately we can only give the flag to 'administrator'. :(
Log out

```Hint: Try guest/guestWe connect to site with credentials guest:guest
```

We see the cookie appear.I modify it with the plugin Cookie+ Manager de Firefox. Knowing that we have to be logged into administrator.
```Host:                 easyauth-afee0e67.ctf.bsidessf.netName:                 authPath:                 /Content:              username%3Dadministrator%26date%3D2017-02-13T08%3A35%3A43%2B0000%26Content raw:          username%3Dadministrator%26date%3D2017-02-13T08%3A35%3A43%2B0000%26Expires:              À la fin de la sessionExpires raw:          0Send for:             Tout type de connexionSend for raw:         falseCreated:              Monday, February 13, 2017 9:34:50 AMCreated raw:          1486974889695000Last accessed:        Monday, February 13, 2017 9:35:29 AMLast accessed raw:    1486974929269000HTTP only:            NoHTTP only raw:        falseThis domain only:     NoThis domain only raw: falsePolicy:               no information availablePolicy raw:           0Status:               no information availableStatus raw:           0---```
Then reload the page by logging in as administrator.

```FLAG:0076ecde2daae415d7e5ccc7db909e7e```
