Forrest Gump

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: response_message_as_hint, session_state_machine_exploitation, word_chain_puzzle

Summary

Walkthrough of the CUSTOM Web Forrest Gump. Task: a PHP password form with a Forrest Gump theme — 'do whatever you're told'. Solution: enter the last word from each response message as the next password across three session-preserved steps: 'па

Description

«Форрест Гамп Га-а-амп, что ты должен делать в армии?»

(Forrest Gump, what should you do in the army?)

The challenge references the famous Forrest Gump movie scene where the drill sergeant asks Gump what he should do, and Gump answers: "To do whatever you tell me, drill sergeant!" The key concept is literal obedience — do exactly what the page tells you.

Target: http://62.173.140.174:10490/

Analysis

The target is a PHP web page with a simple password form displaying the text "Введите пароль" (Enter password). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Initial observations:

• Apache + PHP server
• The form accepts a password input
• Most inputs produce no visible error — the page just redisplays "Введите пароль"
• The challenge title references Forrest Gump's army scene about doing whatever you're told

The critical insight comes from the Forrest Gump theme: the page is literally telling you what to type. Each response message contains the next password as its last word. The server uses PHP sessions to track progress through a three-state machine. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

State Machine

Each response message appears to be a normal error/prompt, but the last word of each message is actually the password for the next step. This is deceptive because:

• "Введите пароль" looks like a standard prompt
• "Пароль неправильный" looks like a rejection message
• "Попробуйте позже" looks like a rate-limit message ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

The solution requires sending three POST requests in sequence within the same PHP session (cookies must be preserved). Each password is the last word from the previous response, in lowercase Russian.

Manual approach with curl

 bash read-only • copy allowed Copy
# Step 1: Enter "пароль" (password) — the page says "Введите пароль"
curl -c cookies.txt -b cookies.txt -X POST \
  http://62.173.140.174:10490/ \
  -d 'password=пароль'

# Step 2: Enter "неправильный" (incorrect) — the page says "Пароль неправильный"
curl -c cookies.txt -b cookies.txt -X POST \
  http://62.173.140.174:10490/ \
  -d 'password=неправильный'
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Step 3: Enter "позже" (later) — the page says "Попробуйте позже"
curl -c cookies.txt -b cookies.txt -X POST \
  http://62.173.140.174:10490/ \
  -d 'password=позже'
# → Flag is displayed

Python solve script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Forrest Gump word chain solver — Hackerlab CTF
Theme: "Do whatever you're told" — enter the last word from each response.
"""
import requests

URL = "http://62.173.140.174:10490/"

session = requests.Session()

# The chain of passwords: last word from each response message
passwords = ["пароль", "неправильный", "позже"]
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

for i, pwd in enumerate(passwords, 1):
    resp = session.post(URL, data={"password": pwd})
    print(f"Step {i}: entered '{pwd}' → {resp.text[:200]}")

# The final response should contain the flag
print(f"\nFinal response:\n{resp.text}")

Execution

Step 1: entered 'пароль' → Пароль неправильный
Step 2: entered 'неправильный' → Попробуйте позже
Step 3: entered 'позже' → CODEBY{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering response_message_as_hint, session_state_machine_exploitation, word_chain_puzzle was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-05 • CUSTOM • Forrest Gump • Difficulty: Easy