Emdee five for life

Platform: HackTheBox | Category: Misc | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Can you encrypt fast enough?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. What comes to my mind is we can use intruder in burpsuite to bruteforce the hash or we can use python script.

3. For this solution i tried to use python script.

THE SCRIPT

 py read-only • copy allowed Copy
from pwn import *
import requests
import os
from bs4 import BeautifulSoup

os.system('clear')

context.log_level = 'debug'
url = 'http://142.93.37.215:30301/'
cookies = {'PHPSESSID': '9eddrh0aufnmjqpg8cpht98pb1'} # get the cookie value using burpsuite

response = requests.get(url, cookies=cookies)  # Initial request

### Loop until we see the HTB string

while 'HTB' not in response.text:
    # Since the hash is inside the <h3> tag, then we need to extract it using h3.contents
    # Then add [0], because we want just the value not all the <h3> tag
    extractString = BeautifulSoup(response.text, features="lxml").h3.contents[0]
    debug('extracted: %s', extractString)

    # MD5 the extracted string
    hashedString = md5sumhex(extractString.encode())
    debug('hash: %s', hashedString)

    # Submit the hash
    response = requests.post(url, data={'hash': hashedString}, cookies=cookies)

### Print the response if we got the HTB string

extracted = BeautifulSoup(response.text, features="lxml").p.contents[0]
warn(extracted)

OUTPUT

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.