Writeup: Hash Browns

In our first OSUSEC challenge of 2021, we were given the instructions to “open the linked website in your browser. Good luck!”

Opening the link in Firefox, we reach this site prompting for a password.

My spidey-senses tingling, I opened inspect element. This revealed some javascript that activated when the submit button was pressed:

function check_password() {
  let password = document.getElementById("password").value;
  let hash = get_sha256(password);
  if (hash == "b0fef621727ff82a7d334d9f1f047dc662ed0e27e05aa8fd1aefd19b0fff312c") {
    document.getElementById("login").submit();
  }
}  

We see that there is a sha256 hash in the script. Using Hash Toolkit on the hash reveals that the password is “pineapple.” Hit submit, and getting the flag should be trivial from here!

Looks like we’re in for a bit more! We’ve got to click the link, which is twisting and turning all about the webpage. We can either click it (the fun way) or pretend to click it (the 1337 way).

Looks like it calls a function called print_flag(), which can be entered using the web console. After this function is called, the text “Get the flag!” is replaced with the flag. Hitting Ctrl-A selects the text, which can then be copied and submitted!

This was a fun, goofy introduction to OSUSEC, and I enjoyed my first-ever CTF challenge 🙂