PRIMER is a vulnerable VM developed by Arne Rick featured on Vulnhub. It can be found here. If you intend to complete this VM yourself then this write up will spoil it for you. So I say in bold and caps - SPOILERS!
------------------------------------------------------------------------------------------------------
CHAPTER 2: [(α=β)<=>(α<=>β)]
I am progressing through this VM somewhat faster than I originally anticipated, also the chapters are shorter than I imagined, none the less I will continue as intended and post one chapter at a time.
CHAPTER 2: [(α=β)<=>(α<=>β)]
I am progressing through this VM somewhat faster than I originally anticipated, also the chapters are shorter than I imagined, none the less I will continue as intended and post one chapter at a time.
Lets continue.
This chapter, much like the first, features a block of text which continues the vague story littered with small clues.
The most telling of these clues are as follows..
"..needed to penetrate the next circle, blocked of[f] to unauthorized access".
"But she felt a presence of something left behind. Like breadcrums, not intentional, but something forgotten by an incomplete piece of code to handle access".
At this point, my mind first went to cookies... breadcrumbs!
However, more haste, less speed. I first checked the HTML to see if there were any further clues, unfortunately, none to be found there. I then thought to have a quick look at the css and there we have another comment!
This comment confirmed my suspicions. "Clean sessions terminate without leaving things behind..", "Sometimes, an exploit is as simple as changing a simple value in a local file". Yep, definitely cookies!
I then looked at the GET request headers to see what parameters are being passed. There we have it!
"activeSession=false"
I wonder if it is as simple as changing the active session value to true? Is that all the server is checking for an active session? The clues seem to suggest it.. so I fired up a plugin to edit the cookie and gave it a try.
I found the relevant cookie, altered the value from false to true, saved the now manipulated cookie and reloaded the page.
Sure enough! 302 found, redirect! On to Chapter 3..
