FetchTheFlag CTF 2023-Web-UnhackalbeAndy

Unhackable Andy - Easy

Description

^{Author: @HuskyHacks}

Someone might want to let ol’ Andy know the old addage - pride goeth before the fall.

Press the Start button on the top-right to begin this challenge.
Connect with:
http://challenge.ctf.games:31244
Please allow up to 30 seconds for the challenge to become available.

Solution

There is his GitHub in the website, Let’s check it up. In app.py, The website get username and password from env. So we need to find env file. But there isn’t env file in GitHub repository. Look carefully at commits history.

ADMIN_USERNAME=unhackableandy	
ADMIN_PASSWORD=ThisIsASUPERStrongSecuredPasswordAndIAMUNHACKABLEANDYYYYBOIIIII133742069LOLlolLOL	

use this credential to login and then run cat flag.txt in shell box.

Flag: flag{e81b8885d8a5e8d57bbadeb124cc956b}