Mercure’s Signature Dish Writeup

Story

Hotel Me.Mercure is an online secret food ordering platform. Find a way to order their signature dishes!

Solution

A URL is provided, which leads to a login page. The challenger has to login using username and password, but as we know the password is not given (username is provided).

After logging in, you can find a PDF file, which is also protected by a password. Inside the PDF, the flag is hidden. You have to find out the password to login and also you have to crack the password of the pdf file.

1. Brute force the login page using rockyou.txt file to crack the login page password.

2. After login there will be a PDF file, which is also protected by password.

3. Use “John the Ripper” to crack the password for this file, and the flag will be hidden in the PDF. A simple text hiding method was used to hide the flag.

Written by

Jishnu Vijayan

Security Engineer