Mercure’s Signature Dish Writeup

Story

Hotel Me.Mercure is an online secret food ordering platform. Find a way to order their signature dishes!

Solution

A URL is provided, which leads to a login page. The challenger has to login using username and password, but as we know the password is not given (username is provided).

After logging in, you can find a PDF file, which is also protected by a password. Inside the PDF, the flag is hidden. You have to find out the password to login and also you have to crack the password of the pdf file.

1. Brute force the login page using rockyou.txt file to crack the login page password.

2. After login there will be a PDF file, which is also protected by password.

3. Use “John the Ripper” to crack the password for this file, and the flag will be hidden in the PDF. A simple text hiding method was used to hide the flag.

Written by

Jishnu Vijayan

Security Engineer

As a dedicated Security Engineer, Jishnu brings a wealth of expertise and a vigilant approach to protecting digital environments from relentless cyber threats. With a keen analytical mind and a strong background in cybersecurity, he serves as a vigilant guardian of data and systems. Jishnu's commitment to staying ahead of the ever-evolving threat landscape and his expertise in securing digital assets make him an essential asset in the ongoing battle against cybercrime.