Emdee five for life — HTB Writeup

The site serves a random string inside an

and demands its MD5 back before it expires, tied to the same session cookie. Solving it by hand is impossible — the real skill being tested is turning the whole read → hash → resend cycle into one reliable `curl` script.

Challenge overview

Field	Value
Platform	Hack The Box · Challenge
Category	Misc
Difficulty	Very Easy
State	Retired

Attack map

[Web] random string in <h3>
      │
      ▼
[curl -c] read string + cookie
      │
      ▼
[grep+sed] isolate the exact value
      │
      ▼
[md5sum -n] hash without newline
      │
      ▼
[cut -d' '] clean the output
      │
      ▼
[curl -b POST hash] same session
      │
      ▼
[FLAG]

La web sirve un string aleatorio dentro de un

y exige devolver su MD5 antes de que expire, atado a la misma cookie de sesión. Resolverlo a mano es imposible: la habilidad real que se pone a prueba es convertir todo el ciclo leer → calcular hash → reenviar en un único script fiable con `curl`.

Ficha del challenge

Campo	Valor
Plataforma	Hack The Box · Challenge
Categoría	Misc
Dificultad	Very Easy
Estado	Retirado

Mapa del ataque

[Web] string aleatorio en <h3>
      │
      ▼
[curl -c] leer string + cookie
      │
      ▼
[grep+sed] aislar el valor exacto
      │
      ▼
[md5sum -n] hash sin salto de línea
      │
      ▼
[cut -d' '] limpiar la salida
      │
      ▼
[curl -b POST hash] misma sesión
      │
      ▼
[FLAG]

🔒 Free account required

This is USER ACCESS content — free to unlock, no payment. The rest of the write-up (and everything else at this level) opens up once you're signed in.

Create a free account

and demands its MD5 back before it expires, tied to the same session cookie. Solving it by hand is impossible — the real skill being tested is turning the whole read → hash → resend cycle into one reliable curl script.

Challenge overview

Attack map

y exige devolver su MD5 antes de que expire, atado a la misma cookie de sesión. Resolverlo a mano es imposible: la habilidad real que se pone a prueba es convertir todo el ciclo leer → calcular hash → reenviar en un único script fiable con curl.

Ficha del challenge

Mapa del ataque

and demands its MD5 back before it expires, tied to the same session cookie. Solving it by hand is impossible — the real skill being tested is turning the whole read → hash → resend cycle into one reliable `curl` script.

y exige devolver su MD5 antes de que expire, atado a la misma cookie de sesión. Resolverlo a mano es imposible: la habilidad real que se pone a prueba es convertir todo el ciclo leer → calcular hash → reenviar en un único script fiable con `curl`.