Код решения:

import requests
import base64
from tqdm import *


url = "http://mercury.picoctf.net:21553/"
ses = requests.Session()
ses.get(url)
enc_cookie = ses.cookies["auth_name"]
dec_cookie = base64.b64decode(base64.b64decode(enc_cookie))


def main():


        for pos in tqdm(range(0, len(dec_cookie))):
                for bit in range(0,8):

                        bitflip_guess = (
                dec_cookie[0:pos]
                + ((dec_cookie[pos] ^ (1 << bit)).to_bytes(1,"big"))
                + dec_cookie[pos + 1 :]
        )

                        guess = base64.b64encode(base64.b64encode(bitflip_guess)).decode()

                        r = requests.get(url, cookies = {"auth_name": guess})
                        if "picoCTF{" in r.text:
                                print("\033[H\033[J", end="")
                                print(f'\nAdmin bit found in byte {pos} in bit {bit}.')
                                flag = r.text.split("<code>")[1].split("</code>")[0]
                                print(f'\nFlag: {flag}')
                                return
if __name__ == "__main__":

        main()

Видео выполнения:

• Оригинал:
• YouTube