Possible unintended solution
1. Only single byte flipped to login as admin with group=root
2. Exploiting split() function in auth

Original writeup (https://masterpessimistaa.wordpress.com/2018/07/23/exploiting-cookie-auth-mechanism-ctfzone-ussh-3-0-write-up/).