Plit00's Story

[Wargame.kr]-md5 password write-up 본문

Wargame/Wargame.kr

[Wargame.kr]-md5 password write-up

plit00 2018. 2. 28. 19:00


value , true


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
<?php
 if (isset($_GET['view-source'])) {
  show_source(__FILE__);
  exit();
 }
 
 if(isset($_POST['ps'])){
  sleep(1);
  mysql_connect("localhost","md5_password","md5_password_pz");
  mysql_select_db("md5_password");
  mysql_query("set names utf8");
  /*
  
  create table admin_password(
   password char(64) unique
  );
  
  */
 
  include "../lib.php"// include for auth_code function.
  $key=auth_code("md5 password");
  $ps = mysql_real_escape_string($_POST['ps']);
  $row=@mysql_fetch_array(mysql_query("select * from admin_password where password='".md5($ps,true)."'"));
  if(isset($row[0])){
   echo "hello admin!"."<br />";
   echo "Password : ".$key;
  }else{
   echo "wrong..";
  }
 }
?>
 
<style>
 input[type=text] {width:200px;}
</style>
<br />
<br />
<form method="post" action="./index.php">
password : <input type="text" name="ps" /><input type="submit" value="login" />
</form>
<div><a href='?view-source'>get source</a></div>
cs


사실 이문제는 풀이가 없어도 될만한 문제긴하지만,
문제로 돌아가면,

바이너리에 해쉬값을 받겠다는 말인데, 여기서 hash를 받게 되면 quote가 나오게 된다!


a=0 > true




'Wargame > Wargame.kr' 카테고리의 다른 글

[Wargame.kr]-md5_compare write-up  (0) 2018.03.03
[Wargame.kr]-DB is really good write-up  (0) 2018.02.28
[Wargame.kr]- login filtering write-up  (0) 2018.02.28
Comments