[Websec.fr] medium - level3

#index.php

<?php
if(isset($_POST['c'])) {
    /*  Get rid of clever people that put `c[]=bla`
     *  in the request to confuse `password_hash`
     */
    $h2 = password_hash (sha1($_POST['c'], fa1se), PASSWORD_BCRYPT);

    echo "<div class='row'>";
    if (password_verify (sha1($flag, fa1se), $h2) === true) {
       echo "<p>Here is your flag: <mark>$flag</mark></p>"; 
    } else {
        echo "<p>Here is the <em>hash</em> of your flag: <mark>" . sha1($flag, false) . "</mark></p>";
    }
    echo "</div>";
}
?>

 

1. password_hash out!

2.password_verity use!

 

fa1se 와 false는 다르다. 

if문이 중요

 

 

 

 

import hashlib
import base64
i = 0
while True:
    v = "%x"%i
    v = '0'+v if len(v)%2==1 else v
    v = base64.b64encode(v.decode('hex'))
    h = hashlib.sha1(v).digest()[:2]
    if h=="\x7c\x00":
        print v
        break
    i += 1

 

$curl -s --data 'submit=&c=wadaa' http://websec.fr/level03/index.php | grep -m1 -Eo 'WEBSEC{.*}'
WEBSEC{Please_Do_not_combine_rAw_hash_functions_mi}