首先打开题目环境
看了一下没什么,扫一下目录
扫到了www.zip,下载解压,解压出了一个index.php
<?php
header('Content-type:text/html; charset=utf-8');
error_reporting(0);
if(isset($_POST['login'])){
$username = $_POST['username'];
$password = $_POST['password'];
$Private_key = $_POST['Private_key'];
if (($username == '') || ($password == '') ||($Private_key == '')) {
// 若为空,视为未填写,提示错误,并3秒后返回登录界面
header('refresh:2; url=login.html');
echo "用户名、密码、密钥不能为空啦,crispr会让你在2秒后跳转到登录界面的!";
exit;
}
else if($Private_key != '*************' )
{
header('refresh:2; url=login.html');
echo "假密钥,咋会让你登录?crispr会让你在2秒后跳转到登录界面的!";
exit;
}
else{
if($Private_key === '************'){
$getuser = "SELECT flag FROM user WHERE username= 'crispr' AND password = '$password'".';';
$link=mysql_connect("localhost","root","root");
mysql_select_db("test",$link);
$result = mysql_query($getuser);
while($row=mysql_fetch_assoc($result)){
echo "<tr><td>".$row["username"]."</td><td>".$row["flag"]."</td><td>";
}
}
}
}
// genarate public_key
function public_key($length = 16) {
$strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$public_key = '';
for ( $i = 0; $i < $length; $i++ )
$public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);
return $public_key;
}
//genarate private_key
function private_key($length = 12) {
$strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$private_key = '';
for ( $i = 0; $i < $length; $i++ )
$private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);
return $private_key;
}
$Public_key = public_key();
//$Public_key = KVQP0LdJKRaV3n9D how to get crispr's private_key???
可以看到有一个login.html,想要获取flag,那就要填对密码和密钥
密码可以用万能密码来绕过
看到mt_rand(),php伪随机数,伪随机数的话我们就可以得到它的种子,在代码的末尾给出了一段公钥,那么我们就可以根据这个公钥推算出种子,然后把私钥整出来。
先要把公钥转换成php_mt_seed可识别的参数
脚本
str1 ='KVQP0LdJKRaV3n9D'
str2 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
res =''
length = str(len(str2)-1)
for i in range(len(str1)):
for j in range(len(str2)):
if str1[i] == str2[j]:
res += str(j) + ' ' +str(j) + ' ' + '0' + ' ' + length + ' '
break
print(res)
然后用php_mt_seed爆出种子
成功爆出种子为1775196155,要注意这里告诉我php的版本PHP 5.2.1 to 7.0.x
现在就可以来搞私钥啦,修改一下源码
<?php
mt_srand(1775196155);
$strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$public_key = '';
for ( $i = 0; $i < 16; $i++ )
$public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);
echo $public_key. "<br>";
$strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
$private_key = '';
for ( $i = 0; $i < 12; $i++ )
$private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);
echo $private_key;
得到了私钥为XuNhoueCDCGc
进到login.html
填入密码和秘钥
获得flag
flag{9c3187f1-3b7d-43c6-a527-0af23a6babf3}