bugku-web-CBC

2021-08-11

按流程：随便输——>提示admin——>输admin——>发现不行

扫目录，发现swp备份文件
用linux打开（vim -r .index.php.swp）

<?php
define("SECRET_KEY", file_get_contents('/root/key'));
define("METHOD", "aes-128-cbc");
session_start();

function get_random_iv(){	//随机生成16位初始化向量
    $random_iv='';
    for($i=0;$i<16;$i++){
        $random_iv.=chr(rand(1,255));
    }
    return $random_iv;
}

#第一个执行的方法
function login($info){
    $iv = get_random_iv();
    $plain = serialize($info);	//明文序列化
    $cipher = openssl_encrypt($plain, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $iv);	//加密
	//options：以下标记的按位或： OPENSSL_RAW_DATA 原生数据，对应数字1，不进行 base64 编码。OPENSSL_ZERO_PADDING 数据进行 base64 编码再返回，对应数字0。 
    $_SESSION['username'] = $info['username'];	//注册SESSION全局变量
	//以下两行设置cookie
    setcookie("iv", base64_encode($iv));
    setcookie("cipher", base64_encode($cipher));
}

function check_login(){
    if(isset($_COOKIE['cipher']) && isset($_COOKIE['iv'])){
        $cipher = base64_decode($_COOKIE['cipher']);
        $iv = base64_decode($_COOKIE["iv"]);
        if($plain = openssl_decrypt($cipher, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $iv)){
            $info = unserialize($plain) or die("<p>base64_decode('".base64_encode($plain)."') can't unserialize</p>");
            $_SESSION['username'] = $info['username'];
        }else{
            die("ERROR!");
        }
    }
}

#第二个执行，检测用户名为admin时，打印flag
function show_homepage(){
    if ($_SESSION["username"]==='admin'){
        echo '<p>Hello admin</p>';
        echo '<p>Flag is $flag</p>';
    }else{
        echo '<p>hello '.$_SESSION['username'].'</p>';
        echo '<p>Only admin can see flag</p>';
    }
    echo '<p><a href="loginout.php">Log out</a></p>';
}

if(isset($_POST['username']) && isset($_POST['password'])){
    $username = (string)$_POST['username'];
    $password = (string)$_POST['password'];
    if($username === 'admin'){
        exit('<p>admin are not allowed to login</p>');
    }else{
        $info = array('username'=>$username,'password'=>$password);
        login($info);
        show_homepage();
    }
}else{
    if(isset($_SESSION["username"])){
        check_login();
        show_homepage();
    }else{
        echo '<body class="login-body">
                <div id="wrapper">
                    <div class="user-icon"></div>
                    <div class="pass-icon"></div>
                    <form name="login-form" class="login-form" action="" method="post">
                        <div class="header">
                        <h1>Login Form</h1>
                        <span>Fill out the form below to login to my super awesome imaginary control panel.</span>
                        </div>
                        <div class="content">
                        <input name="username" type="text" class="input username" value="Username" onfocus="this.value=\'\'" />
                        <input name="password" type="password" class="input password" value="Password" onfocus="this.value=\'\'" />
                        </div>

然后代码审计：
真做不出来，主要参考的这篇文章https://blog.csdn.net/u013577244/article/details/86310881

解题：

<?php
header("Content-Type: text/html;charset=utf-8");
	#计算cipher
	/*
	明文1：a:2:{s:8:"userna		//r
	明文2：me";s:5:"admil";		//l字母在第14个字节
	明文3：s:8:"password";s
	明文4：:3:"123";}
	*/
	$cipher = base64_decode(urldecode('f0csYAAWDy%2FGlSsvWLr6NlCBad4p2U%2BXm2Rr2X07iytKd4r8V5tbO7%2FcxIib96eRDGUOMQclQgvxw2SZXOobWQ%3D%3D'));
	$temp = $cipher;
	/*
	设密文1[13]=A,	解密(密文2)[13]=B,	明文2[13]=C,	
	将A修改为A ^ C,则:
	A ^ B = A ^ C ^ B = B ^ B = 0 = C
	*/
	//						A				  C			 X
	$cipher[13] = chr(ord($cipher[13]) ^ ord('l') ^ ord('n'));
	echo urlencode(base64_encode($cipher));
	?>

<?php
	#计算iv
	$res = base64_decode('yeiydaYLG5RNzOPWaQgOkG1lIjtzOjU6ImFkbWluIjtzOjg6InBhc3N3b3JkIjtzOjM6IjEyMyI7fQ==');	//这里放burp放回的base64数据
	$iv = base64_decode(urldecode('TD9FI%2FvbrZn%2FSjbSD9bfSQ%3D%3D')); //这里放cookie中的iv
	$plaintext = 'a:2:{s:8:"userna';
	$new_iv = '';
	for ($i = 0; $i < 16; $i ++){
		$new_iv = $new_iv . chr(ord($iv[$i]) ^ ord($res[$i]) ^ ord($plaintext[$i]));
	}
	echo urlencode(base64_encode($new_iv));
?>

得到flag