Skip to content

Instantly share code, notes, and snippets.

@rverton

rverton/admin_console.php

Created April 9, 2017 13:12
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rverton/248a03afb0f7f5451fa253feb8a3b440 to your computer and use it in GitHub Desktop.
Save rverton/248a03afb0f7f5451fa253feb8a3b440 to your computer and use it in GitHub Desktop.
Download ZIP
ASIS CTF 2017, Tar Bomb Challenge
Raw
admin_console.php
<?php
session_start();
if ($_COOKIE['tar'] !== 'super-secret-cookie-you-never-know') {
echo "Try better cookie, bro!";
die();
}
if (isset($_POST['url']) && isset($_POST['challenge'])) {
$url = $_POST['url'];
$challenge = substr(md5($_POST['challenge']), 0, 6);
$expected = $_SESSION['challenge'];
$_SESSION['challenge'] = substr(md5(random_bytes(16)), 0, 6);
if ($challenge !== $expected) {
echo "Prove your work first.";
die();
}
$match = preg_match('/https?:\/\/[a-zA-Z0-9_\-.\/@%:]/', $url);
if ($match) {
$cmd = "phantomjs /worker.js '$url'";
exec($cmd, $output);
error_log($cmd);
error_log(implode("\n", $output));
echo 'Submitted!';
} else {
echo 'Stop hacking, bro!';
}
} else {
$_SESSION['challenge'] = substr(md5(random_bytes(16)), 0, 6);
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Admin Console</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
<style>
.center {
margin-left: auto;
margin-right: auto;
display: block;
}
body {
margin-top: 2em;
}
form {
margin-top: 2em;
}
</style>
</head>
<body>
<div class="container">
<h2>Admin Console</h2>
<div class="row">
<form action="" method="POST">
<div class="form-group">
<label>Find a string `str` such that substr(md5(str), 0, 6) === '<?php echo $_SESSION['challenge']; ?>':</label>
<input type="text" class="form-control" name="challenge" placeholder="Your answer" />
</div>
<div class="form-group">
<label>Now give me a url to take a look.</label>
<input type="text" class="form-control" name="url" placeholder="Url" />
</div>
<button type="submit" class="btn btn-default center">Submit</button>
</form>
</div>
</div>
</body>
</html>
<?php
}
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment