Created
April 9, 2017 13:12
-
-
Save rverton/248a03afb0f7f5451fa253feb8a3b440 to your computer and use it in GitHub Desktop.
ASIS CTF 2017, Tar Bomb Challenge
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| session_start(); | |
| if ($_COOKIE['tar'] !== 'super-secret-cookie-you-never-know') { | |
| echo "Try better cookie, bro!"; | |
| die(); | |
| } | |
| if (isset($_POST['url']) && isset($_POST['challenge'])) { | |
| $url = $_POST['url']; | |
| $challenge = substr(md5($_POST['challenge']), 0, 6); | |
| $expected = $_SESSION['challenge']; | |
| $_SESSION['challenge'] = substr(md5(random_bytes(16)), 0, 6); | |
| if ($challenge !== $expected) { | |
| echo "Prove your work first."; | |
| die(); | |
| } | |
| $match = preg_match('/https?:\/\/[a-zA-Z0-9_\-.\/@%:]/', $url); | |
| if ($match) { | |
| $cmd = "phantomjs /worker.js '$url'"; | |
| exec($cmd, $output); | |
| error_log($cmd); | |
| error_log(implode("\n", $output)); | |
| echo 'Submitted!'; | |
| } else { | |
| echo 'Stop hacking, bro!'; | |
| } | |
| } else { | |
| $_SESSION['challenge'] = substr(md5(random_bytes(16)), 0, 6); | |
| ?> | |
| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <meta name="viewport" content="width=device-width, initial-scale=1"> | |
| <title>Admin Console</title> | |
| <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous"> | |
| <style> | |
| .center { | |
| margin-left: auto; | |
| margin-right: auto; | |
| display: block; | |
| } | |
| body { | |
| margin-top: 2em; | |
| } | |
| form { | |
| margin-top: 2em; | |
| } | |
| </style> | |
| </head> | |
| <body> | |
| <div class="container"> | |
| <h2>Admin Console</h2> | |
| <div class="row"> | |
| <form action="" method="POST"> | |
| <div class="form-group"> | |
| <label>Find a string `str` such that substr(md5(str), 0, 6) === '<?php echo $_SESSION['challenge']; ?>':</label> | |
| <input type="text" class="form-control" name="challenge" placeholder="Your answer" /> | |
| </div> | |
| <div class="form-group"> | |
| <label>Now give me a url to take a look.</label> | |
| <input type="text" class="form-control" name="url" placeholder="Url" /> | |
| </div> | |
| <button type="submit" class="btn btn-default center">Submit</button> | |
| </form> | |
| </div> | |
| </div> | |
| </body> | |
| </html> | |
| <?php | |
| } | |
| ?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment