Natas Wargame Level20 Writeup（会话状态注入/篡改）

  1 <?
  2 
  3 function debug($msg) { 
  4     if(array_key_exists("debug", $_GET)) {
  5         print "DEBUG: $msg<br>";
  6     }
  7 }
  8 
  9 function print_credentials() { 
 10     if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
 11     print "You are an admin. The credentials for the next level are:<br>";
 12     print "<pre>Username: natas21\n";
 13     print "Password: <censored></pre>";
 14     } else {
 15     print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas21.";
 16     }
 17 }
 18 
 19 
 20 /* we don‘t need this */
 21 function myopen($path, $name) { 
 22     //debug("MYOPEN $path $name"); 
 23     return true; 
 24 }
 25 
 26 /* we don‘t need this */
 27 function myclose() { 
 28     //debug("MYCLOSE"); 
 29     return true; 
 30 }
 31 
 32 function myread($sid) { 
 33     debug("MYREAD $sid"); 
 34     if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) {
 35     debug("Invalid SID");
 36         return "";
 37     }
 38     $filename = session_save_path() . "/" . "mysess_" . $sid;
 39     if(!file_exists($filename)) {
 40         debug("Session file doesn‘t exist");
 41         return "";
 42     }
 43     debug("Reading from ". $filename);
 44     $data = file_get_contents($filename);
 45     $_SESSION = array();
 46     foreach(explode("\n", $data) as $line) {
 47         debug("Read [$line]");
 48     $parts = explode(" ", $line, 2);
 49     if($parts[0] != "") $_SESSION[$parts[0]] = $parts[1];
 50     }
 51     return session_encode();
 52 }
 53 
 54 function mywrite($sid, $data) { 
 55     // $data contains the serialized version of $_SESSION
 56     // but our encoding is better
 57     debug("MYWRITE $sid $data"); 
 58     // make sure the sid is alnum only!!
 59     if(strspn($sid, "1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM-") != strlen($sid)) {
 60     debug("Invalid SID"); 
 61         return;
 62     }
 63     $filename = session_save_path() . "/" . "mysess_" . $sid;
 64     $data = "";
 65     debug("Saving in ". $filename);
 66     ksort($_SESSION);
 67     foreach($_SESSION as $key => $value) {
 68         debug("$key => $value");
 69         $data .= "$key $value\n";
 70     }
 71     file_put_contents($filename, $data);
 72     chmod($filename, 0600);
 73 }
 74 
 75 /* we don‘t need this */
 76 function mydestroy($sid) {
 77     //debug("MYDESTROY $sid"); 
 78     return true; 
 79 }
 80 /* we don‘t need this */
 81 function mygarbage($t) { 
 82     //debug("MYGARBAGE $t"); 
 83     return true; 
 84 }
 85 
 86 session_set_save_handler(
 87     "myopen", 
 88     "myclose", 
 89     "myread", 
 90     "mywrite", 
 91     "mydestroy", 
 92     "mygarbage");
 93 session_start();
 94 
 95 if(array_key_exists("name", $_REQUEST)) {
 96     $_SESSION["name"] = $_REQUEST["name"];
 97     debug("Name set to " . $_REQUEST["name"]);
 98 }
 99 
100 print_credentials();
101 
102 $name = "";
103 if(array_key_exists("name", $_SESSION)) {
104     $name = $_SESSION["name"];
105 }
106 
107 ?>
108 
109 <form action="index.php" method="POST">
110 Your name: <input name="name" value="<?=$name?>"><br>
111 <input type="submit" value="Change name" />
112 </form>