PHP绕过MD5比较的各种姿势

1.用==进行弱类型比较时， 可以通过两个0e开头后面纯数字的md5绕过

php在进行弱类型比较时，如果为字符串为纯数字，包括浮点数、科学计数法、十六进制数等，都会转化为数字类型再进行比较，利用这点，0e开头的科学计数法大小均为0，所有均相等，即可绕过

以下实例的md5均满足0e开头纯数字

byGcY

sonZ7y

240610708

s878926199a

s155964671a

s214587387a

s214587387a

s878926199a

QNKCDZO

aabg7XSs

aabC9RqS

 

2.碰撞出md5值相同的字符串

实例：

$s1 = "%af%13%76%70%82%a0%a6%58%cb%3e%23%38%c4%c6%db%8b%60%2c%bb%90%68%a0%2d%e9%47%aa%78%49%6e%0a%c0%c0%31%d3%fb%cb%82%25%92%0d%cf%61%67%64%e8%cd%7d%47%ba%0e%5d%1b%9c%1c%5c%cd%07%2d%f7%a8%2d%1d%bc%5e%2c%06%46%3a%0f%2d%4b%e9%20%1d%29%66%a4%e1%8b%7d%0c%f5%ef%97%b6%ee%48%dd%0e%09%aa%e5%4d%6a%5d%6d%75%77%72%cf%47%16%a2%06%72%71%c9%a1%8f%00%f6%9d%ee%54%27%71%be%c8%c3%8f%93%e3%52%73%73%53%a0%5f%69%ef%c3%3b%ea%ee%70%71%ae%2a%21%c8%44%d7%22%87%9f%be%79%6d%c4%61%a4%08%57%02%82%2a%ef%36%95%da%ee%13%bc%fb%7e%a3%59%45%ef%25%67%3c%e0%27%69%2b%95%77%b8%cd%dc%4f%de%73%24%e8%ab%66%74%d2%8c%68%06%80%0c%dd%74%ae%31%05%d1%15%7d%c4%5e%bc%0b%0f%21%23%a4%96%7c%17%12%d1%2b%b3%10%b7%37%60%68%d7%cb%35%5a%54%97%08%0d%54%78%49%d0%93%c3%b3%fd%1f%0b%35%11%9d%96%1d%ba%64%e0%86%ad%ef%52%98%2d%84%12%77%bb%ab%e8%64%da%a3%65%55%5d%d5%76%55%57%46%6c%89%c9%df%b2%3c%85%97%1e%f6%38%66%c9%17%22%e7%ea%c9%f5%d2%e0%14%d8%35%4f%0a%5c%34%d3%73%a5%98%f7%66%72%aa%43%e3%bd%a2%cd%62%fd%69%1d%34%30%57%52%ab%41%b1%91%65%f2%30%7f%cf%c6%a1%8c%fb%dc%c4%8f%61%a5%93%40%1a%13%d1%09%c5%e0%f7%87%5f%48%e7%d7%b3%62%04%a7%c4%cb%fd%f4%ff%cf%3b%74%28%1c%96%8e%09%73%3a%9b%a6%2f%ed%b7%99%d5%b9%05%39%95%ab";
$s2 = "%af%13%76%70%82%a0%a6%58%cb%3e%23%38%c4%c6%db%8b%60%2c%bb%90%68%a0%2d%e9%47%aa%78%49%6e%0a%c0%c0%31%d3%fb%cb%82%25%92%0d%cf%61%67%64%e8%cd%7d%47%ba%0e%5d%1b%9c%1c%5c%cd%07%2d%f7%a8%2d%1d%bc%5e%2c%06%46%3a%0f%2d%4b%e9%20%1d%29%66%a4%e1%8b%7d%0c%f5%ef%97%b6%ee%48%dd%0e%09%aa%e5%4d%6a%5d%6d%75%77%72%cf%47%16%a2%06%72%71%c9%a1%8f%00%f6%9d%ee%54%27%71%be%c8%c3%8f%93%e3%52%73%73%53%a0%5f%69%ef%c3%3b%ea%ee%70%71%ae%2a%21%c8%44%d7%22%87%9f%be%79%6d%c4%61%a4%08%57%02%82%2a%ef%36%95%da%ee%13%bc%fb%7e%a3%59%45%ef%25%67%3c%e0%27%69%2b%95%77%b8%cd%dc%4f%de%73%24%e8%ab%66%74%d2%8c%68%06%80%0c%dd%74%ae%31%05%d1%15%7d%c4%5e%bc%0b%0f%21%23%a4%96%7c%17%12%d1%2b%b3%10%b7%37%60%68%d7%cb%35%5a%54%97%08%0d%54%78%49%d0%93%c3%b3%fd%1f%0b%35%11%9d%96%1d%ba%64%e0%86%ad%ef%52%98%2d%84%12%77%bb%ab%e8%64%da%a3%65%55%5d%d5%76%55%57%46%6c%89%c9%5f%b2%3c%85%97%1e%f6%38%66%c9%17%22%e7%ea%c9%f5%d2%e0%14%d8%35%4f%0a%5c%34%d3%f3%a5%98%f7%66%72%aa%43%e3%bd%a2%cd%62%fd%e9%1d%34%30%57%52%ab%41%b1%91%65%f2%30%7f%cf%c6%a1%8c%fb%dc%c4%8f%61%a5%13%40%1a%13%d1%09%c5%e0%f7%87%5f%48%e7%d7%b3%62%04%a7%c4%cb%fd%f4%ff%cf%3b%74%a8%1b%96%8e%09%73%3a%9b%a6%2f%ed%b7%99%d5%39%05%39%95%ab";
$s3 = "%af%13%76%70%82%a0%a6%58%cb%3e%23%38%c4%c6%db%8b%60%2c%bb%90%68%a0%2d%e9%47%aa%78%49%6e%0a%c0%c0%31%d3%fb%cb%82%25%92%0d%cf%61%67%64%e8%cd%7d%47%ba%0e%5d%1b%9c%1c%5c%cd%07%2d%f7%a8%2d%1d%bc%5e%2c%06%46%3a%0f%2d%4b%e9%20%1d%29%66%a4%e1%8b%7d%0c%f5%ef%97%b6%ee%48%dd%0e%09%aa%e5%4d%6a%5d%6d%75%77%72%cf%47%16%a2%06%72%71%c9%a1%8f%00%f6%9d%ee%54%27%71%be%c8%c3%8f%93%e3%52%73%73%53%a0%5f%69%ef%c3%3b%ea%ee%70%71%ae%2a%21%c8%44%d7%22%87%9f%be%79%ed%c4%61%a4%08%57%02%82%2a%ef%36%95%da%ee%13%bc%fb%7e%a3%59%45%ef%25%67%3c%e0%a7%69%2b%95%77%b8%cd%dc%4f%de%73%24%e8%ab%e6%74%d2%8c%68%06%80%0c%dd%74%ae%31%05%d1%15%7d%c4%5e%bc%0b%0f%21%23%a4%16%7c%17%12%d1%2b%b3%10%b7%37%60%68%d7%cb%35%5a%54%97%08%0d%54%78%49%d0%93%c3%33%fd%1f%0b%35%11%9d%96%1d%ba%64%e0%86%ad%6f%52%98%2d%84%12%77%bb%ab%e8%64%da%a3%65%55%5d%d5%76%55%57%46%6c%89%c9%df%b2%3c%85%97%1e%f6%38%66%c9%17%22%e7%ea%c9%f5%d2%e0%14%d8%35%4f%0a%5c%34%d3%73%a5%98%f7%66%72%aa%43%e3%bd%a2%cd%62%fd%69%1d%34%30%57%52%ab%41%b1%91%65%f2%30%7f%cf%c6%a1%8c%fb%dc%c4%8f%61%a5%93%40%1a%13%d1%09%c5%e0%f7%87%5f%48%e7%d7%b3%62%04%a7%c4%cb%fd%f4%ff%cf%3b%74%28%1c%96%8e%09%73%3a%9b%a6%2f%ed%b7%99%d5%b9%05%39%95%ab"; 

echo $s1 != $s2 && $s1 != $s3 && $s2 != $s3 ;       //返回False
echo md5(urldecode($s1)) === md5(urldecode($s2)) && md5(urldecode($s3)) === md5(urldecode($s1)) && md5(urldecode($s2)) === md5(urldecode($s3)) ;  //返回True

可以用软件碰撞生成指定前缀相同md5的字符串

 

3.利用数组的md5均为null来绕过

实例：http://127.0.0.1/?key1[]=2134&key2[]=21

php的md5()函数无法处理数组对象，遇到数组md5()全部返回NULL，即相等成功绕过

 

4.当允许传入非数组或字符串时，比如可以传入序列化对象时

实例：

<?php

class trick{

   public $trick1;

   public $trick2;

   public function __destruct(){

       $this->trick1 = (string)$this->trick1;

       if(strlen($this->trick1) > 5 || strlen($this->trick2) > 5){

           die("你太长了");

       }

       if($this->trick1 !== $this->trick2 && md5($this->trick1) === md5($this->trick2) && $this->trick1 != $this->trick2){

           echo file_get_contents("/flag");

       }

   }

}

highlight_file(__FILE__);

unserialize($_GET['trick']);

 

(1)利用浮点数精度问题绕过

0.1 + 0.2 为啥不等于 0.3 ? （正确结果：0.30000000000000004）

0.8 * 7 为啥不等于 5.6 ? （正确结果：5.6000000000000005）

由于浮点数底层是二进制的浮点表示法，一些在十进制下有穷的数字，在二进制下是无穷的,无限数运算自然会有微小差错，而且任然为无限循环数

这种无限循环数在被转化为字符串后就四舍五入了

$x->trick1 = 0.01;

$x->trick2 = 0.01000000000000001;    //以下payload的trick1为正常数，trick2是个无限循环数

$x->trick1 = 0.3;

$x->trick2 = 0.1+0.2;     

$x->trick1 = 5.6;

$x->trick2 = 0.8*7;

$x->trick1 = 5.6;

$x->trick2 = 5.6000000000000005;

由于在进行数值比较时，!=会优先把字符串转化为浮点数进行比较，所以显然不同，而md5函数，是将其转化为字符串再进行md5运算，结果相同

 

(2)通过NAN、INF特殊常量绕过

某些数学运算会产生一个由常量 NAN 所代表的结果。此结果代表着一个在浮点数运算中未定义或不可表述的值。任何拿此值与其它任何值（除了 TRUE）进行的松散或严格比较的结果都是 FALSE。由于 NAN 代表着任何不同值，不应拿 NAN 去和其它值进行比较，包括其自身”。这里的说明就很清楚了，NAN代表着任何不同值，也就是说便面看上去(NAN == NAN)是判断自身是否等于自身，实际上等号前NAN和等号后的NAN代表着不同的值。

INF，这个值在PHP中代表的是无穷大的意思，计算不当，或者计算值超过服务器的上限是也会显示这个，例如下面这个公式

pow(9999,pow(99999,pow(99999,9999)))

由于NAN和INF在php中都是不确定的值，所以他们在与自身做==比较时，都返回false，利用此即可绕过