2

I'm preparing for this CTF challenge I'll be participating in next week, and I ran across this problem online which I can't manage to solve.

I only have control of the variables $user and $pass that the challenge function gets which I can send as a part of the POST request. I need to make the challenge function return true.

I tried sending an empty array as the password (by changing the password fields name to pass[]) but the regex function won't let me through.

<?php
//by Mawekl
//more challenges coming soon ;)

function validateuser($user)
{
    #Check username
    if(!preg_match('/^[A-Z][a-z]{1,15}$/',$user))
        die('Are you stupid hacker? Don\'t try inject my script!');
}

function validatepass($pass)
{
    #Check password (injection attempt?)
    if(!preg_match('/^[A-Za-z0-9_ ]+$/',$pass))
        header('Location: http://piv.pivpiv.dk/');
        #kick away stupid hacker!
}

function challenge($user, $pass) //Objective: return TRUE
{
    $users = array(
        "Admin" => $_VeryLongPasswords[0],
        "Mawekl" => $_VeryLongPasswords[1]
    );
    validateuser($user);
    validatepass($pass);
    return ($users[$user] == $pass);
}

?>
0

1 Answer 1

3

Since the script does not check that the user exists using some non-existing username with an empty password succeeds in my test:

 echo challenge('Foobar','') ? "MATCH\n":"nomatch\n";

 PHP Notice:  Undefined index: Foobar in ... 
 MATCH
2
  • Since the password is empty it'll faill the validatepass regex check
    – Name
    Commented Jun 12, 2016 at 12:00
  • ok thank u i realized thanks to you i just had to block the header('location') thing
    – Name
    Commented Jun 12, 2016 at 12:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .