I'm trying to solve a challenge on a CTF, with PHP sessions.
The goal is to make
I do not have access to the files themselves, and therefore I cannot edit them.
My proposed solution is:
- We want the session to be locked for 20 seconds, therefore we need to make
eat.phprun that much time.
- At the same time, we need to run
check.php, having it set
$timeand then wait for the session to be unlocked.
- Now we need to unlock the session, which means we need to stop
check.phpwill continue running, the following expression:
$time+20!=$_SESSION['time']will be false, and PHP will echo
Is my proposal possible? If it is, how would you implement it? I'd also like to hear about other directions for solving this problem.
<?php setcookie('id',uniqid()); ?>
<?php $cookie=$_POST['cookie']; session_save_path('/home/mawekl/timetravel/'); session_start(); echo 'You ate: '.htmlspecialchars($cookie); echo "\n<br>"; $_SESSION['cookie']=$cookie; $_SESSION['time']=time(); ?>
<?php $cookie=$_COOKIE['id']; $time=time(); session_save_path('/home/mawekl/timetravel/'); session_start(); if ($cookie!=$_SESSION['cookie']) die('Wrong cookie'); if ($time+20!=$_SESSION['time']) die('You must eat cookie after 20 seconds from now, but you ate it '.($time-$_SESSION['time']).' seconds ago'); echo $_PASSWORD; ?>