1

I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used php 5.5.16(Windows x64 version) for testing.

t1.php:

<?php
include 'test.php';
$t =  Token::gen(10);
echo $t;
echo "\n";

test.php:

<?php
class Token {
    public static function gen($len = 5)
    {
        $token = '';
        while($len--){
            $choose = rand(0, 2);
            if ($choose === 0)
                $token .= chr(rand(ord('A'), ord('Z')));
            else if($choose === 1)
                $token .= chr(rand(ord('a'), ord('z')));
            else
                $token .= chr(rand(ord('0'), ord('9')));
        }
        return $token;
    }

}

I generated some CSRF Tokens in vulnerable application as follows:

> php.exe .\t1.php
308AXoL3zs
> php.exe .\t1.php
g18tZZHgv3
> php.exe .\t1.php
Chk7ir55g4
> php.exe .\t1.php
33oRvjqqYf

I took 308AXoL3zs and used it in wincrackseed.c file. I edited that file a little bit. here my edited file:

https://pastebin.com/kS8S8Ps5

my problem is when I tried to crack seed using this attack, attack was active about 2-3 hours but nothing matched ! in my laptop its checked over 34 million seeds in that period of time. but in article Sjoerd Langkemper said:

This will take about 10 minutes for the Windows version

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.