0

I have pseudocode of the following script:

  $pass = '...';
  $answer = '....'

  extract($_GET);

  if (($inp)) {
    if ($inp === get_contents($pass)) {
      return $answer
    } else {
      echo "Wrong!"
    }
  }

My task is to find out the $answer variable. I have an HTML form which passes the input parameter from the field into this script using the GET method. What kind of attacks could this script be vulnerable to? I am a complete beginner to this stuff, so any help would be greatly appreciated.

P.S. I read on the PHP website that extract() with $_GET is a very bad idea. Could it be because it makes XSS attacks possible against this script?

2

The extract() imports variables into the current symbol table from an array. The get_contents might actually be file_get_contents() which reads a file into a string. The file could be either on the local filesystem or from the Internet via HTTP.

  1. If you know the contents of the text file referenced in $pass you know the password you should have in $inp, but you don't have that file nor its location.
  2. $_GET['pass'] becomes $pass because there's the extract($_GET);. Hence, by adding a GET variable you can change the password required for printing the answer.

I would try a file with predictable contents, e.g. ?pass=/etc/hostname&inp=server.example.com%0A – the Line Feed character %0A is required, because /etc/hostname ends with a newline.

  • Hi. I have already tried something like index.html/?pass=abc&inp=abc but it does not work in this scenario. Can you please clarify if that is not what you meant? My question is, even if I could change the $pass by using GET variable in URL, wouldn't it change again when get_contents() is used in comparison as it will replace the string with the content from; let's say a file? – Charming Potato Apr 13 at 8:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.