test

tháng 4 26, 2022 Phạm Hồ Anh Dũng 0 Comments

 ## Problem

10 years has passed since MD5 was broken, yet it is still frequently used in web applications, particularly PHP powered applications (maybe because there's a function after it?). Break it again to prove the point!

## Solution

Source code: SourceCODE-CTF/md5.php at main · onsra03/SourceCODE-CTF (github.com)

The only way we can get the flag is to pass string, which MD5 hash is exact the same as the string itself. Because such string does not exists (or I don't know one) we have to find another solution.

The only way to solve this challenge is to exploit PHP type juggling (as $md5 is compared with md5($md5) with == instead of strict comparision operator ===).

The easiest way to do this is to provide a number starting with 0e, which MD5 hash begins with 0e as well and contains only numbers.

Thats because such comparision will return true:

// test.php
<?php
echo intval('0e123' == '0e999'); // result 1, which means TRUE
echo "\n";
echo intval('0e123' === '0e999'); // result 0, which means FALSE
echo "\n";