Help Brain conquer the world

[jazzc]

I am a strong believer that security in programming is a mindset and not an add-on. I will be making a few posts with non standard security problems in PHP. Of course, they are not mine, I just tweaked them enough to hopefully avoid easy detection. Credit goes where it 's due.

If you manage to solve them by yourself (i.e. without your googling sk14z), big kudos

Here is the first one - you must help Brain send the message to Pinky to start the world conquest. Can you do it?

$cachedCredentials = unserialize($cookieVal);

// Assume we successfully retrieved $user & $pass before somehow
$user = 'admin';
$pass = 'root11';

if ($cachedCredentials['username'] == $user && $cachedCredentials['password'] == $pass) {
       $loggedIn = true;
} else {
       $loggedIn = false;
}

if ($loggedIn) {
     Pinky::conquerUniverse();
}

Brain has a big collection of cookies in the kitchen - but he 's at a loss of which one to use. Come on, bake the proper one

Edit: Brain has no knowledge what the username/password combo is. You can't use that info as a solution. I 've put it there to signify just the fact that there program successfully gets the stored value from somewhere (db, file, api, whatever) with some code we don't need to know for our purposes.

Edit 2: PM me the solution, don't post it

 

[madoctopus]

The devil is in the details... is that cookie encrypted?

 

[jazzc]

is that cookie encrypted?

Extracting the value from the cookie doesn't matter, assume all the necessary steps have been successfully done already and the value we need is now comfortably sitting on $cookieVal.

I should have cleared that up, thanks

 

[Panther28]

ehhhhh...

Brain: (select best cookie)
if (cookie) = (best taste) true
If (cookie) = (biggest size) true
Else
(give to cookie monster)
Now
Brain (encrypted cookie bag) == Pinky's (hand)
Then
(World conquest)


am i close?

 

[jazzc]

am i close?

Nobody can resist the Cookie Monster!

 

[ThePacketeer]

Here is the first one - you must help Brain send the message to Pinky to start the world conquest. Can you do it?
Brain has a big collection of cookies in the kitchen - but he 's at a loss of which one to use. Come on, bake the proper one

Extracting the value from the cookie doesn't matter, assume all the necessary steps have been successfully done already and the value we need is now comfortably sitting on $cookieVal.

I don't understand your question. At first I though I should provide you with

a:2:{s:8:"username";s:5:"admin";s:8:"password";s"root11";}

But then you say that the cookieVal is already set to the correct values...

So I don't understand what we should be trying to do ?

 

[jazzc]

I don't understand your question. At first I though I should provide you with

a:2:{s:8:"username";s:5:"admin";s:8:"password";s"root11";}

But then you say that the cookieVal is already set to the correct values...

So I don't understand what we should be trying to do ?

Obviously Brain does not know that username is admin and password is root11 - those where just placeholder values, could have been anything.

He needs you to trick the authentication check without knowing the username/password.

 

[jazzc]

Update: madoctopus sent me his solution, we have the first winner!

Congratulations

Keep the ball rolling, send me your ideas!

 

[jazzc]

lancis is the second one to get it right!

Congratulations

 

[bk071]

 

[madoctopus]

I personally like it more when trying to login with admin/admin or admin/test actually works. Is priceless.

That aside problems like this have to do more with bad coding which im also guilty of at times. Real badass hackers though figure shit out in PHP functions themselves. Saw an example once where by sending some data that looked like garbage through POST would essentially trigger PHP to run some code from the memory in ways it wasnt supposed to. Basically jump the program stack pointer to some code you posted. Thought that was sick.

 

[jazzc]

Saw an example once where by sending some data that looked like garbage through POST would essentially trigger PHP to run some code from the memory in ways it wasnt supposed to. Basically jump the program stack pointer to some code you posted. Thought that was sick.

These are exploits on a lower level, the Zend Engine that PHP is built upon.

 

[jazzc]

artizhay is now on the winners list!

Congratulations

 

[Gogol]

Ahha interesting
What's next?

 

[jazzc]

Ahha interesting
What's next?

How about solving this one before the next ones?

 

[Gogol]

Ok lemme read the whole thread
Sorry for being a lazy bum lol

How about solving this one before the next ones?

 

[Gogol]

Ok this one looks easy.. Sending you a PM.. Please check

 

[jazzc]

g0g0l is now in the winners list!

Congratulations

 

[Gogol]

Thank you
This one was really tricky by the way and I almost always do this mistake

g0g0l is now in the winners list!

Congratulations

Waiting for the next one to come. Subbed

 

[Panther28]

Will we be able to see the solution and why it works?