mdk.fr/content/pages/supinternet_secu_web.md

status: hidden
title: Sup'Internet — Cybersécurité — HTTP
slug: e5eoGhcoh3phiD-supinternet-cybersecurite-http
robots: noindex


# Attaques via HTTP

Chaque exemple suivant vous fournit le contenu d'un fichier PHP.

Copiez simplement PHP dans un `index.php` dans un dossier vide de
votre choix et démarrez y PHP simplement avec le serveur de dev:

```
$ php -S localhost:8080 -d zend.assertions=1
```

Chaque code contient un `flag`, le but est de récupérer ce flag via
HTTP. Évidemment vous connaissez le flag à l'avance, vous l'avez vu,
vous l'avez copié avec le code, le but reste de réussir à l'obtenir
via http://localhost:8000/.


## Injection de code

    <?php

    /* flag: sup3rs3cr3t */

    if (isset($_GET['solve']))
        echo eval('echo ' . $_GET['solve'] . ';');
    else
        echo 'Missing "solve" in query string';



## Injection de code — protection

    <?php

    /* flag: sup3rs3cr3t */

    if (isset($_GET['solve']))
    {
        $blacklisteds = ['file_get_contents', 'open', 'exec', '`', 'shell', 'cmd', 'system'];
        foreach ($blacklisteds as $blacklisted)
        {
            if (strpos($_GET['solve'], $blacklisted) !== FALSE)
            {
                die("No way.");
            }
        }
        echo eval('echo ' . $_GET['solve'] . ';');
    }


## Basic Auth

    <?php

    $admin_password = "Just_Imagine_You_Dont_Know_It_" . (string)rand();

    if ($_SERVER['REQUEST_METHOD'] == 'GET' ||
        $_SERVER['REQUEST_METHOD'] == 'POST')
    {
        if ($_SERVER['HTTP_AUTHORIZATION'] != 'Basic ' .
            base64_encode("root:" . $admin_password))
        {
            header('HTTP/1.0 401 Unauthorized');
            header('WWW-Authenticate: Basic realm="Admin Zone');
            die();
        }
    }

    echo "Access Granted!! You got root!";
    echo "Flag: Sup3rS3cr3t";


## File storage

    <form method="post" enctype="multipart/form-data">
      <input type="file" name="file">
      <input type="submit" value="upload">
    </form>
    <pre>

    <?php

    $flag = 'sup3rs3cr3t';

    $uploaddir = './uploads';
    $whitelist = ['image/jpeg', 'image/png'];
    @mkdir("./uploads", 0700);
    $uploadfile = $uploaddir . '/' . basename($_FILES['file']['name']);

    if (isset($_FILES['file']) && !in_array($_FILES['file']['type'], $whitelist)) {
        echo "Seulement jpg et png autorisés.";
        die();
    }

    if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
        echo "Le fichier est valide, et a été téléchargé
               avec succès : <a href='$uploadfile'>$uploadfile</a>\n";
    }

    echo 'debug:';

    print_r($_FILES);


## Assert

    <?php

    /* flag: super secret */

    // Create a handler function
    function my_assert_handler($file, $line, $code)
    {
        echo "<hr>Assertion Failed:
            File '$file'<br />
            Line '$line'<br />
            Code '$code'<br /><hr />";
    }

    // Set up the callback
    assert_options(ASSERT_CALLBACK, 'my_assert_handler');

    ini_set('zend.assertions', '1');

    assert("strlen('" . $_GET["password"] . "') > 3",
           "Need a longer password");


## Transtypage


    <?php

    $auth = json_decode($_GET['auth'], TRUE);

    $username = 'root';
    $password = 'secret' . rand() . rand() . rand(); // Yup, you can't know it, don't attack this.

    if (!empty($auth))
    {
        if ($auth['login'] == $username &&
            $auth['password'] == $password)
        {
            echo "flag: Super Secret Flag !";
            die();
        }
        else
        {
            echo "Bad login / password;";
            die();
        }
    }
    echo "Need a ?auth= query string with JSON like";
    echo "   {'login': your_login, 'password': your_password}";


## Harder transtypage

    <?php

    $auth = json_decode($_GET['auth'], TRUE);

    $username = 'root';
    $password = 'secret' . rand() . rand() . rand(); // Yup, you can't know it, don't attack this.

    if (!empty($auth))
    {
        if ($auth['login'] == $username &&
            !strcmp($auth['password'], $password))
        {
            echo "flag: Super Secret Flag !";
            die();
        }
        else
        {
            echo "Bad login / password;";
            die();
        }
    }
    echo "Need a ?auth= query string with JSON like";
    echo "   {'login': your_login, 'password': your_password}";