MD5与PHP的漏洞利用大全 MD5漏洞这么多年以来，MD5这个点在CTF里已经被玩坏了，反反复复就是那几个考点，但是如果作为入门考核的话好像又离不开这个点，更重要的是考察大家对PHP代码的解读能力，我已经把这个点可以搜集到的都搜集好了，整理在一起，方便大家复制。漏洞利用大全# md5 后都是0e开头 s878926199a 0e545993274517709034328855841020 s155964671a 0e342768416822451524974117254469 s214587387a 0e848240448830537924465865611904 s214587387a 0e848240448830537924465865611904 s878926199a 0e545993274517709034328855841020 s1091221200a 0e940624217856561557816327384675 s1885207154a 0e509367213418206700842008763514 s1502113478a 0e861580163291561247404381396064 s1885207154a 0e509367213418206700842008763514 s1836677006a 0e481036490867661113260034900752 s155964671a 0e342768416822451524974117254469 s1184209335a 0e072485820392773389523109082030 s1665632922a 0e731198061491163073197128363787 s1502113478a 0e861580163291561247404381396064 s1836677006a 0e481036490867661113260034900752 s1091221200a 0e940624217856561557816327384675 s155964671a 0e342768416822451524974117254469 s1502113478a 0e861580163291561247404381396064 s155964671a 0e342768416822451524974117254469 s1665632922a 0e731198061491163073197128363787 s155964671a 0e342768416822451524974117254469 s1091221200a 0e940624217856561557816327384675 s1836677006a 0e481036490867661113260034900752 s1885207154a 0e509367213418206700842008763514 s532378020a 0e220463095855511507588041205815 s878926199a 0e545993274517709034328855841020 s1091221200a 0e940624217856561557816327384675 s214587387a 0e848240448830537924465865611904 s1502113478a 0e861580163291561247404381396064 s1091221200a 0e940624217856561557816327384675 s1665632922a 0e731198061491163073197128363787 s1885207154a 0e509367213418206700842008763514 s1836677006a 0e481036490867661113260034900752 s1665632922a 0e731198061491163073197128363787 s878926199a 0e545993274517709034328855841020 # $md5 = md5($md5) 自身和md5后都是0e开头 0e215962017 0e291242476940776845150308577824 0e00275209979 0e551387587965716321018342879905 0e00506035745 0e224441551631909369101555335043 0e00540451811 0e057099852684304412663796608095 0e00678205148 0e934049274119262631743072394111 0e00741250258 0e899567782965109269932883593603 0e00928251504 0e148856674729228041723861799600 0e01350016114 0e769018222125751782256460324867 0e01352028862 0e388419153010508575572061606161 0e01392313004 0e793314107039222217518920037885 0e01875552079 0e780449305367629893512581736357 0e01975903983 0e317084484960342086618161584202 0e02042356163 0e335912055437180460060141819624 0e02218562930 0e151492820470888772364059321579 0e02451355147 0e866503534356013079241759641492 0e02739970294 0e894318228115677783240047043017 0e02760920150 0e413159393756646578537635311046 0e02784726287 0e433955189140949269100965859496 0e03298616350 0e851613188370453906408258609284 0e03393034171 0e077847024281996293485700020358 # $md5 = md5(md5($md5)) 0e1138100474 0e779212254407018184727546255414 # 特殊使用 第一组 s1=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2 s2=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2 # 特殊使用 第二组 M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%00%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1U%5D%83%60%FB_%07%FE%A2 M%C9h%FF%0E%E3%5C%20%95r%D4w%7Br%15%87%D3o%A7%B2%1B%DCV%B7J%3D%C0x%3E%7B%95%18%AF%BF%A2%02%A8%28K%F3n%8EKU%B3_Bu%93%D8Igm%A0%D1%D5%5D%83%60%FB_%07%FE%A2 # 特殊使用 第三组 4dc968ff0ee35c209572d4777b721587d36fa7b21bdc56b74a3dc0783e7b9518afbfa200a8284bf36e8e4b55b35f427593d849676da0d1555d8360fb5f07fea2 4dc968ff0ee35c209572d4777b721587d36fa7b21bdc56b74a3dc0783e7b9518afbfa202a8284bf36e8e4b55b35f427593d849676da0d1d55d8360fb5f07fea2 # 特殊使用 第四组 a=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%00%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%55%5d%83%60%fb%5f%07%fe%a2 b=%4d%c9%68%ff%0e%e3%5c%20%95%72%d4%77%7b%72%15%87%d3%6f%a7%b2%1b%dc%56%b7%4a%3d%c0%78%3e%7b%95%18%af%bf%a2%02%a8%28%4b%f3%6e%8e%4b%55%b3%5f%42%75%93%d8%49%67%6d%a0%d1%d5%5d%83%60%fb%5f%07%fe%a2 # md5 与 mysql 经过md5的万能密码 ffifdyop 经过md5加密后：276f722736c95d99e921722cf9ed621c 再转换为字符串：'or'6<乱码> 即 'or'66 ] !r, b 这样的话，条件恒成立。 还有一个功能一样的：129581926211651571912466741651878684928ctfshow web9这个题多次尝试注入无果，扫描目录发现Index.phps，下载后得到代码：$flag=""; $password=$_POST['password']; if(strlen($password)>10){ die("password error"); } $sql="select * from user where username ='admin' and password ='".md5($password,true)."'"; $result=mysqli_query($con,$sql); if(mysqli_num_rows($result)>0){ while($row=mysqli_fetch_assoc($result)){ echo "登陆成功<br>"; echo $flag; } }刚好利用 ffifdyop 直接得到flag

MD5扩展攻击 工具下载个人感觉hash-ext-attack比HashPump好用，并且支持库安装也比较方便，直接pip install -r requirements.txt就可以了，下载地址：https://pan.quark.cn/s/367f838460c4题目<?php error_reporting(0); $key = getKey(); $username = $_POST['username']; $data = $_POST['data']; $sign = $_COOKIE["sign"]; if (!empty($sign)) { if ($username === "jwt") { if ($sign === md5($key . $username . $data)) { if (strpos($data, 'sec')) { $flag = file_get_contents('/flag'); echo $flag; } else echo "数据似乎没有被恶意篡改，但服务器接收到的数据中不包含sec"; } else echo "检测到当前用户的数据被恶意篡改"; } else echo "看起来你并不是用户jwt"; } else echo "检测到sign为空, 可能需要刷新一下浏览器"; ?> 解题思路1、根据题目可知，$key."jwt"."data" 的md5是 5a18d02b1f8da8d5f70a4cba720dfafd ，并且key的长度是172、那么已知明文就是jwtdata，已知key长度就是17，已知md5就是 5a18d02b1f8da8d5f70a4cba720dfafd3、并且data数据要包含sec，那么使用工具开始攻击4、开始传参，这里有个需要注意的地方，因为$sign === md5($key . $username . $data) ，而username我们已经传参jwt，所以data传参的时候要把前面的jwt去掉