[MRCTF2020]Ezaudit

知识点：伪随机数mt_rand()
源码泄露：www.zip
下载后，是个index.php

<?php 
header('Content-type:text/html; charset=utf-8');
error_reporting(0);
if(isset($_POST['login'])){$username = $_POST['username'];$password = $_POST['password'];$Private_key = $_POST['Private_key'];if (($username == '') || ($password == '') ||($Private_key == '')) {// 若为空,视为未填写,提示错误,并3秒后返回登录界面header('refresh:2; url=login.html');echo "用户名、密码、密钥不能为空啦,crispr会让你在2秒后跳转到登录界面的!";exit;
}else if($Private_key != '*************' )#13个#{header('refresh:2; url=login.html');echo "假密钥，咋会让你登录?crispr会让你在2秒后跳转到登录界面的!";exit;}else{if($Private_key === '************'){#12个#$getuser = "SELECT flag FROM user WHERE username= 'crispr' AND password = '$password'".';'; $link=mysql_connect("localhost","root","root");mysql_select_db("test",$link);$result = mysql_query($getuser);while($row=mysql_fetch_assoc($result)){echo "<tr><td>".$row["username"]."</td><td>".$row["flag"]."</td><td>";}}}} 
// genarate public_key 
function public_key($length = 16) {$strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';$public_key = '';for ( $i = 0; $i < $length; $i++ )$public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);return $public_key;}//genarate private_keyfunction private_key($length = 12) {$strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';$private_key = '';for ( $i = 0; $i < $length; $i++ )$private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);return $private_key;}$Public_key = public_key();//$Public_key = KVQP0LdJKRaV3n9D  how to get crispr's private_key???

分析一下
密码那个地方可以使用万能密码绕过1' or '1'='1，私钥那个地方，题目已经给了公钥，可以根据公钥，反推出私钥

伪随机数php_mt_rand()

真随机数和伪随机数的区别是有的，伪随机数会根据种子(seed)和调用次数(i)生成伪随机数
常用的是mt_rand(min,max)函数

本题知道了公钥，可以反推出seed

首先将公钥转换为工具能够识别的字符串

str1='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
str2='KVQP0LdJKRaV3n9D'#公钥
str3 = str1[::-1]
length = len(str2)
res=''for i in range(len(str2)):  for j in range(len(str1)):if str2[i] == str1[j]:res+=str(j)+' '+str(j)+' '+'0'+' '+str(len(str1)-1)+' 'break
print(res)#36 36 0 61 47 47 0 61 42 42 0 61 41 41 0 61 52 52 0 61 37 37 0 61 3 3 0 61 35 35 0 61 36 36 0 61 43 43 0 61 0 0 0 61 47 47 0 61 55 55 0 61 13 13 0 61 61 61 0 61 29 29 0 61 

得到seed:1775196155，利用seed得到私钥

<?php
mt_srand(1775196155);//种子
//公钥
function public_key($length = 16) {$strings1 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';$public_key = '';for ( $i = 0; $i < $length; $i++ )$public_key .= substr($strings1, mt_rand(0, strlen($strings1) - 1), 1);return $public_key;
}
//私钥
function private_key($length = 12) {$strings2 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';$private_key = '';for ( $i = 0; $i < $length; $i++ )$private_key .= substr($strings2, mt_rand(0, strlen($strings2) - 1), 1);return $private_key;
}
echo public_key();
echo "<br>";
echo private_key();
//必须需要先执行一次，然后才能得到正确的私钥
?>结果  公钥和私钥的结果根据次数不同而不同KVQP0LdJKRaV3n9D
XuNhoueCDCGc

输入密码和私钥即可得flag