Магическая админка — hackerlab

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: NA

Summary

Магическая админка — hackerlab

Task Info

• Event: hackerlab
• Name: Магическая админка
• Category: Web
• Difficulty: medium (350 points)
• Flag: CODEBY{REDACTED}

Description

Все говорят мне, что нельзя оставлять оставлять пароли в коде, ведь их кто-нибудь может увидеть. "Бла бла бла" - вот что я слышу. Что бы доказать всем, что мое приложение безопасно, я выложил его в открытый доступ. Никто не сможет сломать его!

Solution

Step 1: Source Code Analysis

Downloaded task.zip with source files. Found vulnerable authentication code in functions.php: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 php read-only • copy allowed Copy
function auth(?string $username, ?string $password): bool
{
    $isAdmin = $username == "admin" && md5(md5($password)) == "0e385589729688144363378792916561";
    if (!$isAdmin) {
        return false;
    }
    session_start();
    $_SESSION['is_admin'] = true;
    session_commit();
    return true;
}

Step 2: Vulnerability Identification

Vulnerability: PHP Type Juggling (Magic Hash Attack)

The issue is using == (loose comparison) instead of === (strict comparison).

Hash 0e385589729688144363378792916561:

• Starts with 0e
• Contains only digits after 0e
• PHP interprets it as scientific notation: 0 × 10^385589... = 0 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Any password where md5(md5(password)) also produces a magic hash of the form 0e[digits only] will be interpreted as 0, and the comparison 0 == 0 will return TRUE.

Step 3: Finding a Suitable Password

Found a repository with known magic hashes for double MD5: https://github.com/spaze/hashes/blob/master/md5-double.md

List of passwords for double md5 magic hash:

Step 4: Exploitation

 bash read-only • copy allowed Copy
curl -X POST "http://TARGET/login" -d "username=admin&password=179122048" -L

Successful login to admin panel → flag on /admin page.

Key Techniques

• php_type_juggling — PHP loose comparison vulnerability
• magic_hash — Magic hash attack (0e prefix)
• double_md5 — Double MD5 hash collision
• source_code_analysis — Source code analysis

Useful Resources

• spaze/hashes — Collection of magic hashes for various algorithms
• PHP Type Comparison Tables
• md5-double.md — Magic hashes for md5(md5()) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Defense Recommendations

1. Use === instead of == for hash comparison
2. Use hash_equals() for hash comparison (timing-safe)
3. Use password_hash() and password_verify() for passwords
4. Do not use MD5 for password hashing ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍