1
2
3
4
| Daddy told me about cool MD5 hash collision today.
I wanna do something like that too!
ssh col@pwnable.kr -p2222 (pw:guest)
|
登录上之后，查看文件：
1
2
3
4
5
6
7
8
9
10
| col@pwnable:~$ ls -al
total 36
drwxr-x--- 5 root col 4096 Oct 23 2016 .
drwxr-xr-x 117 root root 4096 Nov 10 2022 ..
d--------- 2 root root 4096 Jun 12 2014 .bash_history
dr-xr-xr-x 2 root root 4096 Aug 20 2014 .irssi
drwxr-xr-x 2 root root 4096 Oct 23 2016 .pwntools-cache
-r-sr-x--- 1 col_pwn col 7341 Jun 11 2014 col
-rw-r--r-- 1 root root 555 Jun 12 2014 col.c
-r--r----- 1 col_pwn col_pwn 52 Jun 11 2014 flag
|
如下是col.c的内容：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| #include <stdio.h>
#include <string.h>
unsigned long hashcode = 0x21DD09EC;
unsigned long check_password(const char* p){
int* ip = (int*)p;
int i;
int res=0;
for(i=0; i<5; i++){
res += ip[i];
}
return res;
}
int main(int argc, char* argv[]){
if(argc<2){
printf("usage : %s [passcode]\n", argv[0]);
return 0;
}
if(strlen(argv[1]) != 20){
printf("passcode length should be 20 bytes\n");
return 0;
}
if(hashcode == check_password( argv[1] )){
system("/bin/cat flag");
return 0;
}
else
printf("wrong passcode.\n");
return 0;
}
|
要求输入长度为20的字符串，然后将20个字符串划分成5组，并将5组子字符串作为整数依次相加，最后的值如果等于0x21DD09EC，则输出flag。
0x21DD09EC = 568134124；568134124 / 5 = 113626824 余 4；那么就相当于：
0x21DD09EC = 0x6C5CEC8 * 5 + 4 = 0x6C5CEC8 * 4 + 0x6C5CEC8 + 4 = 0x6C5CEC8 * 4 + 0x6C5CECC
那么就可以构造出来字符串了，再考虑到大小端：
1
2
| python -c "print '\xc8\xce\xc5\x06'*4+'\xcc\xce\xc5\x06'"
./col "`python -c "print '\xc8\xce\xc5\x06'*4+'\xcc\xce\xc5\x06'"`"
|
1
2
3
| col@pwnable:~$ ./col "`python -c "print '\xc8\xce\xc5\x06'*4+'\xcc\xce\xc5\x06'"`"
daddy! I just managed to create a hash collision :)
col@pwnable:~$
|