96 lines
1.9 KiB
PHP
96 lines
1.9 KiB
PHP
<?php
|
|
include('config.php');
|
|
|
|
function generate_cookie($user,$ENC_SECRET_KEY) {
|
|
$SALT=generatesalt(2);
|
|
|
|
$secure_cookie_string = $user.":".$_SERVER['HTTP_USER_AGENT'].":".$ENC_SECRET_KEY;
|
|
|
|
$secure_cookie = make_secure_cookie($secure_cookie_string,$SALT);
|
|
|
|
setcookie("secure_cookie",$secure_cookie,time()+3600,'/','',false);
|
|
setcookie("user","$user",time()+3600,'/','',false);
|
|
}
|
|
|
|
function cryptstring($what,$SALT){
|
|
|
|
return crypt($what,$SALT);
|
|
|
|
}
|
|
|
|
|
|
function make_secure_cookie($text,$SALT) {
|
|
|
|
$secure_cookie='';
|
|
|
|
foreach ( str_split($text,8) as $el ) {
|
|
$secure_cookie .= cryptstring($el,$SALT);
|
|
}
|
|
|
|
return($secure_cookie);
|
|
}
|
|
|
|
|
|
function generatesalt($n) {
|
|
$randomString='';
|
|
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
|
|
for ($i = 0; $i < $n; $i++) {
|
|
$index = rand(0, strlen($characters) - 1);
|
|
$randomString .= $characters[$index];
|
|
}
|
|
return $randomString;
|
|
}
|
|
|
|
|
|
|
|
function verify_cookie($ENC_SECRET_KEY){
|
|
|
|
|
|
$crypted_cookie=$_COOKIE['secure_cookie'];
|
|
$user=$_COOKIE['user'];
|
|
$string=$user.":".$_SERVER['HTTP_USER_AGENT'].":".$ENC_SECRET_KEY;
|
|
|
|
$salt=substr($_COOKIE['secure_cookie'],0,2);
|
|
|
|
if(make_secure_cookie($string,$salt)===$crypted_cookie) {
|
|
return true;
|
|
} else {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
|
|
if ( isset($_COOKIE['secure_cookie']) && isset($_COOKIE['user'])) {
|
|
|
|
$user=$_COOKIE['user'];
|
|
|
|
if (verify_cookie($ENC_SECRET_KEY)) {
|
|
|
|
if ($user === "admin") {
|
|
|
|
echo 'congrats: ******flag here******. Now I want the key.';
|
|
|
|
} else {
|
|
|
|
$length=strlen($_SERVER['HTTP_USER_AGENT']);
|
|
print "<p>You are logged in as " . $user . ":" . str_repeat("*", $length) . "\n";
|
|
print "<p>SSO cookie is protected with traditional military grade en<b>crypt</b>ion\n";
|
|
}
|
|
|
|
} else {
|
|
|
|
print "<p>You are not logged in\n";
|
|
|
|
|
|
}
|
|
|
|
}
|
|
else {
|
|
|
|
generate_cookie('guest',$ENC_SECRET_KEY);
|
|
|
|
header('Location: /');
|
|
|
|
|
|
}
|
|
?>
|