Type-juggling in php: bypass a comparison with non-empty array

Question

On an CTF for my web-security-class I was able to find following php-code on the server

<?php 
        $user = array("user" => "admin");
        $secret = random_bytes(20);
          if (isset($_GET["usr"]) and isset($_GET["pwd"]))  {
            if ($_GET["usr"] == $user) {
              if (! strcmp($_GET["pwd"], $secret)) {
                echo var_dump(scandir($_GET["path"][1]));
              } else {
                echo "Wrong pwd!";
              }
            } else {
              echo "You are so close!";
            }
          }
?>

What payload do I have to send in order to bypass the $_GET["usr"] == $user comparison?

I tried sending NULL as "%00", also "0" and "1" because I guess that the weak ==-comparison could open up some type-juggling possibilities, but it didn't work.

madirish.net/401: "As you can see the comparison operator does not have any problem with the null byte (\0)" - null bytes in strings don't trip == up any more. — C3roe
– C3roe, Commented Nov 3, 2023 at 10:43
I have to say that the example doesn't make much sense. Why would you compare $_GET['usr'] against an array to begin with? I get that it's an exercise, but testing improbable code isn't particularly useful, imho. — M. Eriksson
– M. Eriksson, Commented Nov 3, 2023 at 10:51

AymDev · Accepted Answer · 2023-11-03 10:43:07Z

4

The $user variable is an array. GET data can contain arrays, you can use the right syntax to "bypass" the condition:

?usr[user]=admin

I don't think you can make use of type juggling here.

answered Nov 3, 2023 at 10:43

AymDev

7,7234 gold badges34 silver badges59 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Type-juggling in php: bypass a comparison with non-empty array

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related