PHP AUTH BYPASS

															PHP auth bypass

All the PHP webshells that are "password protected" are using the == to verify if the hard-coded md5 hashed password is matching the user input. The fact that they use the == sign together with md5 hashes can sometimes be dangerous and lead to authentication bypass.

It can be bypassed by simply typing this string as a password: 240610708 md5('240610708') - 0e462097431906509019562988736854
This kind of thing is called Magic Hashes. It doesn't always work, however. Here's why:

IF the hard-coded hash in the webshell begins with 0e - it can be bypassed with Magic Hashes.
Why? Because, PHP is a flexible language. The problem is in == comparison. the 0e means that if the following characters are all digits, the whole string gets treated as a float. Think of "0e…" as being the scientific notation for "0 to the power of some value" and that is always "0".

PoC:
Notice that the hashes are different? Yet, we got a successful login:
Code:
md5('240610708')        - 0e462097431906509019562988736854
our secret unknown hash - 0e232097431616219012560978731854

How php interprets it:
PHP Code:
if( 0 == 0 ) { echo 'welcome!'; }

Some more magic hashes:
PHP Code:
<?php
var_dump(md5('240610708') == md5('QNKCDZO'));
var_dump(md5('aabg7XSs')  == md5('aabC9RqS'));
var_dump(sha1('aaroZmOk') == sha1('aaK1STfY'));
var_dump(sha1('aaO8zKZF') == sha1('aa3OFF9m'));
var_dump('0010e2'         == '1e3');
var_dump('0x1234Ab'       == '1193131');
var_dump('0xABCdef'       == '     0xABCdef');
?>

How to mitigate this: use === operator