BUU-WEB-[GWCTF 2019]枯燥的抽奖

Posted 2021-05-24 TzZzEZ-web

[GWCTF 2019]枯燥的抽奖

查看源码发现有个check.php，进去看一看。


mt_seed爆破工具
先通过python脚本进行爆破

str1 = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
str2 = 'TvsDPWvODH'#页面产生的随机数
str3 = str1[::-1]
length = len(str2)
res = ''
for i in range(len(str2)):
    for j in range(len(str1)):
        if str2[i]==str1[j]:
            res+=str(j)+' '+str(j)+' '+'0'+' '+str(len(str1)-1)+' '
            break

print(res)

<?php
mt_srand(320060081);

$str_long1 = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
$str='';
$len1=20;
for ( $i = 0; $i < $len1; $i++ ){
    $str.=substr($str_long1, mt_rand(0, strlen($str_long1) - 1), 1);       
}
echo $str;
?>