I have written a srcipt PHP like here:
"We haven't got much information on device. It's connected to the network by a backend: finger.php.
To open a door you ask the backend to send you the required fingerprint.
GET /s1/s2/s3/s4/s5/finger.php HTTP/1.0
Then you have to return this fingerprint in encoded format (within 5 seconds) like this:
POST /s1/s2/s3/s4/s5/finger.php?action=answer HTTP/1.0
input=(encoded fingerprint)
A general description of the encoding is below, stolen from the DMN Security Archives:
--
count($lines) = count($R) + count($C)
foreach($R as $r){
print count($groups)
foreach($groups as $group){
print " "
print count($group)
}
print "\n"
}
foreach($C as $c){
print count($groups)
foreach($groups as $group){
print " "
print count($group)
}
print "\n"
}
It's still a bit cryptic, but we know you're able to solve it. It will be a lot easier if you found out what the R and C variables mean.
P.S. Please note that the returned, encoded fingerprint may NOT contain any extra spaces or
returns. It must be created exactly as described in this document.
(Hint: don't forget to transfer your cookie, otherwise the system will be unable to find out who solved the mission)"
a file dowload from "finger.php" like here:
13
30
X X XX X XXX X X X X X X
XXX XXXXX X XX XXX X XXX
X X XX XXX X X X XXXXX
X X X XXXX X X XXXX XX
X XXXX X XXX XX XX X
XXX XXXX XXXXX X XXX XXX X
X XXX XXXX X X XX
X X X X XXX XX XXXX X
X X XXXX XX XX X X X
X XXX X XX XXXX XX X XX
X XXX X XX X XX X XXX XXX
X X X XX XX X X X X
XXXXXXXXX XXX XXXXXXX X XX
------------------------------------(there isnt this line in file)
or It can be like here:
20
19
X XXX X XXXX XXX X
X X X XX X
XX XXX X XX X
XXX XXXX X XXXXXXX
X X XXXX X X X X
X XXX X
X XXX XXX XX X
XX X XXXX
XXXX X XXXXX
XXXX XX XX XXXX X
XX X XX X XXX
X X X X XX
XX XXX
X X XX XXX XX
X XXX X XX XX
XXXXXXX XX X XX
XX XX X X XX X
X X XXXX XX X X
X X XX X XX X
X X X XXXXX X
Here is my solution! but it has the error, so someone tell me my errors and then
tell me how to sent a cookie to web server!
Thaanks !
<?PHP
function mgroups($a,$b,$line)
{ $groups="";
for($i=0;$i<strlen($line);$i++)
{$tab=substr($line,$i,1);}
if(($a<$b)&&($b<strlen($line)))
{for($i=$a;$i<=$b;$i++)
{$groups.=$tab[$i];}
}
else
{ print "can't make groups";}
return $groups;
}
function resgroups($line)
{ $len=strlen ($line);
for($i=0;$i<$len;$i+1+($k-$i))
{ if($line[$i]==" ")
$k=$i;
while($line[$i]=="x")
{ for($k=$i;$k<$len-$i;$k++)
{ if (($line[$k]=="x")&&($line[$k+1]==" "))
$groups[]=mgroups($i,$k,$line);
}
}
}
$ngroups=count($groups);
print($ngroups);
for($i=0;$i<$ngroups;$i++)
{ print (" ") ;
$d=strlen($groups[$i]);
print ($d);
}
}
function reponse($file)
{ $tab=explode("\n",$file);
$a=count($tab);
$b=strlen($tab[2]);
for($i=2;$i<$a;$i++)
for($j=0;$j<$b;$j++)
$intab[$j][$i-2]=$tab[$i][$j];
for($i=2;$i<$a;$i++)
{ resgroups²($tab[$i]);
print("\n");
}
for($j=0;$j<$b²;$j++)
{ resgroups($intab[$j]);
print("\n");
}
}
$port=80;
$hote="sers.sourceforge.net";
$url_abs="/s1/s2/s3/s4/s5/finger.php";
$requete="GET sers.sourceforge.net/s1/s2/s3/s4/s5/finger.php HTTP/1.0";
setcookie($user,$passwd,"sers.sourceforge.net",$url_abs,time()+3000);
$fp=fsockopen("sers.sourceforge.net",$port);
if(!fp)
{return false;
echo "connect false";
}
setcookie($user,$passwd,"sers.sourceforge.net",$url_abs,time()+3000);
fputs($fp,$requete);
print ($fp);
$file=fgets($fp,1024);
print ($file);
$view=reponse($file);
print ($view);
$answer="POST sers.sourceforge.net/s1/s2/s3/s4/s5/finger.php?action=answer HTTP/1.0 input=reponse($file)";
setcookie($user,$passwd,"sers.sourceforge.net",$url_abs,time()+3000);
fputs($fp,$answer);
echo "<html><head><body>$view</body></head></html>"
?>😕 😕 😕 😕 😕
