> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/nullcon-hackim-ctf-goa-2023/web/typicalboss.md).

# TYPicalBoss

### <mark style="color:blue;">Challenge Description</mark>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Foz8HfVNapCZhtGTgQt7t%2Fimage.png?alt=media&amp;token=6351865d-25c7-40ad-a939-e9bd2a366a62" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FHrhhBKWhQjMFB7niruJC%2Fimage.png?alt=media&amp;token=0fcda850-827b-4b6c-9989-2b8ba72078b9" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fr2BkoHJ7C8pxqzcBbS8s%2Fimage.png?alt=media&amp;token=31375b9f-4dae-4d82-a3ec-078c5a3f67ce" alt=""><figcaption></figcaption></figure></div>

This is the classic PHP type-confusion bug with an SHA1 hash that sometimes gets incorrectly referred to as hash collision. There are many repositories onine with string-hash pairs to use, I picked mine from [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Type%20Juggling#magic-hashes).

### <mark style="color:blue;">Magic Hashes</mark>

Magic hashes arise due to a quirk in PHP's type juggling, when comparing string hashes to integers. If a string hash starts with "0e" followed by only numbers, PHP interprets this as scientific notation and the hash is treated as a float in comparison operations.

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FzfvwPSvqJ7nhPmCQI5e9%2Fimage.png?alt=media&amp;token=a082dd32-b04a-49c9-b6c2-064d9dbab143" alt=""><figcaption></figcaption></figure></div>

```
username: admin
password: 10932435112
```

when we use those credentials we are redirected to /flag.php that means that we have bypasses the login using magic hashes

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FwXMTRFcX7ZOzgbxXvRJs%2Fimage.png?alt=media&amp;token=1d52e099-a34f-45f0-8c4f-f5df414a581c" alt=""><figcaption></figcaption></figure></div>

if we follow redirection

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FMXZ344tADr09z1wDrCVk%2Fimage.png?alt=media&amp;token=81ba374a-75d1-4dee-8722-d8bc7217ec4d" alt=""><figcaption></figcaption></figure></div>

### <mark style="color:blue;">Flag</mark>

```
ENO{m4ny_th1ng5_c4n_g0_wr0ng_1f_y0u_d0nt_ch3ck_typ35}
```