Deciphering the PHP-Nuke Captcha
April 21, 2008 – 9:38 AMThe Captcha used in the current version 8.1 of PHP Nuke can be deciphered with 100% accuracy. more information can be found here:
http://www.rooksecurity.com/blog/?p=6
Exploit Code: http://www.rooksecurity.com/exploits/php_nuke_captcha.zip
What is so interesting about this captcha is that it is incredibly wide spread. Variants of this captcha are being used by big names like Paypal. This particular captcha is used for the forgotten password feature. There are few differences between this captcha and the one i broke. For one the background is a different image. The captcha is also using alpha-numeric which would mean 36^5 = 60466176 possibilities
My attack against PHP-Nuke is taking advantage of the fact that there are only 10^6 or a 1,000,000 possible combinations of this captcha. It only takes a few minuets to calculate all possibilities. I am storing the results in as a md5 hash in a SQL database for speed. The entire SQL table needed to crack this captcha with 100% accuracy takes up less than 43 megabytes. After the table is generated it take only a few seconds to crack a captcha. This is a time-memory trade off very similar to Rainbow Crack. Let me be very clear that I am not relying on MD5 for security and in fact a faster and much less secure message digest function like Tiger is better suited for this task. MD5 is being used as an attack tool because it saves a lot of space and time verses storing the entire image in the database.
Source: Bugtraq
You must be logged in to post a comment.