3v4l.org

run code in 300+ PHP versions simultaneously
<?php $dn="admin"; $pass="\x00\x41"; if (empty($dn) or empty($pass)) { exit(); } //check for empty strings if (preg_match('/[^a-zA-Z]/',$dn) or preg_match('/[^a-zA-Z0-9\x20!@#$%^&*()]/',$pass)) { exit(); } //check for expected values (whitelisting) //if (preg_match('/\x00/',$dn) or preg_match('/\x00/',$pass)) { exit(); } //check for null byte (blacklisting) $ldapconn=ldap_connect("challenge01.root-me.org", "54013") or die("Could not connect to LDAP server."); if ($ldapconn) { ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3); $ldapbind=ldap_bind($ldapconn, $dn, $pass); if ($ldapbind) { echo("success"); } else { echo("fail"); } } ?>
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 47) Position 1 = 4, Position 2 = 6
Branch analysis from position: 4
2 jumps found. (Code = 43) Position 1 = 7, Position 2 = 8
Branch analysis from position: 7
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 8
2 jumps found. (Code = 47) Position 1 = 13, Position 2 = 18
Branch analysis from position: 13
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 20
Branch analysis from position: 19
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 20
2 jumps found. (Code = 47) Position 1 = 26, Position 2 = 28
Branch analysis from position: 26
1 jumps found. (Code = 79) Position 1 = -2
Branch analysis from position: 28
2 jumps found. (Code = 43) Position 1 = 29, Position 2 = 45
Branch analysis from position: 29
2 jumps found. (Code = 43) Position 1 = 42, Position 2 = 44
Branch analysis from position: 42
1 jumps found. (Code = 42) Position 1 = 45
Branch analysis from position: 45
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 44
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 45
Branch analysis from position: 18
Branch analysis from position: 6
filename:       /in/1UqOZ
function name:  (null)
number of ops:  46
compiled vars:  !0 = $dn, !1 = $pass, !2 = $ldapconn, !3 = $ldapbind
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, 'admin'
    3     1        ASSIGN                                                   !1, '%00A'
    4     2        ISSET_ISEMPTY_CV                                 ~6      !0
          3      > JMPNZ_EX                                         ~6      ~6, ->6
          4    >   ISSET_ISEMPTY_CV                                 ~7      !1
          5        BOOL                                             ~6      ~7
          6    > > JMPZ                                                     ~6, ->8
          7    > > EXIT                                                     
    5     8    >   INIT_FCALL                                               'preg_match'
          9        SEND_VAL                                                 '%2F%5B%5Ea-zA-Z%5D%2F'
         10        SEND_VAR                                                 !0
         11        DO_ICALL                                         $8      
         12      > JMPNZ_EX                                         ~9      $8, ->18
         13    >   INIT_FCALL                                               'preg_match'
         14        SEND_VAL                                                 '%2F%5B%5Ea-zA-Z0-9%5Cx20%21%40%23%24%25%5E%26%2A%28%29%5D%2F'
         15        SEND_VAR                                                 !1
         16        DO_ICALL                                         $10     
         17        BOOL                                             ~9      $10
         18    > > JMPZ                                                     ~9, ->20
         19    > > EXIT                                                     
    7    20    >   INIT_FCALL_BY_NAME                                       'ldap_connect'
         21        SEND_VAL_EX                                              'challenge01.root-me.org'
         22        SEND_VAL_EX                                              '54013'
         23        DO_FCALL                                      0  $11     
         24        ASSIGN                                           ~12     !2, $11
         25      > JMPNZ_EX                                         ~12     ~12, ->28
         26    > > EXIT                                                     'Could+not+connect+to+LDAP+server.'
         27*       BOOL                                             ~12     <true>
    8    28    > > JMPZ                                                     !2, ->45
    9    29    >   INIT_FCALL_BY_NAME                                       'ldap_set_option'
         30        SEND_VAR_EX                                              !2
         31        FETCH_CONSTANT                                   ~13     'LDAP_OPT_PROTOCOL_VERSION'
         32        SEND_VAL_EX                                              ~13
         33        SEND_VAL_EX                                              3
         34        DO_FCALL                                      0          
   10    35        INIT_FCALL_BY_NAME                                       'ldap_bind'
         36        SEND_VAR_EX                                              !2
         37        SEND_VAR_EX                                              !0
         38        SEND_VAR_EX                                              !1
         39        DO_FCALL                                      0  $15     
         40        ASSIGN                                                   !3, $15
   11    41      > JMPZ                                                     !3, ->44
   12    42    >   ECHO                                                     'success'
         43      > JMP                                                      ->45
   14    44    >   ECHO                                                     'fail'
   17    45    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
157.15 ms | 1405 KiB | 15 Q