Abusing weak PRNGs in PHP applications

[gat3way () gat3way eu]

Hello all, 

To cut the intro blablablas short, I've compiled this video here:

http://www.youtube.com/watch?v=NMhO00bnRzM

It's about abusing PHP's builtin PRNG functions to attack web applications. 

It starts where Stefan Esser's wonderful article "mt_srand and not so random numbers" ( 
http://www.suspekt.org/2008/08/17/mt_srand-and-not-so-random-numbers/ ) ended.

I've made some improvements to his idea. Since mt_srand()/mt_rand() are very slow (~17 hours to try all possible 2^32 
seeds on my AMD Phenom 2.6 ghz machine) and lookup tables are huge (at least 32 GB), I implemented rainbow tables. With 
a chain length of 10000 and 512k rows, the table size is 11MB and average search takes only about 35 min. Rainbow table 
parameters can be tuned (longer chains = less space, but slower seed crack, shorter chains and more rows = more space, 
but less time to crack the seed).

Since it's about password reset attacks, time to predict the random string is crucial for the effectiveness of the 
attack. 

I also demonstrate a real PoC against installations of PHP-Nuke and PunBB hosted on a same server with keep-alives 
enabled. In my example, it took 7 minutes and 4 HTTP requests to reset the PunBB's admin password by predicting the 
"password reset" URL.

I also gave my ideas cents on how those attacks can be improved even further (e.g comparing sequences of PRNs instead 
of just the last values in case we have pseudorandom numbers generated in a smaller interval like mt_rand(1,1000);)

PoC code, rainbow table generation code and the rainbow table itself (mt_rainbow2) can be downloaded from 
http://www.gat3way.eu/poc/mtrt 

Hope some of you might find that useful.