webhacking.kr old 5번

webhacking.kr old 5번

2020. 1. 13. 21:19ㆍ보안/webhacking.kr

login과 join이 있는데 join은 막아뒀다.

login 화면으로 가보면 id/pw입력창과 버튼 외엔 아무것도 없다. 소스코드에서도 별다른 점을 찾아볼 수 없기 때문에 join 페이지를 뚫어서 계정을 만들어 로그인을 해야하는 것으로 보인다.(SQL Injection을 시도해도 특별한 반응 없음)

join버튼을 눌러서는 갈 수 없어서 url을 수정하면 아래와 같이 나온다.

어...원래는 access_denied가 아니라 bye가 나왔는데 문제를 푼 상태라 그런지 저렇게 뜬다.

<html>
<title>Challenge 5</title></head><body bgcolor=black><center>
<script>
l='a';
ll='b';
lll='c';
llll='d';
lllll='e';
llllll='f';
lllllll='g';
llllllll='h';
lllllllll='i';
llllllllll='j';
lllllllllll='k';
llllllllllll='l';
lllllllllllll='m';
llllllllllllll='n';
lllllllllllllll='o';
llllllllllllllll='p';
lllllllllllllllll='q';
llllllllllllllllll='r';
lllllllllllllllllll='s';
llllllllllllllllllll='t';
lllllllllllllllllllll='u';
llllllllllllllllllllll='v';
lllllllllllllllllllllll='w';
llllllllllllllllllllllll='x';
lllllllllllllllllllllllll='y';
llllllllllllllllllllllllll='z';
I='1';
II='2';
III='3';
IIII='4';
IIIII='5';
IIIIII='6';
IIIIIII='7';
IIIIIIII='8';
IIIIIIIII='9';
IIIIIIIIII='0';
li='.';
ii='<';
iii='>';


lIllIllIllIllIllIllIllIllIllIl=lllllllllllllll+llllllllllll+llll+llllllllllllllllllllllllll+lllllllllllllll+lllllllllllll+ll+lllllllll+lllll;
lIIIIIIIIIIIIIIIIIIl=llll+lllllllllllllll+lll+lllllllllllllllllllll+lllllllllllll+lllll+llllllllllllll+llllllllllllllllllll+li+lll+lllllllllllllll+lllllllllllllll+lllllllllll+lllllllll+lllll;

if(eval(lIIIIIIIIIIIIIIIIIIl).indexOf(lIllIllIllIllIllIllIllIllIllIl)==-1) {alert('bye');throw "stop";}
if(eval(llll+lllllllllllllll+lll+lllllllllllllllllllll+lllllllllllll+lllll+llllllllllllll+llllllllllllllllllll+li+'U'+'R'+'L').indexOf(lllllllllllll+lllllllllllllll+llll+lllll+'='+I)==-1)
{alert('access_denied');throw "stop";}else{document.write('<font size=2 color=white>Join</font><p>');
	document.write('.<p>.<p>.<p>.<p>.<p>');
	document.write('<form method=post action='+llllllllll+lllllllllllllll+lllllllll+llllllllllllll+li+llllllllllllllll+llllllll+llllllllllllllll+'>');
	document.write('<table border=1><tr><td><font color=gray>id</font></td><td><input type=text name='+lllllllll+llll+' maxlength=20></td></tr>');
	document.write('<tr><td><font color=gray>pass</font></td><td><input type=text name='+llllllllllllllll+lllllllllllllllllllllll+'></td></tr>');
	document.write('<tr align=center><td colspan=2><input type=submit></td></tr></form></table>');
}
</script>
</body>
</html>

소스코드를 정리해봤다(찾아보니 크롬 개발자 도구에 이런 난독화...?된 부분을 처리해주는 기능이 있다고한다. 나는 노트패드...ㅎㅎ)

45번부터 풀어보면 아래와 같다.

lIllIllIllIllIllIllIllIllIllIl=o+l+d+z+o+m+b+i+e
lIIIIIIIIIIIIIIIIIIl=d+o+c+u+m+e=n+t+.+c+o+o+k+i+e

if(eval(document.cookie).indexOf(oldzombie==-1) {alert('bye');throw "stop";}
if(eval(document.URL).indexOf(mode=1)==-1)
	{alert('access_denied');throw "stop";}
	else{document.write('<font size=2 color=white>Join</font><p>');
          document.write('.<p>.<p>.<p>.<p>.<p>');
          document.write('<form method=post action='+j+o+i+n+.+p+h+p+'>');
          document.write('<table border=1><tr><td><font color=gray>id</font></td><td><input type=text name='+i+d+' maxlength=20></td></tr>');
          document.write('<tr><td><font color=gray>pass</font></td><td><input type=text name='+p+w+'></td></tr>');
          document.write('<tr align=center><td colspan=2><input type=submit></td></tr></form></table>');
}

5: cookie에서 oldzombie라는 단어가 몇개 있는지 찾는다.

6: URL에서 mode=1이라는 단어가 몇개 있는지 찾는다.