[WebHacking.kr]Old-03 Write-up
2024. 12. 18. 13:18ㆍ보안/웹
728x90
들어가면 이런 그림이 나왔는데 첨에 좀 쫄았다.
<html>
<head>
<title>Challenge 3</title>
</head>
<body>
<center>Nonogram</center>
<p>
<hr>
<form name=kk method=get action=index.php>
<table border=3 width=500 height=500 align=center bgcolor=white>
<tr align=center>
<td colspan=3 rowspan=3 bgcolor=white></td>
<td> </td>
<td> </td>
<td>1</td>
<td> </td>
<td> </td>
</tr>
<tr align=center>
<td>1</td>
<td> </td>
<td>1</td>
<td> </td>
<td>1</td>
</tr>
<tr align=center>
<td>1</td>
<td>3</td>
<td>1</td>
<td>3</td>
<td>1</td>
</tr>
<tr align=center>
<td>1</td>
<td>1</td>
<td>1</td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._1.value=1; } else { this.style.background='white';kk._1.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._2.value=1; } else { this.style.background='white';kk._2.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._3.value=1; } else { this.style.background='white';kk._3.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._4.value=1; } else { this.style.background='white';kk._4.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._5.value=1; } else { this.style.background='white';kk._5.value=0; }" > </td>
</tr>
<tr align=center>
<td> </td>
<td> </td>
<td>0</td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._6.value=1; } else { this.style.background='white';kk._6.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._7.value=1; } else { this.style.background='white';kk._7.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._8.value=1; } else { this.style.background='white';kk._8.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._9.value=1; } else { this.style.background='white';kk._9.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._10.value=1; } else { this.style.background='white';kk._10.value=0; }" > </td>
</tr>
<tr align=center>
<td> </td>
<td> </td>
<td>3</td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._11.value=1; } else { this.style.background='white';kk._11.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._12.value=1; } else { this.style.background='white';kk._12.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._13.value=1; } else { this.style.background='white';kk._13.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._14.value=1; } else { this.style.background='white';kk._14.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._15.value=1; } else { this.style.background='white';kk._15.value=0; }" > </td>
</tr>
<tr align=center>
<td> </td>
<td>1</td>
<td>1</td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._16.value=1; } else { this.style.background='white';kk._16.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._17.value=1; } else { this.style.background='white';kk._17.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._18.value=1; } else { this.style.background='white';kk._18.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._19.value=1; } else { this.style.background='white';kk._19.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._20.value=1; } else { this.style.background='white';kk._20.value=0; }" > </td>
</tr>
<tr align=center>
<td> </td>
<td> </td>
<td>5</td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._21.value=1; } else { this.style.background='white';kk._21.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._22.value=1; } else { this.style.background='white';kk._22.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._23.value=1; } else { this.style.background='white';kk._23.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._24.value=1; } else { this.style.background='white';kk._24.value=0; }" > </td>
<td onclick="if(this.style.background!='black') { this.style.background='black'; kk._25.value=1; } else { this.style.background='white';kk._25.value=0; }" > </td>
</tr>
</table>
<input name=_1 size=2 value=0 type=hidden>
<input name=_2 size=2 value=0 type=hidden>
<input name=_3 size=2 value=0 type=hidden>
<input name=_4 size=2 value=0 type=hidden>
<input name=_5 size=2 value=0 type=hidden>
<input name=_6 size=2 value=0 type=hidden>
<input name=_7 size=2 value=0 type=hidden>
<input name=_8 size=2 value=0 type=hidden>
<input name=_9 size=2 value=0 type=hidden>
<input name=_10 size=2 value=0 type=hidden>
<input name=_11 size=2 value=0 type=hidden>
<input name=_12 size=2 value=0 type=hidden>
<input name=_13 size=2 value=0 type=hidden>
<input name=_14 size=2 value=0 type=hidden>
<input name=_15 size=2 value=0 type=hidden>
<input name=_16 size=2 value=0 type=hidden>
<input name=_17 size=2 value=0 type=hidden>
<input name=_18 size=2 value=0 type=hidden>
<input name=_19 size=2 value=0 type=hidden>
<input name=_20 size=2 value=0 type=hidden>
<input name=_21 size=2 value=0 type=hidden>
<input name=_22 size=2 value=0 type=hidden>
<input name=_23 size=2 value=0 type=hidden>
<input name=_24 size=2 value=0 type=hidden>
<input name=_25 size=2 value=0 type=hidden>
<input name=_answer type=hidden>
<center><input type=button value='solved' onclick=go()></center>
<script>
function go(){
var answer="";
for(i=1;i<=25;i++) { answer=answer+eval("kk._"+i+".value"); }
kk._answer.value=answer;
kk.submit();
}
</script>
</body>
</html>
코드도 무슨 말인지 잘 모르겠고
그림을 계속 보다보니 예전에 즐겨하던 게임이라는 것을 깨달았다.(제목이 노노그램인 건 몰랐었다)
제출을 누르면 다음 페이지로 넘어갈 수 있다.
그럼 Clear!라고 뜨길래 쉽네 했는데 풀었다는 메세지가 안나오고 이름을 입력하라고 했다.
이름을 입력하면
이렇게 로그?가 기록된다.
이름을 입력하는 페이지의 코드를 보면
<html>
<head>
<title>Challenge 3</title>
</head>
<body>
<center>Nonogram</center>
<p>
<hr>
<form name=kk method=get action=index.php>
</form><form method=post action=index.php><input type=hidden name=answer value=1010100000011100101011111>Clear!<br>enter your name for log : <input type=text name=id maxlength=10 size=10><input type=submit value='submit'>
hideen?필드 타입의 필드가 있다.
10101—~~~저게 답인가 했는데 저건 그냥 노노그램의 정답인 것 같다.
저 hidden 타입의 숨겨진 입력값에 name이나 value에 SQL Injection을 사용하는 문제인 것 같다.
- 정답
- value타입의 값을 1' or 1=1— (띄어쓰기 필)
로 변조해주면 문제가 해결된다.
'보안 > 웹' 카테고리의 다른 글
| [DreamHack] Flying chars Write-up (0) | 2024.12.26 |
|---|---|
| [DreamHack] phpreq Write-up (0) | 2024.12.26 |
| [WebHacking.kr]Old-01 Write-up (1) | 2024.12.17 |
| [WebHacking.kr]Old-07 Write-up (0) | 2024.12.17 |
| [Dreamhack]php7cmp4re Write-up (0) | 2024.07.18 |