처음 화면
Login버튼을 Login 페이지에 들어가진다.
SQL Injection 기본 쿼리문을 입력해 보았을때는 로그인 되지 않았다.
처음 화면에 join 버튼을 눌러보았더니 Access_Denied라는 메세지가 뜨며 페이지에 들어가지지 않았다.
login페이지의 url 주소를 보니 마지막에 login.php라고 쓰여 있었다.
그래서 ' webhacking.kr/challenge/web/web-05/mem/join.php '의 주소로 접속을 시도해 보았다.
접속은 성공하였지만 빈화면이였다. 개발자 환경을 이용하여 소스코드를 보았더니 난독화된 스크립트가 보인다.
l = 'a';
ll = 'b';
lll = 'c';
llll = 'd';
lllll = 'e';
llllll = 'f';
lllllll = 'g';
llllllll = 'h';
lllllllll = 'i';
llllllllll = 'j';
lllllllllll = 'k';
llllllllllll = 'l';
lllllllllllll = 'm';
llllllllllllll = 'n';
lllllllllllllll = 'o';
llllllllllllllll = 'p';
lllllllllllllllll = 'q';
llllllllllllllllll = 'r';
lllllllllllllllllll = 's';
llllllllllllllllllll = 't';
lllllllllllllllllllll = 'u';
llllllllllllllllllllll = 'v';
lllllllllllllllllllllll = 'w';
llllllllllllllllllllllll = 'x';
lllllllllllllllllllllllll = 'y';
llllllllllllllllllllllllll = 'z';
I = '1';
II = '2';
III = '3';
IIII = '4';
IIIII = '5';
IIIIII = '6';
IIIIIII = '7';
IIIIIIII = '8';
IIIIIIIII = '9';
IIIIIIIIII = '0';
li = '.';
ii = '<';
iii = '>';
lIllIllIllIllIllIllIllIllIllIl = lllllllllllllll + llllllllllll + llll + llllllllllllllllllllllllll + lllllllllllllll + lllllllllllll + ll + lllllllll + lllll;
lIIIIIIIIIIIIIIIIIIl = llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + lll + lllllllllllllll + lllllllllllllll + lllllllllll + lllllllll + lllll;
if (eval(lIIIIIIIIIIIIIIIIIIl).indexOf(lIllIllIllIllIllIllIllIllIllIl) == -1) {
bye;
}
if (eval(llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + 'U' + 'R' + 'L').indexOf(lllllllllllll + lllllllllllllll + llll + lllll + '=' + I) == -1) {
alert('access_denied');
history.go(-1);
} else {
document.write('<font size=2 color=white>Join</font><p>');
document.write('.<p>.<p>.<p>.<p>.<p>');
document.write('<form method=post action=' + llllllllll + lllllllllllllll + lllllllll + llllllllllllll + li + llllllllllllllll + llllllll + llllllllllllllll +
'>');
document.write('<table border=1><tr><td><font color=gray>id</font></td><td><input type=text name=' + lllllllll + llll + ' maxlength=5></td></tr>');
document.write('<tr><td><font color=gray>pass</font></td><td><input type=text name=' + llllllllllllllll + lllllllllllllllllllllll + ' maxlength=10></td></tr>');
난독화된 코드를 해석하면 document.cokie indexOf(oldzombie), document.URL mode=1 이라는 내용을 얻을 수 있다.
(해석은 하나하나 대입하면서 했다.... 머리가 나쁘면 몸이 고생...)
해석에 따라' webhacking.kr/challenge/web/web-05/mem/join.php?mode=1 '에 접속해 보았지만 달라진 점은 찾을수 없었다.
그래서 EditThisCookie라는 확장 프로그램을 이용하여 oldzombie라는 쿠키를 추가해 보았다.
id와 password를 만들수 있는 텍스트박스가 나왔다.
id를 아까 나온 admin으로 해서 만들어 보려고 했지만 이미 존재하는 아이디라고 만들어지지는 않는다.
다른 아이디를 만들어서 로그인을 시도했는데 id가 admin이 아니라고 로그인이 되지 않는다.
다시 join.php로 들어와서 개발자 환경에서
아이디의 최대길이를 5에서 6으로 바꿔준다.
그리고 아이디 admin에 공백을 추가하고 계정을 만들면 계정이 잘 만들어지고
'admin'으로 로그인하면 문제가 해결된다!!
