search

old-07 -- SQLi (Union Not Exist Bypass)

URL: https://webhacking.kr/challenge/web-07/?view_source=1arrow-up-right

old-07.png
<?php
include "../../config.php";
if ($_GET["view_source"]) {
    view_source();
}
?><html>
<head>
<title>Challenge 7</title>
</head>
<body>
<?php
$go = $_GET["val"];
if (!$go) {
    echo "<meta http-equiv=refresh content=0;url=index.php?val=1>";
}
echo "<html><head><title>admin page</title></head><body bgcolor='black'><font size=2 color=gray><b><h3>Admin page</h3></b><p>";
if (preg_match("/2|-|\+|from|_|=|\\s|\*|\//i", $go)) {
    exit("Access Denied!");
}
$db = dbconnect();
$rand = rand(1, 5);
if ($rand == 1) {
    ($result = mysqli_query($db, "select lv from chall7 where lv=($go)")) or die("nice try!");
}
if ($rand == 2) {
    ($result = mysqli_query($db, "select lv from chall7 where lv=(($go))")) or die("nice try!");
}
if ($rand == 3) {
    ($result = mysqli_query($db, "select lv from chall7 where lv=((($go)))")) or die("nice try!");
}
if ($rand == 4) {
    ($result = mysqli_query($db, "select lv from chall7 where lv=(((($go))))" )) or die("nice try!");
}
if ($rand == 5) {
    ($result = mysqli_query($db, "select lv from chall7 where lv=((((($go)))))")) or die("nice try!");
}
$data = mysqli_fetch_array($result);
if (!$data[0]) {
    echo "query error";
    exit();
}
if ($data[0] == 1) {
    echo "<input type=button style=border:0;bgcolor='gray' value='auth' onclick=\"alert('Access_Denied!')\"><p>";
} elseif ($data[0] == 2) {
    echo "<input type=button style=border:0;bgcolor='gray' value='auth' onclick=\"alert('Hello admin')\"><p>";
    solve(7);
}
?>
<a href=./?view_source=1>view-source</a>
</body>
</html>

Regex pattern:

  1. 2: Matches the digit 2.

  2. -: Matches the hyphen character -.

  3. \+: Matches the plus character + (escaped with a backslash).

  4. from: Matches the word "from".

  5. _: Matches the underscore character _.

  6. =: Matches the equals character =.

  7. \s: Matches any whitespace character (spaces, tabs, newlines).

  8. \*: Matches the asterisk character * (escaped with a backslash).

  9. \/: Matches the forward slash character / (escaped with a backslash).

The original idea was to use modulo operator to get value 2 -> 5%3 but the application kept giving query error which wasn't due to parentheses. We could use union select to get the desired value.

Since we are luck dependent use a script to make request few times:

Previousold-06 -- PHP (Base64)Nextold-08 -- SQLi (User-Agent)

Last updated