Webhacking.kr_Prob5

webhacking.kr 5번문제입니다.

들어가니 Login 과 Join버튼이 보이네요.

Join버튼을 누르니 Access_Denied라는 말이 나옵니다.

접근금지라는 소리네요.

로그인페이지에들어가니 기본적인 로그인폼밖에 보이지 않습니다.

혹시몰라 SQL Injection을 실행해 보았습니다.

역시나 SQL Injection은 아닌 것 같네요.

둘러보던 중, URL에서 디렉토리 리스팅 취약점을 발견했습니다.

login.php를 지우고 디렉토리로 들어가니 join.php에 들어갈 수 있게 되었네요.

join.php에 들어가니 이상한 스크립트가 보입니다.

아마 자바스크립트 난독화 같은데, 성격이 급한관계로 언팩을 진행하고, 필요한 form부분만 디코딩하였습니다.

l = 'a';

ll = 'b';

lll = 'c';

llll = 'd';

lllll = 'e';

llllll = 'f';

lllllll = 'g';

llllllll = 'h';

lllllllll = 'i';

llllllllll = 'j';

lllllllllll = 'k';

llllllllllll = 'l';

lllllllllllll = 'm';

llllllllllllll = 'n';

lllllllllllllll = 'o';

llllllllllllllll = 'p';

lllllllllllllllll = 'q';

llllllllllllllllll = 'r';

lllllllllllllllllll = 's';

llllllllllllllllllll = 't';

lllllllllllllllllllll = 'u';

llllllllllllllllllllll = 'v';

lllllllllllllllllllllll = 'w';

llllllllllllllllllllllll = 'x';

lllllllllllllllllllllllll = 'y';

llllllllllllllllllllllllll = 'z';

I = '1';

II = '2';

III = '3';

IIII = '4';

IIIII = '5';

IIIIII = '6';

IIIIIII = '7';

IIIIIIII = '8';

IIIIIIIII = '9';

IIIIIIIIII = '0';

li = '.';

ii = '<';

iii = '>';

lIllIllIllIllIllIllIllIllIllIl = lllllllllllllll + llllllllllll + llll + llllllllllllllllllllllllll + lllllllllllllll + lllllllllllll + ll + lllllllll + lllll;

lIIIIIIIIIIIIIIIIIIl = llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + lll + lllllllllllllll + lllllllllllllll + lllllllllll + lllllllll + lllll;

if (eval(lIIIIIIIIIIIIIIIIIIl).indexOf(lIllIllIllIllIllIllIllIllIllIl) == -1) {

    bye;

}

if (eval(llll + lllllllllllllll + lll + lllllllllllllllllllll + lllllllllllll + lllll + llllllllllllll + llllllllllllllllllll + li + 'U' + 'R' + 'L').indexOf(lllllllllllll + lllllllllllllll + llll + lllll + '=' + I) == -1) {

    alert('access_denied');

    history.go(-1);

} else {

    document.write('<font size=2 color=white>Join</font><p>');

    document.write('.<p>.<p>.<p>.<p>.<p>');

    document.write('<form method=post action=' + llllllllll + lllllllllllllll + lllllllll + llllllllllllll + li + llllllllllllllll + llllllll + llllllllllllllll +

        '>');

    document.write('<table border=1><tr><td><font color=gray>id</font></td><td><input type=text name=' + lllllllll + llll + ' maxlength=5></td></tr>');

    document.write('<tr><td><font color=gray>pass</font></td><td><input type=text name=' + llllllllllllllll + lllllllllllllllllllllll + ' maxlength=10></td></tr>');

    document.write('<tr align=center><td colspan=2><input type=submit></td></tr></form></table>');

}

여기서 form부분만 빼오도록 하겠습니다.

    <form method=post action='join.php'>

   <table border=1><tr><td><font color=gray>id</font></td><td><input type=text name='id' maxlength=5></td></tr>

    <tr><td><font color=gray>pass</font></td><td><input type=text name='pw' maxlength=10></td></tr>

    <tr align=center><td colspan=2><input type=submit></td></tr></form></table>

자 이제 아까 Login하는 곳에 들어가 저 폼을 넣어줍시다.

(f12로 개발자도구에 들어간 뒤, html소스를 수정해서 저 폼 코드를 복붙해주세요.)

그냥 admin을 넣으니 이미 있는 아이디라고 나오면서 회원가입이 안되는걸 볼수 있습니다. 저는 maxlength가 5라는 것에 힌트를 얻어

maxlength를 6으로 고친뒤 admin뒤에 띄어쓰기 하나를 넣고, 비밀번호는 제가 쓰는 비밀번호를 넣었습니다.

이렇게 회원가입을 하고 sign up이라는 메세지가 뜬 걸 확인한 뒤 다시 로그인하는 곳에 들어가

ID에 admin을, pw에 제가 넣은 비밀번호를 넣으니 admin으로 로그인에 성공한 걸 볼 수 있었습니다.

clear했다고 나오는 글씨가 검정색인 바람에 화면에 아무것도 안뜬 줄 알았지만, 코드를 보니 글씨가 있네요.

clear