[Webhacking,kr]5번 풀이

300점짜리 문제입니다.

첫페이지는 이렇게 뜹니다. 왠지 어드민으로 로그인 해야할것 같은 기분이 드네요.ㅋㅋㅋ

먼저 로그인버튼을 클릭하게 되면

다음과 같은 창으로 넘어가게 되는데, 웹페이지의 소스를 보겠습니다.

현재페이지에 POST방식으로 값이 전달되네요.

일단 여기까지 login.php 입니다.

혹시나싶어 url에서 login.php를 지워봤더니

아래와 같이 파일들이 그대로 드러나게 됩니다.

join.php라는 파일에 들어가서 소스를 보고 간단하게 정리해봤습니다.

=============================login.php=================================

l='a';

ll='b';

lll='c';

llll='d';

lllll='e';

llllll='f';

lllllll='g';

llllllll='h';

lllllllll='i';

llllllllll='j';

lllllllllll='k';

llllllllllll='l';

lllllllllllll='m';

llllllllllllll='n';

lllllllllllllll='o';

llllllllllllllll='p';

lllllllllllllllll='q';

llllllllllllllllll='r';

lllllllllllllllllll='s';

llllllllllllllllllll='t';

lllllllllllllllllllll='u';

llllllllllllllllllllll='v';

lllllllllllllllllllllll='w';

llllllllllllllllllllllll='x';

lllllllllllllllllllllllll='y';

llllllllllllllllllllllllll='z';

I='1';

II='2';

III='3';

IIII='4';

IIIII='5';

IIIIII='6';

IIIIIII='7';

IIIIIIII='8';

IIIIIIIII='9';

IIIIIIIIII='0';

li='.';

ii='<';

iii='>';

lIllIllIllIllIllIllIllIllIllIl=lllllllllllllll+llllllllllll+llll+llllllllllllllllllllllllll+lllllllllllllll+lllllllllllll+ll+lllllllll+lllll; //oldzombie

lIIIIIIIIIIIIIIIIIIl=llll+lllllllllllllll+lll+lllllllllllllllllllll+lllllllllllll+lllll+llllllllllllll+llllllllllllllllllll+li+lll+lllllllllllllll+lllllllllllllll+lllllllllll+lllllllll+lllll; //document.cookie

if(eval(lIIIIIIIIIIIIIIIIIIl).indexOf(lIllIllIllIllIllIllIllIllIllIl)==-1) { bye; } //oldzombie쿠키 여부

if(eval(llll+lllllllllllllll+lll+lllllllllllllllllllll+lllllllllllll+lllll+llllllllllllll+llllllllllllllllllll+li+'U'+'R'+'L').indexOf(lllllllllllll+lllllllllllllll+llll+lllll+'='+I)==-1) //document.url에서 mode=1 인지 확인

=======================================================================

이렇게 되는데요. 잘보시면 oldzombie라는 쿠키값의 존재 여부를 묻고 있고 url에 인자값으로 mode를 받고있는 것을 알 수 있네요. 해당하는 값들을 전부 적용한다음

아래와 같은 페이지로 되는데,

id란에 최대 길이가 5이상이 될수 없다고 소스에 적혀있습니다.

여기까지 보았을때 sql insert에러가 생각나게 되는데요.

id varchar(5) 이렇게 되어있다면 만약 6글자를 넣었을 떄

5글자만 들어가게 되는 것입니다. 그렇다면 현재페이지에서 id의 maxlength를 수정하고 admin 로 값을 보내고 login.php에서 admin으로 로그인하시면 성공!