[🥉 브론즈 2] 응답 크기로 되감은 blind SQLi — DreamHack access-log 풀이

id=1' AND 9329=IF(
  (ORD(MID((SELECT `value` FROM dvwa.flag ORDER BY id LIMIT 0,1), 1, 1)) > 64),
  SLEEP(1), 9329
)-- -

echo "총 $(wc -l < access.log) 줄"
grep -oE "sqlmap/[0-9.]+" access.log | sort | uniq -c   # User-Agent 분포
head -1 access.log                                       # 첫 요청

# decode_one.py — 로그 한 줄을 URL 디코드해 blind 쿼리 구조 보기
import urllib.parse
for ln in open("access.log"):
    q = urllib.parse.unquote(ln)
    if "value` AS CHAR" in q and "FROM dvwa.flag" in q and ">64)" in q:
        print(q[q.find("id="):q.find(" HTTP")])
        break

# timing.py — 로그 포맷에 응답시간 필드가 있나?
line = open("access.log").readline().rstrip()
print(line)
# 172.20.0.1 - - [26/Apr/2024:...] "GET ... HTTP/1.1" 200 1686 "-" "sqlmap/..."

# oracle.py — 추출 쿼리 응답 바이트 분포
import collections, urllib.parse
bc = collections.Counter()
for ln in open("access.log"):
    if "SLEEP" in ln and "ORD(MID" in urllib.parse.unquote(ln):
        bc[int(ln.split()[9])] += 1
print(bc.most_common(6))

import urllib.parse, re, collections
lines = open("extracted/access.log").read().splitlines()
 
pat = re.compile(
  r"ORD\(MID\(\(SELECT IFNULL\(CAST\((?P<expr>.+?) AS CHAR\),0x20\) FROM (?P<src>.+?)\),"
  r"(?P<pos>\d+),1\)\)(?P<op>!=|>=|<=|=|>|<)(?P<val>\d+)")
 
bytecnt = collections.Counter(); recs = []
for ln in lines:
    if "SLEEP" not in ln: continue
    q = urllib.parse.unquote(ln)
    m = pat.search(q)
    if not m: continue
    by = int(ln.split()[9]); bytecnt[by] += 1
    src = m.group("src"); rr = re.search(r"LIMIT (\d+),1", src)
    r = int(rr.group(1)) if rr else 0
    recs.append((m.group("expr"), re.sub(r" ORDER BY.*$", "", src), r,
                 int(m.group("pos")), m.group("op"), int(m.group("val")), by))
 
TRUE_BYTES = bytecnt.most_common(1)[0][0]      # 가장 흔한 응답 = 조건 참(SLEEP)
bounds = collections.defaultdict(lambda: [0, 255]); eqs = {}; neq = collections.defaultdict(set)
for expr, src, r, pos, op, val, by in recs:
    cond = (by == TRUE_BYTES); k = (expr, src, r, pos); lo, hi = bounds[k]
    if   op == ">":  lo, hi = (max(lo, val+1), hi) if cond else (lo, min(hi, val))
    elif op == "<":  lo, hi = (lo, min(hi, val-1)) if cond else (max(lo, val), hi)
    elif op == "=":  eqs[k] = val if cond else eqs.get(k)
    elif op == "!=": (neq[k].add(val) if cond else eqs.__setitem__(k, val))
    bounds[k] = [lo, hi]
 
def ch(k):
    if k in eqs and eqs[k] is not None: c = eqs[k]
    else:
        lo, hi = bounds[k]; cand = [x for x in range(max(lo,1), hi+1) if x not in neq[k]]
        c = lo if lo == hi else (cand[0] if len(cand)==1 else None)
    return chr(c) if c and 32 <= c < 127 else "?"
 
groups = collections.defaultdict(dict)
for k in bounds:
    expr, src, r, pos = k; groups[(expr, src, r)][pos] = ch(k)
for k, pm in groups.items():
    if "dvwa.flag" in k[1] and "value" in k[0]:
        flag = "".join(pm[p] for p in sorted(pm))
        print("[+] dvwa.flag.value =", flag[:flag.index("}") + 1])

[+] dvwa.flag.value = DH{anA1yz1nGVe3yB19L0g}