\n\nThis page has been machine-translated from the original page.
\n
I participated in Cyber Security Rumble 2021 CTF, which began on 2021/11/26.
\nI will write up a few challenges.
\n\nAccessing the website brings you to a members-only news site.
\nWhen you register, the user registration itself does not complete, but you are redirected to an Invoice page where you can review the submitted information.
\nThis page is accessed via a URL like the following, and it is managed by a path that Base64-encodes the registered user and date, such as username-2021-11-27.
http://ssj.rumble.host/legacy_invoice_system/dGVzdHVzZXItMjAyMS0xMS0yNw==
Here, I tried changing either the username part or the date part into an arbitrary string that did not fit the format. That caused an SQL error, which showed that an SQL injection vulnerability existed.
\nI started by exploring information about other users in the table.
\nIt looked like UNION-based injection would work for reconnaissance.
\nAs for the name of the table that manages users, I was able to identify it as news_subscriber by using commands such as WHERE and HAVING to trigger error messages.
Rakete-2021-11-26' UNION SELECT id,username,null,pensi,email,credit_card,null FROM news_subscriber WHERE id=10--Therefore, with a command like the one above, you can inspect user pages one by one by specifying an ID or username.
\nUnfortunately, even after exploring the entire news_subscriber table, there were no users that seemed likely to lead to the flag.
Next, I decided to look for tables other than news_subscriber.
Rakete-2021-11-26' UNION SELECT id,version(),null,null,null,null,null FROM news_subscriberAs shown above, using the version() command let me identify the database as Postgres.
Since the database is Postgres, table information can be referenced from the tablename column in pg_tables.
There are several ways to retrieve it, but if you want to enumerate them in order from the beginning, the LIMIT 1 OFFSET n syntax is convenient.
LIKE is also useful when you want to search for tables containing a specific string.
# 6番目のテーブルをSQLインジェクションで取得\nRakete-2021-11-26';SELECT null,tablename,null,null,null,null,null FROM pg_tables LIMIT 1 OFFSET 6;--\n\n# テーブル名にnameが含まれるテーブルをSQLインジェクションで取得\nRakete-2021-11-26';SELECT null,tablename,null,null,null,null,null FROM pg_tables WHERE tablename LIKE '%name%';--Exploring tables in this way revealed one called news_article.
It looked like the flag was probably stored in the news_article table.
So I moved on to exploring the columns of the news_article table.
In Postgres, information about the columns of a specific table can be filtered in the form information_schema.columns WHERE table_name='news_article'.
After that, just as when retrieving table information earlier, you can use LIMIT and LIKE to enumerate the column information, then use UNION injection to retrieve the column data and obtain the flag.
\nRakete-2021-11-26';SELECT null,column_name,null,null,null,null,null FROM information_schema.columns WHERE table_name='news_article' AND column_name LIMIT 1 OFFSET 3;--\n\nRakete-2021-11-26';SELECT null,column_name,null,null,null,null,null FROM information_schema.columns WHERE table_name='news_article' AND column_name LIKE '%te%'--Using this method, I was able to recover the flag information from the title on the Invoice page, as shown below.
\n