Username: 
Password: 
Restrict session to IP 
Questions  |  score: 4  |  4.95 6.53 7.05 |  Solved By 788 People  |  2298724 views  |  since Aug 27, 2010 - 21:54:30

The Guestbook (Exploit, PHP, MySQL)

The Guestbook
This time you have to exploit a small guestbook to retrieve the admin password.
Again you are given the guestbook sourcecode, also as highlighted version.
Currently there is no way to register or login to the guestbook tables, but an admin account already exists.
The solution is the Admin password, case sensitive.

Note: Every session gets it own guestbook to play with. However you should clear your guestbook when you are done, as your entries can be read by skilled players.
GeSHi`ed php code for gbook.php.inc
1
2
3
4
56
7
8
9
1011
12
13
14
1516
17
18
19
2021
22
23
24
2526
27
28
29
3031
32
33
34
3536
37
38
39
4041
42
43
44
4546
47
48
49
5051
52
53
54
5556
57
58
59
6061
62
63
64
6566
67
68
69
7071
72
73
74
7576
77
78
79
8081
82
83
84
8586
87
88
89
9091
92
93
94
9596
97
98
99
100101
102
103
104
105106
107
108
109
110111
112
113
114
115116
117
118
119
120121
122
123
124
125126
127
128
129
130131
132
133
134
135136
137
138
139
140141
142
143
144
145146
147
148
149
150151
152
153
154
155156
157
158
159
160161
162
163
164
165166
167
168
169
170
<?php
/**
 * Get the database instance
 * @return GDO_Database
 */function gbook_db()
{
        static $gbdb = true;
        if ($gbdb === true)
        {                $gbdb = gdo_db_instance('localhost', CHALL_GBOOK_USER, CHALL_GBOOK_PASS, CHALL_GBOOK_DB);
                $gbdb->setLogging(false); // Disable annoying logs. 
                $gbdb->setEMailOnError(false); // Disable annoying emails.
        }
        return $gbdb;}
 
/**
 * Create the 2 tables for the challenge.
 */function gbook_createTables()
{
        $db = gbook_db();
        
        // user table can not get populated, but an admin account exists        $query =
                "CREATE TABLE IF NOT EXISTS gbook_user ( ".
                "gbu_id        INT(11)     UNSIGNED PRIMARY KEY, ". # Guestbook userid
                "gbu_name      VARCHAR(63) CHARACTER SET ASCII COLLATE ascii_general_ci, ". # Guestbook username
                "gbu_password  VARCHAR(255) CHARACTER SET ASCII COLLATE ascii_bin ) "; # Guestbook password <-- You need the password for username Admin        $db->queryWrite($query);
        
        // the guestbook messages table
        $query =
                "CREATE TABLE IF NOT EXISTS gbook_book ( ".                "gbb_sessid   CHAR(16)     CHARACTER SET ASCII COLLATE ascii_bin, ". # Every wechall user gets his own guestbook, so you maybe can`t spoil it that easily.
                "gbb_uid      INT(11)      UNSIGNED, ". # GB userid (currently unused)
                "gbb_time     INT(11)      UNSIGNED, ". # Timestamp
                "gbb_ip       VARCHAR(32)  CHARACTER SET ASCII COLLATE ascii_bin, ".       # IP
                "gbb_msg      TEXT         CHARACTER SET utf8  COLLATE utf8_general_ci, ". # Message                "INDEX(gbb_sessid) )";
        $db->queryWrite($query);
}
 
/** * Cleanup very old messages.
 */
function gbook_cleanup()
{
        $db = gbook_db();        $cut = time() - GWF_TIME::ONE_DAY * 2;
        $query = "DELETE FROM gbook_book WHERE gbb_time<$cut";
        return $db->queryWrite($query);
}
 /**
 * Generate a unique ID, so guests can also play this challenge. Every player gets his own guestbook.
 * This part is unimportant for the challenge!
 */
function gbook_playerID($reset=false){
        return GWF_Session::getSessID(); # new session == new game
}
 
/** * Get IP
 */
function gbook_getIP()
{
        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {                return $_SERVER['HTTP_X_FORWARDED_FOR'];
        }
        elseif (isset($_SERVER['HTTP_VIA'])) { 
                return $_SERVER['HTTP_VIA'];
        }        else {
                return $_SERVER['REMOTE_ADDR'];
        }
}
  
/**
 * Insert a message for current player.
 * @param int $userid
 * @param string $message */
function gbook_insertMessage($userid, $message)
{
        $db = gbook_db();
                $message = trim($message);
        $len = strlen($message);
        
        if ($len <= 3) {
                echo GWF_HTML::error('The Guestbook', 'Your message is too short.');                return false;
        }
        
        if ($len > 256) {
                echo GWF_HTML::error('The Guestbook', 'Your message is too long.');                return false;
        }
 
        # insert the entry      
        $playerid = gbook_playerID(true); // Current Player        $userid = 0; # guestbook has no login yet.
        $time = time();
        $ip = gbook_getIP();
        $message = GDO::escape($message); 
        $query = "INSERT INTO gbook_book VALUES('$playerid', $userid, $time, '$ip', '$message')";        if (false === $db->queryWrite($query)) {
                echo GWF_HTML::err('ERR_DATABASE', array(__FILE__, __LINE__));
                return false;
        }
                echo GWF_HTML::message('The Guestbook', 'Your entry has been added.');
        return true;
}
 
/** * Manually clear the guestbook for current player.
 */
function gbook_clear()
{
        $db = gbook_db();        $playerid = gbook_playerID();
        $query = "DELETE FROM gbook_book WHERE gbb_sessid='$playerid'";
        return $db->queryWrite($query);
}
 /**
 * Get Form to sign guestbook.
 */
function gbook_form()
{        return sprintf('<form action="index.php" method="post"><textarea name="message" rows="12" cols="40"></textarea><input type="submit" name="sign" value="Sign Guestbook" /><input type="submit" name="clear" value="Clear Guestbook" /></form>');
}
 
/**
 * Display guestbook of current player. */
function gbook_display()
{
        $db = gbook_db();
                $playerid = gbook_playerID();
        
        $query = "SELECT * FROM gbook_book WHERE gbb_sessid='$playerid'";
        if (false === ($result = $db->queryAll($query))) {
                return GWF_HTML::err('ERR_DATABASE', array(__FILE__, __LINE__));        }
        
        echo '<h3>Your Guestbook</h3>'.PHP_EOL;
        
        echo GWF_Table::start();        foreach ($result as $row)
        {
                $rs = GWF_Table::rowStart();
                $re = GWF_Table::rowEnd();
                $username = GWF_HTML::lang('guest');                echo $rs;
                echo sprintf('<td>%s - %s - %s</td>', GWF_Time::displayTimestamp($row['gbb_time']), $username, $row['gbb_ip']).PHP_EOL;
                echo $re;
                echo $rs;
                echo sprintf('<td>%s</td>', GWF_HTML::display($row['gbb_msg'])).PHP_EOL;                echo $re;
        }
        echo GWF_Table::end();
}
?>

Your Guestbook

Jan 13, 2024 - 07:12:38 - Guest - 95.181.236.4
éire buy arava online genuine
Dec 21, 2023 - 20:50:39 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:50:42 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:41:59 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:42:05 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:32:54 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:33:00 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:23:56 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:23:58 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:15:28 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:15:33 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:06:57 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 20:06:59 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:58:04 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:58:06 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:49:10 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:49:12 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:40:22 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:40:25 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:31:36 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Dec 21, 2023 - 19:31:41 - Guest - 95.181.236.4
https://magnitt.com/startups/buy-xanax-online-no-rx-78039
Nov 09, 2023 - 05:54:55 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Ikukaafes</a> <a href="http://slkjfdf.net/">Ocalcak</a> lgl.iier.wechall.net.ktc.gn http://slkjfdf.net/
Nov 09, 2023 - 05:59:56 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Ikukaafes</a> <a href="http://slkjfdf.net/">Ocalcak</a> lgl.iier.wechall.net.ktc.gn http://slkjfdf.net/
Nov 09, 2023 - 01:28:40 - Guest - 54.39.50.123
http://slkjfdf.net/ - Ludwuqone <a href="http://slkjfdf.net/">Iyozoqow</a> qcz.cdft.wechall.net.jsx.rl http://slkjfdf.net/
Nov 09, 2023 - 01:20:53 - Guest - 54.39.50.123
http://slkjfdf.net/ - Ludwuqone <a href="http://slkjfdf.net/">Iyozoqow</a> qcz.cdft.wechall.net.jsx.rl http://slkjfdf.net/
Nov 08, 2023 - 19:09:57 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Aroxiave</a> <a href="http://slkjfdf.net/">Edovofi</a> ehw.ticy.wechall.net.sbc.ew http://slkjfdf.net/
Nov 08, 2023 - 18:23:29 - Guest - 54.39.50.123
http://slkjfdf.net/ - Opevid <a href="http://slkjfdf.net/">Bequiy</a> uns.hjgx.wechall.net.jvw.qo http://slkjfdf.net/
Nov 08, 2023 - 18:31:35 - Guest - 54.39.50.123
http://slkjfdf.net/ - Opevid <a href="http://slkjfdf.net/">Bequiy</a> uns.hjgx.wechall.net.jvw.qo http://slkjfdf.net/
Nov 08, 2023 - 16:47:40 - Guest - 54.39.50.123
http://slkjfdf.net/ - Neodehofa <a href="http://slkjfdf.net/">Lucewaxem</a> vwi.ootj.wechall.net.ozr.yj http://slkjfdf.net/
Nov 08, 2023 - 16:39:26 - Guest - 54.39.50.123
http://slkjfdf.net/ - Neodehofa <a href="http://slkjfdf.net/">Lucewaxem</a> vwi.ootj.wechall.net.ozr.yj http://slkjfdf.net/
Oct 30, 2023 - 01:52:33 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Efehonjim</a> <a href="http://slkjfdf.net/">Eroxacimi</a> rds.jhzv.wechall.net.tsw.gc http://slkjfdf.net/
Oct 29, 2023 - 21:45:46 - Guest - 54.39.50.123
http://slkjfdf.net/ - Iquyoevao <a href="http://slkjfdf.net/">Ieysewiyi</a> ajk.fhfj.wechall.net.vmu.ag http://slkjfdf.net/
Oct 30, 2023 - 01:47:52 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Efehonjim</a> <a href="http://slkjfdf.net/">Eroxacimi</a> rds.jhzv.wechall.net.tsw.gc http://slkjfdf.net/
Oct 29, 2023 - 21:37:34 - Guest - 54.39.50.123
http://slkjfdf.net/ - Iquyoevao <a href="http://slkjfdf.net/">Ieysewiyi</a> ajk.fhfj.wechall.net.vmu.ag http://slkjfdf.net/
Oct 29, 2023 - 18:01:43 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Iholuv</a> <a href="http://slkjfdf.net/">Eubobolu</a> tqq.vxkh.wechall.net.fuw.oy http://slkjfdf.net/
Oct 29, 2023 - 17:57:23 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Iholuv</a> <a href="http://slkjfdf.net/">Eubobolu</a> tqq.vxkh.wechall.net.fuw.oy http://slkjfdf.net/
Oct 29, 2023 - 16:26:54 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Uudahi</a> <a href="http://slkjfdf.net/">Ohovup</a> vkx.dwgn.wechall.net.ymm.fs http://slkjfdf.net/
Oct 29, 2023 - 16:22:18 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Uudahi</a> <a href="http://slkjfdf.net/">Ohovup</a> vkx.dwgn.wechall.net.ymm.fs http://slkjfdf.net/
Oct 29, 2023 - 15:54:35 - Guest - 54.39.50.123
http://slkjfdf.net/ - Ejijixe <a href="http://slkjfdf.net/">Ehiziced</a> bni.halz.wechall.net.sah.bz http://slkjfdf.net/
Oct 29, 2023 - 15:46:14 - Guest - 54.39.50.123
http://slkjfdf.net/ - Ejijixe <a href="http://slkjfdf.net/">Ehiziced</a> bni.halz.wechall.net.sah.bz http://slkjfdf.net/
Oct 29, 2023 - 14:19:33 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Eajeti</a> <a href="http://slkjfdf.net/">Efilcovi</a> ama.ujqn.wechall.net.sef.hq http://slkjfdf.net/
Oct 29, 2023 - 14:10:23 - Guest - 142.44.212.237
<a href=http://slkjfdf.net/>Eajeti</a> <a href="http://slkjfdf.net/">Efilcovi</a> ama.ujqn.wechall.net.sef.hq http://slkjfdf.net/
Oct 11, 2023 - 19:10:34 - Guest - 77.81.142.58
â dipyridamole pharmacy coupons
Oct 08, 2023 - 15:00:01 - Guest - 91.240.118.252
" and "21"="21
Oct 08, 2023 - 15:00:02 - Guest - 91.240.118.252
-21+21*01
Oct 08, 2023 - 15:00:02 - Guest - 91.240.118.252
'||lower('')||'
Oct 08, 2023 - 15:00:02 - Guest - 91.240.118.252
'+rtrim('')+'
Oct 08, 2023 - 15:00:01 - Guest - 91.240.118.252
,'"QnoVale
Oct 08, 2023 - 15:00:01 - Guest - 91.240.118.252
.9-2
Oct 08, 2023 - 15:00:01 - Guest - 91.240.118.252
and 21=21
Oct 08, 2023 - 15:00:01 - Guest - 91.240.118.252
' and '21'='21
Your solution for The Guestbook
Answer
© 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 and 2024 by Gizmore