Note: This uses the same source as Limited 1. There is a db user named: flag The password for this user is 13 characters and can be found in rockyou. Please wrap this password with wctf{} before submitting. For example, if the password was hocuspocus123 then the flag would be wctf{hocuspocus123} https://limited-app-974780027560.us-east5.run.app/
This is the third challenge of the Limited series, so for the explanations and analysis, refer to the previous two writeups (Limited 1, Limited 2). Let’s move directly to the exploitation phase.
🔬 Vulnerability Analysis
Potential Vulnerabilities
SQL Injection
🎯 Solution Path
Exploitation Steps
Initial setup
I must admit, after many attempts at extracting the password and cracking trials (which didn’t go well), since it was impossible to crack if the format wasn’t correct… I found a query in the hashcat_wiki that allows you to correctly extract MySQL passwords to make them compatible with hashcat’s -m 7401 type. Let’s move on to the next phase.
Exploitation
I modified the initial query from the other challenges, adapting it to the one found on the hashcat_wiki, forming the final payload:
Then, I constructed the following link: https://limited-app-974780027560.us-east5.run.app/query?price=10.00&price_op=< /*&limit=*/ 1 UNION SELECT 1, 1, CONCAT(user, '|$mysql', SUBSTR(authentication_string,1,3), LPAD(CONV(SUBSTR(authentication_string,4,3),16,10),4,0), '*', INSERT(HEX(SUBSTR(authentication_string,8)),41,0,'*')), 1 FROM mysql.user WHERE plugin='caching_sha2_password' AND authentication_string NOT LIKE '%INVALIDSALTANDPASSWORD%' -- . Visiting the page:
Password Hashes
I found the password hashes (in the correct format for hashcat). Then, since the challenge description mentioned that cracking could be done with the rockyou.txt wordlist and that the password is 13 characters long, I filtered the rockyou.txt file to only include passwords of 13 characters using the awk command:
Automated FlagScreenshot of successful exploitation
🔧 Tools Used
Tool
Purpose
Python
Exploit
HashCat
Password Cracking
💡 Key Learnings
Time Optimization
When extracting MySQL > 8 hashes, always use the query from HashCat to extract them, so that they are compatible with -m 7401 if the format is not standard.
