ctf/2019/neverlan/sqlfun2.md

SQL Fun 2

(Web, 50) A Client forgot his Password... again. Could you get it for me? He has a users account and his Lname is Miller if that helps at all. Oh! and Ken was saying something about a new table called passwd; said it was better to separate things.

---

Desarrollo

Para este caso fue necesario hacer una union entre las distintas tablas.

select * from users join passwd where Lname='Miller'

Ahi encontramos la cadena ZmxhZ3tXMWxsX1kwdV9KMDFOX00zP30=, decodificando obtendremos la flag.

echo "ZmxhZ3tXMWxsX1kwdV9KMDFOX00zP30=" | base64 -d

flag{W1ll_Y0u_J01N_M3?}