wechall NO ESCAPE MYSQL I MYSQL II

<?php
//
// Trigger Moved to index.php
//if (false !== ($who = Common::getGet(‘vote_for‘))) {
//      noesc_voteup($who);//}
//
/**
 * Get the database link
 * @return GDO_Database */
function noesc_db()
{
        static $noescdb = true;
        if ($noescdb === true)        {
                $noescdb = gdo_db_instance(‘localhost‘, NO_ESCAPE_USER, NO_ESCAPE_PW, NO_ESCAPE_DB);
                $noescdb->setLogging(false);
                $noescdb->setEMailOnError(false);
        }        return $noescdb;
}
 
/**
 * Create table (called by install-script) * The table layout is crappy, there is only 1 row in the table Oo.
 * @return boolean
 */
function noesc_createTable()
{        $db = noesc_db();
        $query =
                "CREATE TABLE IF NOT EXISTS noescvotes ( ".
                "id     INT(11) UNSIGNED PRIMARY KEY, ". # I could have one row per candidate, but currently there is only one global row(id:1). I know it`s a bit unrealistic, but at least it is safe, isn`t it?
                "bill   INT(11) UNSIGNED NOT NULL DEFAULT 0, ". # bill column                "barack INT(11) UNSIGNED NOT NULL DEFAULT 0, ". # barack column
                "george INT(11) UNSIGNED NOT NULL DEFAULT 0 )"; # george columb
       
        if (false === $db->queryWrite($query)) {
                return false;        }
        return noesc_resetVotes();
}
 
/** * Reset the votes.
 * @return void
 */
function noesc_resetVotes()
{        noesc_db()->queryWrite("REPLACE INTO noescvotes VALUES (1, 0, 0, 0)");
        echo GWF_HTML::message(‘No Escape‘, ‘All votes have been reset‘, false);
}
 
/** * Count a vote.
 * Reset votes when we hit 100 or 111.
 * TODO: Implement multi language
 * @param string $who
 * @return void */
function noesc_voteup($who)
{
        if ( (stripos($who, ‘id‘) !== false) || (strpos($who, ‘/‘) !== false) ) {
                echo GWF_HTML::error(‘No Escape‘, ‘Please do not mess with the id. It would break the challenge for others‘, false);                return;
        }
 
 
        $db = noesc_db();        $who = mysql_real_escape_string($who);
        $query = "UPDATE noescvotes SET `$who`=`$who`+1 WHERE id=1";
        if (false !== $db->queryWrite($query)) {
                echo GWF_HTML::message(‘No Escape‘, ‘Vote counted for ‘.GWF_HTML::display($who), false);
        }       
        noesc_stop100();
}
 
/** * Get all votes.
 * @return array
 */
function noesc_getVotes()
{        return noesc_db()->queryFirst("SELECT * FROM noescvotes WHERE id=1");
}
 
/**
 * Reset when we hit 100. Or call challenge solved on 111. * @return void
 */
function noesc_stop100()
{
        $votes = noesc_getVotes();       　　　　 foreach ($votes as $who => $count)
        {
                if ($count == 111) {
                        noesc_solved();
                        noesc_resetVotes();                       　　　　　　　　　　　　　　 break;
                }
               
                if ($count >= 100) {
                        noesc_resetVotes();                                                break;
                }
        }
}
 /**
 * Display fancy votes table.
 * New: it is multi language now.
 * @return unknown_type
 */function noesc_displayVotes(WC_Challenge $chall)
{
        $votes = noesc_getVotes();
        echo ‘<table>‘;
        echo sprintf(‘<tr><th>%s</th><th>%s</th><th>%s!</th></tr>‘, $chall->lang(‘th_name‘), $chall->lang(‘th_count‘), $chall->lang(‘th_vote‘));        $maxwho = ‘‘;
        $max = 0;
        $maxcount = 0;
        // Print Candidate rows
        foreach ($votes as $who => $count)        {
                if ($who !== ‘id‘) // Skip ID
                {
                        $count = (int) $count;
                        if ($count > $max) {                             　　　　　　　　　　　　　　　　　    $max = $count;
                                $maxwho = $who;
                                $maxcount = 1;
                        }
                        elseif ($count === $max) {                                　　　　　　　　　　　　　　　　　　　$maxcount++;
                        }
                        $button = GWF_Button::generic($chall->lang(‘btn_vote‘, array($who)), "index.php?vote_for=$who");
                        echo sprintf(‘<tr><td>%s</td><td class="gwf_num">%s</td><td>%s</td></tr>‘, $who, $count, $button);
                }        }
        echo ‘</table>‘;
 
        // Print best candidate.       
        if ($maxcount === 1) {               　　　　　　　　　　　　　　 echo GWF_Box::box($chall->lang(‘info_best‘, array(htmlspecialchars($maxwho))));
        }
}
 
/** * Try to get here :)
 */
function noesc_solved()
{
        if (false === ($chall = WC_Challenge::getByTitle(‘No Escape‘))) {                　　　　　　　　$chall = WC_Challenge::dummyChallenge(‘No Escape‘, 2, ‘/challenge/no_escape/index.php‘, false);
        }
       　　　　 $chall->onChallengeSolved(GWF_Session::getUserID());
}
 ?>

<?php
/* TABLE STRUCTURE
CREATE TABLE IF NOT EXISTS users (
userid    INT(11) UNSIGNED AUTO_INCREMENT PRIMARY KEY,
username  VARCHAR(32) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL,password  CHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL
) ENGINE=myISAM;
*/
 
# Username and Password sent?if ( (‘‘ !== ($username = Common::getPostString(‘username‘))) && (false !== ($password = Common::getPostString(‘password‘, false))) ) {
        auth1_onLogin($chall, $username, $password);
}
 
/** * Get the database for this challenge.
 * @return GDO_Database
 */
function auth1_db()
{        if (false === ($db = gdo_db_instance(‘localhost‘, WCC_AUTH_BYPASS1_USER, WCC_AUTH_BYPASS1_PASS, WCC_AUTH_BYPASS1_DB))) {
                die(‘Database error 0815_1!‘);
        }
        $db->setLogging(false);
        $db->setEMailOnError(false);        　　　　 return $db;
}
 
/**
 * Exploit this!  * @param WC_Challenge $chall
 * @param unknown_type $username
 * @param unknown_type $password
 * @return boolean
 */function auth1_onLogin(WC_Challenge $chall, $username, $password)
{
        $db = auth1_db();
       
        $password = md5($password);       
        $query = "SELECT * FROM users WHERE username=‘$username‘ AND password=‘$password‘";
       
        if (false === ($result = $db->queryFirst($query))) {
                echo GWF_HTML::error(‘Auth1‘, $chall->lang(‘err_unknown‘), false); # Unknown user                return false;
        }
 
        # Welcome back!
        echo GWF_HTML::message(‘Auth1‘, $chall->lang(‘msg_welcome_back‘, htmlspecialchars($result[‘username‘])), false);       
        # Challenge solved?
        if (strtolower($result[‘username‘]) === ‘admin‘) {
                $chall->onChallengeSolved(GWF_Session::getUserID());
        }       
        return true;
}
?>
<form action="index.php" method="post"><table>
<tr>
        <td><?php echo $chall->lang(‘username‘); ?>:</td>
        <td><input type="text" name="username" value="" /></td>
</tr><tr>
        <td><?php echo $chall->lang(‘password‘); ?>:</td>
        <td><input type="password" name="password" value="" /></td>
</tr>
<tr>        <td></td>
        <td><input type="submit" name="login" value="<?php echo $chall->lang(‘btn_login‘); ?>" /></td>
</tr>
</table>
</form>