LoRexxar's Blog

Hduisa_ctf_wee4_fucksql

2015/05/21

杩欏懆浼氶暱鍑轰簡涓ら亾鍏充簬娓楅忕殑棰樼洰锛岀患鍚堟х浉褰撳己锛屽嚑涔庡凡缁忔槸涓閬撴寮忕殑ctf鐨200鍒嗛鐩簡锛岄鐩緢绠鍗曟槸杩欐牱鐨勩

0x01 FuckMySQL1

Hint:鏄笚閫忛锛佽繖鏄笚閫忛锛佽櫧鐒朵篃鏈墂eb鐨勬垚鍒嗭紒浣嗘槸杩欐槸娓楅忛锛侊紒锛
棰樼洰鎻忚堪锛氬ソ涔呮病鍑洪浜嗭紝浜庢槸浠婂ぉ鍑轰簡涓笚閫忛涓㈠嚭鏉ワ紝鏈缁堢殑濂栧姳灏辨槸vps鐨剅oot shell鍝http://104.236.139.236/week4/fuckmysql/

鎵撳紑缁欏嚭鐨勯〉闈紝鍑虹幇鐨勬槸涓涓浘鐗囧簱锛岀炕浜嗙炕娌′粈涔堢殑鍦版柟锛屾棦鐒舵弿杩拌鏄笚閫忛锛岄偅涔堝氨鍏堟壂鎻忎笅鐩綍锛屽緢蹇氨寰楀埌浜嗕竴澶у爢濂囨殑锛岄鍏堟槸index.php.bak锛屾湰浠ヤ负浼氬嚭鐜版簮鐮侊紝鎵撳紑鐪嬪埌涓灞忓箷鐨勮懌鑺﹀▋鈥666666

www.zip涓嬭浇涓嬫潵涔熸槸涓鏍风殑涓滆タ锛岀敋鑷宠繕寰楀埌浜唚ojiushihoutai.php杩欑涓滆タ鈥

鏈鍚庡彂鐜皉obot.txt涓嬪叾涓竴涓槸鏈夌敤鐨勶紝鏄痑dmina,php锛屾槸鐪熸鐨勫悗鍙板湴鍧銆

绠鍗曞皾璇曚笅鍙戠幇鍙湁璐︽埛杈撳叆lightless鏃跺欎細鎻愮ず瀵嗙爜閿欒锛屽悗闈竴涓嬪瓙灏卞崱浣忎簡锛屾壘浜嗘壘璨屼技骞舵病鏈変粈涔堟彁绀猴紝鑰屼笖涔熶笉瀛樺湪娉ㄥ叆婕忔礊鈥﹀悗鏉ラ棶杩囧闀垮悗锛屽緱鍒拌繖涓湴鏂规槸瑕佺ぞ宸ョ殑锛屾瘮杈冪籂缁撶殑鏄紝鍙湁涓涓ぞ宸ヨ¥鑳藉緱鍒拌繖涓插瘑鐮侊紝鍋氶鐨勬椂鍊欏垰濂藉穿浜嗭紝鎵浠ヨ繃浜嗕竴澶╂墠寰楀埌瀵嗙爜鈥

鐧诲綍鎴愬姛鍚庤繘鍏hh.php椤甸潰锛岄〉闈腑鍑虹幇濂藉嚑涓彁绀

绗竴涓彁绀烘憜鏄庝簡灏辨槸vim涓嬪啓浜嗙綉椤碉紝鎵浠ヨ繘鍏at.php鍚庡皾璇曚笅杞界紦瀛樻枃浠讹紝cat.php~鎴愬姛鎷垮埌浜嗙綉椤垫簮鐮佲﹀垎鏋愭簮鐮侊紝寰楀埌寰堥噸瑕佺殑淇℃伅銆

1.闇瑕乸ost key1鍜 key2 缁欏悗鍙般

2.post 杩涘叆鏁版嵁搴撶殑key1鏌ヨ杩斿洖琛屼腑key2绛変簬鎵post鐨刱ey2鏃讹紝杩斿洖flag

3.post 杩涘叆鐨勬暟鎹繃婊や簡澶ч儴鍒嗚鍙ワ紝锛堬級锛屼絾浠嶆棫瀛樺湪娉ㄥ叆婕忔礊銆

鐢变簬瀵箂ql鍜宻ql娉ㄥ叆骞舵病鏈夊涔狅紝鎵浠ヤ竴涓嬪瓙鍗′綇浜嗏

鍚庢潵缁忚繃瀛﹂暱鐨勬彁閱掞紝杩欎釜鍦版柟浣跨敤浜唃roupby鐨勯粦榄旀硶锛屽幓鐧惧害浜嗕袱澶╁苟娌℃湁浠涔堢粨鏋滐紝浜庢槸鍘荤湅mysql鐨勫畼鏂规枃妗c

http://dev.mysql.com/doc/refman/5.7/en/group-by-modifiers.html

寰楀埌寰堥噸瑕佺殑淇℃伅灏辨槸groupby with rollup浼氬嚭鐜癗ULL鐨勫硷紝鍚粠瀛﹂暱鐨勮瘽鏈湴鎼缓鍚庯紝灏濊瘯鏋勯犳煡璇㈣鍙ャ

鍚庨潰鐨凩IMIT 1 OFFSET 1 鍙互杩斿洖1琛屽悗鐨1琛岋紝杩欐牱鎴戜滑灏卞緱鍒颁簡鍞竴琛岋紝骞朵娇key2涓篘ULL

鍚庨潰涓涓嬪瓙褰诲簳娌′簡鍔炴硶锛岀敱浜庡sql娉ㄥ叆涓鐐瑰効鍔炴硶閮芥病鏈夛紝鎵浠ヨ繖閲屾槸瀛﹂暱鐩存帴缁欐垜涓涓猵ayload鈥

key1=鈥= 鈥樷 GROUP BY key2 WITH ROLLUP LIMIT 1 OFFSET 1%23&key2=
杩欓噷鐨勨=鈥欌欏苟涓嶇煡閬撲粈涔堟剰鎬濓紝鍚庨潰鐨%23鏄负浜嗘敞閲婃帀鍚庨潰鐨勯鈥 锛屼絾鏄簡瑙eお灏戯紝涓嶇煡閬撲负浠涔堜笉鑳戒娇鐢ㄢ撯

杩欐牱灏辨嬁鍒颁簡flag锛岀敱浜庢渶鍚庣殑sql娉ㄥ叆瀹屽叏鏄潬瀛﹂暱锛屾墍浠ヨ繖涓猣lag鏆傛椂涓嶆彁浜や簡鈥

0x02 FuckMySQL2

涓婇亾棰樼粰鍑虹殑涓涓插瓧绗︼紝鐢╞ase64瑙d笅鏄贡鐮侊紝瑙傚療涓嬶紝鍏ㄩ儴閮芥槸澶у啓锛屾墍浠ユ墦寮py瑙ase32锛屽緱鍒帮細

鈥楴i Xiang Yao Shell Me? GoGoGo! Ji Ran Shi Tu Pian Ku, Na Me Tu Pian Ken Ding You Yong!鈥

CATALOG
  1. 1. 0x01 FuckMySQL1
  2. 2. 0x02 FuckMySQL2